@spfn/auth 0.3.0-beta.26 → 0.3.0-beta.28

package/dist/{machine-principals-CdEgxOB1.d.ts → machine-principals-B0bjs-0K.d.ts}

@@ -1,6 +1,6 @@
-import { S as SessionBindingType, K as KeyAlgorithmType, h as KeyPlatformType, l as SocialProvider } from './types-CTdoTOxM.js';
 import * as _simplewebauthn_server from '@simplewebauthn/server';
-import { RegistrationResponseJSON, AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
+import { AuthenticationResponseJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';
+import { S as SessionBindingType, K as KeyAlgorithmType, h as KeyPlatformType, l as SocialProvider } from './types-CTdoTOxM.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
@@ -10,85 +10,283 @@ import { Context } from 'hono';
 import { User } from '@spfn/auth/server';
 
 /**
- * Role information for client/API responses
- */
-interface Role {
-    id: number;
-    name: string;
-    displayName: string;
-    description: string | null;
-    isBuiltin: boolean;
-    isSystem: boolean;
-    isActive: boolean;
-    priority: number;
-    createdAt: Date;
-    updatedAt: Date;
-}
-/**
- * Permission information for client/API responses
+ * @spfn/auth - Passkeys Entity
+ *
+ * A WebAuthn credential the account owner enrolled on one of their devices.
+ * It is a *credential*, not a session: an assertion proves who is asking, and
+ * the ordinary device key in `user_public_keys` is what the request afterwards
+ * is signed with. The two tables therefore never stand in for each other.
+ *
+ * Nothing here is a bearer value, so nothing is hashed. `publicKey` is public by
+ * construction and `credentialId` is a handle the authenticator hands to any
+ * origin that asks — storing either in the clear costs nothing, and the lookup
+ * on `credentialId` has to be a plain equality match on an indexed column.
+ *
+ * Revocation is soft, and `credentialId` stays unique across live and revoked
+ * rows alike: a credential someone cut off must never become enrollable again,
+ * on this account or on another one.
  */
-interface Permission {
-    id: number;
-    name: string;
-    displayName: string;
-    description: string | null;
-    category: string | null;
-    isBuiltin: boolean;
-    isSystem: boolean;
-    isActive: boolean;
-    metadata: Record<string, any> | null;
-    createdAt: Date;
-    updatedAt: Date;
-}
-interface AuthSession {
-    userId: number;
-    publicId: string;
-    email: string | null;
-    emailVerified: boolean;
-    phoneVerified: boolean;
-    hasPassword: boolean;
-    role: Role;
-    permissions: Permission[];
-}
-interface ProfileInfo {
-    profileId: number;
-    displayName: string | null;
-    firstName: string | null;
-    lastName: string | null;
-    avatarUrl: string | null;
-    bio: string | null;
-    locale: string;
-    timezone: string;
-    website: string | null;
-    location: string | null;
-    company: string | null;
-    jobTitle: string | null;
-    metadata: Record<string, any> | null;
-    createdAt: Date;
-    updatedAt: Date;
-}
 /**
- * User Profile Response
- *
- * Complete user data including:
- * - User fields at top level (userId, email, etc.)
- * - Profile data as nested field (optional)
+ * Whether the credential can leave the authenticator that minted it.
  *
- * Excludes:
- * - Role and permissions (use auth session API)
+ * `multiDevice` is a synced passkey (iCloud Keychain, Google Password Manager);
+ * `singleDevice` is bound to one authenticator. Reported by the authenticator at
+ * enrollment and shown in the management list, because "this one is only on that
+ * phone" is what the owner needs to know before revoking the other entry.
  */
-interface UserProfile {
-    userId: number;
-    publicId: string;
-    email: string | null;
-    username: string | null;
-    emailVerified: boolean;
-    phoneVerified: boolean;
-    lastLoginAt: Date | null;
-    createdAt: Date;
-    updatedAt: Date;
-    profile: ProfileInfo | null;
-}
+declare const PASSKEY_DEVICE_TYPES: readonly ["singleDevice", "multiDevice"];
+type PasskeyDeviceType = typeof PASSKEY_DEVICE_TYPES[number];
+/** How long a label may be — the key list's `deviceName` bound, for the same reason. */
+declare const PASSKEY_LABEL_MAX_LENGTH = 64;
+declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "passkeys";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        credentialId: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        counter: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        transports: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        deviceType: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["singleDevice", "multiDevice"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string enum";
+            data: "singleDevice" | "multiDevice";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["singleDevice", "multiDevice"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        backedUp: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        aaguid: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        label: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        secondFactor: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type Passkey = typeof passkeys.$inferSelect;
+type NewPasskey = typeof passkeys.$inferInsert;
 
 /**
  * @spfn/auth - What a sign-in answers with
@@ -218,31 +416,119 @@ interface ChangePasswordParams {
      * adds no refusal for anybody who has not opted in.
      */
     keyId: string;
-    currentPassword?: string;
-    newPassword: string;
-    passwordHash?: string;
+    currentPassword?: string;
+    newPassword: string;
+    passwordHash?: string;
+}
+/**
+ * Register a new user account
+ */
+declare function registerService(params: RegisterParams): Promise<RegisterResult>;
+/**
+ * Authenticate user and create session
+ */
+declare function loginService(params: LoginParams): Promise<LoginResult>;
+/**
+ * Logout user (revoke current key)
+ */
+declare function logoutService(params: LogoutParams): Promise<void>;
+/**
+ * Change user password
+ *
+ * An enrolled account steps up first (#95): a stolen session must not be able
+ * to take the account over by setting a new password. An unenrolled account is
+ * unaffected — including the OAuth-only account with no password and a key
+ * older than ten minutes, which still sets a first password and gets a 200.
+ */
+declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
+
+/**
+ * @spfn/auth - Session Renewal Service
+ *
+ * What a bound session does when its key runs out: prove, with a fresh WebAuthn
+ * assertion, that the person who enrolled the passkey is still at the machine,
+ * and get a new short-lived key sealed into the cookie.
+ *
+ * Neither step is public. The expiring key is named by `expiredKeyId`, and that
+ * value reaches the service from `authenticateForRenewal` — the `keyId` of a
+ * bearer JWT this very key signed — rather than from the request body, so a
+ * caller who does not hold the private half cannot name a key at all. The
+ * assertion still has to be signed by a passkey that key's owner enrolled: the
+ * signature proves the cookie, and the cookie is the thing that may have been
+ * copied.
+ *
+ * The admission below is run again here all the same. The middleware and the
+ * service ask the same four questions of the row, and a service that trusted its
+ * caller to have asked them would be one refactor away from not being asked at
+ * all.
+ *
+ * Every refusal is the same refusal. A key that never existed, a stranger's key,
+ * an unbound key, a revoked one, one past its grace, an inactive account, a spent
+ * challenge, an assertion that did not verify — all `SessionRenewalRefusedError`,
+ * with the same body, because anything finer would answer "is this key id live"
+ * to whoever asked.
+ *
+ * Renewal announces nothing. No `auth.login`, no `auth.device.registered`, and
+ * `lastLoginAt` does not move: this is the same person on the same device
+ * continuing the session they already had, and a subscriber mailing "new sign-in"
+ * once a day per device would train its reader to ignore the notice that matters.
+ * A `lastLoginAt` that moved every day would make dormant-account detection
+ * meaningless for exactly the accounts that turned this protection on.
+ */
+
+interface StartSessionRenewParams {
+    /** The key that ran out, read off the JWT the request was signed with. */
+    expiredKeyId: string;
+}
+interface FinishSessionRenewParams extends StartSessionRenewParams {
+    /** The assertion, from `navigator.credentials.get()`. */
+    response: AuthenticationResponseJSON;
+    /**
+     * The new key pair, in the vocabulary the Next.js login interceptor already
+     * writes: `renew/verify` is on that interceptor's path list, so these arrive
+     * exactly as they do on a login.
+     */
+    keyId: string;
+    publicKey: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
 }
 /**
- * Register a new user account
- */
-declare function registerService(params: RegisterParams): Promise<RegisterResult>;
-/**
- * Authenticate user and create session
+ * What a completed renewal answers: a sign-in result, plus the new key's id.
+ *
+ * The id is the one thing a renewal has that a sign-in does not need to say —
+ * `renewSession()` promises it to the app, which has no other way to learn it
+ * (the key pair is minted in the proxy and the private half never leaves the
+ * cookie). It is not a contract operation, so nothing generated reads it.
  */
-declare function loginService(params: LoginParams): Promise<LoginResult>;
+interface SessionRenewResult extends LoginResult {
+    /** The key this renewal registered, the one the session now signs with. */
+    keyId: string;
+}
 /**
- * Logout user (revoke current key)
+ * Step 1 — the challenge the authenticator signs.
+ *
+ * `allowCredentials` is empty and the account lives only on the challenge row.
+ * See `startRenewalCeremonyService`.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없는 키·계정일 때 (모든 사유 동일)
  */
-declare function logoutService(params: LogoutParams): Promise<void>;
+declare function startSessionRenewService(params: StartSessionRenewParams): Promise<PublicKeyCredentialRequestOptionsJSON>;
 /**
- * Change user password
+ * Step 2 — verify the assertion, put a new bound key in place of the old one.
  *
- * An enrolled account steps up first (#95): a stolen session must not be able
- * to take the account over by setting a new password. An unenrolled account is
- * unaffected — including the OAuth-only account with no password and a key
- * older than ten minutes, which still sets a first password and gets a 200.
+ * The revocation runs first and its answer is the race winner: two verifies that
+ * both got past their own challenges meet at the same conditional UPDATE, and
+ * only the one that actually revoked the key goes on to register a replacement.
+ *
+ * The new key inherits the old row's provenance, so the device list keeps saying
+ * where this device first appeared rather than re-stamping itself every day. Its
+ * expiry is a fresh window from now — renewal is a renewal, not an extension of
+ * what the old key had.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없을 때 (증명 실패 포함, 모든 사유 동일)
  */
-declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
+declare function finishSessionRenewService(params: FinishSessionRenewParams): Promise<SessionRenewResult>;
 
 declare const EmailSchema: _sinclair_typebox.TString;
 declare const PhoneSchema: _sinclair_typebox.TString;
@@ -289,6 +575,15 @@ declare const FingerprintSchema: _sinclair_typebox.TString;
  * out the format — `USER_CODE_ALPHABET` is the only thing that can match a row.
  */
 declare const UserCodeSchema: _sinclair_typebox.TString;
+/**
+ * The issuer's handle on a device link, as `issue` returned it.
+ *
+ * A UUID today; bounded rather than patterned so the handle's format stays the
+ * server's to change. It authorizes nothing without the issuing key beside it.
+ */
+declare const LinkIdSchema: _sinclair_typebox.TString;
+/** A number the issuer picked from the three `status` showed. */
+declare const MatchChoiceSchema: _sinclair_typebox.TInteger;
 /**
  * What `POST /_auth/device/poll` answers with.
  *
@@ -565,6 +860,41 @@ interface CompletePasswordResetParams {
  */
 declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<LoginResult>;
 
+/**
+ * @spfn/auth - Device Registration Provenance
+ *
+ * What a registering request said about where it came from: the client address
+ * and the `user-agent` header, read once at the top of a route and carried into
+ * the key row so the account owner's device list can say "this one appeared
+ * from there".
+ *
+ * Both values are unauthenticated display material. `getClientIp` is documented
+ * as best-effort keying material and is spoofable on any request that is not
+ * proxy-verified, and a `user-agent` is whatever the caller typed — so nothing
+ * in this package decides anything by either one, and neither is ever compared.
+ */
+
+/** Where a device key registration came from, as the request stated it. */
+interface DeviceProvenance {
+    ip?: string;
+    userAgent?: string;
+    /**
+     * Whether `proxy-guard` recognised this request as the trusted Next.js
+     * proxy's — the one fact here that a caller cannot state about itself.
+     *
+     * The two fields above are what the request claimed; this one is what the
+     * signature check concluded, so it is the only part of the provenance
+     * anything is allowed to decide by. Session binding decides by it: a key can
+     * be bound only on a request that reached the backend through the proxy that
+     * holds the session cookie, because nothing else can run the renewal.
+     *
+     * Optional so that a caller assembling provenance by hand — a test, a job
+     * replaying a request — can leave it out. Absent reads as "not the proxy",
+     * which is the conservative answer: the key is registered unbound.
+     */
+    webProxy?: boolean;
+}
+
 /**
  * @spfn/auth - Device Auth Service
  *
@@ -591,6 +921,12 @@ declare function completePasswordResetService(params: CompletePasswordResetParam
  * refuses the account's live records too, as `denied`, so they land in that row
  * of the table. See `denyAllActiveByUserId`; the three callers are the three
  * places that revoke every key at once.
+ *
+ * A poll may ask to wait (`waitMillis`). `waitForDeviceAuthAnswerService` then
+ * holds a pending record's request — before the route's transaction opens — until
+ * something answers it, the wait runs out, or the device hangs up, and only after
+ * that is the table above applied. A long poll answers exactly what a short poll
+ * sent at the same moment would, only sooner.
  */
 
 interface StartDeviceAuthParams {
@@ -645,10 +981,21 @@ interface PollDeviceAuthParams {
      * to run a WebAuthn ceremony in needs.
      */
     webProxy?: boolean;
+    /**
+     * How long this request already waited on the server, from the long-poll
+     * middleware. A pending answer subtracts it from the interval: the device
+     * has done that much of its waiting here.
+     */
+    waitedMillis?: number;
 }
 /** Nobody has answered yet. Not an error — the waiting device waits. */
 interface DeviceAuthPendingResult {
     status: 'pending';
+    /**
+     * How long to wait before polling again, less what the request already
+     * waited on the server — 0 once a long poll has waited at least the interval,
+     * so the device asks again at once.
+     */
     intervalMillis: number;
 }
 /**
@@ -716,41 +1063,47 @@ declare function denyDeviceAuthService(params: DenyDeviceAuthParams): Promise<vo
 declare function pollDeviceAuthService(params: PollDeviceAuthParams): Promise<PollDeviceAuthResult>;
 
 /**
- * @spfn/auth - Passkeys Entity
+ * @spfn/auth - Device Links Entity
  *
- * A WebAuthn credential the account owner enrolled on one of their devices.
- * It is a *credential*, not a session: an assertion proves who is asking, and
- * the ordinary device key in `user_public_keys` is what the request afterwards
- * is signed with. The two tables therefore never stand in for each other.
+ * Backs device link: the mirror image of device-code login. A device that is
+ * already signed in (the issuer) asks for a short code and shows it; a new
+ * device with no key on file reads it, parks its public key here, and shows a
+ * two-digit match number; the issuer picks that number out of three, and the
+ * new device's next poll registers the parked key under the issuer's account.
  *
- * Nothing here is a bearer value, so nothing is hashed. `publicKey` is public by
- * construction and `credentialId` is a handle the authenticator hands to any
- * origin that asks — storing either in the clear costs nothing, and the lookup
- * on `credentialId` has to be a plain equality match on an indexed column.
+ * A separate table from `device_authorizations` rather than a mode of it. The
+ * two records are owned from opposite ends — a device authorization gains an
+ * account only when someone approves it, a link has one from the moment it is
+ * issued, and is bound to the issuing key as well — and folding them together
+ * would leave every column meaning one thing in one flow and something else in
+ * the other.
  *
- * Revocation is soft, and `credentialId` stays unique across live and revoked
- * rows alike: a credential someone cut off must never become enrollable again,
- * on this account or on another one.
+ * The parked key material duplicates the `user_public_keys` columns for the
+ * reason `device_authorizations` gives: a row there can sign requests, and
+ * nothing here has been confirmed yet.
+ *
+ * Nothing sweeps this table. Rows are judged by `expiresAt` and by the issuing
+ * key on read, so a stale row authorizes nothing.
  */
 /**
- * Whether the credential can leave the authenticator that minted it.
+ * Lifecycle of one device link.
  *
- * `multiDevice` is a synced passkey (iCloud Keychain, Google Password Manager);
- * `singleDevice` is bound to one authenticator. Reported by the authenticator at
- * enrollment and shown in the management list, because "this one is only on that
- * phone" is what the owner needs to know before revoking the other entry.
+ * `issued -> redeemed -> approved -> consumed` is the only path to a registered
+ * key. `denied` is a refusal the new device is told about — the issuer said no,
+ * or picked the wrong number. `expired` is a link its issuer abandoned: a newer
+ * one issued from the same key, a cancel, or a global revocation of the account.
+ * A link whose TTL ran out, or whose issuing key was revoked, is judged expired
+ * on read without the status having to say so.
  */
-declare const PASSKEY_DEVICE_TYPES: readonly ["singleDevice", "multiDevice"];
-type PasskeyDeviceType = typeof PASSKEY_DEVICE_TYPES[number];
-/** How long a label may be — the key list's `deviceName` bound, for the same reason. */
-declare const PASSKEY_LABEL_MAX_LENGTH = 64;
-declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "passkeys";
+declare const DEVICE_LINK_STATUSES: readonly ["issued", "redeemed", "approved", "denied", "consumed", "expired"];
+type DeviceLinkStatus = typeof DEVICE_LINK_STATUSES[number];
+declare const deviceLinks: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "device_links";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -763,9 +1116,9 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -778,9 +1131,9 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -793,9 +1146,39 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        linkId: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userCode: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_links";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        issuerUserId: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "device_links";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
@@ -808,9 +1191,9 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        credentialId: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        issuerKeyId: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -823,13 +1206,13 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        publicKey: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        deviceCodeHash: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "string";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -838,14 +1221,14 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        counter: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
-            dataType: "number int32";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: true;
+            tableName: "device_links";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -853,12 +1236,12 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        transports: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>, {
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "string";
-            data: string[];
-            driverParam: string | string[];
+            data: string;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -868,39 +1251,39 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        deviceType: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["singleDevice", "multiDevice"] & [string, ...string[]]>>, {
+        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
-            dataType: "string enum";
-            data: "singleDevice" | "multiDevice";
+            tableName: "device_links";
+            dataType: "string";
+            data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["singleDevice", "multiDevice"] & [string, ...string[]];
+            enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        backedUp: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        algorithm: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            tableName: "device_links";
+            dataType: "string enum";
+            data: "ES256" | "RS256";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["ES256", "RS256"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
-        aaguid: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -913,39 +1296,84 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        label: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        platform: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
             name: string;
-            tableName: "passkeys";
-            dataType: "string";
-            data: string;
+            tableName: "device_links";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        matchNumber: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgIntegerBuilder, {
+            name: string;
+            tableName: "device_links";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
             enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        secondFactor: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        choices: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgIntegerBuilder, 1>, {
             name: string;
-            tableName: "passkeys";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
+            tableName: "device_links";
+            dataType: "number int32";
+            data: number[];
+            driverParam: string | (string | number)[];
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        status: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["issued", "redeemed", "approved", "denied", "consumed", "expired"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "device_links";
+            dataType: "string enum";
+            data: "expired" | "approved" | "denied" | "consumed" | "issued" | "redeemed";
+            driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
+            enumValues: ["issued", "redeemed", "approved", "denied", "consumed", "expired"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "device_links";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
             enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        redeemedAt: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -958,9 +1386,9 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        approvedAt: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "passkeys";
+            tableName: "device_links";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -973,11 +1401,11 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"device_links", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "passkeys";
-            dataType: "string";
-            data: string;
+            tableName: "device_links";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -991,8 +1419,162 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type Passkey = typeof passkeys.$inferSelect;
-type NewPasskey = typeof passkeys.$inferInsert;
+type DeviceLink = typeof deviceLinks.$inferSelect;
+type NewDeviceLink = typeof deviceLinks.$inferInsert;
+
+/**
+ * @spfn/auth - Device Link Service
+ *
+ * Device link: the mirror image of device-code login. A device that is already
+ * signed in (the issuer) asks for a short code and shows it; a new device with no
+ * key on file reads it, redeems it with its public key, and shows a two-digit
+ * match number; the issuer is shown the device and three numbers, and picks the
+ * one on the new device's screen. The new device's next poll registers its key
+ * under the issuer's account and answers exactly what `loginService` answers —
+ * the same completion device-code login uses, so the two are indistinguishable.
+ *
+ * | state ↓ op → | redeem | status | confirm | deny | cancel | poll |
+ * | --- | --- | --- | --- | --- | --- | --- |
+ * | issued | device parked, → redeemed | issued | NotRedeemed | NotRedeemed | → expired | — |
+ * | redeemed | NotFound | device + choices | match: → approved; else → denied, WrongMatch | → denied | → expired | pending |
+ * | approved | NotFound | approved | AlreadyHandled | AlreadyHandled | AlreadyHandled | key registered, → consumed |
+ * | denied | NotFound | denied | AlreadyHandled | AlreadyHandled | AlreadyHandled | Denied |
+ * | consumed | NotFound | consumed | AlreadyHandled | AlreadyHandled | AlreadyHandled | NotFound |
+ * | dead | Expired | Expired | Expired | Expired | Expired | Expired |
+ * | unknown | NotFound | NotFound | NotFound | NotFound | NotFound | NotFound |
+ *
+ * "Dead" is a link past its TTL, one its issuer cancelled or replaced or a global
+ * revocation expired (status `expired`), and one whose issuing key has since been
+ * revoked or run out — whatever state it was in. Expiry outranks state, with one
+ * exception on the new device's side, for device-code login's reason: a spent
+ * link answers redeem and poll as unknown even once its TTL has run out.
+ *
+ * Status, confirm, deny and cancel belong to the issuing key alone. A link
+ * another key issued — another account's, or another device of the same
+ * account's — answers NotFound to them before anything else is judged, so a
+ * device that did not issue a link cannot learn it exists.
+ *
+ * Both parties can long-poll: the issuer's `status` while the link waits on the
+ * new device (issued, or approved and not yet collected), the new device's `poll`
+ * while it waits on the issuer (redeemed). The waits run before the routes'
+ * transactions open, as device-code login's does, and every transition wakes
+ * both after commit.
+ *
+ * Nothing here logs a user code, a device code, a match number or a key.
+ */
+
+/** The signed-in device a link belongs to, read from the request's principal. Never from a body. */
+interface DeviceLinkIssuer {
+    userId: number;
+    /** The key that signed the request. */
+    keyId: string;
+}
+interface IssueDeviceLinkResult {
+    /** The issuer's handle on the link, for status, confirm, deny and cancel. */
+    linkId: string;
+    /** `XXXX-XXXX`, for the issuer's screen — as text and in the QR the client draws. */
+    userCode: string;
+    /** For the countdown on the issuer's screen. Display only; the server decides by its own clock. */
+    expiresAtMillis: number;
+}
+interface RedeemDeviceLinkParams {
+    userCode: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    /** Device label shown to the issuer. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+}
+interface RedeemDeviceLinkResult {
+    /** Returned once. The new device polls with it; the server stores only its hash. */
+    deviceCode: string;
+    /** The number the new device shows, 10–99, for the issuer to pick out of three. */
+    matchNumber: number;
+    expiresAtMillis: number;
+    /** Milliseconds the new device should wait between polls. */
+    intervalMillis: number;
+}
+interface DeviceLinkParams {
+    linkId: string;
+    issuer: DeviceLinkIssuer;
+}
+interface ConfirmDeviceLinkParams extends DeviceLinkParams {
+    /** The number the issuer picked. */
+    choice: number;
+}
+/**
+ * The issuer's view of its link, which every issuer operation answers with.
+ *
+ * The device fields appear once a device has redeemed the code; `choices` only
+ * while the link waits on the issuer's pick (`redeemed`), since that is the only
+ * moment a number means anything. `expired` is only ever cancel's answer: a
+ * link that is dead when it is asked about answers `DeviceLinkExpiredError`.
+ */
+interface DeviceLinkStatusResult {
+    status: DeviceLinkStatus;
+    expiresAtMillis: number;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /** First bytes of the redeeming key's fingerprint, as the device list truncates it. */
+    fingerprintPrefix?: string;
+    redeemedAtMillis?: number;
+    /** The match and two decoys, in the order drawn at redeem. */
+    choices?: number[];
+}
+interface PollDeviceLinkParams extends DeviceProvenance {
+    deviceCode: string;
+    /** How long this request already waited on the server, from the long-poll middleware. */
+    waitedMillis?: number;
+}
+/**
+ * Issue a link from the signed-in device that asked, replacing any link that
+ * device still has in play — one live link per issuing key, so a screen that was
+ * closed without cancelling leaves nothing behind that a later redeem could use.
+ */
+declare function issueDeviceLinkService(issuer: DeviceLinkIssuer): Promise<IssueDeviceLinkResult>;
+/**
+ * Park a new device's key on the link its code names, and hand back what that
+ * device shows and polls with.
+ *
+ * Public by definition: the caller has no key yet. The code is the only thing it
+ * holds, so every refusal that could tell a guesser the code was real — someone
+ * redeemed it first, it was already used — is the same NotFound as a code never
+ * issued. Only a code that died of age answers Expired, as the state table asks.
+ */
+declare function redeemDeviceLinkService(params: RedeemDeviceLinkParams): Promise<RedeemDeviceLinkResult>;
+/** The issuer asking where its link stands. */
+declare function getDeviceLinkStatusService(params: DeviceLinkParams): Promise<DeviceLinkStatusResult>;
+/**
+ * The issuer picked a number.
+ *
+ * The right one approves the link; any other denies it on the spot, and the
+ * refusal is committed before the error answers — there is no second pick. The
+ * route is not wrapped in `Transactional()` for exactly that reason: a rollback
+ * would undo the denial and hand the issuer another guess.
+ *
+ * The match number is fixed once a link is redeemed, so comparing against the
+ * value read is safe; the transitions still name `redeemed`, so a deny or a
+ * cancel landing in between wins or loses cleanly.
+ */
+declare function confirmDeviceLinkService(params: ConfirmDeviceLinkParams): Promise<DeviceLinkStatusResult>;
+/** The issuer refused the device, so it is told no instead of timing out. */
+declare function denyDeviceLinkService(params: DeviceLinkParams): Promise<DeviceLinkStatusResult>;
+/**
+ * The issuer closed its screen before letting anyone in. The link is expired, so
+ * a device holding its code — or already showing a match number — is told so.
+ */
+declare function cancelDeviceLinkService(params: DeviceLinkParams): Promise<DeviceLinkStatusResult>;
+/**
+ * The new device asking whether the issuer has answered.
+ *
+ * Approved is the one branch with a side effect, and it is device-code login's
+ * one-shot: the link is spent by a conditional update naming `approved` — and the
+ * issuing key, so a link whose issuer signed out after confirming registers
+ * nothing — and of two polls arriving together exactly one registers the key.
+ */
+declare function pollDeviceLinkService(params: PollDeviceLinkParams): Promise<PollDeviceAuthResult>;
 
 /**
  * @spfn/auth - Passkey Service
@@ -1236,7 +1818,7 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "passkey" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device";
+    provider: "passkey" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone" | "device";
     mfaEnrolled: boolean;
 }>;
 /**
@@ -1248,15 +1830,15 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
  * both arrive at `createVerifiedAccount`, so the two name themselves there;
  * `'invitation'` is the one path that stores a key without the key service.
  */
-declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"renewal">]>;
-/** The ten doors a device key is registered through. */
+declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"device-link">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"renewal">]>;
+/** The eleven doors a device key is registered through. */
 type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
 /**
  * auth.device.registered — a new device key was added to an account
  *
  * 발행 시점:
  * - a key row was created for an account and the transaction that created it
- *   committed, on every one of the ten channels above
+ *   committed, on every one of the eleven channels above
  *
  * This is the notice an account owner needs and could not get before: a stolen
  * password used to sign in on a new device was silent, because a login event
@@ -1288,13 +1870,13 @@ declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
     platform?: string | undefined;
     ip?: string | undefined;
     userAgent?: string | undefined;
+    userId: string;
     keyId: string;
     algorithm: string;
-    userId: string;
     mfaEnrolled: boolean;
     fingerprintPrefix: string;
     createdAtMillis: number;
-    channel: "password" | "register" | "passkey" | "oauth-native" | "renewal" | "signup-link" | "invitation" | "oauth" | "device-code" | "password-reset";
+    channel: "passkey" | "renewal" | "register" | "signup-link" | "invitation" | "password" | "oauth" | "oauth-native" | "device-code" | "device-link" | "password-reset";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -1317,7 +1899,7 @@ declare const authRegisterEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
 }>;
 /**
  * auth.invitation.created - 초대 생성 이벤트
@@ -1344,11 +1926,11 @@ declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     email: string;
-    token: string;
-    expiresAt: string;
     roleId: number;
-    invitedBy: string;
+    expiresAt: string;
     invitationId: string;
+    token: string;
+    invitedBy: string;
     isResend: boolean;
 }>;
 /**
@@ -1368,11 +1950,11 @@ declare const invitationAcceptedEvent: _spfn_core_event.EventDef<{
     metadata?: {
         [x: string]: unknown;
     } | undefined;
-    email: string;
     userId: string;
+    email: string;
     roleId: number;
-    invitedBy: string;
     invitationId: string;
+    invitedBy: string;
 }>;
 /**
  * auth.deletion.requested - 계정 탈퇴 요청 이벤트
@@ -1391,7 +1973,7 @@ declare const authDeletionRequestedEvent: _spfn_core_event.EventDef<{
     userId: string;
     purgeScheduledAt: string;
     userPublicId: string;
-    requestedBy: "admin" | "self";
+    requestedBy: "self" | "admin";
 }>;
 /**
  * auth.deletion.cancelled - 계정 탈퇴 복구 이벤트
@@ -1436,7 +2018,7 @@ declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
 declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
     reason?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
     providerUserId: string;
 }>;
 /**
@@ -1458,8 +2040,8 @@ declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
  * ```
  */
 declare const authPasswordResetEvent: _spfn_core_event.EventDef<{
-    email: string;
     userId: string;
+    email: string;
 }>;
 /**
  * Auth event payload types
@@ -1607,7 +2189,7 @@ declare const mfaChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "mfa_challenges";
             dataType: "string enum";
-            data: "password" | "oauth-native" | "oauth" | "password-reset";
+            data: "password" | "oauth" | "oauth-native" | "password-reset";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -3094,94 +3676,6 @@ declare function disableSessionBindingService(params: DisableSessionBindingParam
 /** The challenge the disabling ceremony signs. Same ceremony renewal uses. */
 declare function startSessionBindingDisableService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
 
-/**
- * @spfn/auth - Session Renewal Service
- *
- * What a bound session does when its key runs out: prove, with a fresh WebAuthn
- * assertion, that the person who enrolled the passkey is still at the machine,
- * and get a new short-lived key sealed into the cookie.
- *
- * Neither step is public. The expiring key is named by `expiredKeyId`, and that
- * value reaches the service from `authenticateForRenewal` — the `keyId` of a
- * bearer JWT this very key signed — rather than from the request body, so a
- * caller who does not hold the private half cannot name a key at all. The
- * assertion still has to be signed by a passkey that key's owner enrolled: the
- * signature proves the cookie, and the cookie is the thing that may have been
- * copied.
- *
- * The admission below is run again here all the same. The middleware and the
- * service ask the same four questions of the row, and a service that trusted its
- * caller to have asked them would be one refactor away from not being asked at
- * all.
- *
- * Every refusal is the same refusal. A key that never existed, a stranger's key,
- * an unbound key, a revoked one, one past its grace, an inactive account, a spent
- * challenge, an assertion that did not verify — all `SessionRenewalRefusedError`,
- * with the same body, because anything finer would answer "is this key id live"
- * to whoever asked.
- *
- * Renewal announces nothing. No `auth.login`, no `auth.device.registered`, and
- * `lastLoginAt` does not move: this is the same person on the same device
- * continuing the session they already had, and a subscriber mailing "new sign-in"
- * once a day per device would train its reader to ignore the notice that matters.
- * A `lastLoginAt` that moved every day would make dormant-account detection
- * meaningless for exactly the accounts that turned this protection on.
- */
-
-interface StartSessionRenewParams {
-    /** The key that ran out, read off the JWT the request was signed with. */
-    expiredKeyId: string;
-}
-interface FinishSessionRenewParams extends StartSessionRenewParams {
-    /** The assertion, from `navigator.credentials.get()`. */
-    response: AuthenticationResponseJSON;
-    /**
-     * The new key pair, in the vocabulary the Next.js login interceptor already
-     * writes: `renew/verify` is on that interceptor's path list, so these arrive
-     * exactly as they do on a login.
-     */
-    keyId: string;
-    publicKey: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-}
-/**
- * What a completed renewal answers: a sign-in result, plus the new key's id.
- *
- * The id is the one thing a renewal has that a sign-in does not need to say —
- * `renewSession()` promises it to the app, which has no other way to learn it
- * (the key pair is minted in the proxy and the private half never leaves the
- * cookie). It is not a contract operation, so nothing generated reads it.
- */
-interface SessionRenewResult extends LoginResult {
-    /** The key this renewal registered, the one the session now signs with. */
-    keyId: string;
-}
-/**
- * Step 1 — the challenge the authenticator signs.
- *
- * `allowCredentials` is empty and the account lives only on the challenge row.
- * See `startRenewalCeremonyService`.
- *
- * @throws SessionRenewalRefusedError 갱신할 수 없는 키·계정일 때 (모든 사유 동일)
- */
-declare function startSessionRenewService(params: StartSessionRenewParams): Promise<PublicKeyCredentialRequestOptionsJSON>;
-/**
- * Step 2 — verify the assertion, put a new bound key in place of the old one.
- *
- * The revocation runs first and its answer is the race winner: two verifies that
- * both got past their own challenges meet at the same conditional UPDATE, and
- * only the one that actually revoked the key goes on to register a replacement.
- *
- * The new key inherits the old row's provenance, so the device list keeps saying
- * where this device first appeared rather than re-stamping itself every day. Its
- * expiry is a fresh window from now — renewal is a renewal, not an extension of
- * what the old key had.
- *
- * @throws SessionRenewalRefusedError 갱신할 수 없을 때 (증명 실패 포함, 모든 사유 동일)
- */
-declare function finishSessionRenewService(params: FinishSessionRenewParams): Promise<SessionRenewResult>;
-
 /**
  * What `POST /_auth/oauth/finalize` answers with, in both of its branches.
  *
@@ -3203,6 +3697,87 @@ interface OAuthFinalizeResponse {
     keyExpiresAtMillis?: number;
 }
 
+/**
+ * Role information for client/API responses
+ */
+interface Role {
+    id: number;
+    name: string;
+    displayName: string;
+    description: string | null;
+    isBuiltin: boolean;
+    isSystem: boolean;
+    isActive: boolean;
+    priority: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * Permission information for client/API responses
+ */
+interface Permission {
+    id: number;
+    name: string;
+    displayName: string;
+    description: string | null;
+    category: string | null;
+    isBuiltin: boolean;
+    isSystem: boolean;
+    isActive: boolean;
+    metadata: Record<string, any> | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+interface AuthSession {
+    userId: number;
+    publicId: string;
+    email: string | null;
+    emailVerified: boolean;
+    phoneVerified: boolean;
+    hasPassword: boolean;
+    role: Role;
+    permissions: Permission[];
+}
+interface ProfileInfo {
+    profileId: number;
+    displayName: string | null;
+    firstName: string | null;
+    lastName: string | null;
+    avatarUrl: string | null;
+    bio: string | null;
+    locale: string;
+    timezone: string;
+    website: string | null;
+    location: string | null;
+    company: string | null;
+    jobTitle: string | null;
+    metadata: Record<string, any> | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * User Profile Response
+ *
+ * Complete user data including:
+ * - User fields at top level (userId, email, etc.)
+ * - Profile data as nested field (optional)
+ *
+ * Excludes:
+ * - Role and permissions (use auth session API)
+ */
+interface UserProfile {
+    userId: number;
+    publicId: string;
+    email: string | null;
+    username: string | null;
+    emailVerified: boolean;
+    phoneVerified: boolean;
+    lastLoginAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+    profile: ProfileInfo | null;
+}
+
 /**
  * @spfn/auth - Main Router
  *
@@ -3341,6 +3916,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     pollDeviceAuth: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             deviceCode: _sinclair_typebox.TString;
+            waitMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
         }>;
     }, {}, {
         status: "pending";
@@ -3371,6 +3947,59 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             userCode: _sinclair_typebox.TString;
         }>;
     }, {}, void>;
+    issueDeviceLink: _spfn_core_route.RouteDef<{}, {}, IssueDeviceLinkResult>;
+    redeemDeviceLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, {}, RedeemDeviceLinkResult>;
+    getDeviceLinkStatus: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            linkId: _sinclair_typebox.TString;
+            waitMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
+        }>;
+    }, {}, DeviceLinkStatusResult>;
+    confirmDeviceLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            linkId: _sinclair_typebox.TString;
+            choice: _sinclair_typebox.TInteger;
+        }>;
+    }, {}, DeviceLinkStatusResult>;
+    denyDeviceLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            linkId: _sinclair_typebox.TString;
+        }>;
+    }, {}, DeviceLinkStatusResult>;
+    cancelDeviceLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            linkId: _sinclair_typebox.TString;
+        }>;
+    }, {}, DeviceLinkStatusResult>;
+    pollDeviceLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            deviceCode: _sinclair_typebox.TString;
+            waitMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
+        }>;
+    }, {}, {
+        status: "pending";
+        intervalMillis: number;
+    } | {
+        email?: string | undefined;
+        phone?: string | undefined;
+        sessionBinding?: "none" | "passkey" | undefined;
+        keyExpiresAtMillis?: number | undefined;
+        status: "approved";
+        mfaRequired: boolean;
+        userId: string;
+        publicId: string;
+        passwordChangeRequired: boolean;
+    }>;
     passkeyRegisterOptions: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -3531,7 +4160,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             id: number;
             name: string;
             displayName: string;
-            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
         }[];
         userId: number;
         publicId: string;
@@ -3856,8 +4485,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         roles: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -3878,8 +4507,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -3902,8 +4531,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -4754,4 +5383,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { type AuthDeletionCompletedPayload as $, type AuthInitOptions as A, type NewPasskey as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type Passkey as E, type FinishPasskeyEnrollmentResult as F, type MfaVerification as G, type MfaVerificationMethod as H, type IssueOneTimeTokenResult as I, type NewMfaChallenge as J, type KeySummary as K, type LoginResult as L, type MfaStatus as M, type NewUserPublicKey as N, type OAuthStartResult as O, type PermissionConfig as P, type MfaChallenge as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, type VerifyMfaChallengeResult as V, type UserPublicKey as W, type AuthContext as X, type ApproveDeviceAuthParams as Y, type AssertStepUpParams as Z, type AuthDeletionCancelledPayload as _, type RegisterResult as a, type PollDeviceAuthParams as a$, type AuthDeletionRequestedPayload as a0, type AuthDeviceRegisteredPayload as a1, type AuthLoginPayload as a2, type AuthPasswordResetPayload as a3, type AuthProfileOutcome as a4, type AuthProfileVerifier as a5, AuthProviderSchema as a6, type AuthRegisterPayload as a7, type BearerOutcome as a8, type BearerRefusal as a9, MFA_CHALLENGE_ATTEMPT_LIMIT as aA, MFA_CHALLENGE_CHANNELS as aB, MFA_VERIFICATION_METHODS as aC, type MachinePrincipal as aD, type MachineVerifierRegistration as aE, type MarkPasskeyParams as aF, type MfaChallengeChannel as aG, type MfaChallengeHandle as aH, type NativeVerifyOptions as aI, type NewMfaVerification as aJ, type NormalizedIdentity as aK, type OAuth2AuthorizeParams as aL, type OAuth2ScopeDescription as aM, type OAuthCallbackParams as aN, type OAuthCallbackResult as aO, type OAuthCodeExchangeOptions as aP, type OAuthNativeParams as aQ, type OAuthStartParams as aR, type OAuthTokens as aS, type OAuthUnlinkedPayload as aT, type OpenStepUpChallengeParams as aU, PASSKEY_DEVICE_TYPES as aV, PASSKEY_LABEL_MAX_LENGTH as aW, type PasskeyDeviceType as aX, PasswordSchema as aY, PhoneSchema as aZ, PlatformSchema as a_, type ChangePasswordParams as aa, type CompletePasswordResetParams as ab, type CompleteSignupParams as ac, type ConfirmPasswordResetParams as ad, type ConfirmSignupLinkParams as ae, type ConfirmTotpParams as af, type DeferredLoginEvent as ag, type DenyDeviceAuthParams as ah, type DeviceAuthApprovedResult as ai, type DeviceAuthInfoParams as aj, type DeviceAuthPendingResult as ak, DeviceAuthPollResponseSchema as al, DeviceNameSchema as am, type DeviceRegistrationChannel as an, type DisableSessionBindingParams as ao, EmailSchema as ap, FingerprintSchema as aq, type FinishPasskeyEnrollmentParams as ar, type FinishPasskeyLoginParams as as, type FinishSessionRenewParams as at, type InvitationAcceptedPayload as au, type InvitationCreatedPayload as av, KEY_FINGERPRINT_PREFIX_LENGTH as aw, KeyIdSchema as ax, type LoginParams as ay, type LogoutParams as az, type RequestSignupLinkResult as b, getEnabledOAuthProviders as b$, type PollDeviceAuthResult as b0, PublicKeySchema as b1, type RecentAuthenticationParams as b2, type RegisterParams as b3, type RegisterPublicKeyParams as b4, type RegisterPublicKeyResult as b5, type RenamePasskeyParams as b6, type RequestPasswordResetParams as b7, type RequestSignupLinkParams as b8, type RevokeAllKeysParams as b9, authDeletionCancelledEvent as bA, authDeletionCompletedEvent as bB, authDeletionRequestedEvent as bC, authDeviceRegisteredEvent as bD, authLoginEvent as bE, authPasswordResetEvent as bF, authRegisterEvent as bG, authenticate as bH, bearerAuthContext as bI, buildOAuthErrorUrl as bJ, carryStepUpVerification as bK, changePasswordService as bL, completePasswordResetService as bM, completeSignupService as bN, confirmPasswordResetService as bO, confirmSignupLinkService as bP, confirmTotpEnrolmentService as bQ, denyDeviceAuthService as bR, denyOAuth2AuthorizeService as bS, describeOAuth2AuthorizeRequestService as bT, disableMfaService as bU, disableSessionBindingService as bV, enableSessionBindingService as bW, finishPasskeyEnrollmentService as bX, finishPasskeyLoginService as bY, finishSessionRenewService as bZ, getDeviceAuthInfoService as b_, type RevokeKeyParams as ba, type RevokePasskeyParams as bb, type RotateKeyParams as bc, type SendVerificationCodeParams as bd, type SessionBindingParams as be, type StartDeviceAuthParams as bf, type StartPasskeyEnrollmentParams as bg, type StartSessionRenewParams as bh, type StepUpParams as bi, TargetTypeSchema as bj, type UnlinkNotification as bk, UnlinkNotifyRejection as bl, type UnlinkNotifyRequest as bm, type UnlinkNotifyResult as bn, UserCodeSchema as bo, VerificationPurposeSchema as bp, type VerifyCodeParams as bq, type VerifyCodeResult as br, type VerifyMfaChallengeParams as bs, admitBearerKey as bt, approveDeviceAuthService as bu, approveOAuth2AuthorizeService as bv, assertNotLastRecoveryCredential as bw, assertRecentAuthentication as bx, assertStepUp as by, attemptSecondFactor as bz, type RequestPasswordResetResult as c, sweepUnconfirmedMfaService as c$, getGoogleAccessToken as c0, getMachinePrincipal as c1, getOAuthProvider as c2, getRegisteredProviders as c3, getSessionBindingService as c4, invitationAcceptedEvent as c5, invitationCreatedEvent as c6, isOAuthProviderEnabled as c7, issueOneTimeTokenService as c8, keySessionBindingService as c9, registeredBinding as cA, renamePasskeyService as cB, requestPasswordResetService as cC, requestSignupLinkService as cD, requireEnabledProvider as cE, requireMachineScope as cF, resolveAuthenticatedUser as cG, resumeStepUpChallengeService as cH, revokeAllKeysService as cI, revokeAllOAuth2GrantsForUser as cJ, revokeKeyService as cK, revokeOAuth2GrantService as cL, revokePasskeyService as cM, rotateKeyService as cN, runAuthProfile as cO, selectAuthProfile as cP, sendVerificationCodeService as cQ, startDeviceAuthService as cR, startMfaChallengeAssertionService as cS, startPasskeyEnrollmentService as cT, startPasskeyLoginService as cU, startSessionBindingDisableService as cV, startSessionRenewService as cW, startStepUpService as cX, startTotpEnrolmentService as cY, stepUpService as cZ, sweepMfaChallengesService as c_, listKeysService as ca, listOAuth2GrantsService as cb, listPasskeysService as cc, loginService as cd, logoutService as ce, machineAuth as cf, markPasskeySecondFactorService as cg, mfaChallenges as ch, mfaEnrolledForUser as ci, mfaStatusService as cj, mfaVerifications as ck, oauthCallbackService as cl, oauthNativeService as cm, oauthStartService as cn, oauthUnlinkNotifyService as co, oauthUnlinkedEvent as cp, openStepUpChallengeService as cq, optionalAuth as cr, passkeys as cs, pollDeviceAuthService as ct, regenerateRecoveryCodesService as cu, registerAuthProfile as cv, registerMachineVerifier as cw, registerOAuthProvider as cx, registerPublicKeyService as cy, registerService as cz, type ConfirmPasswordResetResult as d, userPublicKeys as d0, verifyCodeService as d1, verifyMfaChallengeService as d2, verifyOneTimeTokenService as d3, verifySecondFactor as d4, type StartDeviceAuthResult as e, type PasskeySummary as f, type ConfirmTotpResult as g, type RotateKeyResult as h, type RevokeAllKeysResult as i, type SessionBindingResult as j, type SessionRenewResult as k, type OAuthFinalizeResponse as l, mainAuthRouter as m, type OAuthNativeResult as n, type ProfileInfo as o, type OAuth2ConsentView as p, type OAuth2AuthorizationCodeIssued as q, type OAuth2GrantSummary as r, type AuthSession as s, PERMISSION_CATEGORIES as t, type PermissionCategory as u, VERIFICATION_PURPOSES as v, VERIFICATION_TARGET_TYPES as w, type VerificationPurpose as x, type VerificationTargetType as y, type OAuthProvider as z };
+export { type UserPublicKey as $, type AuthInitOptions as A, type VerificationPurpose as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type VerificationTargetType as E, type FinishPasskeyEnrollmentResult as F, type OAuthProvider as G, type NewPasskey as H, type IssueDeviceLinkResult as I, type Passkey as J, type KeySummary as K, type LoginResult as L, type MfaStatus as M, type NewUserPublicKey as N, type OAuthStartResult as O, type PermissionConfig as P, type MfaVerification as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, type VerifyMfaChallengeResult as V, type MfaVerificationMethod as W, type NewMfaChallenge as X, type MfaChallenge as Y, type DeviceLink as Z, type NewDeviceLink as _, type RegisterResult as a, type OAuthCodeExchangeOptions as a$, type AuthContext as a0, type ApproveDeviceAuthParams as a1, type AssertStepUpParams as a2, type AuthDeletionCancelledPayload as a3, type AuthDeletionCompletedPayload as a4, type AuthDeletionRequestedPayload as a5, type AuthDeviceRegisteredPayload as a6, type AuthLoginPayload as a7, type AuthPasswordResetPayload as a8, type AuthProfileOutcome as a9, FingerprintSchema as aA, type FinishPasskeyEnrollmentParams as aB, type FinishPasskeyLoginParams as aC, type FinishSessionRenewParams as aD, type InvitationAcceptedPayload as aE, type InvitationCreatedPayload as aF, KEY_FINGERPRINT_PREFIX_LENGTH as aG, KeyIdSchema as aH, LinkIdSchema as aI, type LoginParams as aJ, type LogoutParams as aK, MFA_CHALLENGE_ATTEMPT_LIMIT as aL, MFA_CHALLENGE_CHANNELS as aM, MFA_VERIFICATION_METHODS as aN, type MachinePrincipal as aO, type MachineVerifierRegistration as aP, type MarkPasskeyParams as aQ, MatchChoiceSchema as aR, type MfaChallengeChannel as aS, type MfaChallengeHandle as aT, type NativeVerifyOptions as aU, type NewMfaVerification as aV, type NormalizedIdentity as aW, type OAuth2AuthorizeParams as aX, type OAuth2ScopeDescription as aY, type OAuthCallbackParams as aZ, type OAuthCallbackResult as a_, type AuthProfileVerifier as aa, AuthProviderSchema as ab, type AuthRegisterPayload as ac, type BearerOutcome as ad, type BearerRefusal as ae, type ChangePasswordParams as af, type CompletePasswordResetParams as ag, type CompleteSignupParams as ah, type ConfirmDeviceLinkParams as ai, type ConfirmPasswordResetParams as aj, type ConfirmSignupLinkParams as ak, type ConfirmTotpParams as al, DEVICE_LINK_STATUSES as am, type DeferredLoginEvent as an, type DenyDeviceAuthParams as ao, type DeviceAuthApprovedResult as ap, type DeviceAuthInfoParams as aq, type DeviceAuthPendingResult as ar, DeviceAuthPollResponseSchema as as, type DeviceLinkIssuer as at, type DeviceLinkParams as au, type DeviceLinkStatus as av, DeviceNameSchema as aw, type DeviceRegistrationChannel as ax, type DisableSessionBindingParams as ay, EmailSchema as az, type StartDeviceAuthResult as b, completePasswordResetService as b$, type OAuthNativeParams as b0, type OAuthStartParams as b1, type OAuthTokens as b2, type OAuthUnlinkedPayload as b3, type OpenStepUpChallengeParams as b4, PASSKEY_DEVICE_TYPES as b5, PASSKEY_LABEL_MAX_LENGTH as b6, type PasskeyDeviceType as b7, PasswordSchema as b8, PhoneSchema as b9, type UnlinkNotifyRequest as bA, type UnlinkNotifyResult as bB, UserCodeSchema as bC, VerificationPurposeSchema as bD, type VerifyCodeParams as bE, type VerifyCodeResult as bF, type VerifyMfaChallengeParams as bG, admitBearerKey as bH, approveDeviceAuthService as bI, approveOAuth2AuthorizeService as bJ, assertNotLastRecoveryCredential as bK, assertRecentAuthentication as bL, assertStepUp as bM, attemptSecondFactor as bN, authDeletionCancelledEvent as bO, authDeletionCompletedEvent as bP, authDeletionRequestedEvent as bQ, authDeviceRegisteredEvent as bR, authLoginEvent as bS, authPasswordResetEvent as bT, authRegisterEvent as bU, authenticate as bV, bearerAuthContext as bW, buildOAuthErrorUrl as bX, cancelDeviceLinkService as bY, carryStepUpVerification as bZ, changePasswordService as b_, PlatformSchema as ba, type PollDeviceAuthParams as bb, type PollDeviceAuthResult as bc, type PollDeviceLinkParams as bd, PublicKeySchema as be, type RecentAuthenticationParams as bf, type RedeemDeviceLinkParams as bg, type RegisterParams as bh, type RegisterPublicKeyParams as bi, type RegisterPublicKeyResult as bj, type RenamePasskeyParams as bk, type RequestPasswordResetParams as bl, type RequestSignupLinkParams as bm, type RevokeAllKeysParams as bn, type RevokeKeyParams as bo, type RevokePasskeyParams as bp, type RotateKeyParams as bq, type SendVerificationCodeParams as br, type SessionBindingParams as bs, type StartDeviceAuthParams as bt, type StartPasskeyEnrollmentParams as bu, type StartSessionRenewParams as bv, type StepUpParams as bw, TargetTypeSchema as bx, type UnlinkNotification as by, UnlinkNotifyRejection as bz, type RedeemDeviceLinkResult as c, requireMachineScope as c$, completeSignupService as c0, confirmDeviceLinkService as c1, confirmPasswordResetService as c2, confirmSignupLinkService as c3, confirmTotpEnrolmentService as c4, denyDeviceAuthService as c5, denyDeviceLinkService as c6, denyOAuth2AuthorizeService as c7, describeOAuth2AuthorizeRequestService as c8, deviceLinks as c9, markPasskeySecondFactorService as cA, mfaChallenges as cB, mfaEnrolledForUser as cC, mfaStatusService as cD, mfaVerifications as cE, oauthCallbackService as cF, oauthNativeService as cG, oauthStartService as cH, oauthUnlinkNotifyService as cI, oauthUnlinkedEvent as cJ, openStepUpChallengeService as cK, optionalAuth as cL, passkeys as cM, pollDeviceAuthService as cN, pollDeviceLinkService as cO, redeemDeviceLinkService as cP, regenerateRecoveryCodesService as cQ, registerAuthProfile as cR, registerMachineVerifier as cS, registerOAuthProvider as cT, registerPublicKeyService as cU, registerService as cV, registeredBinding as cW, renamePasskeyService as cX, requestPasswordResetService as cY, requestSignupLinkService as cZ, requireEnabledProvider as c_, disableMfaService as ca, disableSessionBindingService as cb, enableSessionBindingService as cc, finishPasskeyEnrollmentService as cd, finishPasskeyLoginService as ce, finishSessionRenewService as cf, getDeviceAuthInfoService as cg, getDeviceLinkStatusService as ch, getEnabledOAuthProviders as ci, getGoogleAccessToken as cj, getMachinePrincipal as ck, getOAuthProvider as cl, getRegisteredProviders as cm, getSessionBindingService as cn, invitationAcceptedEvent as co, invitationCreatedEvent as cp, isOAuthProviderEnabled as cq, issueDeviceLinkService as cr, issueOneTimeTokenService as cs, keySessionBindingService as ct, listKeysService as cu, listOAuth2GrantsService as cv, listPasskeysService as cw, loginService as cx, logoutService as cy, machineAuth as cz, type DeviceLinkStatusResult as d, resolveAuthenticatedUser as d0, resumeStepUpChallengeService as d1, revokeAllKeysService as d2, revokeAllOAuth2GrantsForUser as d3, revokeKeyService as d4, revokeOAuth2GrantService as d5, revokePasskeyService as d6, rotateKeyService as d7, runAuthProfile as d8, selectAuthProfile as d9, sendVerificationCodeService as da, startDeviceAuthService as db, startMfaChallengeAssertionService as dc, startPasskeyEnrollmentService as dd, startPasskeyLoginService as de, startSessionBindingDisableService as df, startSessionRenewService as dg, startStepUpService as dh, startTotpEnrolmentService as di, stepUpService as dj, sweepMfaChallengesService as dk, sweepUnconfirmedMfaService as dl, userPublicKeys as dm, verifyCodeService as dn, verifyMfaChallengeService as dp, verifyOneTimeTokenService as dq, verifySecondFactor as dr, type RotateKeyResult as e, type RevokeAllKeysResult as f, type IssueOneTimeTokenResult as g, type ProfileInfo as h, type OAuthFinalizeResponse as i, type OAuthNativeResult as j, type RequestSignupLinkResult as k, type RequestPasswordResetResult as l, mainAuthRouter as m, type ConfirmPasswordResetResult as n, type PasskeySummary as o, type ConfirmTotpResult as p, type SessionBindingResult as q, type SessionRenewResult as r, type OAuth2ConsentView as s, type OAuth2AuthorizationCodeIssued as t, type OAuth2GrantSummary as u, type AuthSession as v, PERMISSION_CATEGORIES as w, type PermissionCategory as x, VERIFICATION_PURPOSES as y, VERIFICATION_TARGET_TYPES as z };