@spfn/auth 0.3.0-beta.24 → 0.3.0-beta.25

package/dist/server.js

@@ -897,8 +897,8 @@ var init_array2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs
-function Argument(index20) {
-  return CreateType({ [Kind]: "Argument", index: index20 });
+function Argument(index21) {
+  return CreateType({ [Kind]: "Argument", index: index21 });
 }
 var init_argument = __esm({
   "../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs"() {
@@ -1136,28 +1136,28 @@ var init_union2 = __esm({
 function Unescape(pattern) {
   return pattern.replace(/\\\$/g, "$").replace(/\\\*/g, "*").replace(/\\\^/g, "^").replace(/\\\|/g, "|").replace(/\\\(/g, "(").replace(/\\\)/g, ")");
 }
-function IsNonEscaped(pattern, index20, char) {
-  return pattern[index20] === char && pattern.charCodeAt(index20 - 1) !== 92;
+function IsNonEscaped(pattern, index21, char) {
+  return pattern[index21] === char && pattern.charCodeAt(index21 - 1) !== 92;
 }
-function IsOpenParen(pattern, index20) {
-  return IsNonEscaped(pattern, index20, "(");
+function IsOpenParen(pattern, index21) {
+  return IsNonEscaped(pattern, index21, "(");
 }
-function IsCloseParen(pattern, index20) {
-  return IsNonEscaped(pattern, index20, ")");
+function IsCloseParen(pattern, index21) {
+  return IsNonEscaped(pattern, index21, ")");
 }
-function IsSeparator(pattern, index20) {
-  return IsNonEscaped(pattern, index20, "|");
+function IsSeparator(pattern, index21) {
+  return IsNonEscaped(pattern, index21, "|");
 }
 function IsGroup(pattern) {
   if (!(IsOpenParen(pattern, 0) && IsCloseParen(pattern, pattern.length - 1)))
     return false;
   let count2 = 0;
-  for (let index20 = 0; index20 < pattern.length; index20++) {
-    if (IsOpenParen(pattern, index20))
+  for (let index21 = 0; index21 < pattern.length; index21++) {
+    if (IsOpenParen(pattern, index21))
       count2 += 1;
-    if (IsCloseParen(pattern, index20))
+    if (IsCloseParen(pattern, index21))
       count2 -= 1;
-    if (count2 === 0 && index20 !== pattern.length - 1)
+    if (count2 === 0 && index21 !== pattern.length - 1)
       return false;
   }
   return true;
@@ -1167,19 +1167,19 @@ function InGroup(pattern) {
 }
 function IsPrecedenceOr(pattern) {
   let count2 = 0;
-  for (let index20 = 0; index20 < pattern.length; index20++) {
-    if (IsOpenParen(pattern, index20))
+  for (let index21 = 0; index21 < pattern.length; index21++) {
+    if (IsOpenParen(pattern, index21))
       count2 += 1;
-    if (IsCloseParen(pattern, index20))
+    if (IsCloseParen(pattern, index21))
       count2 -= 1;
-    if (IsSeparator(pattern, index20) && count2 === 0)
+    if (IsSeparator(pattern, index21) && count2 === 0)
       return true;
   }
   return false;
 }
 function IsPrecedenceAnd(pattern) {
-  for (let index20 = 0; index20 < pattern.length; index20++) {
-    if (IsOpenParen(pattern, index20))
+  for (let index21 = 0; index21 < pattern.length; index21++) {
+    if (IsOpenParen(pattern, index21))
       return true;
   }
   return false;
@@ -1187,16 +1187,16 @@ function IsPrecedenceAnd(pattern) {
 function Or(pattern) {
   let [count2, start] = [0, 0];
   const expressions = [];
-  for (let index20 = 0; index20 < pattern.length; index20++) {
-    if (IsOpenParen(pattern, index20))
+  for (let index21 = 0; index21 < pattern.length; index21++) {
+    if (IsOpenParen(pattern, index21))
       count2 += 1;
-    if (IsCloseParen(pattern, index20))
+    if (IsCloseParen(pattern, index21))
       count2 -= 1;
-    if (IsSeparator(pattern, index20) && count2 === 0) {
-      const range2 = pattern.slice(start, index20);
+    if (IsSeparator(pattern, index21) && count2 === 0) {
+      const range2 = pattern.slice(start, index21);
       if (range2.length > 0)
         expressions.push(TemplateLiteralParse(range2));
-      start = index20 + 1;
+      start = index21 + 1;
     }
   }
   const range = pattern.slice(start);
@@ -1209,40 +1209,40 @@ function Or(pattern) {
   return { type: "or", expr: expressions };
 }
 function And(pattern) {
-  function Group(value, index20) {
-    if (!IsOpenParen(value, index20))
+  function Group(value, index21) {
+    if (!IsOpenParen(value, index21))
       throw new TemplateLiteralParserError(`TemplateLiteralParser: Index must point to open parens`);
     let count2 = 0;
-    for (let scan = index20; scan < value.length; scan++) {
+    for (let scan = index21; scan < value.length; scan++) {
       if (IsOpenParen(value, scan))
         count2 += 1;
       if (IsCloseParen(value, scan))
         count2 -= 1;
       if (count2 === 0)
-        return [index20, scan];
+        return [index21, scan];
     }
     throw new TemplateLiteralParserError(`TemplateLiteralParser: Unclosed group parens in expression`);
   }
-  function Range(pattern2, index20) {
-    for (let scan = index20; scan < pattern2.length; scan++) {
+  function Range(pattern2, index21) {
+    for (let scan = index21; scan < pattern2.length; scan++) {
       if (IsOpenParen(pattern2, scan))
-        return [index20, scan];
+        return [index21, scan];
     }
-    return [index20, pattern2.length];
+    return [index21, pattern2.length];
   }
   const expressions = [];
-  for (let index20 = 0; index20 < pattern.length; index20++) {
-    if (IsOpenParen(pattern, index20)) {
-      const [start, end] = Group(pattern, index20);
+  for (let index21 = 0; index21 < pattern.length; index21++) {
+    if (IsOpenParen(pattern, index21)) {
+      const [start, end] = Group(pattern, index21);
       const range = pattern.slice(start, end + 1);
       expressions.push(TemplateLiteralParse(range));
-      index20 = end;
+      index21 = end;
     } else {
-      const [start, end] = Range(pattern, index20);
+      const [start, end] = Range(pattern, index21);
       const range = pattern.slice(start, end);
       if (range.length > 0)
         expressions.push(TemplateLiteralParse(range));
-      index20 = end - 1;
+      index21 = end - 1;
     }
   }
   return expressions.length === 0 ? { type: "const", const: "" } : expressions.length === 1 ? expressions[0] : { type: "and", expr: expressions };
@@ -2577,13 +2577,13 @@ function FromBoolean(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsBoolean(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromConstructor(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index20) => IntoBooleanResult(Visit3(right.parameters[index20], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index21) => IntoBooleanResult(Visit3(right.parameters[index21], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromDate(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsDate(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromFunction(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index20) => IntoBooleanResult(Visit3(right.parameters[index20], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index21) => IntoBooleanResult(Visit3(right.parameters[index21], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromIntegerRight(left, right) {
   return type_exports.IsLiteral(left) && value_exports.IsNumber(left.const) ? ExtendsResult.True : type_exports.IsNumber(left) || type_exports.IsInteger(left) ? ExtendsResult.True : ExtendsResult.False;
@@ -2743,7 +2743,7 @@ function FromTupleRight(left, right) {
   return type_exports.IsNever(left) ? ExtendsResult.True : type_exports.IsUnknown(left) ? ExtendsResult.False : type_exports.IsAny(left) ? ExtendsResult.Union : ExtendsResult.False;
 }
 function FromTuple3(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index20) => Visit3(schema, right.items[index20]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index21) => Visit3(schema, right.items[index21]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromUint8Array(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsUint8Array(right) ? ExtendsResult.True : ExtendsResult.False;
@@ -4520,6 +4520,12 @@ var init_schema3 = __esm({
       }),
       Type.Object({
         status: Type.Literal("approved"),
+        // The `LoginResult` discriminant, carried because the approved branch is
+        // a `LoginResult` spread whole (#95). Always false here: a device-code
+        // approval is the owner saying yes on a device that is already signed
+        // in, which is itself a second factor, so this channel never steps up
+        // and never carries a challenge.
+        mfaRequired: Type.Boolean(),
         userId: Type.String(),
         publicId: Type.String(),
         email: Type.Optional(Type.String()),
@@ -4815,7 +4821,7 @@ var init_wire_headers = __esm({
 });
 
 // src/server/entities/user-public-keys.ts
-import { text as text4, boolean as boolean3, index as index4 } from "drizzle-orm/pg-core";
+import { text as text4, boolean as boolean3, bigint, index as index4 } from "drizzle-orm/pg-core";
 import { id as id4, foreignKey as foreignKey3, enumText as enumText2, utcTimestamp as utcTimestamp2 } from "@spfn/core/db";
 var userPublicKeys;
 var init_user_public_keys = __esm({
@@ -4946,6 +4952,19 @@ var init_user_public_keys = __esm({
         // false: Key is deactivated (cannot be used for verification)
         // Used for: soft key rotation, temporary key suspension
         isActive: boolean3("is_active").notNull().default(true),
+        // The second-factor challenge gating this key, when it is pending (#95)
+        // null: the ordinary state — the key is whatever `is_active` says it is
+        // set: the key was registered inactive because the account has a second
+        //   factor and this device is new, and it stays that way until the
+        //   challenge is verified. `is_active` alone cannot say this, because a
+        //   revoked key is inactive too, and the two must not read alike:
+        //   `listKeys` hides a pending key in both modes and a global revocation
+        //   deletes it outright rather than revoking it
+        // NOT a foreign key, deliberately. `mfa_challenges.key_id` points back at
+        // this row, and a pair of constraints in a cycle leaves neither row
+        // writable first. The link that decides anything is that one; this column
+        // is what makes "is this row pending" a predicate on the keys table
+        pendingMfaChallengeId: bigint("pending_mfa_challenge_id", { mode: "number" }),
         // Key creation timestamp
         // Automatically set on insertion
         createdAt: utcTimestamp2("created_at").notNull().defaultNow(),
@@ -5339,7 +5358,7 @@ var init_passkeys = __esm({
 });
 
 // src/server/entities/webauthn-challenges.ts
-import { bigint, index as index11, text as text11, uniqueIndex as uniqueIndex5 } from "drizzle-orm/pg-core";
+import { bigint as bigint2, index as index11, text as text11, uniqueIndex as uniqueIndex5 } from "drizzle-orm/pg-core";
 import { id as id11, enumText as enumText6, utcTimestamp as utcTimestamp9 } from "@spfn/core/db";
 var WEBAUTHN_CHALLENGE_KINDS, webauthnChallenges;
 var init_webauthn_challenges = __esm({
@@ -5364,7 +5383,7 @@ var init_webauthn_challenges = __esm({
         // Nullable, so `foreignKey()` (which is notNull by construction) does
         // not apply; the cascade is still declared, so destroying an account
         // takes its in-flight enrollment challenges with it.
-        userId: bigint("user_id", { mode: "number" }).references(() => users.id, { onDelete: "cascade" }),
+        userId: bigint2("user_id", { mode: "number" }).references(() => users.id, { onDelete: "cascade" }),
         // SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS from creation
         expiresAt: utcTimestamp9("expires_at").notNull(),
         // Set by the verify that spent it. Non-null means the challenge is
@@ -5384,7 +5403,7 @@ var init_webauthn_challenges = __esm({
 });
 
 // src/server/entities/mfa-totp.ts
-import { bigint as bigint2, integer as integer6, text as text12, uniqueIndex as uniqueIndex6 } from "drizzle-orm/pg-core";
+import { bigint as bigint3, integer as integer6, text as text12, uniqueIndex as uniqueIndex6 } from "drizzle-orm/pg-core";
 import { id as id12, foreignKey as foreignKey8, timestamps as timestamps10, utcTimestamp as utcTimestamp10 } from "@spfn/core/db";
 var MFA_CONFIRM_ATTEMPT_LIMIT, mfaTotp;
 var init_mfa_totp = __esm({
@@ -5407,7 +5426,7 @@ var init_mfa_totp = __esm({
         // the screen cannot be replayed inside its own window. Per account
         // rather than per device: the cost is that a second device signing in
         // within the same step is refused and retries on the next one.
-        lastUsedStep: bigint2("last_used_step", { mode: "number" }),
+        lastUsedStep: bigint3("last_used_step", { mode: "number" }),
         // Wrong codes against the unconfirmed row. Reset by a fresh `enroll`.
         failedConfirmAttempts: integer6("failed_confirm_attempts").notNull().default(0),
         ...timestamps10()
@@ -5480,9 +5499,62 @@ var init_mfa_verifications = __esm({
   }
 });
 
+// src/server/entities/mfa-challenges.ts
+import { index as index13, integer as integer8, jsonb, text as text15, uniqueIndex as uniqueIndex7 } from "drizzle-orm/pg-core";
+import { id as id14, enumText as enumText8, foreignKey as foreignKey11, timestamps as timestamps12, utcTimestamp as utcTimestamp13 } from "@spfn/core/db";
+var MFA_CHALLENGE_CHANNELS, MFA_CHALLENGE_ATTEMPT_LIMIT, mfaChallenges;
+var init_mfa_challenges = __esm({
+  "src/server/entities/mfa-challenges.ts"() {
+    "use strict";
+    init_users();
+    init_user_public_keys();
+    init_schema4();
+    MFA_CHALLENGE_CHANNELS = ["password", "oauth", "oauth-native", "password-reset"];
+    MFA_CHALLENGE_ATTEMPT_LIMIT = 5;
+    mfaChallenges = authSchema.table(
+      "mfa_challenges",
+      {
+        id: id14(),
+        userId: foreignKey11("user", () => users.id),
+        // SHA-256 of the 32-byte secret, base64url. The secret leaves the server
+        // in the 202 body, the OAuth callback query and the verify request, and
+        // is nowhere else — not in a log line and not in this column.
+        challengeHash: text15("challenge_hash").notNull(),
+        // The inactive key this challenge would activate. Cascade, so deleting a
+        // pending key — the sweep, five wrong proofs, a global revocation —
+        // takes the challenge with it rather than leaving one pointing at
+        // nothing.
+        keyId: text15("key_id").notNull().references(() => userPublicKeys.keyId, { onDelete: "cascade" }),
+        channel: enumText8("channel", MFA_CHALLENGE_CHANNELS).notNull(),
+        // The account's key generation when this was minted. A challenge from an
+        // earlier generation verifies nothing.
+        keyEpoch: integer8("key_epoch").notNull(),
+        // Wrong proofs so far. MFA_CHALLENGE_ATTEMPT_LIMIT of them expire the
+        // challenge and delete the pending key.
+        attempts: integer8("attempts").notNull().default(0),
+        // SPFN_AUTH_MFA_CHALLENGE_TTL_MINUTES from creation.
+        expiresAt: utcTimestamp13("expires_at").notNull(),
+        // Set by the verify that spent it, in a conditional UPDATE, so two
+        // concurrent verifies produce one winner.
+        verifiedAt: utcTimestamp13("verified_at"),
+        // The login announcement the 202 held back. See DeferredLoginEvent.
+        loginEvent: jsonb("login_event").$type(),
+        ...timestamps12()
+      },
+      (table) => [
+        // The verify path addresses a row by this alone. Unique so one presented
+        // secret can never match two rows.
+        uniqueIndex7("mfa_challenge_hash_idx").on(table.challengeHash),
+        // The sweep and the live-challenge lookups both scan by expiry.
+        index13("mfa_challenges_expires_at_idx").on(table.expiresAt)
+      ]
+    );
+  }
+});
+
 // src/server/entities/device-authorizations.ts
-import { text as text15, uniqueIndex as uniqueIndex7 } from "drizzle-orm/pg-core";
-import { id as id14, timestamps as timestamps12, enumText as enumText8, utcTimestamp as utcTimestamp13, optionalForeignKey } from "@spfn/core/db";
+import { text as text16, uniqueIndex as uniqueIndex8 } from "drizzle-orm/pg-core";
+import { id as id15, timestamps as timestamps13, enumText as enumText9, utcTimestamp as utcTimestamp14, optionalForeignKey } from "@spfn/core/db";
 var DEVICE_AUTH_STATUSES, deviceAuthorizations;
 var init_device_authorizations = __esm({
   "src/server/entities/device-authorizations.ts"() {
@@ -5494,58 +5566,58 @@ var init_device_authorizations = __esm({
     deviceAuthorizations = authSchema.table(
       "device_authorizations",
       {
-        id: id14(),
+        id: id15(),
         // SHA-256 of the device code, hex
         // The code itself (32 random bytes, base64url) is returned to the waiting
         // device once and never stored: it is the only thing that device holds,
         // so a dump of this table must not let its reader finish someone's login
-        deviceCodeHash: text15("device_code_hash").notNull().unique(),
+        deviceCodeHash: text16("device_code_hash").notNull().unique(),
         // The code a person reads off the waiting device's screen
         // Stored normalized — uppercase, no dash — because that is the only form
         // a lookup can match; the dash is put back for display
         // Plaintext on purpose: it authorizes nothing without an approver who is
         // already authenticated, and it has to be found by exact match
-        userCode: text15("user_code").notNull(),
+        userCode: text16("user_code").notNull(),
         // Key material the waiting device generated, same shapes as user_public_keys
         // Parked, not registered: it can sign nothing until a poll moves it over
-        publicKey: text15("public_key").notNull(),
-        keyId: text15("key_id").notNull(),
-        fingerprint: text15("fingerprint").notNull(),
-        algorithm: enumText8("algorithm", KEY_ALGORITHM).notNull().default("ES256"),
+        publicKey: text16("public_key").notNull(),
+        keyId: text16("key_id").notNull(),
+        fingerprint: text16("fingerprint").notNull(),
+        algorithm: enumText9("algorithm", KEY_ALGORITHM).notNull().default("ES256"),
         // Device labels the waiting device supplied
         // null: it sent none
         // Shown to the approver so they can tell whether the device asking is the
         // one in front of them — display only, so a client that lies gains nothing
         // but a wrong line on the approval screen
-        deviceName: text15("device_name"),
-        platform: enumText8("platform", KEY_PLATFORM),
-        status: enumText8("status", DEVICE_AUTH_STATUSES).notNull().default("pending"),
+        deviceName: text16("device_name"),
+        platform: enumText9("platform", KEY_PLATFORM),
+        status: enumText9("status", DEVICE_AUTH_STATUSES).notNull().default("pending"),
         // Who approved, written at approve time from the approver's session
         // null while pending, and on every record that was denied or expired
         // Never taken from a request body — that would be the whole authorization
         userId: optionalForeignKey("user", () => users.id, { onDelete: "cascade" }),
         // Expiry — 10 minutes from creation by default
         // Judged on read; no job clears the row
-        expiresAt: utcTimestamp13("expires_at").notNull(),
+        expiresAt: utcTimestamp14("expires_at").notNull(),
         // Set when the approver said yes
-        approvedAt: utcTimestamp13("approved_at"),
+        approvedAt: utcTimestamp14("approved_at"),
         // Set when the poll that registered the key won the race
         // Non-null means the record is spent, whatever else it says
-        consumedAt: utcTimestamp13("consumed_at"),
-        ...timestamps12()
+        consumedAt: utcTimestamp14("consumed_at"),
+        ...timestamps13()
       },
       (table) => [
         // Lookup path for info/approve/deny
         // Unique so a typed code can never address two records
-        uniqueIndex7("device_authorization_user_code_idx").on(table.userCode)
+        uniqueIndex8("device_authorization_user_code_idx").on(table.userCode)
       ]
     );
   }
 });
 
 // src/server/entities/user-invitations.ts
-import { text as text16, index as index13 } from "drizzle-orm/pg-core";
-import { id as id15, timestamps as timestamps13, enumText as enumText9, utcTimestamp as utcTimestamp14, typedJsonb as typedJsonb2, foreignKey as foreignKey11 } from "@spfn/core/db";
+import { text as text17, index as index14 } from "drizzle-orm/pg-core";
+import { id as id16, timestamps as timestamps14, enumText as enumText10, utcTimestamp as utcTimestamp15, typedJsonb as typedJsonb2, foreignKey as foreignKey12 } from "@spfn/core/db";
 var userInvitations;
 var init_user_invitations = __esm({
   "src/server/entities/user-invitations.ts"() {
@@ -5558,39 +5630,39 @@ var init_user_invitations = __esm({
       "user_invitations",
       {
         // Primary key
-        id: id15(),
+        id: id16(),
         // Target email address for the invitation
         // Will become the user's email upon acceptance
-        email: text16("email").notNull(),
+        email: text17("email").notNull(),
         // Unique invitation token (UUID v4)
         // Used in invitation URL: /auth/invite/{token}
         // Single-use token that expires after acceptance
-        token: text16("token").notNull().unique(),
+        token: text17("token").notNull().unique(),
         // Role to be assigned when invitation is accepted
         // Foreign key to roles table
-        roleId: foreignKey11("role", () => roles.id),
+        roleId: foreignKey12("role", () => roles.id),
         // User who created this invitation
         // Foreign key to users table
         // Used for: audit trail, permission checks
-        invitedBy: foreignKey11("invited_by", () => users.id, { onDelete: "cascade" }),
+        invitedBy: foreignKey12("invited_by", () => users.id, { onDelete: "cascade" }),
         // Invitation status
         // - pending: Invitation sent, awaiting acceptance
         // - accepted: User accepted and account created
         // - expired: Invitation expired (automatic)
         // - cancelled: Invitation cancelled by admin
-        status: enumText9("status", INVITATION_STATUSES).default("pending").notNull(),
+        status: enumText10("status", INVITATION_STATUSES).default("pending").notNull(),
         // Expiration timestamp (default: 7 days from creation)
         // Invitation cannot be accepted after this time
         // Background job should update status to 'expired'
-        expiresAt: utcTimestamp14("expires_at").notNull(),
+        expiresAt: utcTimestamp15("expires_at").notNull(),
         // Timestamp when invitation was accepted
         // null = not yet accepted
         // Used for: audit trail, analytics
-        acceptedAt: utcTimestamp14("accepted_at"),
+        acceptedAt: utcTimestamp15("accepted_at"),
         // Timestamp when invitation was cancelled
         // null = not cancelled
         // Used for: audit trail
-        cancelledAt: utcTimestamp14("cancelled_at"),
+        cancelledAt: utcTimestamp15("cancelled_at"),
         // Additional metadata (JSONB)
         // Use cases:
         // - Custom welcome message
@@ -5599,26 +5671,26 @@ var init_user_invitations = __esm({
         // - Custom fields for app-specific data
         // Example: { message: "Welcome!", department: "Engineering" }
         metadata: typedJsonb2("metadata"),
-        ...timestamps13()
+        ...timestamps14()
       },
       (table) => [
         // Indexes for query optimization
-        index13("invitations_token_idx").on(table.token),
-        index13("invitations_email_idx").on(table.email),
-        index13("invitations_status_idx").on(table.status),
-        index13("invitations_invited_by_idx").on(table.invitedBy),
-        index13("invitations_expires_at_idx").on(table.expiresAt),
+        index14("invitations_token_idx").on(table.token),
+        index14("invitations_email_idx").on(table.email),
+        index14("invitations_status_idx").on(table.status),
+        index14("invitations_invited_by_idx").on(table.invitedBy),
+        index14("invitations_expires_at_idx").on(table.expiresAt),
         // For cleanup jobs
-        index13("invitations_role_id_idx").on(table.roleId)
+        index14("invitations_role_id_idx").on(table.roleId)
       ]
     );
   }
 });
 
 // src/server/entities/account-deletion-requests.ts
-import { text as text17, index as index14, uniqueIndex as uniqueIndex8 } from "drizzle-orm/pg-core";
+import { text as text18, index as index15, uniqueIndex as uniqueIndex9 } from "drizzle-orm/pg-core";
 import { sql as sql2 } from "drizzle-orm";
-import { id as id16, timestamps as timestamps14, enumText as enumText10, utcTimestamp as utcTimestamp15, optionalForeignKey as optionalForeignKey2 } from "@spfn/core/db";
+import { id as id17, timestamps as timestamps15, enumText as enumText11, utcTimestamp as utcTimestamp16, optionalForeignKey as optionalForeignKey2 } from "@spfn/core/db";
 var accountDeletionRequests;
 var init_account_deletion_requests = __esm({
   "src/server/entities/account-deletion-requests.ts"() {
@@ -5629,40 +5701,40 @@ var init_account_deletion_requests = __esm({
     accountDeletionRequests = authSchema.table(
       "account_deletion_requests",
       {
-        id: id16(),
+        id: id17(),
         // Foreign key to users table. `set null` (optionalForeignKey default) so this
         // row survives a hard-delete purge of the user it refers to.
         userId: optionalForeignKey2("user", () => users.id),
         // Snapshot of the user's public UUID at request time — stays readable even
         // after userId is nulled out or the account is anonymized.
-        userPublicId: text17("user_public_id").notNull(),
+        userPublicId: text18("user_public_id").notNull(),
         // When the deletion was requested
-        requestedAt: utcTimestamp15("requested_at").notNull().defaultNow(),
+        requestedAt: utcTimestamp16("requested_at").notNull().defaultNow(),
         // When the purge job is allowed to run (requestedAt + grace period; equals
         // requestedAt itself for immediate/zero-grace deletions)
-        purgeScheduledAt: utcTimestamp15("purge_scheduled_at").notNull(),
+        purgeScheduledAt: utcTimestamp16("purge_scheduled_at").notNull(),
         // Request lifecycle status
         // - pending: awaiting purgeScheduledAt (or immediate purge)
         // - cancelled: recovered before purge
         // - completed: purge ran
-        status: enumText10("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
+        status: enumText11("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
         // Who initiated the request
-        requestedBy: enumText10("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
+        requestedBy: enumText11("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
         // Optional free-text reason (self-service UI, admin note, DSR reference, ...)
-        reason: text17("reason"),
-        cancelledAt: utcTimestamp15("cancelled_at"),
-        completedAt: utcTimestamp15("completed_at"),
+        reason: text18("reason"),
+        cancelledAt: utcTimestamp16("cancelled_at"),
+        completedAt: utcTimestamp16("completed_at"),
         // Purge strategy actually executed (set on completion; null while pending)
-        purgeStrategy: enumText10("purge_strategy", PURGE_STRATEGIES),
-        ...timestamps14()
+        purgeStrategy: enumText11("purge_strategy", PURGE_STRATEGIES),
+        ...timestamps15()
       },
       (table) => [
-        index14("account_deletion_requests_user_id_idx").on(table.userId),
-        index14("account_deletion_requests_status_idx").on(table.status),
-        index14("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
-        index14("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
+        index15("account_deletion_requests_user_id_idx").on(table.userId),
+        index15("account_deletion_requests_status_idx").on(table.status),
+        index15("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
+        index15("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
         // Partial unique index: at most one pending request per user at a time.
-        uniqueIndex8("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
+        uniqueIndex9("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
       ]
     );
   }
@@ -5814,8 +5886,8 @@ var init_rbac = __esm({
 });
 
 // src/server/entities/permissions.ts
-import { text as text18, boolean as boolean5, index as index15 } from "drizzle-orm/pg-core";
-import { id as id17, timestamps as timestamps15, enumText as enumText11, typedJsonb as typedJsonb3 } from "@spfn/core/db";
+import { text as text19, boolean as boolean5, index as index16 } from "drizzle-orm/pg-core";
+import { id as id18, timestamps as timestamps16, enumText as enumText12, typedJsonb as typedJsonb3 } from "@spfn/core/db";
 var permissions;
 var init_permissions = __esm({
   "src/server/entities/permissions.ts"() {
@@ -5826,7 +5898,7 @@ var init_permissions = __esm({
       "permissions",
       {
         // Primary key
-        id: id17(),
+        id: id18(),
         // Permission identifier
         // Format: resource:action or namespace:resource:action
         // Examples:
@@ -5834,20 +5906,20 @@ var init_permissions = __esm({
         // - Namespaced: 'auth:user:delete', 'cms:post:publish'
         // Must be unique across all permissions
         // Used in: permission checks, role assignments, API guards
-        name: text18("name").notNull().unique(),
+        name: text19("name").notNull().unique(),
         // Display name for UI
         // Human-readable name shown in admin panels
         // Example: "Delete Users", "Publish Posts"
-        displayName: text18("display_name").notNull(),
+        displayName: text19("display_name").notNull(),
         // Permission description
         // Detailed explanation of what this permission allows
         // Example: "Allows deletion of user accounts from the system"
-        description: text18("description"),
+        description: text19("description"),
         // Category for grouping
         // Used for: organizing permissions in UI, filtering
         // Built-in categories: auth, user, rbac, system
         // Custom categories: any app-specific category
-        category: enumText11("category", PERMISSION_CATEGORIES),
+        category: enumText12("category", PERMISSION_CATEGORIES),
         // Built-in permission flag
         // true: Core package permissions (auth:*, user:*, rbac:*)
         //       - Cannot be deleted or modified
@@ -5878,22 +5950,22 @@ var init_permissions = __esm({
         // - Audit: { createdBy: 123, source: 'migration', version: '1.0.0' }
         // Example: { icon: 'trash', color: 'red', requiresMfa: true }
         metadata: typedJsonb3("metadata"),
-        ...timestamps15()
+        ...timestamps16()
       },
       (table) => [
-        index15("permissions_name_idx").on(table.name),
-        index15("permissions_category_idx").on(table.category),
-        index15("permissions_is_system_idx").on(table.isSystem),
-        index15("permissions_is_active_idx").on(table.isActive),
-        index15("permissions_is_builtin_idx").on(table.isBuiltin)
+        index16("permissions_name_idx").on(table.name),
+        index16("permissions_category_idx").on(table.category),
+        index16("permissions_is_system_idx").on(table.isSystem),
+        index16("permissions_is_active_idx").on(table.isActive),
+        index16("permissions_is_builtin_idx").on(table.isBuiltin)
       ]
     );
   }
 });
 
 // src/server/entities/role-permissions.ts
-import { index as index16, unique } from "drizzle-orm/pg-core";
-import { id as id18, timestamps as timestamps16, foreignKey as foreignKey12 } from "@spfn/core/db";
+import { index as index17, unique } from "drizzle-orm/pg-core";
+import { id as id19, timestamps as timestamps17, foreignKey as foreignKey13 } from "@spfn/core/db";
 var rolePermissions;
 var init_role_permissions = __esm({
   "src/server/entities/role-permissions.ts"() {
@@ -5905,25 +5977,25 @@ var init_role_permissions = __esm({
       "role_permissions",
       {
         // Primary key
-        id: id18(),
+        id: id19(),
         // Role reference
         // Foreign key to roles table
         // Cascade delete: when role is deleted, all role-permission mappings are removed
         // Used for: defining which permissions each role has
         // Example: Admin role → [user:create, user:delete, user:update]
-        roleId: foreignKey12("role", () => roles.id, { onDelete: "cascade" }),
+        roleId: foreignKey13("role", () => roles.id, { onDelete: "cascade" }),
         // Permission reference
         // Foreign key to permissions table
         // Cascade delete: when permission is deleted, all role-permission mappings are removed
         // Used for: granting permissions to roles
         // Example: user:delete permission → [Admin, Superadmin]
-        permissionId: foreignKey12("permission", () => permissions.id, { onDelete: "cascade" }),
-        ...timestamps16()
+        permissionId: foreignKey13("permission", () => permissions.id, { onDelete: "cascade" }),
+        ...timestamps17()
       },
       (table) => [
         // Indexes for query performance
-        index16("role_permissions_role_id_idx").on(table.roleId),
-        index16("role_permissions_permission_id_idx").on(table.permissionId),
+        index17("role_permissions_role_id_idx").on(table.roleId),
+        index17("role_permissions_permission_id_idx").on(table.permissionId),
         // Unique constraint: one role-permission pair only
         unique("role_permissions_unique").on(table.roleId, table.permissionId)
       ]
@@ -5932,8 +6004,8 @@ var init_role_permissions = __esm({
 });
 
 // src/server/entities/user-permissions.ts
-import { boolean as boolean6, text as text19, index as index17, unique as unique2 } from "drizzle-orm/pg-core";
-import { id as id19, timestamps as timestamps17, utcTimestamp as utcTimestamp16, foreignKey as foreignKey13 } from "@spfn/core/db";
+import { boolean as boolean6, text as text20, index as index18, unique as unique2 } from "drizzle-orm/pg-core";
+import { id as id20, timestamps as timestamps18, utcTimestamp as utcTimestamp17, foreignKey as foreignKey14 } from "@spfn/core/db";
 var userPermissions;
 var init_user_permissions = __esm({
   "src/server/entities/user-permissions.ts"() {
@@ -5945,15 +6017,15 @@ var init_user_permissions = __esm({
       "user_permissions",
       {
         // Primary key
-        id: id19(),
+        id: id20(),
         // User reference
         // Foreign key to users table
         // Cascade delete: when user is deleted, all overrides are removed
-        userId: foreignKey13("user", () => users.id, { onDelete: "cascade" }),
+        userId: foreignKey14("user", () => users.id, { onDelete: "cascade" }),
         // Permission reference
         // Foreign key to permissions table
         // Cascade delete: when permission is deleted, all overrides are removed
-        permissionId: foreignKey13("permission", () => permissions.id, { onDelete: "cascade" }),
+        permissionId: foreignKey14("permission", () => permissions.id, { onDelete: "cascade" }),
         // Grant or revoke flag
         // true: GRANT this permission to the user (additive override)
         //       - Grants permission even if role doesn't have it
@@ -5968,19 +6040,19 @@ var init_user_permissions = __esm({
         // Reason for grant/revocation
         // Used for: audit trail, compliance documentation
         // Example: "Temporary access for project X", "Security incident - restricted"
-        reason: text19("reason"),
+        reason: text20("reason"),
         // Expiration timestamp (optional)
         // null: Permanent override (remains until manually removed)
         // timestamp: Permission expires at this time (auto-revoked by background job)
         // Use case: Time-limited elevated access, temporary restrictions
-        expiresAt: utcTimestamp16("expires_at"),
-        ...timestamps17()
+        expiresAt: utcTimestamp17("expires_at"),
+        ...timestamps18()
       },
       (table) => [
         // Indexes for query performance
-        index17("user_permissions_user_id_idx").on(table.userId),
-        index17("user_permissions_permission_id_idx").on(table.permissionId),
-        index17("user_permissions_expires_at_idx").on(table.expiresAt),
+        index18("user_permissions_user_id_idx").on(table.userId),
+        index18("user_permissions_permission_id_idx").on(table.permissionId),
+        index18("user_permissions_expires_at_idx").on(table.expiresAt),
         // Unique constraint: one user-permission pair only
         unique2("user_permissions_unique").on(table.userId, table.permissionId)
       ]
@@ -5989,8 +6061,8 @@ var init_user_permissions = __esm({
 });
 
 // src/server/entities/oauth2-clients.ts
-import { text as text20 } from "drizzle-orm/pg-core";
-import { id as id20, timestamps as timestamps18, utcTimestamp as utcTimestamp17 } from "@spfn/core/db";
+import { text as text21 } from "drizzle-orm/pg-core";
+import { id as id21, timestamps as timestamps19, utcTimestamp as utcTimestamp18 } from "@spfn/core/db";
 var oauth2Clients;
 var init_oauth2_clients = __esm({
   "src/server/entities/oauth2-clients.ts"() {
@@ -5999,35 +6071,35 @@ var init_oauth2_clients = __esm({
     oauth2Clients = authSchema.table(
       "oauth2_clients",
       {
-        id: id20(),
+        id: id21(),
         // The `client_id` the client sends on every later request. Random, opaque,
         // and the unique constraint doubles as the lookup index.
-        clientId: text20("client_id").notNull().unique(),
+        clientId: text21("client_id").notNull().unique(),
         // Self-declared label, shown on the consent screen and nowhere else.
         // A client that lies about it gains one wrong line on that screen.
-        clientName: text20("client_name").notNull(),
+        clientName: text21("client_name").notNull(),
         // Registered redirect URIs, stored exactly as the client wrote them.
         // The registration answer echoes them back verbatim, so normalising here
         // would answer a client with a URI it did not register. Matching
         // normalises both sides instead — see lib/oauth2/redirect-uri.ts.
-        redirectUris: text20("redirect_uris").array().notNull(),
+        redirectUris: text21("redirect_uris").array().notNull(),
         // Client IP the registration arrived from, so the per-IP cap on clients
         // nobody has approved yet can be counted. Nullable: an IP is not always
         // knowable behind a proxy that forwards none, and a registration is not
         // worth refusing over that.
-        createdIp: text20("created_ip"),
+        createdIp: text21("created_ip"),
         // Last token issuance or refresh under this client, updated
         // fire-and-forget. Operator-facing only; nothing is authorized by it.
-        lastUsedAt: utcTimestamp17("last_used_at"),
-        ...timestamps18()
+        lastUsedAt: utcTimestamp18("last_used_at"),
+        ...timestamps19()
       }
     );
   }
 });
 
 // src/server/entities/oauth2-grants.ts
-import { uniqueIndex as uniqueIndex9, index as index18, text as text21 } from "drizzle-orm/pg-core";
-import { id as id21, timestamps as timestamps19, utcTimestamp as utcTimestamp18, foreignKey as foreignKey14 } from "@spfn/core/db";
+import { uniqueIndex as uniqueIndex10, index as index19, text as text22 } from "drizzle-orm/pg-core";
+import { id as id22, timestamps as timestamps20, utcTimestamp as utcTimestamp19, foreignKey as foreignKey15 } from "@spfn/core/db";
 var oauth2Grants;
 var init_oauth2_grants = __esm({
   "src/server/entities/oauth2-grants.ts"() {
@@ -6038,39 +6110,39 @@ var init_oauth2_grants = __esm({
     oauth2Grants = authSchema.table(
       "oauth2_grants",
       {
-        id: id21(),
+        id: id22(),
         // `oauth2_client_id` and not `client_id`: the opaque string a client
         // sends is called `client_id` everywhere in the protocol, and a bigint
         // foreign key under that name in this schema would read as that value.
-        client: foreignKey14("oauth2_client", () => oauth2Clients.id, { onDelete: "cascade" }),
+        client: foreignKey15("oauth2_client", () => oauth2Clients.id, { onDelete: "cascade" }),
         // Whose consent this is. Read from the approving session at authorize
         // time, never from a request body — that is the whole authorization.
-        user: foreignKey14("user", () => users.id, { onDelete: "cascade" }),
+        user: foreignKey15("user", () => users.id, { onDelete: "cascade" }),
         // The RFC 8707 target this consent is for, normalised (see lib/oauth2).
         // An access token is only good against the resource its grant names.
-        resource: text21("resource").notNull(),
+        resource: text22("resource").notNull(),
         // Scope names the user approved. A refresh may ask for a subset of these
         // and never for more.
-        scopes: text21("scopes").array().notNull(),
+        scopes: text22("scopes").array().notNull(),
         // null = live; a timestamp cuts off every code and token beneath it
-        revokedAt: utcTimestamp18("revoked_at"),
-        ...timestamps19()
+        revokedAt: utcTimestamp19("revoked_at"),
+        ...timestamps20()
       },
       (table) => [
         // One consent per (client, user, resource) — the re-consent path updates
         // this row rather than inserting beside it.
-        uniqueIndex9("oauth2_grant_client_user_resource_idx").on(table.client, table.user, table.resource),
+        uniqueIndex10("oauth2_grant_client_user_resource_idx").on(table.client, table.user, table.resource),
         // The global-revocation path and the user's own grant list both address
         // rows by user alone.
-        index18("oauth2_grant_user_idx").on(table.user)
+        index19("oauth2_grant_user_idx").on(table.user)
       ]
     );
   }
 });
 
 // src/server/entities/oauth2-authorization-codes.ts
-import { text as text22 } from "drizzle-orm/pg-core";
-import { id as id22, timestamps as timestamps20, utcTimestamp as utcTimestamp19, foreignKey as foreignKey15 } from "@spfn/core/db";
+import { text as text23 } from "drizzle-orm/pg-core";
+import { id as id23, timestamps as timestamps21, utcTimestamp as utcTimestamp20, foreignKey as foreignKey16 } from "@spfn/core/db";
 var oauth2AuthorizationCodes;
 var init_oauth2_authorization_codes = __esm({
   "src/server/entities/oauth2-authorization-codes.ts"() {
@@ -6080,33 +6152,33 @@ var init_oauth2_authorization_codes = __esm({
     oauth2AuthorizationCodes = authSchema.table(
       "oauth2_authorization_codes",
       {
-        id: id22(),
+        id: id23(),
         // SHA-256 hex of the code. The code itself (32 random bytes, base64url)
         // is in the redirect and nowhere else.
-        codeHash: text22("code_hash").notNull().unique(),
-        grant: foreignKey15("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
+        codeHash: text23("code_hash").notNull().unique(),
+        grant: foreignKey16("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
         // The exact redirect_uri string the authorize request carried. The token
         // request must repeat it character for character (RFC 6749 §4.1.3).
-        redirectUri: text22("redirect_uri").notNull(),
+        redirectUri: text23("redirect_uri").notNull(),
         // The PKCE S256 challenge. `code_verifier` at the token endpoint is
         // hashed and compared against this; `plain` is not accepted anywhere,
         // so no method column is needed.
-        codeChallenge: text22("code_challenge").notNull(),
+        codeChallenge: text23("code_challenge").notNull(),
         // 60 seconds from issuance. Judged by the database in the statement that
         // spends the row, not only in a read before it.
-        expiresAt: utcTimestamp19("expires_at").notNull(),
+        expiresAt: utcTimestamp20("expires_at").notNull(),
         // null = unspent. Non-null means spent, and a second presentation of the
         // same code revokes the grant.
-        usedAt: utcTimestamp19("used_at"),
-        ...timestamps20()
+        usedAt: utcTimestamp20("used_at"),
+        ...timestamps21()
       }
     );
   }
 });
 
 // src/server/entities/oauth2-tokens.ts
-import { index as index19, text as text23 } from "drizzle-orm/pg-core";
-import { id as id23, timestamps as timestamps21, enumText as enumText12, utcTimestamp as utcTimestamp20, foreignKey as foreignKey16 } from "@spfn/core/db";
+import { index as index20, text as text24 } from "drizzle-orm/pg-core";
+import { id as id24, timestamps as timestamps22, enumText as enumText13, utcTimestamp as utcTimestamp21, foreignKey as foreignKey17 } from "@spfn/core/db";
 var OAUTH2_TOKEN_KINDS, oauth2Tokens;
 var init_oauth2_tokens = __esm({
   "src/server/entities/oauth2-tokens.ts"() {
@@ -6117,30 +6189,30 @@ var init_oauth2_tokens = __esm({
     oauth2Tokens = authSchema.table(
       "oauth2_tokens",
       {
-        id: id23(),
+        id: id24(),
         // SHA-256 hex of the token value. Lookup key; the unique constraint
         // doubles as the index.
-        tokenHash: text23("token_hash").notNull().unique(),
-        kind: enumText12("kind", OAUTH2_TOKEN_KINDS).notNull(),
-        grant: foreignKey16("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
+        tokenHash: text24("token_hash").notNull().unique(),
+        kind: enumText13("kind", OAUTH2_TOKEN_KINDS).notNull(),
+        grant: foreignKey17("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
         // What this particular token carries, which may be narrower than its
         // grant's scopes: a refresh request is allowed to ask for a subset.
         // Never wider — that is `invalid_scope`.
-        scopes: text23("scopes").array().notNull(),
-        expiresAt: utcTimestamp20("expires_at").notNull(),
+        scopes: text24("scopes").array().notNull(),
+        expiresAt: utcTimestamp21("expires_at").notNull(),
         // null = live. Set by revoke, by a grant revocation, and by the two
         // replay detections (code reuse, refresh reuse).
-        revokedAt: utcTimestamp20("revoked_at"),
+        revokedAt: utcTimestamp21("revoked_at"),
         // Refresh only: set when a rotation issued the successor. A row with
         // this set is spent, and presenting it revokes the grant.
-        replacedAt: utcTimestamp20("replaced_at"),
+        replacedAt: utcTimestamp21("replaced_at"),
         // Last successful verification, updated fire-and-forget like ops tokens
-        lastUsedAt: utcTimestamp20("last_used_at"),
-        ...timestamps21()
+        lastUsedAt: utcTimestamp21("last_used_at"),
+        ...timestamps22()
       },
       (table) => [
         // Revocation addresses every token under one grant.
-        index19("oauth2_token_grant_idx").on(table.grant)
+        index20("oauth2_token_grant_idx").on(table.grant)
       ]
     );
   }
@@ -6148,7 +6220,7 @@ var init_oauth2_tokens = __esm({
 
 // src/server/entities/auth-metadata.ts
 import { sql as sql3 } from "drizzle-orm";
-import { text as text24, timestamp } from "drizzle-orm/pg-core";
+import { text as text25, timestamp } from "drizzle-orm/pg-core";
 var authMetadata;
 var init_auth_metadata = __esm({
   "src/server/entities/auth-metadata.ts"() {
@@ -6158,9 +6230,9 @@ var init_auth_metadata = __esm({
       "auth_metadata",
       {
         // Metadata key (primary key)
-        key: text24("key").primaryKey(),
+        key: text25("key").primaryKey(),
         // Metadata value
-        value: text24("value").notNull(),
+        value: text25("value").notNull(),
         // Last updated timestamp — stamped by the database on insert and on update
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow().$onUpdate(() => sql3`now()`)
       }
@@ -6169,8 +6241,8 @@ var init_auth_metadata = __esm({
 });
 
 // src/server/entities/ops-tokens.ts
-import { text as text25 } from "drizzle-orm/pg-core";
-import { id as id24, timestamps as timestamps22, utcTimestamp as utcTimestamp21 } from "@spfn/core/db";
+import { text as text26 } from "drizzle-orm/pg-core";
+import { id as id25, timestamps as timestamps23, utcTimestamp as utcTimestamp22 } from "@spfn/core/db";
 var opsTokens;
 var init_ops_tokens = __esm({
   "src/server/entities/ops-tokens.ts"() {
@@ -6179,22 +6251,22 @@ var init_ops_tokens = __esm({
     opsTokens = authSchema.table(
       "ops_tokens",
       {
-        id: id24(),
+        id: id25(),
         // Operator-facing label ("ci-deploy", "rayim-laptop")
-        name: text25("name").notNull(),
+        name: text26("name").notNull(),
         // SHA-256 hex of the token secret. Lookup key — the secret never lands
         // here, and the unique constraint doubles as the lookup index.
-        tokenHash: text25("token_hash").notNull().unique(),
+        tokenHash: text26("token_hash").notNull().unique(),
         // Granted scopes as permission strings ('waitlist:read', ...).
         // '*' grants every scope.
-        scopes: text25("scopes").array().notNull(),
+        scopes: text26("scopes").array().notNull(),
         // null = the token does not expire
-        expiresAt: utcTimestamp21("expires_at"),
+        expiresAt: utcTimestamp22("expires_at"),
         // null = active; a timestamp revokes the token permanently
-        revokedAt: utcTimestamp21("revoked_at"),
+        revokedAt: utcTimestamp22("revoked_at"),
         // Last successful verification, updated fire-and-forget
-        lastUsedAt: utcTimestamp21("last_used_at"),
-        ...timestamps22()
+        lastUsedAt: utcTimestamp22("last_used_at"),
+        ...timestamps23()
       }
     );
   }
@@ -6218,6 +6290,7 @@ var init_entities = __esm({
     init_mfa_totp();
     init_mfa_recovery_codes();
     init_mfa_verifications();
+    init_mfa_challenges();
     init_device_authorizations();
     init_user_invitations();
     init_account_deletion_requests();
@@ -6245,12 +6318,26 @@ var init_users_repository = __esm({
     init_entities();
     init_email();
     UsersRepository = class extends BaseRepository {
+      /**
+       * The account's current key generation.
+       *
+       * Read from the primary, and this is the one place that matters: the value
+       * is stamped onto a second-factor challenge that must die with the
+       * generation it was minted in, and a replica lagging behind a revoke-all
+       * would stamp the generation that has just ended.
+       *
+       * Write primary 사용
+       */
+      async currentKeyEpoch(id26) {
+        const result = await this.db.select({ keyEpoch: users.keyEpoch }).from(users).where(eq(users.id, id26)).limit(1);
+        return result[0]?.keyEpoch ?? 0;
+      }
       /**
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6260,8 +6347,8 @@ var init_users_repository = __esm({
        * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
        * 계속 사용할 것.
        */
-      async findByIdOnPrimary(id25) {
-        const result = await this.db.select().from(users).where(eq(users.id, id25)).limit(1);
+      async findByIdOnPrimary(id26) {
+        const result = await this.db.select().from(users).where(eq(users.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6277,8 +6364,8 @@ var init_users_repository = __esm({
        * Only meaningful inside a transaction — the lock is released at commit.
        * Write primary.
        */
-      async lockById(id25) {
-        await this.db.select({ id: users.id }).from(users).where(eq(users.id, id25)).for("update");
+      async lockById(id26) {
+        await this.db.select({ id: users.id }).from(users).where(eq(users.id, id26)).for("update");
       }
       /**
        * 이메일로 사용자 조회
@@ -6348,13 +6435,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id25) {
+      async findByIdWithRole(id26) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id25)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id26)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -6429,9 +6516,9 @@ var init_users_repository = __esm({
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id25, data) {
+      async updateById(id26, data) {
         const patch = "email" in data ? { ...data, email: normalizeOptionalEmail(data.email) } : data;
-        const result = await this.db.update(users).set(patch).where(eq(users.id, id25)).returning();
+        const result = await this.db.update(users).set(patch).where(eq(users.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6443,10 +6530,10 @@ var init_users_repository = __esm({
        * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
        * Write primary 사용
        */
-      async reactivateFromPendingDeletion(id25) {
+      async reactivateFromPendingDeletion(id26) {
         const result = await this.db.update(users).set({ status: "active" }).where(
           and(
-            eq(users.id, id25),
+            eq(users.id, id26),
             eq(users.status, "pending_deletion")
           )
         ).returning();
@@ -6456,32 +6543,32 @@ var init_users_repository = __esm({
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id25, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id26, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash
         };
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id25)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id25) {
+      async updateLastLogin(id26) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id25)).returning();
+        }).where(eq(users.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id25) {
-        const result = await this.db.delete(users).where(eq(users.id, id25)).returning();
+      async deleteById(id26) {
+        const result = await this.db.delete(users).where(eq(users.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6839,12 +6926,15 @@ function assertPasskeyConfig(env21 = passkeyEnvSource()) {
     );
   }
 }
+function minutesOr(configured2, fallback) {
+  const minutes = Number(configured2);
+  return Number.isFinite(minutes) && minutes > 0 ? minutes : fallback;
+}
 function getMfaConfig() {
-  const configuredMinutes = Number(process.env.SPFN_AUTH_MFA_STEP_UP_MINUTES);
-  const minutes = Number.isFinite(configuredMinutes) && configuredMinutes > 0 ? configuredMinutes : DEFAULT_STEP_UP_MINUTES;
   return {
     issuer: process.env.SPFN_AUTH_MFA_ISSUER?.trim() || process.env.SPFN_AUTH_PASSKEY_RP_NAME?.trim() || mfaIssuerFromAppUrl() || DEFAULT_MFA_ISSUER,
-    stepUpWindowMs: minutes * 6e4
+    stepUpWindowMs: minutesOr(process.env.SPFN_AUTH_MFA_STEP_UP_MINUTES, DEFAULT_STEP_UP_MINUTES) * 6e4,
+    challengeTtlMs: minutesOr(process.env.SPFN_AUTH_MFA_CHALLENGE_TTL_MINUTES, DEFAULT_CHALLENGE_TTL_MINUTES) * 6e4
   };
 }
 function mfaIssuerFromAppUrl() {
@@ -6858,7 +6948,7 @@ function mfaIssuerFromAppUrl() {
     return null;
   }
 }
-var COOKIE_NAMES, globalConfig, CSRF_MODES, unrecognizedCsrfModeReported, PACKAGE_CSRF_EXEMPT_PATHS, DEFAULT_SESSION_RENEW_PATH, PASSKEY_USER_VERIFICATIONS, DEFAULT_CHALLENGE_TTL_SECONDS, DEFAULT_RECENT_AUTH_MINUTES, PASSKEY_VARS, DEFAULT_MFA_ISSUER, DEFAULT_STEP_UP_MINUTES;
+var COOKIE_NAMES, globalConfig, CSRF_MODES, unrecognizedCsrfModeReported, PACKAGE_CSRF_EXEMPT_PATHS, DEFAULT_SESSION_RENEW_PATH, PASSKEY_USER_VERIFICATIONS, DEFAULT_CHALLENGE_TTL_SECONDS, DEFAULT_RECENT_AUTH_MINUTES, PASSKEY_VARS, DEFAULT_MFA_ISSUER, DEFAULT_STEP_UP_MINUTES, DEFAULT_CHALLENGE_TTL_MINUTES;
 var init_config = __esm({
   "src/server/lib/config.ts"() {
     "use strict";
@@ -6878,6 +6968,18 @@ var init_config = __esm({
       get OAUTH_PENDING() {
         return `spfn_oauth_pending${getCookieSuffix()}`;
       },
+      /**
+       * Pending second-factor session (privateKey, keyId, challengeHash) (#95)
+       *
+       * Its own name and its own audience, separate from OAUTH_PENDING. The two
+       * coexist: a person who starts a social login in one tab while a password
+       * step-up is outstanding in another has both flows live, and one name would
+       * mean the second overwrote the first — sealing a session with a private key
+       * that does not match the key being activated.
+       */
+      get MFA_PENDING() {
+        return `spfn_mfa_pending${getCookieSuffix()}`;
+      },
       /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
       get OAUTH_CSRF() {
         return `spfn_oauth_csrf${getCookieSuffix()}`;
@@ -6920,6 +7022,7 @@ var init_config = __esm({
     ];
     DEFAULT_MFA_ISSUER = "SPFN";
     DEFAULT_STEP_UP_MINUTES = 10;
+    DEFAULT_CHALLENGE_TTL_MINUTES = 10;
   }
 });
 
@@ -6932,6 +7035,7 @@ var init_keys_repository = __esm({
     "use strict";
     init_user_public_keys();
     init_users();
+    init_mfa_challenges();
     init_config();
     LAST_USED_THROTTLE_MS = 6e4;
     KeysRepository = class extends BaseRepository2 {
@@ -6979,6 +7083,12 @@ var init_keys_repository = __esm({
        * `lastSeenIp` is not selected, deliberately. The concurrent-use moment is
        * what the owner acts on; the trail of addresses behind it is stored PII the
        * account surface has no use for.
+       *
+       * A key still waiting on a second factor is excluded in **both** modes
+       * (#95). It is not a device that can sign, so it does not belong in the
+       * default list; and it is not a device the owner signed out either, so it
+       * does not belong in the revoked one — where it would read exactly like a
+       * revoked key with no revocation time, which is a different thing entirely.
        * Read replica 사용
        */
       async listForUser(userId, includeRevoked = false) {
@@ -6997,12 +7107,11 @@ var init_keys_repository = __esm({
           registeredUserAgent: userPublicKeys.registeredUserAgent,
           binding: userPublicKeys.binding,
           concurrentUseAt: userPublicKeys.concurrentUseAt
-        }).from(userPublicKeys).where(
-          includeRevoked ? eq2(userPublicKeys.userId, userId) : and2(
-            eq2(userPublicKeys.userId, userId),
-            eq2(userPublicKeys.isActive, true)
-          )
-        ).orderBy(desc(userPublicKeys.createdAt));
+        }).from(userPublicKeys).where(and2(
+          eq2(userPublicKeys.userId, userId),
+          isNull(userPublicKeys.pendingMfaChallengeId),
+          includeRevoked ? void 0 : eq2(userPublicKeys.isActive, true)
+        )).orderBy(desc(userPublicKeys.createdAt));
       }
       /**
        * 공개키 생성
@@ -7071,6 +7180,17 @@ var init_keys_repository = __esm({
        * active keys still had its generation ended, and an outstanding
        * sign-out-everywhere link must die with it.
        *
+       * The two second-factor CTEs are here for the same "no caller can forget"
+       * reason (#95). A pending key is `is_active = false`, so the UPDATE below
+       * does not touch it and neither would anything else: the owner who sees an
+       * unexpected second-factor prompt and does exactly what the notice says —
+       * change the password, sign out everywhere, open the revoke-all link, run a
+       * reset — would otherwise leave the attacker's pending key and its live
+       * challenge untouched. Deleting the key cascades onto its challenge; the
+       * expiry beside it catches a challenge whose key is already gone. A pending
+       * row and an active row are disjoint sets, so the two statements never
+       * contend for the same row.
+       *
        * Write primary 사용
        */
       async revokeActive(userId, reason, keepKeyId) {
@@ -7080,6 +7200,18 @@ var init_keys_repository = __esm({
                 UPDATE ${users}
                 SET key_epoch = key_epoch + 1
                 WHERE id = ${userId}
+            ),
+            challenges_expired AS (
+                UPDATE ${mfaChallenges}
+                SET expires_at = now()
+                WHERE user_id = ${userId}
+                  AND verified_at IS NULL
+                  AND expires_at > now()
+            ),
+            pending_dropped AS (
+                DELETE FROM ${userPublicKeys}
+                WHERE user_id = ${userId}
+                  AND pending_mfa_challenge_id IS NOT NULL
             )
             UPDATE ${userPublicKeys} t
             SET is_active = false,
@@ -7234,7 +7366,7 @@ var init_keys_repository = __esm({
        * replica-lagged address compared in application code both misses real
        * switches and invents ones that did not happen.
        */
-      async updateLastUsedById(id25, identity, ip) {
+      async updateLastUsedById(id26, identity, ip) {
         const now = /* @__PURE__ */ new Date();
         const nowParam = sql5`${now.toISOString()}::timestamptz`;
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
@@ -7275,7 +7407,7 @@ var init_keys_repository = __esm({
             clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
           } : {}
         }).where(and2(
-          eq2(userPublicKeys.id, id25),
+          eq2(userPublicKeys.id, id26),
           or(lastUsedIsStale, identityChanged, sql5`(${ipChanged} AND ${notStampedThisWindow})`)
         ));
       }
@@ -7326,8 +7458,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7341,22 +7473,22 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id25) {
+      async markAsUsed(id26) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id25)).returning();
+        }).where(eq3(verificationCodes.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id25) {
-        const code = await this.findById(id25);
+      async incrementAttempts(id26) {
+        const code = await this.findById(id26);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1
-        }).where(eq3(verificationCodes.id, id25)).returning();
+        }).where(eq3(verificationCodes.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7440,10 +7572,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the issued row, or null if the row is no longer deliverable
        */
-      async issue(id25, tokenHash) {
+      async issue(id26, tokenHash) {
         const result = await this.db.update(signupLinkTokens).set({ tokenHash }).where(
           and4(
-            eq4(signupLinkTokens.id, id25),
+            eq4(signupLinkTokens.id, id26),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt),
             isNull3(signupLinkTokens.completedAt),
@@ -7479,14 +7611,14 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async claimLink(id25, setupSecretHash, setupExpiresAt) {
+      async claimLink(id26, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(signupLinkTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and4(
-            eq4(signupLinkTokens.id, id25),
+            eq4(signupLinkTokens.id, id26),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -7499,10 +7631,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async claimSetupSession(id25) {
+      async claimSetupSession(id26) {
         const result = await this.db.update(signupLinkTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and4(
-            eq4(signupLinkTokens.id, id25),
+            eq4(signupLinkTokens.id, id26),
             isNull3(signupLinkTokens.completedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -7584,10 +7716,10 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the issued row, or null if the row is no longer deliverable
        */
-      async issue(id25, tokenHash) {
+      async issue(id26, tokenHash) {
         const result = await this.db.update(passwordResetTokens).set({ tokenHash }).where(
           and5(
-            eq5(passwordResetTokens.id, id25),
+            eq5(passwordResetTokens.id, id26),
             isNull4(passwordResetTokens.consumedAt),
             isNull4(passwordResetTokens.supersededAt),
             isNull4(passwordResetTokens.completedAt),
@@ -7635,14 +7767,14 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async consume(id25, setupSecretHash, setupExpiresAt) {
+      async consume(id26, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(passwordResetTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and5(
-            eq5(passwordResetTokens.id, id25),
+            eq5(passwordResetTokens.id, id26),
             isNull4(passwordResetTokens.consumedAt),
             isNull4(passwordResetTokens.supersededAt)
           )
@@ -7655,10 +7787,10 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async complete(id25) {
+      async complete(id26) {
         const result = await this.db.update(passwordResetTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and5(
-            eq5(passwordResetTokens.id, id25),
+            eq5(passwordResetTokens.id, id26),
             isNull4(passwordResetTokens.completedAt),
             isNull4(passwordResetTokens.supersededAt)
           )
@@ -7856,9 +7988,9 @@ var init_passkeys_repository = __esm({
        * Owner-scoped, so an id belonging to someone else answers null rather than
        * a row — a management route can only ever say "not yours".
        */
-      async findLiveByIdAndUserId(id25, userId) {
+      async findLiveByIdAndUserId(id26, userId) {
         const result = await this.db.select().from(passkeys).where(and7(
-          eq7(passkeys.id, id25),
+          eq7(passkeys.id, id26),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).limit(1);
@@ -7868,17 +8000,17 @@ var init_passkeys_repository = __esm({
        * Record a successful assertion.
        * Write primary.
        */
-      async recordUse(id25, counter) {
-        await this.db.update(passkeys).set({ counter, lastUsedAt: /* @__PURE__ */ new Date() }).where(eq7(passkeys.id, id25));
+      async recordUse(id26, counter) {
+        await this.db.update(passkeys).set({ counter, lastUsedAt: /* @__PURE__ */ new Date() }).where(eq7(passkeys.id, id26));
       }
       /**
        * Rename, but only a credential this user still owns and has not revoked.
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async renameByIdAndUserId(id25, userId, label) {
+      async renameByIdAndUserId(id26, userId, label) {
         const result = await this.db.update(passkeys).set({ label }).where(and7(
-          eq7(passkeys.id, id25),
+          eq7(passkeys.id, id26),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).returning();
@@ -7893,9 +8025,9 @@ var init_passkeys_repository = __esm({
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async revokeByIdAndUserId(id25, userId, reason) {
+      async revokeByIdAndUserId(id26, userId, reason) {
         const result = await this.db.update(passkeys).set({ revokedAt: /* @__PURE__ */ new Date(), revokedReason: reason }).where(and7(
-          eq7(passkeys.id, id25),
+          eq7(passkeys.id, id26),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).returning();
@@ -7910,9 +8042,9 @@ var init_passkeys_repository = __esm({
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async markSecondFactorByIdAndUserId(id25, userId, secondFactor) {
+      async markSecondFactorByIdAndUserId(id26, userId, secondFactor) {
         const result = await this.db.update(passkeys).set({ secondFactor }).where(and7(
-          eq7(passkeys.id, id25),
+          eq7(passkeys.id, id26),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).returning();
@@ -8133,8 +8265,8 @@ var init_mfa_recovery_codes_repository = __esm({
        *
        * @returns true when this call spent the row
        */
-      async consume(id25) {
-        const result = await this.db.update(mfaRecoveryCodes).set({ usedAt: /* @__PURE__ */ new Date() }).where(and10(eq10(mfaRecoveryCodes.id, id25), isNull9(mfaRecoveryCodes.usedAt))).returning();
+      async consume(id26) {
+        const result = await this.db.update(mfaRecoveryCodes).set({ usedAt: /* @__PURE__ */ new Date() }).where(and10(eq10(mfaRecoveryCodes.id, id26), isNull9(mfaRecoveryCodes.usedAt))).returning();
         return result.length > 0;
       }
       /** Drop every generation the account has. Write primary. */
@@ -8186,9 +8318,161 @@ var init_mfa_verifications_repository = __esm({
   }
 });
 
-// src/server/repositories/mfa-enrolment.repository.ts
+// src/server/repositories/mfa-challenges.repository.ts
 import { BaseRepository as BaseRepository12 } from "@spfn/core/db";
-import { and as and12, eq as eq12, isNotNull, isNull as isNull10 } from "drizzle-orm";
+import { and as and12, eq as eq12, gt as gt6, inArray, isNotNull, isNull as isNull10, lte, or as or3, sql as sql8 } from "drizzle-orm";
+var MfaChallengesRepository, mfaChallengesRepository;
+var init_mfa_challenges_repository = __esm({
+  "src/server/repositories/mfa-challenges.repository.ts"() {
+    "use strict";
+    init_mfa_challenges();
+    init_user_public_keys();
+    MfaChallengesRepository = class extends BaseRepository12 {
+      /** Park a fresh challenge. The caller has already written the pending key. */
+      async create(data) {
+        return await this._create(mfaChallenges, data);
+      }
+      /**
+       * The challenge this secret names, whatever state it is in.
+       *
+       * Reads the primary rather than the replica: `verify` decides whether a key
+       * becomes usable, and a replica lagging behind the 202 that created the row
+       * would refuse a challenge the caller was handed a moment ago.
+       */
+      async findByHash(challengeHash) {
+        const result = await this.db.select().from(mfaChallenges).where(eq12(mfaChallenges.challengeHash, challengeHash)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * The live challenge already outstanding for this key, if there is one.
+       *
+       * What makes a retried registration resume rather than collide: a native
+       * client reusing its keyId, or an OAuth state replayed from the back button,
+       * gets the challenge it was already given instead of a 409 about a key it
+       * does own.
+       */
+      async findLiveByKeyId(userId, keyId) {
+        const result = await this.db.select().from(mfaChallenges).where(and12(
+          eq12(mfaChallenges.userId, userId),
+          eq12(mfaChallenges.keyId, keyId),
+          isNull10(mfaChallenges.verifiedAt),
+          gt6(mfaChallenges.expiresAt, /* @__PURE__ */ new Date())
+        )).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Spend the challenge, or answer false because somebody else already did.
+       *
+       * A conditional UPDATE and not a read followed by a write: two verifies
+       * arriving together would both pass a read, and a challenge is single use.
+       * Every condition the caller checked is restated here, so the row that is
+       * marked is a row that was still spendable at the moment it was marked.
+       */
+      async markVerified(id26, keyEpoch) {
+        const result = await this.db.update(mfaChallenges).set({ verifiedAt: /* @__PURE__ */ new Date() }).where(and12(
+          eq12(mfaChallenges.id, id26),
+          eq12(mfaChallenges.keyEpoch, keyEpoch),
+          isNull10(mfaChallenges.verifiedAt),
+          gt6(mfaChallenges.expiresAt, /* @__PURE__ */ new Date())
+        )).returning();
+        return result.length > 0;
+      }
+      /**
+       * Count a wrong proof, and say whether that was the last one allowed.
+       *
+       * The increment is on the row the presented secret actually hashed to, which
+       * is the whole reason lookup is by hash: there is no id for a caller to name,
+       * so no counter but their own can be moved.
+       */
+      async countFailure(id26) {
+        const result = await this.db.update(mfaChallenges).set({ attempts: sql8`${mfaChallenges.attempts} + 1` }).where(eq12(mfaChallenges.id, id26)).returning({ attempts: mfaChallenges.attempts });
+        return (result[0]?.attempts ?? 0) >= MFA_CHALLENGE_ATTEMPT_LIMIT;
+      }
+      /**
+       * Point an inactive key at the challenge that gates it.
+       *
+       * A second statement rather than a column on the insert, because the
+       * challenge references the key: the key row has to exist before the
+       * challenge can, so the back-reference is written once both do. Both run
+       * inside the registering route's transaction.
+       */
+      async markKeyPending(keyId, challengeId) {
+        await this.db.update(userPublicKeys).set({ pendingMfaChallengeId: challengeId }).where(eq12(userPublicKeys.keyId, keyId));
+      }
+      /**
+       * Give a live challenge a fresh secret, leaving everything else alone.
+       *
+       * What a retried registration gets. The row keeps its id, its expiry and its
+       * spent attempts, so retrying is not a way to reset the counter or buy
+       * another ten minutes; only the secret is new, because the old one was never
+       * stored and cannot be handed out twice.
+       */
+      async resecret(id26, challengeHash) {
+        const result = await this.db.update(mfaChallenges).set({ challengeHash }).where(and12(
+          eq12(mfaChallenges.id, id26),
+          isNull10(mfaChallenges.verifiedAt),
+          gt6(mfaChallenges.expiresAt, /* @__PURE__ */ new Date())
+        )).returning({ id: mfaChallenges.id });
+        return result.length > 0;
+      }
+      /**
+       * Delete the pending key a challenge was gating, which takes the challenge
+       * with it through the cascade.
+       *
+       * Scoped to `pending_mfa_challenge_id`, so a key that has since been
+       * activated is never deleted by a late failure or a sweep.
+       */
+      async dropPendingKey(keyId, challengeId) {
+        await this.db.delete(userPublicKeys).where(and12(
+          eq12(userPublicKeys.keyId, keyId),
+          eq12(userPublicKeys.pendingMfaChallengeId, challengeId)
+        ));
+      }
+      /**
+       * Mark a key active and no longer pending — what a verified challenge buys.
+       *
+       * Conditioned on the challenge id, so this can only activate the key that
+       * challenge was minted for.
+       */
+      async activateKey(keyId, challengeId) {
+        await this.db.update(userPublicKeys).set({ isActive: true, pendingMfaChallengeId: null }).where(and12(
+          eq12(userPublicKeys.keyId, keyId),
+          eq12(userPublicKeys.pendingMfaChallengeId, challengeId)
+        ));
+      }
+      /**
+       * Clear out challenges nobody finished, and the keys they were gating.
+       *
+       * Counted from the read rather than from either delete, because the two
+       * overlap: deleting a pending key cascades onto its challenge, so the second
+       * statement finds only the challenges whose key had already gone some other
+       * way — and a count taken there would report a sweep that did nothing.
+       *
+       * A spent challenge is kept for the same span as an expired one, so a replay
+       * inside the window meets "already verified" from a row rather than
+       * "unknown" from an absence. The 401 is the same either way; the record is
+       * not.
+       *
+       * @returns how many challenge rows are gone
+       */
+      async sweepFinished(cutoff) {
+        const finished = or3(lte(mfaChallenges.expiresAt, cutoff), isNotNull(mfaChallenges.verifiedAt));
+        const doomed = await this.readDb.select({ id: mfaChallenges.id }).from(mfaChallenges).where(finished);
+        if (doomed.length === 0) {
+          return 0;
+        }
+        await this.db.delete(userPublicKeys).where(inArray(userPublicKeys.pendingMfaChallengeId, doomed.map((row) => row.id)));
+        await this.db.delete(mfaChallenges).where(finished);
+        return doomed.length;
+      }
+    };
+    mfaChallengesRepository = new MfaChallengesRepository();
+  }
+});
+
+// src/server/repositories/mfa-enrolment.repository.ts
+import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
+import { and as and13, eq as eq13, isNotNull as isNotNull2, isNull as isNull11 } from "drizzle-orm";
 import { unionAll } from "drizzle-orm/pg-core";
 var MfaEnrolmentRepository, mfaEnrolmentRepository;
 var init_mfa_enrolment_repository = __esm({
@@ -8196,19 +8480,19 @@ var init_mfa_enrolment_repository = __esm({
     "use strict";
     init_mfa_totp();
     init_passkeys();
-    MfaEnrolmentRepository = class extends BaseRepository12 {
+    MfaEnrolmentRepository = class extends BaseRepository13 {
       /** Whether the account has a confirmed TOTP or a live second-factor passkey. */
       async isEnrolled(userId) {
-        const confirmedTotp = this.readDb.select({ owner: mfaTotp.userId }).from(mfaTotp).where(and12(eq12(mfaTotp.userId, userId), isNotNull(mfaTotp.confirmedAt)));
+        const confirmedTotp = this.readDb.select({ owner: mfaTotp.userId }).from(mfaTotp).where(and13(eq13(mfaTotp.userId, userId), isNotNull2(mfaTotp.confirmedAt)));
         const rows = await unionAll(confirmedTotp, this.liveSecondFactorPasskeys(userId)).limit(1);
         return rows.length > 0;
       }
       /** The other half of the union, as its own read for `status` to reuse. */
       liveSecondFactorPasskeys(userId) {
-        return this.readDb.select({ owner: passkeys.userId }).from(passkeys).where(and12(
-          eq12(passkeys.userId, userId),
-          eq12(passkeys.secondFactor, true),
-          isNull10(passkeys.revokedAt)
+        return this.readDb.select({ owner: passkeys.userId }).from(passkeys).where(and13(
+          eq13(passkeys.userId, userId),
+          eq13(passkeys.secondFactor, true),
+          isNull11(passkeys.revokedAt)
         ));
       }
       /** Whether at least one live passkey is marked as a second factor. */
@@ -8222,15 +8506,15 @@ var init_mfa_enrolment_repository = __esm({
 });
 
 // src/server/repositories/device-authorizations.repository.ts
-import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
-import { eq as eq13, and as and13, gt as gt6, inArray, sql as sql8 } from "drizzle-orm";
+import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
+import { eq as eq14, and as and14, gt as gt7, inArray as inArray2, sql as sql9 } from "drizzle-orm";
 var notExpired, DeviceAuthorizationsRepository, deviceAuthorizationsRepository;
 var init_device_authorizations_repository = __esm({
   "src/server/repositories/device-authorizations.repository.ts"() {
     "use strict";
     init_device_authorizations();
-    notExpired = () => gt6(deviceAuthorizations.expiresAt, sql8`now()`);
-    DeviceAuthorizationsRepository = class extends BaseRepository13 {
+    notExpired = () => gt7(deviceAuthorizations.expiresAt, sql9`now()`);
+    DeviceAuthorizationsRepository = class extends BaseRepository14 {
       /**
        * Insert a pending authorization, unless one of its codes is already taken.
        *
@@ -8258,7 +8542,7 @@ var init_device_authorizations_repository = __esm({
        * Read replica.
        */
       async findByUserCode(userCode) {
-        const result = await this.readDb.select().from(deviceAuthorizations).where(eq13(deviceAuthorizations.userCode, userCode)).limit(1);
+        const result = await this.readDb.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.userCode, userCode)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8268,7 +8552,7 @@ var init_device_authorizations_repository = __esm({
        * Read replica.
        */
       async findByDeviceCodeHash(deviceCodeHash) {
-        const result = await this.readDb.select().from(deviceAuthorizations).where(eq13(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
+        const result = await this.readDb.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8280,11 +8564,11 @@ var init_device_authorizations_repository = __esm({
        *
        * @returns the updated row, or null if it was no longer pending, or expired
        */
-      async approve(id25, userId) {
+      async approve(id26, userId) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "approved", userId, approvedAt: /* @__PURE__ */ new Date() }).where(
-          and13(
-            eq13(deviceAuthorizations.id, id25),
-            eq13(deviceAuthorizations.status, "pending"),
+          and14(
+            eq14(deviceAuthorizations.id, id26),
+            eq14(deviceAuthorizations.status, "pending"),
             notExpired()
           )
         ).returning();
@@ -8297,11 +8581,11 @@ var init_device_authorizations_repository = __esm({
        *
        * @returns the updated row, or null if it was no longer pending, or expired
        */
-      async deny(id25) {
+      async deny(id26) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
-          and13(
-            eq13(deviceAuthorizations.id, id25),
-            eq13(deviceAuthorizations.status, "pending"),
+          and14(
+            eq14(deviceAuthorizations.id, id26),
+            eq14(deviceAuthorizations.status, "pending"),
             notExpired()
           )
         ).returning();
@@ -8334,9 +8618,9 @@ var init_device_authorizations_repository = __esm({
        */
       async denyAllActiveByUserId(userId) {
         return await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
-          and13(
-            eq13(deviceAuthorizations.userId, userId),
-            inArray(deviceAuthorizations.status, ["pending", "approved"])
+          and14(
+            eq14(deviceAuthorizations.userId, userId),
+            inArray2(deviceAuthorizations.status, ["pending", "approved"])
           )
         ).returning();
       }
@@ -8353,9 +8637,9 @@ var init_device_authorizations_repository = __esm({
        */
       async consumeApproved(deviceCodeHash) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "consumed", consumedAt: /* @__PURE__ */ new Date() }).where(
-          and13(
-            eq13(deviceAuthorizations.deviceCodeHash, deviceCodeHash),
-            eq13(deviceAuthorizations.status, "approved"),
+          and14(
+            eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash),
+            eq14(deviceAuthorizations.status, "approved"),
             notExpired()
           )
         ).returning();
@@ -8367,26 +8651,26 @@ var init_device_authorizations_repository = __esm({
 });
 
 // src/server/repositories/roles.repository.ts
-import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
-import { eq as eq14, asc } from "drizzle-orm";
+import { BaseRepository as BaseRepository15 } from "@spfn/core/db";
+import { eq as eq15, asc } from "drizzle-orm";
 var RolesRepository, rolesRepository;
 var init_roles_repository = __esm({
   "src/server/repositories/roles.repository.ts"() {
     "use strict";
     init_roles();
-    RolesRepository = class extends BaseRepository14 {
+    RolesRepository = class extends BaseRepository15 {
       /**
        * ID로 역할 조회
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(roles).where(eq14(roles.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(roles).where(eq15(roles.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 역할 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(roles).where(eq14(roles.name, name)).limit(1);
+        const result = await this.readDb.select().from(roles).where(eq15(roles.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8399,7 +8683,7 @@ var init_roles_repository = __esm({
        * 활성 역할만 조회
        */
       async findActive() {
-        return this.readDb.select().from(roles).where(eq14(roles.isActive, true)).orderBy(asc(roles.priority));
+        return this.readDb.select().from(roles).where(eq15(roles.isActive, true)).orderBy(asc(roles.priority));
       }
       /**
        * 역할 생성
@@ -8410,15 +8694,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id25, data) {
-        const result = await this.db.update(roles).set(data).where(eq14(roles.id, id25)).returning();
+      async updateById(id26, data) {
+        const result = await this.db.update(roles).set(data).where(eq15(roles.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id25) {
-        const result = await this.db.delete(roles).where(eq14(roles.id, id25)).returning();
+      async deleteById(id26) {
+        const result = await this.db.delete(roles).where(eq15(roles.id, id26)).returning();
         return result[0] ?? null;
       }
     };
@@ -8427,26 +8711,26 @@ var init_roles_repository = __esm({
 });
 
 // src/server/repositories/permissions.repository.ts
-import { BaseRepository as BaseRepository15 } from "@spfn/core/db";
-import { asc as asc2, eq as eq15, inArray as inArray2 } from "drizzle-orm";
+import { BaseRepository as BaseRepository16 } from "@spfn/core/db";
+import { asc as asc2, eq as eq16, inArray as inArray3 } from "drizzle-orm";
 var PermissionsRepository, permissionsRepository;
 var init_permissions_repository = __esm({
   "src/server/repositories/permissions.repository.ts"() {
     "use strict";
     init_permissions();
-    PermissionsRepository = class extends BaseRepository15 {
+    PermissionsRepository = class extends BaseRepository16 {
       /**
        * ID로 권한 조회
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(permissions).where(eq15(permissions.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(permissions).where(eq16(permissions.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 권한 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(permissions).where(eq15(permissions.name, name)).limit(1);
+        const result = await this.readDb.select().from(permissions).where(eq16(permissions.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8454,7 +8738,7 @@ var init_permissions_repository = __esm({
        */
       async findByNames(names) {
         if (names.length === 0) return [];
-        return this.readDb.select().from(permissions).where(inArray2(permissions.name, names));
+        return this.readDb.select().from(permissions).where(inArray3(permissions.name, names));
       }
       /**
        * 모든 권한 조회
@@ -8466,13 +8750,13 @@ var init_permissions_repository = __esm({
        * 활성 권한만 조회
        */
       async findActive() {
-        return this.readDb.select().from(permissions).where(eq15(permissions.isActive, true)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq16(permissions.isActive, true)).orderBy(asc2(permissions.name));
       }
       /**
        * 카테고리별 권한 조회
        */
       async findByCategory(category) {
-        return this.readDb.select().from(permissions).where(eq15(permissions.category, category)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq16(permissions.category, category)).orderBy(asc2(permissions.name));
       }
       /**
        * 권한 생성
@@ -8490,15 +8774,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id25, data) {
-        const result = await this.db.update(permissions).set(data).where(eq15(permissions.id, id25)).returning();
+      async updateById(id26, data) {
+        const result = await this.db.update(permissions).set(data).where(eq16(permissions.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id25) {
-        const result = await this.db.delete(permissions).where(eq15(permissions.id, id25)).returning();
+      async deleteById(id26) {
+        const result = await this.db.delete(permissions).where(eq16(permissions.id, id26)).returning();
         return result[0] ?? null;
       }
     };
@@ -8507,25 +8791,25 @@ var init_permissions_repository = __esm({
 });
 
 // src/server/repositories/role-permissions.repository.ts
-import { BaseRepository as BaseRepository16 } from "@spfn/core/db";
-import { and as and14, eq as eq16 } from "drizzle-orm";
+import { BaseRepository as BaseRepository17 } from "@spfn/core/db";
+import { and as and15, eq as eq17 } from "drizzle-orm";
 var RolePermissionsRepository, rolePermissionsRepository;
 var init_role_permissions_repository = __esm({
   "src/server/repositories/role-permissions.repository.ts"() {
     "use strict";
     init_role_permissions();
-    RolePermissionsRepository = class extends BaseRepository16 {
+    RolePermissionsRepository = class extends BaseRepository17 {
       /**
        * 역할 ID로 모든 권한 조회
        */
       async findByRoleId(roleId) {
-        return this.readDb.select().from(rolePermissions).where(eq16(rolePermissions.roleId, roleId));
+        return this.readDb.select().from(rolePermissions).where(eq17(rolePermissions.roleId, roleId));
       }
       /**
        * 권한 ID로 모든 역할 조회
        */
       async findByPermissionId(permissionId) {
-        return this.readDb.select().from(rolePermissions).where(eq16(rolePermissions.permissionId, permissionId));
+        return this.readDb.select().from(rolePermissions).where(eq17(rolePermissions.permissionId, permissionId));
       }
       /**
        * 역할-권한 매핑 생성
@@ -8545,9 +8829,9 @@ var init_role_permissions_repository = __esm({
        */
       async deleteByRoleIdAndPermissionId(roleId, permissionId) {
         const result = await this.db.delete(rolePermissions).where(
-          and14(
-            eq16(rolePermissions.roleId, roleId),
-            eq16(rolePermissions.permissionId, permissionId)
+          and15(
+            eq17(rolePermissions.roleId, roleId),
+            eq17(rolePermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -8556,7 +8840,7 @@ var init_role_permissions_repository = __esm({
        * 역할의 모든 권한 매핑 삭제
        */
       async deleteByRoleId(roleId) {
-        const result = await this.db.delete(rolePermissions).where(eq16(rolePermissions.roleId, roleId)).returning();
+        const result = await this.db.delete(rolePermissions).where(eq17(rolePermissions.roleId, roleId)).returning();
         return result.length;
       }
       /**
@@ -8577,19 +8861,19 @@ var init_role_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-permissions.repository.ts
-import { BaseRepository as BaseRepository17 } from "@spfn/core/db";
-import { eq as eq17, and as and15, or as or3, isNull as isNull11, isNotNull as isNotNull2, lt as lt6, gt as gt7 } from "drizzle-orm";
+import { BaseRepository as BaseRepository18 } from "@spfn/core/db";
+import { eq as eq18, and as and16, or as or4, isNull as isNull12, isNotNull as isNotNull3, lt as lt6, gt as gt8 } from "drizzle-orm";
 var UserPermissionsRepository, userPermissionsRepository;
 var init_user_permissions_repository = __esm({
   "src/server/repositories/user-permissions.repository.ts"() {
     "use strict";
     init_user_permissions();
-    UserPermissionsRepository = class extends BaseRepository17 {
+    UserPermissionsRepository = class extends BaseRepository18 {
       /**
        * 사용자 ID로 모든 권한 오버라이드 조회
        */
       async findByUserId(userId) {
-        return this.readDb.select().from(userPermissions).where(eq17(userPermissions.userId, userId));
+        return this.readDb.select().from(userPermissions).where(eq18(userPermissions.userId, userId));
       }
       /**
        * 사용자 ID로 유효한 권한 오버라이드만 조회
@@ -8598,11 +8882,11 @@ var init_user_permissions_repository = __esm({
       async findValidByUserId(userId) {
         const now = /* @__PURE__ */ new Date();
         return this.readDb.select().from(userPermissions).where(
-          and15(
-            eq17(userPermissions.userId, userId),
-            or3(
-              isNull11(userPermissions.expiresAt),
-              gt7(userPermissions.expiresAt, now)
+          and16(
+            eq18(userPermissions.userId, userId),
+            or4(
+              isNull12(userPermissions.expiresAt),
+              gt8(userPermissions.expiresAt, now)
             )
           )
         );
@@ -8612,9 +8896,9 @@ var init_user_permissions_repository = __esm({
        */
       async findByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.readDb.select().from(userPermissions).where(
-          and15(
-            eq17(userPermissions.userId, userId),
-            eq17(userPermissions.permissionId, permissionId)
+          and16(
+            eq18(userPermissions.userId, userId),
+            eq18(userPermissions.permissionId, permissionId)
           )
         ).limit(1);
         return result[0] ?? null;
@@ -8628,8 +8912,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id25, data) {
-        const result = await this.db.update(userPermissions).set(data).where(eq17(userPermissions.id, id25)).returning();
+      async updateById(id26, data) {
+        const result = await this.db.update(userPermissions).set(data).where(eq18(userPermissions.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
@@ -8637,9 +8921,9 @@ var init_user_permissions_repository = __esm({
        */
       async deleteByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.db.delete(userPermissions).where(
-          and15(
-            eq17(userPermissions.userId, userId),
-            eq17(userPermissions.permissionId, permissionId)
+          and16(
+            eq18(userPermissions.userId, userId),
+            eq18(userPermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -8648,7 +8932,7 @@ var init_user_permissions_repository = __esm({
        * 사용자의 모든 권한 오버라이드 삭제
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userPermissions).where(eq17(userPermissions.userId, userId)).returning();
+        const result = await this.db.delete(userPermissions).where(eq18(userPermissions.userId, userId)).returning();
         return result.length;
       }
       /**
@@ -8657,8 +8941,8 @@ var init_user_permissions_repository = __esm({
       async deleteExpired() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.delete(userPermissions).where(
-          and15(
-            isNotNull2(userPermissions.expiresAt),
+          and16(
+            isNotNull3(userPermissions.expiresAt),
             lt6(userPermissions.expiresAt, now)
           )
         ).returning();
@@ -8670,33 +8954,33 @@ var init_user_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-profiles.repository.ts
-import { BaseRepository as BaseRepository18 } from "@spfn/core/db";
-import { eq as eq18 } from "drizzle-orm";
+import { BaseRepository as BaseRepository19 } from "@spfn/core/db";
+import { eq as eq19 } from "drizzle-orm";
 var UserProfilesRepository, userProfilesRepository;
 var init_user_profiles_repository = __esm({
   "src/server/repositories/user-profiles.repository.ts"() {
     "use strict";
     init_user_profiles();
-    UserProfilesRepository = class extends BaseRepository18 {
+    UserProfilesRepository = class extends BaseRepository19 {
       /**
        * ID로 프로필 조회
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(userProfiles).where(eq18(userProfiles.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(userProfiles).where(eq19(userProfiles.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
        * User ID로 locale만 조회 (경량)
        */
       async findLocaleByUserId(userId) {
-        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq18(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq19(userProfiles.userId, userId)).limit(1);
         return result[0]?.locale || "en";
       }
       /**
        * User ID로 프로필 조회
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userProfiles).where(eq18(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select().from(userProfiles).where(eq19(userProfiles.userId, userId)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8708,29 +8992,29 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id25, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq18(userProfiles.id, id25)).returning();
+      async updateById(id26, data) {
+        const result = await this.db.update(userProfiles).set(data).where(eq19(userProfiles.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 업데이트 (by User ID)
        */
       async updateByUserId(userId, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq18(userProfiles.userId, userId)).returning();
+        const result = await this.db.update(userProfiles).set(data).where(eq19(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id25) {
-        const result = await this.db.delete(userProfiles).where(eq18(userProfiles.id, id25)).returning();
+      async deleteById(id26) {
+        const result = await this.db.delete(userProfiles).where(eq19(userProfiles.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by User ID)
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userProfiles).where(eq18(userProfiles.userId, userId)).returning();
+        const result = await this.db.delete(userProfiles).where(eq19(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
@@ -8772,7 +9056,7 @@ var init_user_profiles_repository = __esm({
           metadata: userProfiles.metadata,
           createdAt: userProfiles.createdAt,
           updatedAt: userProfiles.updatedAt
-        }).from(userProfiles).where(eq18(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
+        }).from(userProfiles).where(eq19(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
         if (!profile) {
           return null;
         }
@@ -8800,8 +9084,8 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq19, and as and16, lt as lt7, desc as desc3, sql as sql9 } from "drizzle-orm";
-import { BaseRepository as BaseRepository19 } from "@spfn/core/db";
+import { eq as eq20, and as and17, lt as lt7, desc as desc3, sql as sql10 } from "drizzle-orm";
+import { BaseRepository as BaseRepository20 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
   "src/server/repositories/invitations.repository.ts"() {
@@ -8810,19 +9094,19 @@ var init_invitations_repository = __esm({
     init_roles();
     init_user_invitations();
     init_email();
-    InvitationsRepository = class extends BaseRepository19 {
+    InvitationsRepository = class extends BaseRepository20 {
       /**
        * ID로 초대 조회
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(userInvitations).where(eq19(userInvitations.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(userInvitations).where(eq20(userInvitations.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Token으로 초대 조회
        */
       async findByToken(token) {
-        const result = await this.readDb.select().from(userInvitations).where(eq19(userInvitations.token, token)).limit(1);
+        const result = await this.readDb.select().from(userInvitations).where(eq20(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8830,9 +9114,9 @@ var init_invitations_repository = __esm({
        */
       async findPendingByEmail(email) {
         const result = await this.readDb.select().from(userInvitations).where(
-          and16(
-            eq19(userInvitations.email, normalizeEmail(email)),
-            eq19(userInvitations.status, "pending")
+          and17(
+            eq20(userInvitations.email, normalizeEmail(email)),
+            eq20(userInvitations.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -8841,13 +9125,13 @@ var init_invitations_repository = __esm({
        * 초대자 ID로 모든 초대 조회
        */
       async findByInvitedBy(invitedBy) {
-        return this.readDb.select().from(userInvitations).where(eq19(userInvitations.invitedBy, invitedBy));
+        return this.readDb.select().from(userInvitations).where(eq20(userInvitations.invitedBy, invitedBy));
       }
       /**
        * 상태별 초대 조회
        */
       async findByStatus(status) {
-        return this.readDb.select().from(userInvitations).where(eq19(userInvitations.status, status));
+        return this.readDb.select().from(userInvitations).where(eq20(userInvitations.status, status));
       }
       /**
        * 초대 생성
@@ -8858,7 +9142,7 @@ var init_invitations_repository = __esm({
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id25, status, timestamp2) {
+      async updateStatus(id26, status, timestamp2) {
         const updates = {
           status
         };
@@ -8869,14 +9153,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq19(userInvitations.id, id25)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq20(userInvitations.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id25) {
-        const result = await this.db.delete(userInvitations).where(eq19(userInvitations.id, id25)).returning();
+      async deleteById(id26) {
+        const result = await this.db.delete(userInvitations).where(eq20(userInvitations.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
@@ -8885,8 +9169,8 @@ var init_invitations_repository = __esm({
       async updateExpiredInvitations() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.update(userInvitations).set({ status: "expired" }).where(
-          and16(
-            eq19(userInvitations.status, "pending"),
+          and17(
+            eq20(userInvitations.status, "pending"),
             lt7(userInvitations.expiresAt, now)
           )
         ).returning();
@@ -8918,7 +9202,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq19(userInvitations.roleId, roles.id)).innerJoin(users, eq19(userInvitations.invitedBy, users.id)).where(eq19(userInvitations.token, token)).limit(1);
+        }).from(userInvitations).innerJoin(roles, eq20(userInvitations.roleId, roles.id)).innerJoin(users, eq20(userInvitations.invitedBy, users.id)).where(eq20(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8929,13 +9213,13 @@ var init_invitations_repository = __esm({
         const offset = (page - 1) * limit;
         const conditions = [];
         if (status) {
-          conditions.push(eq19(userInvitations.status, status));
+          conditions.push(eq20(userInvitations.status, status));
         }
         if (invitedBy) {
-          conditions.push(eq19(userInvitations.invitedBy, invitedBy));
+          conditions.push(eq20(userInvitations.invitedBy, invitedBy));
         }
-        const whereClause = conditions.length > 0 ? and16(...conditions) : void 0;
-        const countResult = await this.readDb.select({ count: sql9`count(*)` }).from(userInvitations).where(whereClause);
+        const whereClause = conditions.length > 0 ? and17(...conditions) : void 0;
+        const countResult = await this.readDb.select({ count: sql10`count(*)` }).from(userInvitations).where(whereClause);
         const total = Number(countResult[0]?.count || 0);
         const results = await this.readDb.select({
           id: userInvitations.id,
@@ -8959,7 +9243,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq19(userInvitations.roleId, roles.id)).innerJoin(users, eq19(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc3(userInvitations.createdAt)).limit(limit).offset(offset);
+        }).from(userInvitations).innerJoin(roles, eq20(userInvitations.roleId, roles.id)).innerJoin(users, eq20(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc3(userInvitations.createdAt)).limit(limit).offset(offset);
         return {
           invitations: results,
           total,
@@ -8971,31 +9255,31 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id25, data) {
+      async updateById(id26, data) {
         const patch = "email" in data && typeof data.email === "string" ? { ...data, email: normalizeEmail(data.email) } : data;
-        const result = await this.db.update(userInvitations).set(patch).where(eq19(userInvitations.id, id25)).returning();
+        const result = await this.db.update(userInvitations).set(patch).where(eq20(userInvitations.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id25, newExpiresAt) {
+      async resend(id26, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt
-        }).where(eq19(userInvitations.id, id25)).returning();
+        }).where(eq20(userInvitations.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id25, cancelledBy, reason, currentMetadata) {
+      async cancel(id26, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata
-        }).where(eq19(userInvitations.id, id25)).returning();
+        }).where(eq20(userInvitations.id, id26)).returning();
         return result[0] ?? null;
       }
     };
@@ -9366,6 +9650,22 @@ var init_schema5 = __esm({
           examples: [5, 10, 30]
         })
       },
+      SPFN_AUTH_MFA_CONFIRM_PATH: {
+        ...envString({
+          description: "App page that asks for the second factor after a 202 sign-in, as a path on {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}. createOAuthCallbackHandler redirects the browser there with ?challenge= when a social sign-in needs a step-up; the page posts that challenge and a code to /_auth/mfa/verify. It is a page in your app, not an API route.",
+          default: "/auth/mfa",
+          required: false,
+          examples: ["/auth/mfa", "/sign-in/two-factor"]
+        })
+      },
+      SPFN_AUTH_MFA_CHALLENGE_TTL_MINUTES: {
+        ...envNumber({
+          description: "How long a new-device second-factor challenge stays spendable. A sign-in on an enrolled account from a device it has never seen answers 202 with a challenge instead of a session, and the key it registered is inactive until POST /_auth/mfa/verify spends it. This is how long the person has to reach for their authenticator \u2014 and how long an attacker holding only the password has. The Next.js proxy seals its pending cookie for the same span.",
+          default: 10,
+          required: false,
+          examples: [5, 10, 15]
+        })
+      },
       // ============================================================================
       // Session binding (#97)
       // ============================================================================
@@ -9819,15 +10119,15 @@ var init_token_cipher = __esm({
 });
 
 // src/server/repositories/social-accounts.repository.ts
-import { eq as eq20, and as and17 } from "drizzle-orm";
-import { BaseRepository as BaseRepository20 } from "@spfn/core/db";
+import { eq as eq21, and as and18 } from "drizzle-orm";
+import { BaseRepository as BaseRepository21 } from "@spfn/core/db";
 var SocialAccountsRepository, socialAccountsRepository;
 var init_social_accounts_repository = __esm({
   "src/server/repositories/social-accounts.repository.ts"() {
     "use strict";
     init_entities();
     init_token_cipher();
-    SocialAccountsRepository = class extends BaseRepository20 {
+    SocialAccountsRepository = class extends BaseRepository21 {
       /**
        * 저장 row 의 토큰을 평문으로 복호화해 반환한다.
        *
@@ -9855,10 +10155,10 @@ var init_social_accounts_repository = __esm({
             if (refresh?.needsRotation) {
               heal.refreshToken = await encryptToken(refresh.value, context("refresh"));
             }
-            await this.db.update(userSocialAccounts).set(heal).where(and17(
-              eq20(userSocialAccounts.id, account.id),
-              access?.needsRotation && account.accessToken !== null ? eq20(userSocialAccounts.accessToken, account.accessToken) : void 0,
-              refresh?.needsRotation && account.refreshToken !== null ? eq20(userSocialAccounts.refreshToken, account.refreshToken) : void 0
+            await this.db.update(userSocialAccounts).set(heal).where(and18(
+              eq21(userSocialAccounts.id, account.id),
+              access?.needsRotation && account.accessToken !== null ? eq21(userSocialAccounts.accessToken, account.accessToken) : void 0,
+              refresh?.needsRotation && account.refreshToken !== null ? eq21(userSocialAccounts.refreshToken, account.refreshToken) : void 0
             ));
           } catch {
           }
@@ -9875,9 +10175,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByProviderAndProviderId(provider, providerUserId) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and17(
-            eq20(userSocialAccounts.provider, provider),
-            eq20(userSocialAccounts.providerUserId, providerUserId)
+          and18(
+            eq21(userSocialAccounts.provider, provider),
+            eq21(userSocialAccounts.providerUserId, providerUserId)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -9887,7 +10187,7 @@ var init_social_accounts_repository = __esm({
        * Read replica 사용
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userSocialAccounts).where(eq20(userSocialAccounts.userId, userId));
+        const result = await this.readDb.select().from(userSocialAccounts).where(eq21(userSocialAccounts.userId, userId));
         return Promise.all(result.map((account) => this.decryptAccount(account)));
       }
       /**
@@ -9896,9 +10196,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByUserIdAndProvider(userId, provider) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and17(
-            eq20(userSocialAccounts.userId, userId),
-            eq20(userSocialAccounts.provider, provider)
+          and18(
+            eq21(userSocialAccounts.userId, userId),
+            eq21(userSocialAccounts.provider, provider)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -9924,11 +10224,11 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id25, data) {
+      async updateTokens(id26, data) {
         const accounts = await this.db.select({
           provider: userSocialAccounts.provider,
           providerUserId: userSocialAccounts.providerUserId
-        }).from(userSocialAccounts).where(eq20(userSocialAccounts.id, id25)).limit(1);
+        }).from(userSocialAccounts).where(eq21(userSocialAccounts.id, id26)).limit(1);
         const account = accounts[0];
         if (!account) {
           return null;
@@ -9942,15 +10242,15 @@ var init_social_accounts_repository = __esm({
           ...data,
           accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
           refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken
-        }).where(eq20(userSocialAccounts.id, id25)).returning();
+        }).where(eq21(userSocialAccounts.id, id26)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id25) {
-        const result = await this.db.delete(userSocialAccounts).where(eq20(userSocialAccounts.id, id25)).returning();
+      async deleteById(id26) {
+        const result = await this.db.delete(userSocialAccounts).where(eq21(userSocialAccounts.id, id26)).returning();
         return result[0] ?? null;
       }
       /**
@@ -9959,9 +10259,9 @@ var init_social_accounts_repository = __esm({
        */
       async deleteByUserIdAndProvider(userId, provider) {
         const result = await this.db.delete(userSocialAccounts).where(
-          and17(
-            eq20(userSocialAccounts.userId, userId),
-            eq20(userSocialAccounts.provider, provider)
+          and18(
+            eq21(userSocialAccounts.userId, userId),
+            eq21(userSocialAccounts.provider, provider)
           )
         ).returning();
         return result[0] ?? null;
@@ -9974,7 +10274,7 @@ var init_social_accounts_repository = __esm({
        * Write primary 사용
        */
       async deleteAllByUserId(userId) {
-        const result = await this.db.delete(userSocialAccounts).where(eq20(userSocialAccounts.userId, userId)).returning();
+        const result = await this.db.delete(userSocialAccounts).where(eq21(userSocialAccounts.userId, userId)).returning();
         return result.length;
       }
     };
@@ -9983,19 +10283,19 @@ var init_social_accounts_repository = __esm({
 });
 
 // src/server/repositories/auth-metadata.repository.ts
-import { BaseRepository as BaseRepository21 } from "@spfn/core/db";
-import { eq as eq21 } from "drizzle-orm";
+import { BaseRepository as BaseRepository22 } from "@spfn/core/db";
+import { eq as eq22 } from "drizzle-orm";
 var AuthMetadataRepository, authMetadataRepository;
 var init_auth_metadata_repository = __esm({
   "src/server/repositories/auth-metadata.repository.ts"() {
     "use strict";
     init_auth_metadata();
-    AuthMetadataRepository = class extends BaseRepository21 {
+    AuthMetadataRepository = class extends BaseRepository22 {
       /**
        * 키로 값 조회
        */
       async get(key) {
-        const result = await this.readDb.select().from(authMetadata).where(eq21(authMetadata.key, key)).limit(1);
+        const result = await this.readDb.select().from(authMetadata).where(eq22(authMetadata.key, key)).limit(1);
         return result[0]?.value ?? null;
       }
       /**
@@ -10018,20 +10318,20 @@ var init_auth_metadata_repository = __esm({
 });
 
 // src/server/repositories/account-deletion-requests.repository.ts
-import { eq as eq22, and as and18, lte } from "drizzle-orm";
-import { BaseRepository as BaseRepository22 } from "@spfn/core/db";
+import { eq as eq23, and as and19, lte as lte2 } from "drizzle-orm";
+import { BaseRepository as BaseRepository23 } from "@spfn/core/db";
 var AccountDeletionRequestsRepository, accountDeletionRequestsRepository;
 var init_account_deletion_requests_repository = __esm({
   "src/server/repositories/account-deletion-requests.repository.ts"() {
     "use strict";
     init_account_deletion_requests();
-    AccountDeletionRequestsRepository = class extends BaseRepository22 {
+    AccountDeletionRequestsRepository = class extends BaseRepository23 {
       /**
        * ID로 요청 조회
        * Read replica 사용
        */
-      async findById(id25) {
-        const result = await this.readDb.select().from(accountDeletionRequests).where(eq22(accountDeletionRequests.id, id25)).limit(1);
+      async findById(id26) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq23(accountDeletionRequests.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -10040,9 +10340,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserId(userId) {
         const result = await this.readDb.select().from(accountDeletionRequests).where(
-          and18(
-            eq22(accountDeletionRequests.userId, userId),
-            eq22(accountDeletionRequests.status, "pending")
+          and19(
+            eq23(accountDeletionRequests.userId, userId),
+            eq23(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -10056,9 +10356,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserIdOnPrimary(userId) {
         const result = await this.db.select().from(accountDeletionRequests).where(
-          and18(
-            eq22(accountDeletionRequests.userId, userId),
-            eq22(accountDeletionRequests.status, "pending")
+          and19(
+            eq23(accountDeletionRequests.userId, userId),
+            eq23(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -10069,9 +10369,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findDueForPurge(now) {
         return this.readDb.select().from(accountDeletionRequests).where(
-          and18(
-            eq22(accountDeletionRequests.status, "pending"),
-            lte(accountDeletionRequests.purgeScheduledAt, now)
+          and19(
+            eq23(accountDeletionRequests.status, "pending"),
+            lte2(accountDeletionRequests.purgeScheduledAt, now)
           )
         );
       }
@@ -10090,14 +10390,14 @@ var init_account_deletion_requests_repository = __esm({
        * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCancelled(id25) {
+      async markCancelled(id26) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date()
         }).where(
-          and18(
-            eq22(accountDeletionRequests.id, id25),
-            eq22(accountDeletionRequests.status, "pending")
+          and19(
+            eq23(accountDeletionRequests.id, id26),
+            eq23(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -10112,15 +10412,15 @@ var init_account_deletion_requests_repository = __esm({
        * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCompleted(id25, purgeStrategy) {
+      async markCompleted(id26, purgeStrategy) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "completed",
           completedAt: /* @__PURE__ */ new Date(),
           purgeStrategy
         }).where(
-          and18(
-            eq22(accountDeletionRequests.id, id25),
-            eq22(accountDeletionRequests.status, "pending")
+          and19(
+            eq23(accountDeletionRequests.id, id26),
+            eq23(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -10131,14 +10431,14 @@ var init_account_deletion_requests_repository = __esm({
 });
 
 // src/server/repositories/ops-tokens.repository.ts
-import { and as and19, desc as desc4, eq as eq23, isNull as isNull12 } from "drizzle-orm";
-import { BaseRepository as BaseRepository23 } from "@spfn/core/db";
+import { and as and20, desc as desc4, eq as eq24, isNull as isNull13 } from "drizzle-orm";
+import { BaseRepository as BaseRepository24 } from "@spfn/core/db";
 var OpsTokensRepository, opsTokensRepository;
 var init_ops_tokens_repository = __esm({
   "src/server/repositories/ops-tokens.repository.ts"() {
     "use strict";
     init_ops_tokens();
-    OpsTokensRepository = class extends BaseRepository23 {
+    OpsTokensRepository = class extends BaseRepository24 {
       /**
        * Lookup by the secret's hash — the verification path.
        *
@@ -10148,7 +10448,7 @@ var init_ops_tokens_repository = __esm({
        * and revocation is documented as taking effect immediately.
        */
       async findByTokenHash(tokenHash) {
-        const result = await this.db.select().from(opsTokens).where(eq23(opsTokens.tokenHash, tokenHash)).limit(1);
+        const result = await this.db.select().from(opsTokens).where(eq24(opsTokens.tokenHash, tokenHash)).limit(1);
         return result[0] ?? null;
       }
       async create(data) {
@@ -10163,13 +10463,13 @@ var init_ops_tokens_repository = __esm({
        * token is already revoked — the first revocation's timestamp is never
        * overwritten.
        */
-      async revokeById(id25) {
-        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and19(eq23(opsTokens.id, id25), isNull12(opsTokens.revokedAt))).returning();
+      async revokeById(id26) {
+        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and20(eq24(opsTokens.id, id26), isNull13(opsTokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path. */
-      async updateLastUsedById(id25) {
-        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq23(opsTokens.id, id25));
+      async updateLastUsedById(id26) {
+        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq24(opsTokens.id, id26));
       }
     };
     opsTokensRepository = new OpsTokensRepository();
@@ -10177,15 +10477,15 @@ var init_ops_tokens_repository = __esm({
 });
 
 // src/server/repositories/oauth2-clients.repository.ts
-import { and as and20, eq as eq24, gt as gt8, lt as lt8, sql as sql10 } from "drizzle-orm";
-import { BaseRepository as BaseRepository24, runInTransaction } from "@spfn/core/db";
+import { and as and21, eq as eq25, gt as gt9, lt as lt8, sql as sql11 } from "drizzle-orm";
+import { BaseRepository as BaseRepository25, runInTransaction } from "@spfn/core/db";
 var OAuth2ClientsRepository, oauth2ClientsRepository;
 var init_oauth2_clients_repository = __esm({
   "src/server/repositories/oauth2-clients.repository.ts"() {
     "use strict";
     init_oauth2_clients();
     init_oauth2_grants();
-    OAuth2ClientsRepository = class extends BaseRepository24 {
+    OAuth2ClientsRepository = class extends BaseRepository25 {
       async create(data) {
         const result = await this.db.insert(oauth2Clients).values(data).returning();
         return result[0];
@@ -10199,12 +10499,12 @@ var init_oauth2_clients_repository = __esm({
        * at the one moment a CLI is being connected.
        */
       async findByClientId(clientId) {
-        const result = await this.db.select().from(oauth2Clients).where(eq24(oauth2Clients.clientId, clientId)).limit(1);
+        const result = await this.db.select().from(oauth2Clients).where(eq25(oauth2Clients.clientId, clientId)).limit(1);
         return result[0] ?? null;
       }
       /** Fire-and-forget from the token-issuing path. */
-      async updateLastUsedById(id25) {
-        await this.db.update(oauth2Clients).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq24(oauth2Clients.id, id25));
+      async updateLastUsedById(id26) {
+        await this.db.update(oauth2Clients).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq25(oauth2Clients.id, id26));
       }
       /**
        * Register a client unless this address is already at its standing cap.
@@ -10226,7 +10526,7 @@ var init_oauth2_clients_repository = __esm({
        */
       async createWithinStandingCap(data, limit) {
         return await runInTransaction(async () => {
-          await this.db.execute(sql10`select pg_advisory_xact_lock(hashtext(${limit.ip}))`);
+          await this.db.execute(sql11`select pg_advisory_xact_lock(hashtext(${limit.ip}))`);
           const standing = await this.countRecentUngrantedByIp(limit.ip, limit.windowMs);
           return standing < limit.max ? await this.create(data) : null;
         });
@@ -10248,11 +10548,11 @@ var init_oauth2_clients_repository = __esm({
        * count exists to see.
        */
       async countRecentUngrantedByIp(ip, windowMs) {
-        const result = await this.db.select({ count: sql10`count(*)::int` }).from(oauth2Clients).where(
-          and20(
-            eq24(oauth2Clients.createdIp, ip),
-            gt8(oauth2Clients.createdAt, new Date(Date.now() - windowMs)),
-            sql10`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
+        const result = await this.db.select({ count: sql11`count(*)::int` }).from(oauth2Clients).where(
+          and21(
+            eq25(oauth2Clients.createdIp, ip),
+            gt9(oauth2Clients.createdAt, new Date(Date.now() - windowMs)),
+            sql11`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
           )
         );
         return result[0]?.count ?? 0;
@@ -10269,9 +10569,9 @@ var init_oauth2_clients_repository = __esm({
        */
       async deleteStaleUngranted(before) {
         const deleted = await this.db.delete(oauth2Clients).where(
-          and20(
+          and21(
             lt8(oauth2Clients.createdAt, before),
-            sql10`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
+            sql11`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
           )
         ).returning({ id: oauth2Clients.id });
         return deleted.length;
@@ -10282,8 +10582,8 @@ var init_oauth2_clients_repository = __esm({
 });
 
 // src/server/repositories/oauth2-grants.repository.ts
-import { and as and21, desc as desc5, eq as eq25, inArray as inArray3, isNull as isNull13, sql as sql11 } from "drizzle-orm";
-import { BaseRepository as BaseRepository25 } from "@spfn/core/db";
+import { and as and22, desc as desc5, eq as eq26, inArray as inArray4, isNull as isNull14, sql as sql12 } from "drizzle-orm";
+import { BaseRepository as BaseRepository26 } from "@spfn/core/db";
 var OAuth2GrantsRepository, oauth2GrantsRepository;
 var init_oauth2_grants_repository = __esm({
   "src/server/repositories/oauth2-grants.repository.ts"() {
@@ -10291,7 +10591,7 @@ var init_oauth2_grants_repository = __esm({
     init_oauth2_grants();
     init_oauth2_clients();
     init_oauth2_tokens();
-    OAuth2GrantsRepository = class extends BaseRepository25 {
+    OAuth2GrantsRepository = class extends BaseRepository26 {
       /**
        * Record a consent, or refresh the scopes of the one already there.
        *
@@ -10318,13 +10618,13 @@ var init_oauth2_grants_repository = __esm({
        *
        * Read primary: revocation is documented as taking effect immediately.
        */
-      async findWithClientById(id25) {
-        const result = await this.db.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq25(oauth2Grants.client, oauth2Clients.id)).where(eq25(oauth2Grants.id, id25)).limit(1);
+      async findWithClientById(id26) {
+        const result = await this.db.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq26(oauth2Grants.client, oauth2Clients.id)).where(eq26(oauth2Grants.id, id26)).limit(1);
         return result[0] ?? null;
       }
       /** What the user's "connected apps" screen lists. Read replica. */
       async listActiveByUserId(userId) {
-        return await this.readDb.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq25(oauth2Grants.client, oauth2Clients.id)).where(and21(eq25(oauth2Grants.user, userId), isNull13(oauth2Grants.revokedAt))).orderBy(desc5(oauth2Grants.createdAt));
+        return await this.readDb.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq26(oauth2Grants.client, oauth2Clients.id)).where(and22(eq26(oauth2Grants.user, userId), isNull14(oauth2Grants.revokedAt))).orderBy(desc5(oauth2Grants.createdAt));
       }
       /**
        * Revoke one live grant belonging to one user.
@@ -10337,19 +10637,19 @@ var init_oauth2_grants_repository = __esm({
        * @returns the revoked row, or null if there was no live grant of that id
        *          for that user
        */
-      async revokeByIdForUser(id25, userId) {
+      async revokeByIdForUser(id26, userId) {
         const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(
-          and21(
-            eq25(oauth2Grants.id, id25),
-            eq25(oauth2Grants.user, userId),
-            isNull13(oauth2Grants.revokedAt)
+          and22(
+            eq26(oauth2Grants.id, id26),
+            eq26(oauth2Grants.user, userId),
+            isNull14(oauth2Grants.revokedAt)
           )
         ).returning();
         return result[0] ?? null;
       }
       /** Revoke one grant by id, whoever it belongs to — the replay detections. */
-      async revokeById(id25) {
-        const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and21(eq25(oauth2Grants.id, id25), isNull13(oauth2Grants.revokedAt))).returning();
+      async revokeById(id26) {
+        const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and22(eq26(oauth2Grants.id, id26), isNull14(oauth2Grants.revokedAt))).returning();
         return result[0] ?? null;
       }
       /**
@@ -10359,7 +10659,7 @@ var init_oauth2_grants_repository = __esm({
        * @returns the grant ids this call revoked
        */
       async revokeAllActiveByUserId(userId) {
-        const revoked = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and21(eq25(oauth2Grants.user, userId), isNull13(oauth2Grants.revokedAt))).returning({ id: oauth2Grants.id });
+        const revoked = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and22(eq26(oauth2Grants.user, userId), isNull14(oauth2Grants.revokedAt))).returning({ id: oauth2Grants.id });
         return revoked.map((row) => row.id);
       }
       /**
@@ -10375,7 +10675,7 @@ var init_oauth2_grants_repository = __esm({
         if (grantIds.length === 0) {
           return 0;
         }
-        const revoked = await this.db.update(oauth2Tokens).set({ revokedAt: sql11`now()` }).where(and21(inArray3(oauth2Tokens.grant, grantIds), isNull13(oauth2Tokens.revokedAt))).returning({ id: oauth2Tokens.id });
+        const revoked = await this.db.update(oauth2Tokens).set({ revokedAt: sql12`now()` }).where(and22(inArray4(oauth2Tokens.grant, grantIds), isNull14(oauth2Tokens.revokedAt))).returning({ id: oauth2Tokens.id });
         return revoked.length;
       }
     };
@@ -10384,14 +10684,14 @@ var init_oauth2_grants_repository = __esm({
 });
 
 // src/server/repositories/oauth2-authorization-codes.repository.ts
-import { and as and22, eq as eq26, gt as gt9, isNull as isNull14, sql as sql12 } from "drizzle-orm";
-import { BaseRepository as BaseRepository26 } from "@spfn/core/db";
+import { and as and23, eq as eq27, gt as gt10, isNull as isNull15, sql as sql13 } from "drizzle-orm";
+import { BaseRepository as BaseRepository27 } from "@spfn/core/db";
 var OAuth2AuthorizationCodesRepository, oauth2AuthorizationCodesRepository;
 var init_oauth2_authorization_codes_repository = __esm({
   "src/server/repositories/oauth2-authorization-codes.repository.ts"() {
     "use strict";
     init_oauth2_authorization_codes();
-    OAuth2AuthorizationCodesRepository = class extends BaseRepository26 {
+    OAuth2AuthorizationCodesRepository = class extends BaseRepository27 {
       async create(data) {
         const result = await this.db.insert(oauth2AuthorizationCodes).values(data).returning();
         return result[0];
@@ -10403,11 +10703,11 @@ var init_oauth2_authorization_codes_repository = __esm({
        *          spent, or past its 60 seconds
        */
       async consume(codeHash) {
-        const result = await this.db.update(oauth2AuthorizationCodes).set({ usedAt: sql12`now()` }).where(
-          and22(
-            eq26(oauth2AuthorizationCodes.codeHash, codeHash),
-            isNull14(oauth2AuthorizationCodes.usedAt),
-            gt9(oauth2AuthorizationCodes.expiresAt, sql12`now()`)
+        const result = await this.db.update(oauth2AuthorizationCodes).set({ usedAt: sql13`now()` }).where(
+          and23(
+            eq27(oauth2AuthorizationCodes.codeHash, codeHash),
+            isNull15(oauth2AuthorizationCodes.usedAt),
+            gt10(oauth2AuthorizationCodes.expiresAt, sql13`now()`)
           )
         ).returning();
         return result[0] ?? null;
@@ -10418,7 +10718,7 @@ var init_oauth2_authorization_codes_repository = __esm({
        * would be indistinguishable from a code that never existed.
        */
       async findByCodeHash(codeHash) {
-        const result = await this.db.select().from(oauth2AuthorizationCodes).where(eq26(oauth2AuthorizationCodes.codeHash, codeHash)).limit(1);
+        const result = await this.db.select().from(oauth2AuthorizationCodes).where(eq27(oauth2AuthorizationCodes.codeHash, codeHash)).limit(1);
         return result[0] ?? null;
       }
     };
@@ -10427,14 +10727,14 @@ var init_oauth2_authorization_codes_repository = __esm({
 });
 
 // src/server/repositories/oauth2-tokens.repository.ts
-import { and as and23, eq as eq27, gt as gt10, isNull as isNull15, sql as sql13 } from "drizzle-orm";
-import { BaseRepository as BaseRepository27 } from "@spfn/core/db";
+import { and as and24, eq as eq28, gt as gt11, isNull as isNull16, sql as sql14 } from "drizzle-orm";
+import { BaseRepository as BaseRepository28 } from "@spfn/core/db";
 var OAuth2TokensRepository, oauth2TokensRepository;
 var init_oauth2_tokens_repository = __esm({
   "src/server/repositories/oauth2-tokens.repository.ts"() {
     "use strict";
     init_oauth2_tokens();
-    OAuth2TokensRepository = class extends BaseRepository27 {
+    OAuth2TokensRepository = class extends BaseRepository28 {
       async create(data) {
         const result = await this.db.insert(oauth2Tokens).values(data).returning();
         return result[0];
@@ -10448,7 +10748,7 @@ var init_oauth2_tokens_repository = __esm({
        * Unfiltered, so the service can tell revoked from expired from unknown.
        */
       async findByTokenHash(tokenHash) {
-        const result = await this.db.select().from(oauth2Tokens).where(eq27(oauth2Tokens.tokenHash, tokenHash)).limit(1);
+        const result = await this.db.select().from(oauth2Tokens).where(eq28(oauth2Tokens.tokenHash, tokenHash)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -10458,13 +10758,13 @@ var init_oauth2_tokens_repository = __esm({
        *          rotated, revoked, or expired
        */
       async rotate(tokenHash) {
-        const result = await this.db.update(oauth2Tokens).set({ replacedAt: sql13`now()` }).where(
-          and23(
-            eq27(oauth2Tokens.tokenHash, tokenHash),
-            eq27(oauth2Tokens.kind, "refresh"),
-            isNull15(oauth2Tokens.replacedAt),
-            isNull15(oauth2Tokens.revokedAt),
-            gt10(oauth2Tokens.expiresAt, sql13`now()`)
+        const result = await this.db.update(oauth2Tokens).set({ replacedAt: sql14`now()` }).where(
+          and24(
+            eq28(oauth2Tokens.tokenHash, tokenHash),
+            eq28(oauth2Tokens.kind, "refresh"),
+            isNull16(oauth2Tokens.replacedAt),
+            isNull16(oauth2Tokens.revokedAt),
+            gt11(oauth2Tokens.expiresAt, sql14`now()`)
           )
         ).returning();
         return result[0] ?? null;
@@ -10477,12 +10777,12 @@ var init_oauth2_tokens_repository = __esm({
        *          about whether the value it presented ever existed.
        */
       async revokeByTokenHash(tokenHash) {
-        const result = await this.db.update(oauth2Tokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and23(eq27(oauth2Tokens.tokenHash, tokenHash), isNull15(oauth2Tokens.revokedAt))).returning();
+        const result = await this.db.update(oauth2Tokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and24(eq28(oauth2Tokens.tokenHash, tokenHash), isNull16(oauth2Tokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path, as ops tokens do. */
-      async updateLastUsedById(id25) {
-        await this.db.update(oauth2Tokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq27(oauth2Tokens.id, id25));
+      async updateLastUsedById(id26) {
+        await this.db.update(oauth2Tokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq28(oauth2Tokens.id, id26));
       }
     };
     oauth2TokensRepository = new OAuth2TokensRepository();
@@ -10504,6 +10804,7 @@ var init_repositories = __esm({
     init_mfa_totp_repository();
     init_mfa_recovery_codes_repository();
     init_mfa_verifications_repository();
+    init_mfa_challenges_repository();
     init_mfa_enrolment_repository();
     init_device_authorizations_repository();
     init_roles_repository();
@@ -10611,7 +10912,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id25) => Number(id25));
+  const permissionIdNums = permissionIds.map((id26) => Number(id26));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -10631,7 +10932,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id25) => permissionsRepository.findById(id25))
+    permissionIds.map((id26) => permissionsRepository.findById(id26))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -10895,8 +11196,8 @@ async function listOAuth2GrantsService(userId) {
     lastUsedAtMillis: client.lastUsedAt?.getTime()
   }));
 }
-async function revokeOAuth2GrantService(id25, userId) {
-  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id25, userId);
+async function revokeOAuth2GrantService(id26, userId) {
+  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id26, userId);
   if (!revoked) {
     throw new OAuth2GrantNotFoundError();
   }
@@ -11283,10 +11584,10 @@ function uaFamily(userAgent) {
 // src/server/services/key.service.ts
 init_repositories();
 import { InvalidKeyFingerprintError, KeyIdAlreadyRegisteredError } from "@spfn/auth/errors";
-import { ValidationError as ValidationError2 } from "@spfn/core/errors";
+import { ValidationError as ValidationError3 } from "@spfn/core/errors";
 
 // src/server/services/device-registration.service.ts
-import { onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
+import { onAfterCommit } from "@spfn/core/db";
 
 // src/server/events/index.ts
 init_esm();
@@ -11433,11 +11734,31 @@ var authPasswordResetEvent = defineEvent(
   })
 );
 
+// src/server/services/device-registration.service.ts
+init_repositories();
+var DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH = 12;
+async function emitDeviceRegistered(row, channel) {
+  const mfaEnrolled = await mfaEnrolmentRepository.isEnrolled(row.userId);
+  onAfterCommit(() => authDeviceRegisteredEvent.emit({
+    userId: String(row.userId),
+    keyId: row.keyId,
+    algorithm: row.algorithm,
+    fingerprintPrefix: row.fingerprint.slice(0, DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH),
+    deviceName: row.deviceName ?? void 0,
+    platform: row.platform ?? void 0,
+    ip: row.registeredIp ?? void 0,
+    userAgent: row.registeredUserAgent ?? void 0,
+    createdAtMillis: row.createdAt.getTime(),
+    channel,
+    mfaEnrolled
+  }));
+}
+
 // src/server/services/mfa.service.ts
 init_logger();
 init_config();
-import { onAfterCommit, runInTransaction as runInTransaction2 } from "@spfn/core/db";
-import { ValidationError } from "@spfn/core/errors";
+import { onAfterCommit as onAfterCommit2, runInTransaction as runInTransaction2 } from "@spfn/core/db";
+import { ValidationError as ValidationError2 } from "@spfn/core/errors";
 import {
   MfaAlreadyEnrolledError,
   MfaNotEnrolledError,
@@ -11534,16 +11855,16 @@ function encodeBase32(bytes) {
   }
   return bits > 0 ? output + BASE32_ALPHABET[value << 5 - bits & 31] : output;
 }
-function decodeBase32(text26) {
+function decodeBase32(text27) {
   let bits = 0;
   let value = 0;
   const bytes = [];
-  for (const character of text26.replace(/=+$/, "").toUpperCase()) {
-    const index20 = BASE32_ALPHABET.indexOf(character);
-    if (index20 < 0) {
+  for (const character of text27.replace(/=+$/, "").toUpperCase()) {
+    const index21 = BASE32_ALPHABET.indexOf(character);
+    if (index21 < 0) {
       throw new Error("Value is not RFC 4648 base32");
     }
-    value = value << 5 | index20;
+    value = value << 5 | index21;
     bits += 5;
     if (bits >= 8) {
       bytes.push(value >>> bits - 8 & 255);
@@ -11724,6 +12045,87 @@ async function verifyAuthentication(params) {
 
 // src/server/services/mfa.service.ts
 init_repositories();
+
+// src/server/services/login-result.ts
+function loginBindingFields(registered) {
+  if (registered.binding !== "passkey" || !registered.expiresAt) {
+    return {};
+  }
+  return { sessionBinding: "passkey", keyExpiresAtMillis: registered.expiresAt.getTime() };
+}
+
+// src/server/services/user.service.ts
+init_repositories();
+import { ValidationError } from "@spfn/core/errors";
+import { ReservedUsernameError, UsernameAlreadyTakenError } from "@spfn/auth/errors";
+import { env as env9 } from "@spfn/auth/config";
+async function getUserByIdService(userId) {
+  return await usersRepository.findById(userId);
+}
+async function getUserByEmailService(email) {
+  return await usersRepository.findByEmail(email);
+}
+async function getUserByPhoneService(phone) {
+  return await usersRepository.findByPhone(phone);
+}
+async function updateLastLoginService(userId) {
+  await usersRepository.updateLastLogin(userId);
+}
+async function updateUserService(userId, updates) {
+  await usersRepository.updateById(userId, updates);
+}
+function getReservedUsernames() {
+  const raw = env9.SPFN_AUTH_RESERVED_USERNAMES ?? "";
+  if (!raw) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)
+  );
+}
+function isReservedUsername(username) {
+  return getReservedUsernames().has(username.toLowerCase());
+}
+function validateUsernameLength(username) {
+  const min = env9.SPFN_AUTH_USERNAME_MIN_LENGTH ?? 3;
+  const max2 = env9.SPFN_AUTH_USERNAME_MAX_LENGTH ?? 30;
+  if (username.length < min) {
+    throw new ValidationError({
+      message: `Username must be at least ${min} characters`,
+      details: { minLength: min, actual: username.length }
+    });
+  }
+  if (username.length > max2) {
+    throw new ValidationError({
+      message: `Username must be at most ${max2} characters`,
+      details: { maxLength: max2, actual: username.length }
+    });
+  }
+}
+async function checkUsernameAvailableService(username) {
+  validateUsernameLength(username);
+  if (isReservedUsername(username)) {
+    return false;
+  }
+  const existing = await usersRepository.findByUsername(username);
+  return !existing;
+}
+async function updateUsernameService(userId, username) {
+  const userIdNum = typeof userId === "string" ? Number(userId) : Number(userId);
+  if (username !== null) {
+    validateUsernameLength(username);
+    if (isReservedUsername(username)) {
+      throw new ReservedUsernameError({ username });
+    }
+    const existing = await usersRepository.findByUsername(username);
+    if (existing && existing.id !== userIdNum) {
+      throw new UsernameAlreadyTakenError({ username });
+    }
+  }
+  return await usersRepository.updateById(userIdNum, { username });
+}
+
+// src/server/services/mfa.service.ts
 init_mfa_totp();
 
 // src/server/services/webauthn-challenge.service.ts
@@ -11752,9 +12154,9 @@ function presentedChallenge(clientDataJSON) {
   const decoded = parseJson(Buffer.from(clientDataJSON, "base64url").toString("utf8"));
   return typeof decoded?.challenge === "string" ? decoded.challenge : "";
 }
-function parseJson(text26) {
+function parseJson(text27) {
   try {
-    return JSON.parse(text26);
+    return JSON.parse(text27);
   } catch {
     return null;
   }
@@ -11774,10 +12176,110 @@ async function assertStepUp(params) {
   if (verification?.userId === params.userId && Date.now() - verification.verifiedAt.getTime() <= window) {
     return;
   }
-  throw new StepUpRequiredError();
+  throw new StepUpRequiredError();
+}
+function carryStepUpVerification(userId, fromKeyId, toKeyId) {
+  return mfaVerificationsRepository.moveToKeyId(userId, fromKeyId, toKeyId);
+}
+async function openStepUpChallengeService(params) {
+  const { secret, hash: hash2 } = mintCredential();
+  const expiresAt = new Date(Date.now() + getMfaConfig().challengeTtlMs);
+  const row = await mfaChallengesRepository.create({
+    userId: params.userId,
+    challengeHash: hash2,
+    keyId: params.keyId,
+    channel: params.channel,
+    keyEpoch: params.keyEpoch,
+    expiresAt,
+    loginEvent: params.loginEvent ?? null
+  });
+  await mfaChallengesRepository.markKeyPending(params.keyId, row.id);
+  return { secret, expiresAtMillis: expiresAt.getTime() };
+}
+async function resumeStepUpChallengeService(userId, keyId) {
+  const live = await mfaChallengesRepository.findLiveByKeyId(userId, keyId);
+  if (!live) {
+    return null;
+  }
+  const { secret, hash: hash2 } = mintCredential();
+  return await mfaChallengesRepository.resecret(live.id, hash2) ? { secret, expiresAtMillis: live.expiresAt.getTime() } : null;
+}
+async function spendableChallenge(challengeHash) {
+  const row = await mfaChallengesRepository.findByHash(challengeHash);
+  if (!row || row.verifiedAt || row.expiresAt.getTime() <= Date.now()) {
+    throw new MfaVerificationFailedError();
+  }
+  if (row.keyEpoch !== await usersRepository.currentKeyEpoch(row.userId)) {
+    throw new MfaVerificationFailedError();
+  }
+  return row;
+}
+async function countChallengeFailure(row) {
+  if (await mfaChallengesRepository.countFailure(row.id)) {
+    await mfaChallengesRepository.dropPendingKey(row.keyId, row.id);
+    authLogger.service.warn("Second-factor challenge discarded after repeated wrong proofs", {
+      userId: row.userId
+    });
+  }
+  throw new MfaVerificationFailedError();
+}
+async function releaseDeferredAnnouncements(row, key) {
+  await updateLastLoginService(row.userId);
+  await emitDeviceRegistered(key, row.channel);
+  if (!row.loginEvent) {
+    return;
+  }
+  const mfaEnrolled = await mfaEnrolledForUser(row.userId);
+  onAfterCommit2(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
+}
+async function verifyMfaChallengeService(params) {
+  const challengeHash = hashCredential(params.challenge);
+  const row = await spendableChallenge(challengeHash);
+  const method = await attemptSecondFactor({
+    userId: row.userId,
+    keyId: row.keyId,
+    code: params.code,
+    recoveryCode: params.recoveryCode,
+    response: params.response
+  });
+  if (!method) {
+    await countChallengeFailure(row);
+  }
+  return await runInTransaction2(async () => {
+    if (!await mfaChallengesRepository.markVerified(row.id, row.keyEpoch)) {
+      throw new MfaVerificationFailedError();
+    }
+    await mfaChallengesRepository.activateKey(row.keyId, row.id);
+    await mfaVerificationsRepository.record(row.keyId, row.userId, method);
+    return { ...await settleStepUpLogin(row), keyId: row.keyId, challengeHash };
+  }, { context: "auth:mfa-verify" });
+}
+async function settleStepUpLogin(row) {
+  const user = await usersRepository.findByIdOnPrimary(row.userId);
+  const key = await keysRepository.findByKeyIdAndUserId(row.keyId, row.userId);
+  if (!user || !key) {
+    throw new MfaVerificationFailedError();
+  }
+  await releaseDeferredAnnouncements(row, key);
+  return {
+    mfaRequired: false,
+    userId: String(user.id),
+    publicId: user.publicId,
+    email: user.email || void 0,
+    phone: user.phone || void 0,
+    passwordChangeRequired: user.passwordChangeRequired,
+    ...loginBindingFields(key)
+  };
 }
-function carryStepUpVerification(userId, fromKeyId, toKeyId) {
-  return mfaVerificationsRepository.moveToKeyId(userId, fromKeyId, toKeyId);
+async function startMfaChallengeAssertionService(challenge) {
+  const row = await spendableChallenge(hashCredential(challenge));
+  return await buildAuthenticationOptions({
+    config: getPasskeyConfig(),
+    challenge: await mintChallenge("mfa", row.userId)
+  });
+}
+async function sweepMfaChallengesService() {
+  return { deleted: await mfaChallengesRepository.sweepFinished(/* @__PURE__ */ new Date()) };
 }
 async function startTotpEnrolmentService(userId) {
   const existing = await mfaTotpRepository.findByUserId(userId);
@@ -11822,7 +12324,7 @@ async function countConfirmFailure(userId) {
 function readSecret(secretEnc, userId) {
   const { value, needsRotation } = decryptMfaSecret(secretEnc, userId);
   if (needsRotation) {
-    onAfterCommit(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
+    onAfterCommit2(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
   }
   return value;
 }
@@ -11884,10 +12386,10 @@ async function stepUpService(params) {
   const method = await verifySecondFactor(params);
   await mfaVerificationsRepository.record(params.keyId, params.userId, method);
 }
-async function verifySecondFactor(params) {
+async function attemptSecondFactor(params) {
   const presented = [params.code, params.recoveryCode, params.response].filter((value) => value !== void 0);
   if (presented.length !== 1) {
-    throw new ValidationError({
+    throw new ValidationError2({
       message: "Send exactly one of code, recoveryCode or response."
     });
   }
@@ -11896,10 +12398,17 @@ async function verifySecondFactor(params) {
   }
   return params.recoveryCode !== void 0 ? await verifyRecoveryProof(params.userId, params.recoveryCode) : await verifyPasskeyProof(params.userId, params.response);
 }
+async function verifySecondFactor(params) {
+  const method = await attemptSecondFactor(params);
+  if (!method) {
+    throw new MfaVerificationFailedError();
+  }
+  return method;
+}
 async function verifyTotpProof(userId, code) {
   const row = await mfaTotpRepository.findByUserId(userId);
   if (!row?.confirmedAt) {
-    throw new MfaVerificationFailedError();
+    return null;
   }
   const step = verifyTotp({
     secret: readSecret(row.secretEnc, userId),
@@ -11907,7 +12416,7 @@ async function verifyTotpProof(userId, code) {
     lastUsedStep: row.lastUsedStep
   });
   if (step === null) {
-    throw new MfaVerificationFailedError();
+    return null;
   }
   await mfaTotpRepository.recordUsedStep(userId, step);
   return "totp";
@@ -11921,17 +12430,17 @@ async function verifyRecoveryProof(userId, submitted) {
       return "recovery";
     }
   }
-  throw new MfaVerificationFailedError();
+  return null;
 }
 async function verifyPasskeyProof(userId, response) {
   const challenge = presentedChallenge(response.response.clientDataJSON);
   if (!await spendChallenge(challenge, "mfa", userId)) {
-    throw new MfaVerificationFailedError();
+    return null;
   }
   const marked = await passkeysRepository.listLiveSecondFactorByUserId(userId);
   const passkey = marked.find((row) => row.credentialId === response.id);
   if (!passkey) {
-    throw new MfaVerificationFailedError();
+    return null;
   }
   const outcome = await verifyAuthentication({
     config: getPasskeyConfig(),
@@ -11945,7 +12454,7 @@ async function verifyPasskeyProof(userId, response) {
     }
   });
   if (!outcome.verified) {
-    throw new MfaVerificationFailedError();
+    return null;
   }
   await passkeysRepository.recordUse(passkey.id, outcome.newCounter);
   return "passkey";
@@ -11955,26 +12464,14 @@ async function sweepUnconfirmedMfaService() {
   return { deleted: await mfaTotpRepository.deleteUnconfirmedBefore(cutoff) };
 }
 
-// src/server/services/device-registration.service.ts
-var DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH = 12;
-async function emitDeviceRegistered(row, channel) {
-  const mfaEnrolled = await mfaEnrolledForUser(row.userId);
-  onAfterCommit2(() => authDeviceRegisteredEvent.emit({
-    userId: String(row.userId),
-    keyId: row.keyId,
-    algorithm: row.algorithm,
-    fingerprintPrefix: row.fingerprint.slice(0, DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH),
-    deviceName: row.deviceName ?? void 0,
-    platform: row.platform ?? void 0,
-    ip: row.registeredIp ?? void 0,
-    userAgent: row.registeredUserAgent ?? void 0,
-    createdAtMillis: row.createdAt.getTime(),
-    channel,
-    mfaEnrolled
-  }));
-}
-
 // src/server/services/key.service.ts
+init_mfa_challenges();
+function registeredBinding(result) {
+  if (result.pending) {
+    throw new Error("This registration channel cannot require a second factor");
+  }
+  return result;
+}
 var KEY_FINGERPRINT_PREFIX_LENGTH = 8;
 var DEFAULT_KEY_ALGORITHM = "ES256";
 function getKeyExpiryDate(binding) {
@@ -11988,21 +12485,36 @@ function getKeyExpiryDate(binding) {
 function isExpired(expiresAt) {
   return expiresAt !== null && /* @__PURE__ */ new Date() > expiresAt;
 }
+async function decideStepUp(params) {
+  const channel = MFA_CHALLENGE_CHANNELS.find((candidate) => candidate === params.channel);
+  if (!channel || params.replacesKeyId) {
+    return null;
+  }
+  return await mfaEnrolledForUser(params.userId) ? channel : null;
+}
+async function answerForExistingKey(existing, userId) {
+  if (existing.userId === userId && existing.isActive) {
+    return { pending: false, ...await reRegisterOwnActiveKey(existing, userId) };
+  }
+  const resumed = existing.userId === userId && existing.pendingMfaChallengeId ? await resumeStepUpChallengeService(userId, existing.keyId) : null;
+  if (resumed) {
+    return { pending: true, challenge: resumed };
+  }
+  throw new KeyIdAlreadyRegisteredError();
+}
 async function registerPublicKeyService(params) {
   const { userId, keyId, publicKey, fingerprint, algorithm = DEFAULT_KEY_ALGORITHM, deviceName, platform } = params;
   const binding = params.binding ?? "none";
   const existing = await keysRepository.findByKeyId(keyId);
   if (existing) {
-    if (existing.userId === userId && existing.isActive) {
-      return await reRegisterOwnActiveKey(existing, userId);
-    }
-    throw new KeyIdAlreadyRegisteredError();
+    return await answerForExistingKey(existing, userId);
   }
   const isValidFingerprint = verifyKeyFingerprint(publicKey, fingerprint);
   if (!isValidFingerprint) {
     throw new InvalidKeyFingerprintError();
   }
   assertKeyMatchesAlgorithm(publicKey, algorithm);
+  const stepUp = await decideStepUp(params);
   const row = await keysRepository.create({
     userId,
     keyId,
@@ -12015,15 +12527,24 @@ async function registerPublicKeyService(params) {
     registeredIp: params.ip ?? null,
     registeredUserAgent: params.userAgent ?? null,
     registeredUaFamily: params.userAgent ? uaFamily(params.userAgent) : null,
-    isActive: true,
+    isActive: stepUp === null,
     expiresAt: getKeyExpiryDate(binding)
   });
+  if (stepUp) {
+    return { pending: true, challenge: await openStepUpChallengeService({
+      userId,
+      keyId,
+      channel: stepUp,
+      keyEpoch: await usersRepository.currentKeyEpoch(userId),
+      loginEvent: params.loginEvent
+    }) };
+  }
   if (params.replacesKeyId) {
     await carryStepUpVerification(userId, params.replacesKeyId, keyId);
   } else {
     await emitDeviceRegistered(row, params.channel);
   }
-  return { binding, expiresAt: row.expiresAt };
+  return { pending: false, binding, expiresAt: row.expiresAt };
 }
 async function reRegisterOwnActiveKey(existing, userId) {
   if (existing.binding !== "passkey" && isExpired(existing.expiresAt)) {
@@ -12095,7 +12616,7 @@ async function listKeysService(params) {
 async function revokeAllKeysService(params) {
   const { userId, currentKeyId, includeCurrent = false, reason } = params;
   if (!includeCurrent && !currentKeyId) {
-    throw new ValidationError2({ message: "currentKeyId is required unless includeCurrent is set" });
+    throw new ValidationError3({ message: "currentKeyId is required unless includeCurrent is set" });
   }
   if (currentKeyId) {
     await assertStepUp({ userId, keyId: currentKeyId });
@@ -12109,77 +12630,6 @@ async function revokeAllKeysService(params) {
 // src/server/services/auth.service.ts
 init_key_policy();
 
-// src/server/services/user.service.ts
-init_repositories();
-import { ValidationError as ValidationError3 } from "@spfn/core/errors";
-import { ReservedUsernameError, UsernameAlreadyTakenError } from "@spfn/auth/errors";
-import { env as env9 } from "@spfn/auth/config";
-async function getUserByIdService(userId) {
-  return await usersRepository.findById(userId);
-}
-async function getUserByEmailService(email) {
-  return await usersRepository.findByEmail(email);
-}
-async function getUserByPhoneService(phone) {
-  return await usersRepository.findByPhone(phone);
-}
-async function updateLastLoginService(userId) {
-  await usersRepository.updateLastLogin(userId);
-}
-async function updateUserService(userId, updates) {
-  await usersRepository.updateById(userId, updates);
-}
-function getReservedUsernames() {
-  const raw = env9.SPFN_AUTH_RESERVED_USERNAMES ?? "";
-  if (!raw) {
-    return /* @__PURE__ */ new Set();
-  }
-  return new Set(
-    raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)
-  );
-}
-function isReservedUsername(username) {
-  return getReservedUsernames().has(username.toLowerCase());
-}
-function validateUsernameLength(username) {
-  const min = env9.SPFN_AUTH_USERNAME_MIN_LENGTH ?? 3;
-  const max2 = env9.SPFN_AUTH_USERNAME_MAX_LENGTH ?? 30;
-  if (username.length < min) {
-    throw new ValidationError3({
-      message: `Username must be at least ${min} characters`,
-      details: { minLength: min, actual: username.length }
-    });
-  }
-  if (username.length > max2) {
-    throw new ValidationError3({
-      message: `Username must be at most ${max2} characters`,
-      details: { maxLength: max2, actual: username.length }
-    });
-  }
-}
-async function checkUsernameAvailableService(username) {
-  validateUsernameLength(username);
-  if (isReservedUsername(username)) {
-    return false;
-  }
-  const existing = await usersRepository.findByUsername(username);
-  return !existing;
-}
-async function updateUsernameService(userId, username) {
-  const userIdNum = typeof userId === "string" ? Number(userId) : Number(userId);
-  if (username !== null) {
-    validateUsernameLength(username);
-    if (isReservedUsername(username)) {
-      throw new ReservedUsernameError({ username });
-    }
-    const existing = await usersRepository.findByUsername(username);
-    if (existing && existing.id !== userIdNum) {
-      throw new UsernameAlreadyTakenError({ username });
-    }
-  }
-  return await usersRepository.updateById(userIdNum, { username });
-}
-
 // src/server/services/account-deletion.service.ts
 init_repositories();
 import { ValidationError as ValidationError4, NotFoundError as NotFoundError2 } from "@spfn/core/errors";
@@ -12258,8 +12708,8 @@ async function verifyReauthCredential(user, params) {
     throw new VerificationTokenTargetMismatchError();
   }
 }
-async function sendDeletionEmail(to, subject, text26) {
-  const result = await sendEmail3({ to, subject, text: text26 });
+async function sendDeletionEmail(to, subject, text27) {
+  const result = await sendEmail3({ to, subject, text: text27 });
   if (!result.success) {
     authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
   }
@@ -12508,12 +12958,6 @@ async function sweepDuePurges(now = /* @__PURE__ */ new Date()) {
 }
 
 // src/server/services/auth.service.ts
-function loginBindingFields(registered) {
-  if (registered.binding !== "passkey" || !registered.expiresAt) {
-    return {};
-  }
-  return { sessionBinding: "passkey", keyExpiresAtMillis: registered.expiresAt.getTime() };
-}
 async function registerService(params) {
   const { email, verificationToken } = params;
   const phone = params.phone?.trim();
@@ -12629,10 +13073,19 @@ async function loginService(params) {
     ip: params.ip,
     userAgent: params.userAgent,
     binding: decideKeyBinding(user.sessionBinding, params.webProxy),
-    replacesKeyId
+    replacesKeyId,
+    loginEvent: {
+      provider: email ? "email" : "phone",
+      email: user.email || void 0,
+      phone: user.phone || void 0
+    }
   });
+  if (registered.pending) {
+    return { mfaRequired: true, challenge: registered.challenge };
+  }
   await updateLastLoginService(user.id);
   const result = {
+    mfaRequired: false,
     userId: String(user.id),
     publicId: user.publicId,
     email: user.email || void 0,
@@ -12641,7 +13094,7 @@ async function loginService(params) {
     ...loginBindingFields(registered)
   };
   await authLoginEvent.emit({
-    userId: result.userId,
+    userId: String(user.id),
     provider: email ? "email" : "phone",
     email: result.email,
     phone: result.phone,
@@ -12899,12 +13352,11 @@ async function replaceCredentials(row, user, params) {
     userAgent: params.userAgent,
     binding: decideKeyBinding(user.sessionBinding, params.webProxy)
   });
-  await updateLastLoginService(user.id);
   if (!await passwordResetTokensRepository.complete(row.id)) {
     authLogger.service.warn("Password reset session refused", { reason: "lost the claim race" });
     throw new PasswordResetSessionError();
   }
-  return loginBindingFields(registered);
+  return registered;
 }
 async function completePasswordResetService(params) {
   if (!params.publicKey || !params.keyId || !params.fingerprint) {
@@ -12923,17 +13375,22 @@ async function completePasswordResetService(params) {
     authLogger.service.warn("Password reset session refused", { reason: "account is no longer active" });
     throw new PasswordResetSessionError();
   }
-  const binding = await replaceCredentials(row, user, params);
+  const registered = await replaceCredentials(row, user, params);
   onAfterCommit4(() => authPasswordResetEvent.emit({
     userId: String(user.id),
     email: row.email
   }));
+  if (registered.pending) {
+    return { mfaRequired: true, challenge: registered.challenge };
+  }
+  await updateLastLoginService(user.id);
   return {
+    mfaRequired: false,
     userId: String(user.id),
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
-    ...binding
+    ...loginBindingFields(registered)
   };
 }
 
@@ -13219,16 +13676,20 @@ async function completeDeviceLogin(record, provenance) {
   });
   await updateLastLoginService(user.id);
   const result = {
+    // A device-code approval is itself a second factor: the owner read the
+    // code on a device that is already signed in and said yes, so this
+    // channel never steps up (#95).
+    mfaRequired: false,
     userId: String(user.id),
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
     passwordChangeRequired: user.passwordChangeRequired,
-    ...loginBindingFields(registered)
+    ...loginBindingFields(registeredBinding(registered))
   };
-  const mfaEnrolled = await mfaEnrolledForUser(Number(result.userId));
+  const mfaEnrolled = await mfaEnrolledForUser(user.id);
   onAfterCommit5(() => authLoginEvent.emit({
-    userId: result.userId,
+    userId: String(user.id),
     provider: "device",
     email: result.email,
     phone: result.phone,
@@ -13447,16 +13908,19 @@ async function startSession(user, params) {
   });
   await updateLastLoginService(user.id);
   const result = {
+    // A passkey sign-in never steps up: the assertion is already a second
+    // factor, so this answer is always the session itself (#95).
+    mfaRequired: false,
     userId: String(user.id),
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
     passwordChangeRequired: user.passwordChangeRequired,
-    ...loginBindingFields(registered)
+    ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
   onAfterCommit6(() => authLoginEvent.emit({
-    userId: result.userId,
+    userId: String(user.id),
     provider: "passkey",
     email: result.email,
     phone: result.phone,
@@ -13727,7 +14191,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id25) => permissionsRepository.findById(id25))
+      permIds.map((id26) => permissionsRepository.findById(id26))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -13945,20 +14409,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id25, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id25);
+async function cancelInvitation(id26, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id26);
   if (!invitation) {
     throw new NotFoundError4({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id25, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id26, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id25) {
-  await invitationsRepository.deleteById(id25);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id25}`);
+async function deleteInvitation(id26) {
+  await invitationsRepository.deleteById(id26);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id26}`);
 }
 async function expireOldInvitations() {
   const count2 = await invitationsRepository.updateExpiredInvitations();
@@ -13967,8 +14431,8 @@ async function expireOldInvitations() {
   }
   return count2;
 }
-async function resendInvitation(id25, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id25);
+async function resendInvitation(id26, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id26);
   if (!invitation) {
     throw new NotFoundError4({ message: "Invitation not found", resource: "Invitation" });
   }
@@ -13976,7 +14440,7 @@ async function resendInvitation(id25, expiresInDays = 7) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id25, newExpiresAt);
+  const updated = await invitationsRepository.resend(id26, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -14292,8 +14756,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id25) {
-  return registry2.get(id25);
+function getOAuthProvider(id26) {
+  return registry2.get(id26);
 }
 function getRegisteredProviders() {
   return [...registry2.values()];
@@ -15140,12 +15604,32 @@ async function oauthCallbackService(params) {
     channel: "oauth",
     ip: params.ip,
     userAgent: params.userAgent,
-    binding: decideKeyBinding(user?.sessionBinding ?? "none", params.webProxy)
+    binding: decideKeyBinding(user?.sessionBinding ?? "none", params.webProxy),
+    loginEvent: {
+      provider,
+      email: user?.email || void 0,
+      phone: user?.phone || void 0,
+      metadata: stateData.metadata
+    }
   });
-  await updateLastLoginService(userId);
   const appUrl = env17.NEXT_PUBLIC_SPFN_APP_URL || env17.SPFN_APP_URL;
   const callbackPath = env17.SPFN_AUTH_OAUTH_SUCCESS_URL || "/auth/callback";
   const callbackUrl = callbackPath.startsWith("http") ? callbackPath : `${appUrl}${callbackPath}`;
+  const returnUrl = isSafeReturnPath(stateData.returnUrl) ? stateData.returnUrl : "/";
+  if (registered.pending) {
+    return {
+      redirectUrl: buildRedirectUrl(callbackUrl, {
+        mfaChallenge: registered.challenge.secret,
+        returnUrl,
+        isNewUser: String(isNewUser)
+      }),
+      userId: String(userId),
+      keyId: stateData.keyId,
+      isNewUser,
+      mfaChallenge: registered.challenge.secret
+    };
+  }
+  await updateLastLoginService(userId);
   const redirectUrl = buildRedirectUrl(callbackUrl, {
     userId: String(userId),
     keyId: stateData.keyId,
@@ -15153,7 +15637,7 @@ async function oauthCallbackService(params) {
     // where it was sealed. Checking it again costs one comparison and keeps a
     // destination that leaves the app out of the callback URL no matter which
     // seam sealed it.
-    returnUrl: isSafeReturnPath(stateData.returnUrl) ? stateData.returnUrl : "/",
+    returnUrl,
     isNewUser: String(isNewUser),
     // The callback page and `createOAuthCallbackHandler` are the two seams
     // that seal a session out of this redirect, and neither calls a route
@@ -15395,7 +15879,13 @@ async function persistNativeLogin(identity, params) {
       isNewUser = result.isNewUser;
     }
     await assertActiveForOAuthSession(userId);
-    await registerPublicKeyService({
+    const eventPayload = {
+      userId: String(userId),
+      provider: params.provider,
+      email: identity.email || void 0,
+      metadata: params.metadata
+    };
+    const registered = await registerPublicKeyService({
       userId,
       keyId: params.keyId,
       publicKey: params.publicKey,
@@ -15405,18 +15895,16 @@ async function persistNativeLogin(identity, params) {
       platform: params.platform,
       channel: "oauth-native",
       ip: params.ip,
-      userAgent: params.userAgent
+      userAgent: params.userAgent,
+      loginEvent: { provider: params.provider, email: identity.email || void 0, metadata: params.metadata }
     });
+    if (registered.pending) {
+      return { mfaRequired: true, challenge: registered.challenge };
+    }
     await updateLastLoginService(userId);
-    const eventPayload = {
-      userId: String(userId),
-      provider: params.provider,
-      email: identity.email || void 0,
-      metadata: params.metadata
-    };
     const mfaEnrolled = isNewUser ? false : await mfaEnrolledForUser(userId);
     onAfterCommit7(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
-    return { userId: String(userId), keyId: params.keyId, isNewUser };
+    return { mfaRequired: false, userId: String(userId), keyId: params.keyId, isNewUser };
   }, { context: "auth:oauth-native" });
 }
 
@@ -15465,8 +15953,8 @@ async function verifyOpsTokenService(token) {
     scopes: record.scopes
   };
 }
-async function revokeOpsTokenService(id25) {
-  return await opsTokensRepository.revokeById(id25);
+async function revokeOpsTokenService(id26) {
+  return await opsTokensRepository.revokeById(id26);
 }
 async function listOpsTokensService() {
   return await opsTokensRepository.list();
@@ -16324,13 +16812,16 @@ async function finishSessionRenewService(params) {
     replacesKeyId: key.keyId
   });
   return {
+    // A renewal replaces the key of a device that is already signed in, so
+    // it is a rotation rather than an arrival and never steps up (#95).
+    mfaRequired: false,
     keyId: params.keyId,
     userId: String(user.id),
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
     passwordChangeRequired: user.passwordChangeRequired,
-    ...loginBindingFields(registered)
+    ...loginBindingFields(registeredBinding(registered))
   };
 }
 async function admitForRenewal(expiredKeyId) {
@@ -16579,7 +17070,8 @@ var login = route.post("/_auth/login").input({
   })
 }).use([rateLimitPolicy("auth-login", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  return await loginService({ ...body, ...deviceProvenance(c.raw) });
+  const result = await loginService({ ...body, ...deviceProvenance(c.raw) });
+  return result.mfaRequired ? c.accepted(result) : result;
 });
 var startDeviceAuth = route.post("/_auth/device/start").input({
   // Bounded, unlike the interceptor bodies the authenticated enrolment
@@ -16820,7 +17312,8 @@ var completePasswordReset = route2.post("/_auth/password/reset/complete").input(
   })
 }).use([rateLimitPolicy2("auth-password-reset-complete", { limit: 10, windowMs: 6e4 }), Transactional2()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  return await completePasswordResetService({ ...body, ...deviceProvenance(c.raw) });
+  const result = await completePasswordResetService({ ...body, ...deviceProvenance(c.raw) });
+  return result.mfaRequired ? c.accepted(result) : result;
 });
 
 // src/server/routes/auth/revoke-all-link.ts
@@ -16916,6 +17409,36 @@ var mfaStatus = route4.get("/_auth/mfa/status").handler(async (c) => {
   const { userId } = getAuth(c);
   return await mfaStatusService(Number(userId));
 });
+var CHALLENGE_LIMIT = { limit: 10, windowMs: 6e4 };
+var ChallengeSchema = Type.String({
+  minLength: 16,
+  maxLength: 256,
+  description: "The challenge secret from the 202 sign-in answer or the OAuth callback query"
+});
+var mfaVerify = route4.post("/_auth/mfa/verify").input({
+  body: Type.Object({
+    challenge: ChallengeSchema,
+    code: Type.Optional(TotpCodeSchema),
+    recoveryCode: Type.Optional(RecoveryCodeSchema),
+    response: Type.Optional(AssertionSchema)
+  })
+}).use([rateLimitPolicy4("auth-mfa-verify", CHALLENGE_LIMIT)]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await verifyMfaChallengeService({
+    challenge: body.challenge,
+    code: body.code,
+    recoveryCode: body.recoveryCode,
+    response: body.response
+  });
+});
+var mfaVerifyOptions = route4.post("/_auth/mfa/verify/options").input({
+  body: Type.Object({
+    challenge: ChallengeSchema
+  })
+}).use([rateLimitPolicy4("auth-mfa-verify", CHALLENGE_LIMIT)]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await startMfaChallengeAssertionService(body.challenge);
+});
 var mfaStepUp = route4.post("/_auth/mfa/step-up").input({
   body: Type.Object({
     code: Type.Optional(TotpCodeSchema),
@@ -17035,13 +17558,13 @@ var CanonicalJsonError = class extends Error {
 var INT64_MIN = -(2n ** 63n);
 var INT64_MAX = 2n ** 63n - 1n;
 function parseCanonicalJson(bytes) {
-  let text26;
+  let text27;
   try {
-    text26 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text27 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new CanonicalJsonError("INVALID_UTF8");
   }
-  const parser = new Parser(text26);
+  const parser = new Parser(text27);
   const value = parser.parseValue();
   parser.skipWhitespace();
   if (!parser.atEnd()) {
@@ -17062,8 +17585,8 @@ function isCanonicalBytes(bytes, value) {
   return true;
 }
 var Parser = class {
-  constructor(text26) {
-    this.text = text26;
+  constructor(text27) {
+    this.text = text27;
   }
   pos = 0;
   atEnd() {
@@ -17653,8 +18176,8 @@ var CORE_PREREQUISITE_OPERATIONS = [
 
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.12.0";
-var CONTRACT_SUPPORTED_RANGE = ">=0.12.0 <0.13.0";
+var CONTRACT_VERSION = "0.13.0";
+var CONTRACT_SUPPORTED_RANGE = ">=0.13.0 <0.14.0";
 function required(name, type) {
   return { name, type, optional: false };
 }
@@ -17768,18 +18291,100 @@ var CONTRACT_TYPES = [
       optional("oldKeyId", "string")
     ]
   },
+  /**
+   * The sign-in union, flattened the way the poll union was.
+   *
+   * `mfaRequired` is the discriminant and the only required field; everything
+   * else belongs to one branch. False is a session and carries the five login
+   * fields; true is a 202 carrying `challenge` and nothing else, which the
+   * client spends at `auth.mfa.verify` (#95). This grammar has no union type,
+   * so a required discriminant plus optional fields is the only way to say it
+   * — and the typed web client infers one result type from the same
+   * declaration, so it could not have been a union there either.
+   */
   {
     name: "LoginResponse",
     fields: [
-      required("userId", "string"),
-      required("publicId", "string"),
+      required("mfaRequired", "boolean"),
+      optional("challenge", "MfaChallenge"),
+      optional("userId", "string"),
+      optional("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string"),
+      optional("passwordChangeRequired", "boolean"),
+      optional("sessionBinding", "KeyBinding"),
+      optional("keyExpiresAtMillis", "integer")
+    ]
+  },
+  /**
+   * What a sign-in hands back instead of a session when the account has a
+   * second factor and this device is new to it.
+   *
+   * `secret` is the challenge itself, returned once. The server stores only its
+   * hash and addresses the row by that, so this value is not recoverable from
+   * the database and is not a bearer credential for anything but the one
+   * `auth.mfa.verify` call it belongs to.
+   */
+  {
+    name: "MfaChallenge",
+    fields: [
+      required("secret", "string"),
+      required("expiresAtMillis", "integer")
+    ]
+  },
+  /**
+   * Exactly one of `code` and `recoveryCode`, beside the challenge.
+   *
+   * The third form the server accepts — an assertion from a passkey the owner
+   * marked as a second factor — is not declared: a WebAuthn assertion is a
+   * nested browser object outside this grammar, and the passkey ceremonies are
+   * not on this surface for the same reason.
+   */
+  {
+    name: "MfaVerifyRequest",
+    fields: [
+      required("challenge", "string"),
+      optional("code", "string"),
+      optional("recoveryCode", "string")
+    ]
+  },
+  /**
+   * The sign-in the challenge was standing in for, plus what the proxy needs.
+   *
+   * `mfaRequired` is false on every 200 here — the step-up just happened — and
+   * it is carried so the body is the same `LoginResponse` shape a direct
+   * sign-in answers. `keyId` and `challengeHash` are for the Next.js proxy: it
+   * seals a session only when both match the pending cookie it baked at the
+   * 202, which is what stops a cookie from one flow sealing a session for
+   * another's key.
+   */
+  {
+    name: "MfaVerifyResponse",
+    fields: [
+      required("mfaRequired", "boolean"),
+      required("keyId", "string"),
+      required("challengeHash", "string"),
+      optional("userId", "string"),
+      optional("publicId", "string"),
       optional("email", "string"),
       optional("phone", "string"),
-      required("passwordChangeRequired", "boolean"),
+      optional("passwordChangeRequired", "boolean"),
       optional("sessionBinding", "KeyBinding"),
       optional("keyExpiresAtMillis", "integer")
     ]
   },
+  /**
+   * What the account has enrolled. No secret, no otpauth URI, no recovery code
+   * — only the counts and names an account screen renders.
+   */
+  {
+    name: "MfaStatusResponse",
+    fields: [
+      required("enrolled", "boolean"),
+      required("methods", "array<MfaMethod>"),
+      required("recoveryCodesRemaining", "integer")
+    ]
+  },
   {
     name: "OauthNativeRequest",
     fields: [
@@ -17792,12 +18397,20 @@ var CONTRACT_TYPES = [
       required("algorithm", "KeyAlgorithm")
     ]
   },
+  /**
+   * Flattened on the same terms as `LoginResponse`: a native social sign-in on
+   * an enrolled account and a device it has not seen answers 202 with a
+   * challenge rather than a key, so the discriminant is required and the three
+   * login fields are the false branch.
+   */
   {
     name: "OauthNativeResponse",
     fields: [
-      required("userId", "string"),
-      required("keyId", "string"),
-      required("isNewUser", "boolean")
+      required("mfaRequired", "boolean"),
+      optional("challenge", "MfaChallenge"),
+      optional("userId", "string"),
+      optional("keyId", "string"),
+      optional("isNewUser", "boolean")
     ]
   },
   {
@@ -17915,6 +18528,7 @@ var CONTRACT_TYPES = [
     fields: [
       required("status", "DeviceAuthPollStatus"),
       optional("intervalMillis", "integer"),
+      optional("mfaRequired", "boolean"),
       optional("userId", "string"),
       optional("publicId", "string"),
       optional("email", "string"),
@@ -17963,7 +18577,12 @@ var CONTRACT_ENUMS = [
   { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] },
   { name: "KeyPlatform", values: [...KEY_PLATFORM] },
   { name: "KeyBinding", values: [...SESSION_BINDINGS] },
-  { name: "DeviceAuthPollStatus", values: ["pending", "approved"] }
+  { name: "DeviceAuthPollStatus", values: ["pending", "approved"] },
+  // The two things an account screen can show as enrolled. `recovery` is a
+  // verification method but never a method the account *has* — a recovery code
+  // is what is left when the authenticator is not to hand, so `mfa/status`
+  // reports it as a count and not as a factor.
+  { name: "MfaMethod", values: ["totp", "passkey"] }
 ];
 var BUNDLE_FILENAME = "spfn-mobile-contract.json";
 var BUNDLE_REPO_PATH = `contracts/mobile/${BUNDLE_FILENAME}`;
@@ -19043,8 +19662,8 @@ function bearerOf(header) {
 function chain(handlers) {
   return async (c, next) => {
     let answer;
-    const runFrom = async (index20) => {
-      const produced = index20 < handlers.length ? await handlers[index20](c, () => runFrom(index20 + 1)) : await next();
+    const runFrom = async (index21) => {
+      const produced = index21 < handlers.length ? await handlers[index21](c, () => runFrom(index21 + 1)) : await next();
       if (produced instanceof Response) {
         answer = produced;
       }
@@ -19653,8 +20272,13 @@ var getGoogleOAuthUrl = route10.post("/_auth/oauth/google/url").input({
 });
 var oauthFinalize = route10.post("/_auth/oauth/finalize").input({
   body: Type.Object({
-    userId: Type.String({ description: "User ID from OAuth callback" }),
-    keyId: Type.String({ description: "Key ID from OAuth state" }),
+    userId: Type.Optional(Type.String({ description: "User ID from OAuth callback" })),
+    keyId: Type.Optional(Type.String({ description: "Key ID from OAuth state" })),
+    mfaChallenge: Type.Optional(Type.String({
+      minLength: 16,
+      maxLength: 256,
+      description: "Second-factor challenge from the callback query, when the callback carried one"
+    })),
     returnUrl: Type.Optional(Type.String({ description: "URL to redirect after login" }))
   })
 }).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
@@ -19662,8 +20286,20 @@ var oauthFinalize = route10.post("/_auth/oauth/finalize").input({
   if (body.returnUrl && !isSafeReturnPath(body.returnUrl)) {
     throw new ValidationError17({ message: "returnUrl must be a relative path within the app" });
   }
+  if (body.mfaChallenge) {
+    return c.accepted({
+      success: true,
+      mfaRequired: true,
+      challenge: body.mfaChallenge,
+      returnUrl: body.returnUrl || "/"
+    });
+  }
+  if (!body.userId || !body.keyId) {
+    throw new ValidationError17({ message: "userId and keyId are required unless mfaChallenge is sent" });
+  }
   return {
     success: true,
+    mfaRequired: false,
     userId: body.userId,
     keyId: body.keyId,
     returnUrl: body.returnUrl || "/",
@@ -19784,7 +20420,8 @@ var oauthNative = route10.post("/_auth/oauth/:provider/native").input({
   by: byIpAndIdToken({ ipLimit: 20 })
 })]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
-  return await oauthNativeService({ provider: params.provider, ...body, ...deviceProvenance(c.raw) });
+  const result = await oauthNativeService({ provider: params.provider, ...body, ...deviceProvenance(c.raw) });
+  return result.mfaRequired ? c.accepted(result) : result;
 });
 async function collectUnlinkNotifyFields(raw) {
   const fields = { ...raw.req.query() };
@@ -20258,6 +20895,8 @@ var mainAuthRouter = defineRouter6({
   mfaStatus,
   mfaStepUp,
   mfaStepUpOptions,
+  mfaVerify,
+  mfaVerifyOptions,
   logout,
   rotateKey,
   listKeys,
@@ -20804,8 +21443,9 @@ var DEFAULT_MFA_SWEEP_CRON = "0 7 * * *";
 function createMfaSweepJob(cronExpression = DEFAULT_MFA_SWEEP_CRON) {
   return job5("auth.mfa.sweep").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
     const { deleted } = await sweepUnconfirmedMfaService();
-    if (deleted > 0) {
-      authLogger.service.info("[auth.mfa.sweep] sweep complete", { deleted });
+    const { deleted: challenges } = await sweepMfaChallengesService();
+    if (deleted > 0 || challenges > 0) {
+      authLogger.service.info("[auth.mfa.sweep] sweep complete", { deleted, challenges });
     }
   });
 }
@@ -20859,8 +21499,11 @@ export {
   KeyRevokeAllTokensRepository,
   KeysRepository,
   MAX_UNGRANTED_CLIENTS_PER_IP,
+  MFA_CHALLENGE_ATTEMPT_LIMIT,
+  MFA_CHALLENGE_CHANNELS,
   MFA_CONFIRM_ATTEMPT_LIMIT,
   MFA_VERIFICATION_METHODS,
+  MfaChallengesRepository,
   MfaEnrolmentRepository,
   MfaRecoveryCodesRepository,
   MfaTotpRepository,
@@ -20925,6 +21568,7 @@ export {
   assertPasskeyConfig,
   assertRecentAuthentication,
   assertStepUp,
+  attemptSecondFactor,
   authDeletionCancelledEvent,
   authDeletionCompletedEvent,
   authDeletionRequestedEvent,
@@ -21092,6 +21736,8 @@ export {
   matchOAuthCsrfCookies,
   matchesCsrfToken,
   matchesRegisteredRedirectUri,
+  mfaChallenges,
+  mfaChallengesRepository,
   mfaEnrolledForUser,
   mfaEnrolmentRepository,
   mfaRecoveryCodes,
@@ -21122,6 +21768,7 @@ export {
   oauthUnlinkNotifyService,
   oauthUnlinkedEvent,
   oneTimeTokenAuth,
+  openStepUpChallengeService,
   opsOrUser,
   opsTokenAuth,
   opsTokens,
@@ -21149,6 +21796,7 @@ export {
   registerOAuthProvider,
   registerPublicKeyService,
   registerService,
+  registeredBinding,
   removePermissionFromRole,
   renamePasskeyService,
   requestAccountDeletionService,
@@ -21163,6 +21811,7 @@ export {
   resendInvitation,
   resolveAuthenticatedUser,
   resolveIssuerSource,
+  resumeStepUpChallengeService,
   revokeAllKeysService,
   revokeAllOAuth2GrantsForUser,
   revokeKeyService,
@@ -21191,6 +21840,7 @@ export {
   signupLinkTokensRepository,
   socialAccountsRepository,
   startDeviceAuthService,
+  startMfaChallengeAssertionService,
   startPasskeyEnrollmentService,
   startPasskeyLoginService,
   startSessionBindingDisableService,
@@ -21199,6 +21849,7 @@ export {
   startTotpEnrolmentService,
   stepUpService,
   sweepDuePurges,
+  sweepMfaChallengesService,
   sweepUnconfirmedMfaService,
   toEpochSeconds,
   unsealSession,
@@ -21226,6 +21877,7 @@ export {
   verifyCodeService,
   verifyIdToken,
   verifyKeyFingerprint,
+  verifyMfaChallengeService,
   verifyOAuthState,
   verifyOneTimeTokenService,
   verifyOpsTokenService,