@spfn/auth 0.3.0-beta.24 → 0.3.0-beta.25

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, y as OAuthProvider, N as NewUserPublicKey, w as VerificationPurpose, z as NewPasskey, B as Passkey, E as MfaVerification, G as MfaVerificationMethod, u as PermissionCategory, H as UserPublicKey, J as AuthContext } from './machine-principals-ZJd9anVT.js';
-export { Q as ApproveDeviceAuthParams, W as AssertStepUpParams, X as AuthDeletionCancelledPayload, Y as AuthDeletionCompletedPayload, Z as AuthDeletionRequestedPayload, _ as AuthDeviceRegisteredPayload, $ as AuthLoginPayload, a0 as AuthPasswordResetPayload, a1 as AuthProfileOutcome, a2 as AuthProfileVerifier, a3 as AuthProviderSchema, a4 as AuthRegisterPayload, a5 as BearerOutcome, a6 as BearerRefusal, a7 as ChangePasswordParams, a8 as CompletePasswordResetParams, a9 as CompleteSignupParams, aa as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ab as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, ac as ConfirmTotpParams, h as ConfirmTotpResult, ad as DenyDeviceAuthParams, ae as DeviceAuthApprovedResult, af as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ag as DeviceAuthPendingResult, ah as DeviceAuthPollResponseSchema, ai as DeviceNameSchema, aj as DeviceRegistrationChannel, ak as DisableSessionBindingParams, al as EmailSchema, am as FingerprintSchema, an as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, ao as FinishPasskeyLoginParams, ap as FinishSessionRenewParams, aq as InvitationAcceptedPayload, ar as InvitationCreatedPayload, I as IssueOneTimeTokenResult, as as KEY_FINGERPRINT_PREFIX_LENGTH, at as KeyIdSchema, K as KeySummary, au as LoginParams, e as LoginResult, av as LogoutParams, aw as MFA_VERIFICATION_METHODS, ax as MachinePrincipal, ay as MachineVerifierRegistration, az as MarkPasskeyParams, M as MfaStatus, aA as NativeVerifyOptions, aB as NewMfaVerification, aC as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aD as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aE as OAuth2ScopeDescription, aF as OAuthCallbackParams, aG as OAuthCallbackResult, aH as OAuthCodeExchangeOptions, aI as OAuthNativeParams, n as OAuthNativeResult, aJ as OAuthStartParams, O as OAuthStartResult, aK as OAuthTokens, aL as OAuthUnlinkedPayload, aM as PASSKEY_DEVICE_TYPES, aN as PASSKEY_LABEL_MAX_LENGTH, aO as PasskeyDeviceType, g as PasskeySummary, aP as PasswordSchema, aQ as PhoneSchema, aR as PlatformSchema, aS as PollDeviceAuthParams, aT as PollDeviceAuthResult, aU as PublicKeySchema, aV as RecentAuthenticationParams, aW as RegisterParams, aX as RegisterPublicKeyParams, a as RegisterResult, aY as RenamePasskeyParams, aZ as RequestPasswordResetParams, c as RequestPasswordResetResult, a_ as RequestSignupLinkParams, b as RequestSignupLinkResult, a$ as RevokeAllKeysParams, j as RevokeAllKeysResult, b0 as RevokeKeyParams, b1 as RevokePasskeyParams, b2 as RotateKeyParams, i as RotateKeyResult, b3 as SendVerificationCodeParams, S as SendVerificationCodeResult, b4 as SessionBindingParams, k as SessionBindingResult, b5 as StartDeviceAuthParams, f as StartDeviceAuthResult, b6 as StartPasskeyEnrollmentParams, b7 as StartSessionRenewParams, b8 as StepUpParams, b9 as TargetTypeSchema, T as TotpEnrolmentResult, ba as UnlinkNotification, bb as UnlinkNotifyRejection, bc as UnlinkNotifyRequest, bd as UnlinkNotifyResult, be as UserCodeSchema, V as VERIFICATION_PURPOSES, v as VERIFICATION_TARGET_TYPES, bf as VerificationPurposeSchema, x as VerificationTargetType, bg as VerifyCodeParams, bh as VerifyCodeResult, bi as admitBearerKey, bj as approveDeviceAuthService, bk as approveOAuth2AuthorizeService, bl as assertNotLastRecoveryCredential, bm as assertRecentAuthentication, bn as assertStepUp, bo as authDeletionCancelledEvent, bp as authDeletionCompletedEvent, bq as authDeletionRequestedEvent, br as authDeviceRegisteredEvent, bs as authLoginEvent, bt as authPasswordResetEvent, bu as authRegisterEvent, m as authRouter, bv as authenticate, bw as bearerAuthContext, bx as buildOAuthErrorUrl, by as carryStepUpVerification, bz as changePasswordService, bA as completePasswordResetService, bB as completeSignupService, bC as confirmPasswordResetService, bD as confirmSignupLinkService, bE as confirmTotpEnrolmentService, bF as denyDeviceAuthService, bG as denyOAuth2AuthorizeService, bH as describeOAuth2AuthorizeRequestService, bI as disableMfaService, bJ as disableSessionBindingService, bK as enableSessionBindingService, bL as finishPasskeyEnrollmentService, bM as finishPasskeyLoginService, bN as finishSessionRenewService, bO as getDeviceAuthInfoService, bP as getEnabledOAuthProviders, bQ as getGoogleAccessToken, bR as getMachinePrincipal, bS as getOAuthProvider, bT as getRegisteredProviders, bU as getSessionBindingService, bV as invitationAcceptedEvent, bW as invitationCreatedEvent, bX as isOAuthProviderEnabled, bY as issueOneTimeTokenService, bZ as keySessionBindingService, b_ as listKeysService, b$ as listOAuth2GrantsService, c0 as listPasskeysService, c1 as loginService, c2 as logoutService, c3 as machineAuth, c4 as markPasskeySecondFactorService, c5 as mfaEnrolledForUser, c6 as mfaStatusService, c7 as mfaVerifications, c8 as oauthCallbackService, c9 as oauthNativeService, ca as oauthStartService, cb as oauthUnlinkNotifyService, cc as oauthUnlinkedEvent, cd as optionalAuth, ce as passkeys, cf as pollDeviceAuthService, cg as regenerateRecoveryCodesService, ch as registerAuthProfile, ci as registerMachineVerifier, cj as registerOAuthProvider, ck as registerPublicKeyService, cl as registerService, cm as renamePasskeyService, cn as requestPasswordResetService, co as requestSignupLinkService, cp as requireEnabledProvider, cq as requireMachineScope, cr as resolveAuthenticatedUser, cs as revokeAllKeysService, ct as revokeAllOAuth2GrantsForUser, cu as revokeKeyService, cv as revokeOAuth2GrantService, cw as revokePasskeyService, cx as rotateKeyService, cy as runAuthProfile, cz as selectAuthProfile, cA as sendVerificationCodeService, cB as startDeviceAuthService, cC as startPasskeyEnrollmentService, cD as startPasskeyLoginService, cE as startSessionBindingDisableService, cF as startSessionRenewService, cG as startStepUpService, cH as startTotpEnrolmentService, cI as stepUpService, cJ as sweepUnconfirmedMfaService, cK as userPublicKeys, cL as verifyCodeService, cM as verifyOneTimeTokenService, cN as verifySecondFactor } from './machine-principals-ZJd9anVT.js';
+import { A as AuthInitOptions, z as OAuthProvider, N as NewUserPublicKey, x as VerificationPurpose, B as NewPasskey, E as Passkey, G as MfaVerification, H as MfaVerificationMethod, J as NewMfaChallenge, Q as MfaChallenge, u as PermissionCategory, W as UserPublicKey, X as AuthContext } from './machine-principals-CdEgxOB1.js';
+export { Y as ApproveDeviceAuthParams, Z as AssertStepUpParams, _ as AuthDeletionCancelledPayload, $ as AuthDeletionCompletedPayload, a0 as AuthDeletionRequestedPayload, a1 as AuthDeviceRegisteredPayload, a2 as AuthLoginPayload, a3 as AuthPasswordResetPayload, a4 as AuthProfileOutcome, a5 as AuthProfileVerifier, a6 as AuthProviderSchema, a7 as AuthRegisterPayload, a8 as BearerOutcome, a9 as BearerRefusal, aa as ChangePasswordParams, ab as CompletePasswordResetParams, ac as CompleteSignupParams, ad as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ae as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, af as ConfirmTotpParams, g as ConfirmTotpResult, ag as DeferredLoginEvent, ah as DenyDeviceAuthParams, ai as DeviceAuthApprovedResult, aj as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ak as DeviceAuthPendingResult, al as DeviceAuthPollResponseSchema, am as DeviceNameSchema, an as DeviceRegistrationChannel, ao as DisableSessionBindingParams, ap as EmailSchema, aq as FingerprintSchema, ar as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, as as FinishPasskeyLoginParams, at as FinishSessionRenewParams, au as InvitationAcceptedPayload, av as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aw as KEY_FINGERPRINT_PREFIX_LENGTH, ax as KeyIdSchema, K as KeySummary, ay as LoginParams, L as LoginResult, az as LogoutParams, aA as MFA_CHALLENGE_ATTEMPT_LIMIT, aB as MFA_CHALLENGE_CHANNELS, aC as MFA_VERIFICATION_METHODS, aD as MachinePrincipal, aE as MachineVerifierRegistration, aF as MarkPasskeyParams, aG as MfaChallengeChannel, aH as MfaChallengeHandle, M as MfaStatus, aI as NativeVerifyOptions, aJ as NewMfaVerification, aK as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aL as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aM as OAuth2ScopeDescription, aN as OAuthCallbackParams, aO as OAuthCallbackResult, aP as OAuthCodeExchangeOptions, aQ as OAuthNativeParams, n as OAuthNativeResult, aR as OAuthStartParams, O as OAuthStartResult, aS as OAuthTokens, aT as OAuthUnlinkedPayload, aU as OpenStepUpChallengeParams, aV as PASSKEY_DEVICE_TYPES, aW as PASSKEY_LABEL_MAX_LENGTH, aX as PasskeyDeviceType, f as PasskeySummary, aY as PasswordSchema, aZ as PhoneSchema, a_ as PlatformSchema, a$ as PollDeviceAuthParams, b0 as PollDeviceAuthResult, b1 as PublicKeySchema, b2 as RecentAuthenticationParams, b3 as RegisterParams, b4 as RegisterPublicKeyParams, b5 as RegisterPublicKeyResult, a as RegisterResult, b6 as RenamePasskeyParams, b7 as RequestPasswordResetParams, c as RequestPasswordResetResult, b8 as RequestSignupLinkParams, b as RequestSignupLinkResult, b9 as RevokeAllKeysParams, i as RevokeAllKeysResult, ba as RevokeKeyParams, bb as RevokePasskeyParams, bc as RotateKeyParams, h as RotateKeyResult, bd as SendVerificationCodeParams, S as SendVerificationCodeResult, be as SessionBindingParams, j as SessionBindingResult, bf as StartDeviceAuthParams, e as StartDeviceAuthResult, bg as StartPasskeyEnrollmentParams, bh as StartSessionRenewParams, bi as StepUpParams, bj as TargetTypeSchema, T as TotpEnrolmentResult, bk as UnlinkNotification, bl as UnlinkNotifyRejection, bm as UnlinkNotifyRequest, bn as UnlinkNotifyResult, bo as UserCodeSchema, v as VERIFICATION_PURPOSES, w as VERIFICATION_TARGET_TYPES, bp as VerificationPurposeSchema, y as VerificationTargetType, bq as VerifyCodeParams, br as VerifyCodeResult, bs as VerifyMfaChallengeParams, V as VerifyMfaChallengeResult, bt as admitBearerKey, bu as approveDeviceAuthService, bv as approveOAuth2AuthorizeService, bw as assertNotLastRecoveryCredential, bx as assertRecentAuthentication, by as assertStepUp, bz as attemptSecondFactor, bA as authDeletionCancelledEvent, bB as authDeletionCompletedEvent, bC as authDeletionRequestedEvent, bD as authDeviceRegisteredEvent, bE as authLoginEvent, bF as authPasswordResetEvent, bG as authRegisterEvent, m as authRouter, bH as authenticate, bI as bearerAuthContext, bJ as buildOAuthErrorUrl, bK as carryStepUpVerification, bL as changePasswordService, bM as completePasswordResetService, bN as completeSignupService, bO as confirmPasswordResetService, bP as confirmSignupLinkService, bQ as confirmTotpEnrolmentService, bR as denyDeviceAuthService, bS as denyOAuth2AuthorizeService, bT as describeOAuth2AuthorizeRequestService, bU as disableMfaService, bV as disableSessionBindingService, bW as enableSessionBindingService, bX as finishPasskeyEnrollmentService, bY as finishPasskeyLoginService, bZ as finishSessionRenewService, b_ as getDeviceAuthInfoService, b$ as getEnabledOAuthProviders, c0 as getGoogleAccessToken, c1 as getMachinePrincipal, c2 as getOAuthProvider, c3 as getRegisteredProviders, c4 as getSessionBindingService, c5 as invitationAcceptedEvent, c6 as invitationCreatedEvent, c7 as isOAuthProviderEnabled, c8 as issueOneTimeTokenService, c9 as keySessionBindingService, ca as listKeysService, cb as listOAuth2GrantsService, cc as listPasskeysService, cd as loginService, ce as logoutService, cf as machineAuth, cg as markPasskeySecondFactorService, ch as mfaChallenges, ci as mfaEnrolledForUser, cj as mfaStatusService, ck as mfaVerifications, cl as oauthCallbackService, cm as oauthNativeService, cn as oauthStartService, co as oauthUnlinkNotifyService, cp as oauthUnlinkedEvent, cq as openStepUpChallengeService, cr as optionalAuth, cs as passkeys, ct as pollDeviceAuthService, cu as regenerateRecoveryCodesService, cv as registerAuthProfile, cw as registerMachineVerifier, cx as registerOAuthProvider, cy as registerPublicKeyService, cz as registerService, cA as registeredBinding, cB as renamePasskeyService, cC as requestPasswordResetService, cD as requestSignupLinkService, cE as requireEnabledProvider, cF as requireMachineScope, cG as resolveAuthenticatedUser, cH as resumeStepUpChallengeService, cI as revokeAllKeysService, cJ as revokeAllOAuth2GrantsForUser, cK as revokeKeyService, cL as revokeOAuth2GrantService, cM as revokePasskeyService, cN as rotateKeyService, cO as runAuthProfile, cP as selectAuthProfile, cQ as sendVerificationCodeService, cR as startDeviceAuthService, cS as startMfaChallengeAssertionService, cT as startPasskeyEnrollmentService, cU as startPasskeyLoginService, cV as startSessionBindingDisableService, cW as startSessionRenewService, cX as startStepUpService, cY as startTotpEnrolmentService, cZ as stepUpService, c_ as sweepMfaChallengesService, c$ as sweepUnconfirmedMfaService, d0 as userPublicKeys, d1 as verifyCodeService, d2 as verifyMfaChallengeService, d3 as verifyOneTimeTokenService, d4 as verifySecondFactor } from './machine-principals-CdEgxOB1.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { l as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-CTdoTOxM.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, S as SessionBindingType, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
@@ -21,6 +21,95 @@ import '@spfn/core/event';
 import '@spfn/auth/server';
 import 'jsonwebtoken';
 
+/**
+ * @spfn/auth - Signed Sign-Out-Everywhere Link
+ *
+ * A link an app mails to an account's proven address, which signs every device
+ * of that account out without a session. It exists for the case the rest of the
+ * key surface cannot serve: the owner suspects a device they do not recognise,
+ * and the device they would have to sign in on to do something about it is the
+ * one they no longer trust.
+ *
+ * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
+ * mints the capability and hands the app a URL. `describeRevokeAllLink` says
+ * whether that URL still works and changes nothing, so a mail scanner opening
+ * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
+ * and it takes the owner pressing the button.
+ *
+ * The caller's obligation, which this package cannot enforce: the URL
+ * `createRevokeAllLink` returns carries the plaintext token, because the package
+ * sends no mail here. Do not log it, do not persist it, do not put it in a job
+ * payload — hand it to the mail template and let it go. Every other link in this
+ * package is minted inside the worker that sends it precisely so that no caller
+ * ever holds one; this one cannot be, and the obligation moves to the app.
+ */
+interface CreateRevokeAllLinkOptions {
+    /**
+     * Minutes the link stays valid. Defaults to
+     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
+     */
+    ttlMinutes?: number;
+}
+interface RevokeAllLink {
+    /** Absolute URL of the app page, token in its query string. Never log it. */
+    url: string;
+    expiresAt: Date;
+}
+/** What the describe call tells the page, so it can say what pressing the button does. */
+interface RevokeAllLinkDescription {
+    expiresAt: Date;
+    activeKeyCount: number;
+}
+/**
+ * Mint a sign-out-everywhere link for an account.
+ *
+ * Issuing supersedes every live link the account already has, the rule the
+ * password-reset flow follows: an owner who asks twice must not leave the first
+ * capability working in their mailbox after using the second.
+ *
+ * The row records the account's key generation, so the link dies the moment any
+ * other path signs every device out — a password reset, a password change, a
+ * deletion request, or the ordinary revoke-all route.
+ *
+ * Send it beside a password reset link. It ends the sessions; it does not change
+ * the password that let them start.
+ *
+ * @param userId - The account to issue for
+ * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
+ * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
+ */
+declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
+/**
+ * Say whether a presented link still works, and what pressing the button would
+ * do. Changes nothing — a mail scanner that opens the page has done nothing.
+ *
+ * @throws RevokeAllLinkError every refusal, in one shape
+ */
+declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
+/**
+ * Spend a link and sign every device of the account out.
+ *
+ * The claim is one statement, so of two requests carrying the same token exactly
+ * one revokes and the other is refused as if the token were unknown — which by
+ * then it is. `includeCurrent` is true because there is no current device here:
+ * the caller holds a mailbox, not a session, and sparing something would mean
+ * sparing whatever the owner is trying to cut off.
+ *
+ * @returns how many device keys were revoked; zero is a success, not a refusal
+ * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
+ */
+declare function consumeRevokeAllLink(token: string): Promise<{
+    revokedCount: number;
+}>;
+/**
+ * Delete link rows that can no longer answer anything.
+ *
+ * @returns number of rows deleted
+ */
+declare function purgeRevokeAllTokensService(): Promise<{
+    deleted: number;
+}>;
+
 /**
  * @spfn/auth - Global Configuration
  *
@@ -40,6 +129,16 @@ declare const COOKIE_NAMES: {
     readonly SESSION_KEY_ID: string;
     /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
     readonly OAUTH_PENDING: string;
+    /**
+     * Pending second-factor session (privateKey, keyId, challengeHash) (#95)
+     *
+     * Its own name and its own audience, separate from OAUTH_PENDING. The two
+     * coexist: a person who starts a social login in one tab while a password
+     * step-up is outstanding in another has both flows live, and one name would
+     * mean the second overwrote the first — sealing a session with a private key
+     * that does not match the key being activated.
+     */
+    readonly MFA_PENDING: string;
     /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
     readonly OAUTH_CSRF: string;
     /** Password-setup session for verified-email signup — temporary, single-purpose */
@@ -337,6 +436,15 @@ interface MfaConfig {
     issuer: string;
     /** How long a device's step-up stays good for a sensitive change. */
     stepUpWindowMs: number;
+    /**
+     * How long a new-device step-up challenge stays spendable.
+     *
+     * The window a person has to reach for their authenticator, and the window
+     * an attacker who has the password has to get past the second factor. Ten
+     * minutes is the same number the OAuth pending cookie and the link flows
+     * use, and the proxy's pending cookie is sealed for exactly this long.
+     */
+    challengeTtlMs: number;
 }
 /**
  * Resolve the second-factor configuration.
@@ -353,95 +461,6 @@ interface MfaConfig {
  */
 declare function getMfaConfig(): MfaConfig;
 
-/**
- * @spfn/auth - Signed Sign-Out-Everywhere Link
- *
- * A link an app mails to an account's proven address, which signs every device
- * of that account out without a session. It exists for the case the rest of the
- * key surface cannot serve: the owner suspects a device they do not recognise,
- * and the device they would have to sign in on to do something about it is the
- * one they no longer trust.
- *
- * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
- * mints the capability and hands the app a URL. `describeRevokeAllLink` says
- * whether that URL still works and changes nothing, so a mail scanner opening
- * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
- * and it takes the owner pressing the button.
- *
- * The caller's obligation, which this package cannot enforce: the URL
- * `createRevokeAllLink` returns carries the plaintext token, because the package
- * sends no mail here. Do not log it, do not persist it, do not put it in a job
- * payload — hand it to the mail template and let it go. Every other link in this
- * package is minted inside the worker that sends it precisely so that no caller
- * ever holds one; this one cannot be, and the obligation moves to the app.
- */
-interface CreateRevokeAllLinkOptions {
-    /**
-     * Minutes the link stays valid. Defaults to
-     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
-     */
-    ttlMinutes?: number;
-}
-interface RevokeAllLink {
-    /** Absolute URL of the app page, token in its query string. Never log it. */
-    url: string;
-    expiresAt: Date;
-}
-/** What the describe call tells the page, so it can say what pressing the button does. */
-interface RevokeAllLinkDescription {
-    expiresAt: Date;
-    activeKeyCount: number;
-}
-/**
- * Mint a sign-out-everywhere link for an account.
- *
- * Issuing supersedes every live link the account already has, the rule the
- * password-reset flow follows: an owner who asks twice must not leave the first
- * capability working in their mailbox after using the second.
- *
- * The row records the account's key generation, so the link dies the moment any
- * other path signs every device out — a password reset, a password change, a
- * deletion request, or the ordinary revoke-all route.
- *
- * Send it beside a password reset link. It ends the sessions; it does not change
- * the password that let them start.
- *
- * @param userId - The account to issue for
- * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
- * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
- */
-declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
-/**
- * Say whether a presented link still works, and what pressing the button would
- * do. Changes nothing — a mail scanner that opens the page has done nothing.
- *
- * @throws RevokeAllLinkError every refusal, in one shape
- */
-declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
-/**
- * Spend a link and sign every device of the account out.
- *
- * The claim is one statement, so of two requests carrying the same token exactly
- * one revokes and the other is refused as if the token were unknown — which by
- * then it is. `includeCurrent` is true because there is no current device here:
- * the caller holds a mailbox, not a session, and sparing something would mean
- * sparing whatever the owner is trying to cut off.
- *
- * @returns how many device keys were revoked; zero is a success, not a refusal
- * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
- */
-declare function consumeRevokeAllLink(token: string): Promise<{
-    revokedCount: number;
-}>;
-/**
- * Delete link rows that can no longer answer anything.
- *
- * @returns number of rows deleted
- */
-declare function purgeRevokeAllTokensService(): Promise<{
-    deleted: number;
-}>;
-
 /**
  * @spfn/auth - Users Entity
  *
@@ -6019,6 +6038,17 @@ type NewAuthMetadataEntity = typeof authMetadata.$inferInsert;
  * - 타입 안전성
  */
 declare class UsersRepository extends BaseRepository {
+    /**
+     * The account's current key generation.
+     *
+     * Read from the primary, and this is the one place that matters: the value
+     * is stamped onto a second-factor challenge that must die with the
+     * generation it was minted in, and a replica lagging behind a revoke-all
+     * would stamp the generation that has just ended.
+     *
+     * Write primary 사용
+     */
+    currentKeyEpoch(id: number): Promise<number>;
     /**
      * ID로 사용자 조회
      * Read replica 사용
@@ -6287,10 +6317,10 @@ declare class UsersRepository extends BaseRepository {
     create(data: NewUser): Promise<{
         email: string | null;
         phone: string | null;
-        sessionBinding: "none" | "passkey";
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
+        sessionBinding: "none" | "passkey";
         id: number;
         username: string | null;
         passwordHash: string | null;
@@ -6462,10 +6492,10 @@ declare class UsersRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string | null;
         phone: string | null;
-        sessionBinding: "none" | "passkey";
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
+        sessionBinding: "none" | "passkey";
         id: number;
         username: string | null;
         passwordHash: string | null;
@@ -6589,6 +6619,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6620,6 +6651,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6651,6 +6683,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6669,6 +6702,12 @@ declare class KeysRepository extends BaseRepository {
      * `lastSeenIp` is not selected, deliberately. The concurrent-use moment is
      * what the owner acts on; the trail of addresses behind it is stored PII the
      * account surface has no use for.
+     *
+     * A key still waiting on a second factor is excluded in **both** modes
+     * (#95). It is not a device that can sign, so it does not belong in the
+     * default list; and it is not a device the owner signed out either, so it
+     * does not belong in the revoked one — where it would read exactly like a
+     * revoked key with no revocation time, which is a different thing entirely.
      * Read replica 사용
      */
     listForUser(userId: number, includeRevoked?: boolean): Promise<{
@@ -6716,6 +6755,7 @@ declare class KeysRepository extends BaseRepository {
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
+        pendingMfaChallengeId: number | null;
         revokedReason: string | null;
     }>;
     /**
@@ -6749,6 +6789,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6784,6 +6825,17 @@ declare class KeysRepository extends BaseRepository {
      * active keys still had its generation ended, and an outstanding
      * sign-out-everywhere link must die with it.
      *
+     * The two second-factor CTEs are here for the same "no caller can forget"
+     * reason (#95). A pending key is `is_active = false`, so the UPDATE below
+     * does not touch it and neither would anything else: the owner who sees an
+     * unexpected second-factor prompt and does exactly what the notice says —
+     * change the password, sign out everywhere, open the revoke-all link, run a
+     * reset — would otherwise leave the attacker's pending key and its live
+     * challenge untouched. Deleting the key cascades onto its challenge; the
+     * expiry beside it catches a challenge whose key is already gone. A pending
+     * row and an active row are disjoint sets, so the two statements never
+     * contend for the same row.
+     *
      * Write primary 사용
      */
     private revokeActive;
@@ -6816,6 +6868,7 @@ declare class KeysRepository extends BaseRepository {
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
+        pendingMfaChallengeId: number | null;
         revokedReason: string | null;
     }>;
     /**
@@ -6851,6 +6904,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6882,6 +6936,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6917,6 +6972,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6960,6 +7016,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6991,6 +7048,7 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -7687,6 +7745,108 @@ declare class MfaVerificationsRepository extends BaseRepository {
 }
 declare const mfaVerificationsRepository: MfaVerificationsRepository;
 
+/**
+ * MFA Challenges Repository
+ *
+ * Data access for the row that stands between a registered-but-inactive key and
+ * a session. Extends BaseRepository for transaction-context detection and
+ * read/write splitting.
+ *
+ * Every lookup here is by `challenge_hash` and never by id. The secret is what
+ * the caller holds; the hash is what this table has, so a row can only be found
+ * by someone who already had the secret — a guess reaches no row at all, which
+ * is what keeps a guess from touching another challenge's `attempts`.
+ */
+
+declare class MfaChallengesRepository extends BaseRepository {
+    /** Park a fresh challenge. The caller has already written the pending key. */
+    create(data: NewMfaChallenge): Promise<MfaChallenge>;
+    /**
+     * The challenge this secret names, whatever state it is in.
+     *
+     * Reads the primary rather than the replica: `verify` decides whether a key
+     * becomes usable, and a replica lagging behind the 202 that created the row
+     * would refuse a challenge the caller was handed a moment ago.
+     */
+    findByHash(challengeHash: string): Promise<MfaChallenge | null>;
+    /**
+     * The live challenge already outstanding for this key, if there is one.
+     *
+     * What makes a retried registration resume rather than collide: a native
+     * client reusing its keyId, or an OAuth state replayed from the back button,
+     * gets the challenge it was already given instead of a 409 about a key it
+     * does own.
+     */
+    findLiveByKeyId(userId: number, keyId: string): Promise<MfaChallenge | null>;
+    /**
+     * Spend the challenge, or answer false because somebody else already did.
+     *
+     * A conditional UPDATE and not a read followed by a write: two verifies
+     * arriving together would both pass a read, and a challenge is single use.
+     * Every condition the caller checked is restated here, so the row that is
+     * marked is a row that was still spendable at the moment it was marked.
+     */
+    markVerified(id: number, keyEpoch: number): Promise<boolean>;
+    /**
+     * Count a wrong proof, and say whether that was the last one allowed.
+     *
+     * The increment is on the row the presented secret actually hashed to, which
+     * is the whole reason lookup is by hash: there is no id for a caller to name,
+     * so no counter but their own can be moved.
+     */
+    countFailure(id: number): Promise<boolean>;
+    /**
+     * Point an inactive key at the challenge that gates it.
+     *
+     * A second statement rather than a column on the insert, because the
+     * challenge references the key: the key row has to exist before the
+     * challenge can, so the back-reference is written once both do. Both run
+     * inside the registering route's transaction.
+     */
+    markKeyPending(keyId: string, challengeId: number): Promise<void>;
+    /**
+     * Give a live challenge a fresh secret, leaving everything else alone.
+     *
+     * What a retried registration gets. The row keeps its id, its expiry and its
+     * spent attempts, so retrying is not a way to reset the counter or buy
+     * another ten minutes; only the secret is new, because the old one was never
+     * stored and cannot be handed out twice.
+     */
+    resecret(id: number, challengeHash: string): Promise<boolean>;
+    /**
+     * Delete the pending key a challenge was gating, which takes the challenge
+     * with it through the cascade.
+     *
+     * Scoped to `pending_mfa_challenge_id`, so a key that has since been
+     * activated is never deleted by a late failure or a sweep.
+     */
+    dropPendingKey(keyId: string, challengeId: number): Promise<void>;
+    /**
+     * Mark a key active and no longer pending — what a verified challenge buys.
+     *
+     * Conditioned on the challenge id, so this can only activate the key that
+     * challenge was minted for.
+     */
+    activateKey(keyId: string, challengeId: number): Promise<void>;
+    /**
+     * Clear out challenges nobody finished, and the keys they were gating.
+     *
+     * Counted from the read rather than from either delete, because the two
+     * overlap: deleting a pending key cascades onto its challenge, so the second
+     * statement finds only the challenges whose key had already gone some other
+     * way — and a count taken there would report a sweep that did nothing.
+     *
+     * A spent challenge is kept for the same span as an expired one, so a replay
+     * inside the window meets "already verified" from a row rather than
+     * "unknown" from an absence. The 401 is the same either way; the record is
+     * not.
+     *
+     * @returns how many challenge rows are gone
+     */
+    sweepFinished(cutoff: Date): Promise<number>;
+}
+declare const mfaChallengesRepository: MfaChallengesRepository;
+
 /**
  * MFA Enrolment Repository
  *
@@ -8984,9 +9144,9 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         cancelledAt: Date | null;
         completedAt: Date | null;
         userPublicId: string;
-        requestedAt: Date;
         requestedBy: "admin" | "self";
         purgeStrategy: "anonymize" | "hard-delete" | null;
+        requestedAt: Date;
     }>;
     /**
      * 요청 취소 (복구)
@@ -9926,10 +10086,10 @@ declare function getUser(c: Context | {
 }): {
     email: string | null;
     phone: string | null;
-    sessionBinding: "none" | "passkey";
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     publicId: string;
     passwordChangeRequired: boolean;
+    sessionBinding: "none" | "passkey";
     id: number;
     username: string | null;
     passwordHash: string | null;
@@ -10934,4 +11094,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, MfaChallenge, MfaChallengesRepository, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, NewMfaChallenge, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaChallengesRepository, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };