@spfn/auth 0.3.0-beta.26 → 0.3.0-beta.28

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, z as OAuthProvider, N as NewUserPublicKey, x as VerificationPurpose, B as NewPasskey, E as Passkey, G as MfaVerification, H as MfaVerificationMethod, J as NewMfaChallenge, Q as MfaChallenge, u as PermissionCategory, W as UserPublicKey, X as AuthContext } from './machine-principals-CdEgxOB1.js';
-export { Y as ApproveDeviceAuthParams, Z as AssertStepUpParams, _ as AuthDeletionCancelledPayload, $ as AuthDeletionCompletedPayload, a0 as AuthDeletionRequestedPayload, a1 as AuthDeviceRegisteredPayload, a2 as AuthLoginPayload, a3 as AuthPasswordResetPayload, a4 as AuthProfileOutcome, a5 as AuthProfileVerifier, a6 as AuthProviderSchema, a7 as AuthRegisterPayload, a8 as BearerOutcome, a9 as BearerRefusal, aa as ChangePasswordParams, ab as CompletePasswordResetParams, ac as CompleteSignupParams, ad as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ae as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, af as ConfirmTotpParams, g as ConfirmTotpResult, ag as DeferredLoginEvent, ah as DenyDeviceAuthParams, ai as DeviceAuthApprovedResult, aj as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ak as DeviceAuthPendingResult, al as DeviceAuthPollResponseSchema, am as DeviceNameSchema, an as DeviceRegistrationChannel, ao as DisableSessionBindingParams, ap as EmailSchema, aq as FingerprintSchema, ar as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, as as FinishPasskeyLoginParams, at as FinishSessionRenewParams, au as InvitationAcceptedPayload, av as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aw as KEY_FINGERPRINT_PREFIX_LENGTH, ax as KeyIdSchema, K as KeySummary, ay as LoginParams, L as LoginResult, az as LogoutParams, aA as MFA_CHALLENGE_ATTEMPT_LIMIT, aB as MFA_CHALLENGE_CHANNELS, aC as MFA_VERIFICATION_METHODS, aD as MachinePrincipal, aE as MachineVerifierRegistration, aF as MarkPasskeyParams, aG as MfaChallengeChannel, aH as MfaChallengeHandle, M as MfaStatus, aI as NativeVerifyOptions, aJ as NewMfaVerification, aK as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aL as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aM as OAuth2ScopeDescription, aN as OAuthCallbackParams, aO as OAuthCallbackResult, aP as OAuthCodeExchangeOptions, aQ as OAuthNativeParams, n as OAuthNativeResult, aR as OAuthStartParams, O as OAuthStartResult, aS as OAuthTokens, aT as OAuthUnlinkedPayload, aU as OpenStepUpChallengeParams, aV as PASSKEY_DEVICE_TYPES, aW as PASSKEY_LABEL_MAX_LENGTH, aX as PasskeyDeviceType, f as PasskeySummary, aY as PasswordSchema, aZ as PhoneSchema, a_ as PlatformSchema, a$ as PollDeviceAuthParams, b0 as PollDeviceAuthResult, b1 as PublicKeySchema, b2 as RecentAuthenticationParams, b3 as RegisterParams, b4 as RegisterPublicKeyParams, b5 as RegisterPublicKeyResult, a as RegisterResult, b6 as RenamePasskeyParams, b7 as RequestPasswordResetParams, c as RequestPasswordResetResult, b8 as RequestSignupLinkParams, b as RequestSignupLinkResult, b9 as RevokeAllKeysParams, i as RevokeAllKeysResult, ba as RevokeKeyParams, bb as RevokePasskeyParams, bc as RotateKeyParams, h as RotateKeyResult, bd as SendVerificationCodeParams, S as SendVerificationCodeResult, be as SessionBindingParams, j as SessionBindingResult, bf as StartDeviceAuthParams, e as StartDeviceAuthResult, bg as StartPasskeyEnrollmentParams, bh as StartSessionRenewParams, bi as StepUpParams, bj as TargetTypeSchema, T as TotpEnrolmentResult, bk as UnlinkNotification, bl as UnlinkNotifyRejection, bm as UnlinkNotifyRequest, bn as UnlinkNotifyResult, bo as UserCodeSchema, v as VERIFICATION_PURPOSES, w as VERIFICATION_TARGET_TYPES, bp as VerificationPurposeSchema, y as VerificationTargetType, bq as VerifyCodeParams, br as VerifyCodeResult, bs as VerifyMfaChallengeParams, V as VerifyMfaChallengeResult, bt as admitBearerKey, bu as approveDeviceAuthService, bv as approveOAuth2AuthorizeService, bw as assertNotLastRecoveryCredential, bx as assertRecentAuthentication, by as assertStepUp, bz as attemptSecondFactor, bA as authDeletionCancelledEvent, bB as authDeletionCompletedEvent, bC as authDeletionRequestedEvent, bD as authDeviceRegisteredEvent, bE as authLoginEvent, bF as authPasswordResetEvent, bG as authRegisterEvent, m as authRouter, bH as authenticate, bI as bearerAuthContext, bJ as buildOAuthErrorUrl, bK as carryStepUpVerification, bL as changePasswordService, bM as completePasswordResetService, bN as completeSignupService, bO as confirmPasswordResetService, bP as confirmSignupLinkService, bQ as confirmTotpEnrolmentService, bR as denyDeviceAuthService, bS as denyOAuth2AuthorizeService, bT as describeOAuth2AuthorizeRequestService, bU as disableMfaService, bV as disableSessionBindingService, bW as enableSessionBindingService, bX as finishPasskeyEnrollmentService, bY as finishPasskeyLoginService, bZ as finishSessionRenewService, b_ as getDeviceAuthInfoService, b$ as getEnabledOAuthProviders, c0 as getGoogleAccessToken, c1 as getMachinePrincipal, c2 as getOAuthProvider, c3 as getRegisteredProviders, c4 as getSessionBindingService, c5 as invitationAcceptedEvent, c6 as invitationCreatedEvent, c7 as isOAuthProviderEnabled, c8 as issueOneTimeTokenService, c9 as keySessionBindingService, ca as listKeysService, cb as listOAuth2GrantsService, cc as listPasskeysService, cd as loginService, ce as logoutService, cf as machineAuth, cg as markPasskeySecondFactorService, ch as mfaChallenges, ci as mfaEnrolledForUser, cj as mfaStatusService, ck as mfaVerifications, cl as oauthCallbackService, cm as oauthNativeService, cn as oauthStartService, co as oauthUnlinkNotifyService, cp as oauthUnlinkedEvent, cq as openStepUpChallengeService, cr as optionalAuth, cs as passkeys, ct as pollDeviceAuthService, cu as regenerateRecoveryCodesService, cv as registerAuthProfile, cw as registerMachineVerifier, cx as registerOAuthProvider, cy as registerPublicKeyService, cz as registerService, cA as registeredBinding, cB as renamePasskeyService, cC as requestPasswordResetService, cD as requestSignupLinkService, cE as requireEnabledProvider, cF as requireMachineScope, cG as resolveAuthenticatedUser, cH as resumeStepUpChallengeService, cI as revokeAllKeysService, cJ as revokeAllOAuth2GrantsForUser, cK as revokeKeyService, cL as revokeOAuth2GrantService, cM as revokePasskeyService, cN as rotateKeyService, cO as runAuthProfile, cP as selectAuthProfile, cQ as sendVerificationCodeService, cR as startDeviceAuthService, cS as startMfaChallengeAssertionService, cT as startPasskeyEnrollmentService, cU as startPasskeyLoginService, cV as startSessionBindingDisableService, cW as startSessionRenewService, cX as startStepUpService, cY as startTotpEnrolmentService, cZ as stepUpService, c_ as sweepMfaChallengesService, c$ as sweepUnconfirmedMfaService, d0 as userPublicKeys, d1 as verifyCodeService, d2 as verifyMfaChallengeService, d3 as verifyOneTimeTokenService, d4 as verifySecondFactor } from './machine-principals-CdEgxOB1.js';
+import { A as AuthInitOptions, G as OAuthProvider, N as NewUserPublicKey, B as VerificationPurpose, H as NewPasskey, J as Passkey, Q as MfaVerification, W as MfaVerificationMethod, X as NewMfaChallenge, Y as MfaChallenge, Z as DeviceLink, _ as NewDeviceLink, x as PermissionCategory, $ as UserPublicKey, a0 as AuthContext } from './machine-principals-B0bjs-0K.js';
+export { a1 as ApproveDeviceAuthParams, a2 as AssertStepUpParams, a3 as AuthDeletionCancelledPayload, a4 as AuthDeletionCompletedPayload, a5 as AuthDeletionRequestedPayload, a6 as AuthDeviceRegisteredPayload, a7 as AuthLoginPayload, a8 as AuthPasswordResetPayload, a9 as AuthProfileOutcome, aa as AuthProfileVerifier, ab as AuthProviderSchema, ac as AuthRegisterPayload, ad as BearerOutcome, ae as BearerRefusal, af as ChangePasswordParams, ag as CompletePasswordResetParams, ah as CompleteSignupParams, ai as ConfirmDeviceLinkParams, aj as ConfirmPasswordResetParams, n as ConfirmPasswordResetResult, ak as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, al as ConfirmTotpParams, p as ConfirmTotpResult, am as DEVICE_LINK_STATUSES, an as DeferredLoginEvent, ao as DenyDeviceAuthParams, ap as DeviceAuthApprovedResult, aq as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ar as DeviceAuthPendingResult, as as DeviceAuthPollResponseSchema, at as DeviceLinkIssuer, au as DeviceLinkParams, av as DeviceLinkStatus, d as DeviceLinkStatusResult, aw as DeviceNameSchema, ax as DeviceRegistrationChannel, ay as DisableSessionBindingParams, az as EmailSchema, aA as FingerprintSchema, aB as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, aC as FinishPasskeyLoginParams, aD as FinishSessionRenewParams, aE as InvitationAcceptedPayload, aF as InvitationCreatedPayload, I as IssueDeviceLinkResult, g as IssueOneTimeTokenResult, aG as KEY_FINGERPRINT_PREFIX_LENGTH, aH as KeyIdSchema, K as KeySummary, aI as LinkIdSchema, aJ as LoginParams, L as LoginResult, aK as LogoutParams, aL as MFA_CHALLENGE_ATTEMPT_LIMIT, aM as MFA_CHALLENGE_CHANNELS, aN as MFA_VERIFICATION_METHODS, aO as MachinePrincipal, aP as MachineVerifierRegistration, aQ as MarkPasskeyParams, aR as MatchChoiceSchema, aS as MfaChallengeChannel, aT as MfaChallengeHandle, M as MfaStatus, aU as NativeVerifyOptions, aV as NewMfaVerification, aW as NormalizedIdentity, t as OAuth2AuthorizationCodeIssued, aX as OAuth2AuthorizeParams, s as OAuth2ConsentView, u as OAuth2GrantSummary, aY as OAuth2ScopeDescription, aZ as OAuthCallbackParams, a_ as OAuthCallbackResult, a$ as OAuthCodeExchangeOptions, b0 as OAuthNativeParams, j as OAuthNativeResult, b1 as OAuthStartParams, O as OAuthStartResult, b2 as OAuthTokens, b3 as OAuthUnlinkedPayload, b4 as OpenStepUpChallengeParams, b5 as PASSKEY_DEVICE_TYPES, b6 as PASSKEY_LABEL_MAX_LENGTH, b7 as PasskeyDeviceType, o as PasskeySummary, b8 as PasswordSchema, b9 as PhoneSchema, ba as PlatformSchema, bb as PollDeviceAuthParams, bc as PollDeviceAuthResult, bd as PollDeviceLinkParams, be as PublicKeySchema, bf as RecentAuthenticationParams, bg as RedeemDeviceLinkParams, c as RedeemDeviceLinkResult, bh as RegisterParams, bi as RegisterPublicKeyParams, bj as RegisterPublicKeyResult, a as RegisterResult, bk as RenamePasskeyParams, bl as RequestPasswordResetParams, l as RequestPasswordResetResult, bm as RequestSignupLinkParams, k as RequestSignupLinkResult, bn as RevokeAllKeysParams, f as RevokeAllKeysResult, bo as RevokeKeyParams, bp as RevokePasskeyParams, bq as RotateKeyParams, e as RotateKeyResult, br as SendVerificationCodeParams, S as SendVerificationCodeResult, bs as SessionBindingParams, q as SessionBindingResult, bt as StartDeviceAuthParams, b as StartDeviceAuthResult, bu as StartPasskeyEnrollmentParams, bv as StartSessionRenewParams, bw as StepUpParams, bx as TargetTypeSchema, T as TotpEnrolmentResult, by as UnlinkNotification, bz as UnlinkNotifyRejection, bA as UnlinkNotifyRequest, bB as UnlinkNotifyResult, bC as UserCodeSchema, y as VERIFICATION_PURPOSES, z as VERIFICATION_TARGET_TYPES, bD as VerificationPurposeSchema, E as VerificationTargetType, bE as VerifyCodeParams, bF as VerifyCodeResult, bG as VerifyMfaChallengeParams, V as VerifyMfaChallengeResult, bH as admitBearerKey, bI as approveDeviceAuthService, bJ as approveOAuth2AuthorizeService, bK as assertNotLastRecoveryCredential, bL as assertRecentAuthentication, bM as assertStepUp, bN as attemptSecondFactor, bO as authDeletionCancelledEvent, bP as authDeletionCompletedEvent, bQ as authDeletionRequestedEvent, bR as authDeviceRegisteredEvent, bS as authLoginEvent, bT as authPasswordResetEvent, bU as authRegisterEvent, m as authRouter, bV as authenticate, bW as bearerAuthContext, bX as buildOAuthErrorUrl, bY as cancelDeviceLinkService, bZ as carryStepUpVerification, b_ as changePasswordService, b$ as completePasswordResetService, c0 as completeSignupService, c1 as confirmDeviceLinkService, c2 as confirmPasswordResetService, c3 as confirmSignupLinkService, c4 as confirmTotpEnrolmentService, c5 as denyDeviceAuthService, c6 as denyDeviceLinkService, c7 as denyOAuth2AuthorizeService, c8 as describeOAuth2AuthorizeRequestService, c9 as deviceLinks, ca as disableMfaService, cb as disableSessionBindingService, cc as enableSessionBindingService, cd as finishPasskeyEnrollmentService, ce as finishPasskeyLoginService, cf as finishSessionRenewService, cg as getDeviceAuthInfoService, ch as getDeviceLinkStatusService, ci as getEnabledOAuthProviders, cj as getGoogleAccessToken, ck as getMachinePrincipal, cl as getOAuthProvider, cm as getRegisteredProviders, cn as getSessionBindingService, co as invitationAcceptedEvent, cp as invitationCreatedEvent, cq as isOAuthProviderEnabled, cr as issueDeviceLinkService, cs as issueOneTimeTokenService, ct as keySessionBindingService, cu as listKeysService, cv as listOAuth2GrantsService, cw as listPasskeysService, cx as loginService, cy as logoutService, cz as machineAuth, cA as markPasskeySecondFactorService, cB as mfaChallenges, cC as mfaEnrolledForUser, cD as mfaStatusService, cE as mfaVerifications, cF as oauthCallbackService, cG as oauthNativeService, cH as oauthStartService, cI as oauthUnlinkNotifyService, cJ as oauthUnlinkedEvent, cK as openStepUpChallengeService, cL as optionalAuth, cM as passkeys, cN as pollDeviceAuthService, cO as pollDeviceLinkService, cP as redeemDeviceLinkService, cQ as regenerateRecoveryCodesService, cR as registerAuthProfile, cS as registerMachineVerifier, cT as registerOAuthProvider, cU as registerPublicKeyService, cV as registerService, cW as registeredBinding, cX as renamePasskeyService, cY as requestPasswordResetService, cZ as requestSignupLinkService, c_ as requireEnabledProvider, c$ as requireMachineScope, d0 as resolveAuthenticatedUser, d1 as resumeStepUpChallengeService, d2 as revokeAllKeysService, d3 as revokeAllOAuth2GrantsForUser, d4 as revokeKeyService, d5 as revokeOAuth2GrantService, d6 as revokePasskeyService, d7 as rotateKeyService, d8 as runAuthProfile, d9 as selectAuthProfile, da as sendVerificationCodeService, db as startDeviceAuthService, dc as startMfaChallengeAssertionService, dd as startPasskeyEnrollmentService, de as startPasskeyLoginService, df as startSessionBindingDisableService, dg as startSessionRenewService, dh as startStepUpService, di as startTotpEnrolmentService, dj as stepUpService, dk as sweepMfaChallengesService, dl as sweepUnconfirmedMfaService, dm as userPublicKeys, dn as verifyCodeService, dp as verifyMfaChallengeService, dq as verifyOneTimeTokenService, dr as verifySecondFactor } from './machine-principals-B0bjs-0K.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { l as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-CTdoTOxM.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, S as SessionBindingType, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
@@ -21,95 +21,6 @@ import '@spfn/core/event';
 import '@spfn/auth/server';
 import 'jsonwebtoken';
 
-/**
- * @spfn/auth - Signed Sign-Out-Everywhere Link
- *
- * A link an app mails to an account's proven address, which signs every device
- * of that account out without a session. It exists for the case the rest of the
- * key surface cannot serve: the owner suspects a device they do not recognise,
- * and the device they would have to sign in on to do something about it is the
- * one they no longer trust.
- *
- * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
- * mints the capability and hands the app a URL. `describeRevokeAllLink` says
- * whether that URL still works and changes nothing, so a mail scanner opening
- * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
- * and it takes the owner pressing the button.
- *
- * The caller's obligation, which this package cannot enforce: the URL
- * `createRevokeAllLink` returns carries the plaintext token, because the package
- * sends no mail here. Do not log it, do not persist it, do not put it in a job
- * payload — hand it to the mail template and let it go. Every other link in this
- * package is minted inside the worker that sends it precisely so that no caller
- * ever holds one; this one cannot be, and the obligation moves to the app.
- */
-interface CreateRevokeAllLinkOptions {
-    /**
-     * Minutes the link stays valid. Defaults to
-     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
-     */
-    ttlMinutes?: number;
-}
-interface RevokeAllLink {
-    /** Absolute URL of the app page, token in its query string. Never log it. */
-    url: string;
-    expiresAt: Date;
-}
-/** What the describe call tells the page, so it can say what pressing the button does. */
-interface RevokeAllLinkDescription {
-    expiresAt: Date;
-    activeKeyCount: number;
-}
-/**
- * Mint a sign-out-everywhere link for an account.
- *
- * Issuing supersedes every live link the account already has, the rule the
- * password-reset flow follows: an owner who asks twice must not leave the first
- * capability working in their mailbox after using the second.
- *
- * The row records the account's key generation, so the link dies the moment any
- * other path signs every device out — a password reset, a password change, a
- * deletion request, or the ordinary revoke-all route.
- *
- * Send it beside a password reset link. It ends the sessions; it does not change
- * the password that let them start.
- *
- * @param userId - The account to issue for
- * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
- * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
- */
-declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
-/**
- * Say whether a presented link still works, and what pressing the button would
- * do. Changes nothing — a mail scanner that opens the page has done nothing.
- *
- * @throws RevokeAllLinkError every refusal, in one shape
- */
-declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
-/**
- * Spend a link and sign every device of the account out.
- *
- * The claim is one statement, so of two requests carrying the same token exactly
- * one revokes and the other is refused as if the token were unknown — which by
- * then it is. `includeCurrent` is true because there is no current device here:
- * the caller holds a mailbox, not a session, and sparing something would mean
- * sparing whatever the owner is trying to cut off.
- *
- * @returns how many device keys were revoked; zero is a success, not a refusal
- * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
- */
-declare function consumeRevokeAllLink(token: string): Promise<{
-    revokedCount: number;
-}>;
-/**
- * Delete link rows that can no longer answer anything.
- *
- * @returns number of rows deleted
- */
-declare function purgeRevokeAllTokensService(): Promise<{
-    deleted: number;
-}>;
-
 /**
  * @spfn/auth - Global Configuration
  *
@@ -461,6 +372,95 @@ interface MfaConfig {
  */
 declare function getMfaConfig(): MfaConfig;
 
+/**
+ * @spfn/auth - Signed Sign-Out-Everywhere Link
+ *
+ * A link an app mails to an account's proven address, which signs every device
+ * of that account out without a session. It exists for the case the rest of the
+ * key surface cannot serve: the owner suspects a device they do not recognise,
+ * and the device they would have to sign in on to do something about it is the
+ * one they no longer trust.
+ *
+ * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
+ * mints the capability and hands the app a URL. `describeRevokeAllLink` says
+ * whether that URL still works and changes nothing, so a mail scanner opening
+ * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
+ * and it takes the owner pressing the button.
+ *
+ * The caller's obligation, which this package cannot enforce: the URL
+ * `createRevokeAllLink` returns carries the plaintext token, because the package
+ * sends no mail here. Do not log it, do not persist it, do not put it in a job
+ * payload — hand it to the mail template and let it go. Every other link in this
+ * package is minted inside the worker that sends it precisely so that no caller
+ * ever holds one; this one cannot be, and the obligation moves to the app.
+ */
+interface CreateRevokeAllLinkOptions {
+    /**
+     * Minutes the link stays valid. Defaults to
+     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
+     */
+    ttlMinutes?: number;
+}
+interface RevokeAllLink {
+    /** Absolute URL of the app page, token in its query string. Never log it. */
+    url: string;
+    expiresAt: Date;
+}
+/** What the describe call tells the page, so it can say what pressing the button does. */
+interface RevokeAllLinkDescription {
+    expiresAt: Date;
+    activeKeyCount: number;
+}
+/**
+ * Mint a sign-out-everywhere link for an account.
+ *
+ * Issuing supersedes every live link the account already has, the rule the
+ * password-reset flow follows: an owner who asks twice must not leave the first
+ * capability working in their mailbox after using the second.
+ *
+ * The row records the account's key generation, so the link dies the moment any
+ * other path signs every device out — a password reset, a password change, a
+ * deletion request, or the ordinary revoke-all route.
+ *
+ * Send it beside a password reset link. It ends the sessions; it does not change
+ * the password that let them start.
+ *
+ * @param userId - The account to issue for
+ * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
+ * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
+ */
+declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
+/**
+ * Say whether a presented link still works, and what pressing the button would
+ * do. Changes nothing — a mail scanner that opens the page has done nothing.
+ *
+ * @throws RevokeAllLinkError every refusal, in one shape
+ */
+declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
+/**
+ * Spend a link and sign every device of the account out.
+ *
+ * The claim is one statement, so of two requests carrying the same token exactly
+ * one revokes and the other is refused as if the token were unknown — which by
+ * then it is. `includeCurrent` is true because there is no current device here:
+ * the caller holds a mailbox, not a session, and sparing something would mean
+ * sparing whatever the owner is trying to cut off.
+ *
+ * @returns how many device keys were revoked; zero is a success, not a refusal
+ * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
+ */
+declare function consumeRevokeAllLink(token: string): Promise<{
+    revokedCount: number;
+}>;
+/**
+ * Delete link rows that can no longer answer anything.
+ *
+ * @returns number of rows deleted
+ */
+declare function purgeRevokeAllTokensService(): Promise<{
+    deleted: number;
+}>;
+
 /**
  * @spfn/auth - Users Entity
  *
@@ -1858,7 +1858,7 @@ declare function getAuthSessionService(userId: string | number | bigint): Promis
         id: number;
         name: string;
         displayName: string;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
     }[];
     userId: number;
     publicId: string;
@@ -2327,7 +2327,7 @@ declare const accountDeletionRequests: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "account_deletion_requests";
             dataType: "string enum";
-            data: "admin" | "self";
+            data: "self" | "admin";
             driverParam: string;
             notNull: true;
             hasDefault: true;
@@ -4984,7 +4984,7 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "permissions";
             dataType: "string enum";
-            data: "auth" | "custom" | "user" | "rbac" | "system";
+            data: "custom" | "user" | "auth" | "rbac" | "system";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -6315,18 +6315,18 @@ declare class UsersRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewUser): Promise<{
-        email: string | null;
-        phone: string | null;
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
+        email: string | null;
+        phone: string | null;
         passwordChangeRequired: boolean;
         sessionBinding: "none" | "passkey";
-        id: number;
         username: string | null;
-        passwordHash: string | null;
-        roleId: number;
+        id: number;
         createdAt: Date;
         updatedAt: Date;
+        passwordHash: string | null;
+        roleId: number;
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
@@ -6490,18 +6490,18 @@ declare class UsersRepository extends BaseRepository {
      * Write primary 사용
      */
     deleteById(id: number): Promise<{
-        email: string | null;
-        phone: string | null;
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
+        email: string | null;
+        phone: string | null;
         passwordChangeRequired: boolean;
         sessionBinding: "none" | "passkey";
-        id: number;
         username: string | null;
-        passwordHash: string | null;
-        roleId: number;
+        id: number;
         createdAt: Date;
         updatedAt: Date;
+        passwordHash: string | null;
+        roleId: number;
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
@@ -6528,7 +6528,7 @@ declare class UsersRepository extends BaseRepository {
             id: number;
             name: string;
             displayName: string;
-            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
         }[];
     }>;
     /**
@@ -6731,19 +6731,16 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewUserPublicKey): Promise<{
-        publicKey: string;
-        keyId: string;
-        fingerprint: string;
-        algorithm: "ES256" | "RS256";
-        deviceName: string | null;
-        platform: "ios" | "android" | "web" | "desktop" | null;
         userId: number;
-        expiresAt: Date | null;
+        keyId: string;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        revokedAt: Date | null;
-        lastUsedAt: Date | null;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
         registeredUaFamily: string | null;
@@ -6756,6 +6753,9 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         pendingMfaChallengeId: number | null;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -6815,6 +6815,16 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     revokeAllActiveByUserIdExcept(userId: number, keepKeyId: string, reason: string): Promise<RevokedKey[]>;
+    /**
+     * Lock the user's active key rows until the transaction ends, for a revocation
+     * that has to touch other rows before it revokes the keys.
+     *
+     * Device-link statements lock the issuing key row before the link row. A
+     * transaction that expires links and then revokes keys takes them the other
+     * way round, and deadlocks against an issue, redeem, approve or consume in
+     * flight on the same key. Calling this first restores the key-before-link order.
+     */
+    lockActiveByUserId(userId: number): Promise<void>;
     /**
      * The one statement behind both global revocations.
      *
@@ -6844,19 +6854,16 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     deleteByKeyIdAndUserId(keyId: string, userId: number): Promise<{
-        publicKey: string;
-        keyId: string;
-        fingerprint: string;
-        algorithm: "ES256" | "RS256";
-        deviceName: string | null;
-        platform: "ios" | "android" | "web" | "desktop" | null;
         userId: number;
-        expiresAt: Date | null;
+        keyId: string;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        revokedAt: Date | null;
-        lastUsedAt: Date | null;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
         registeredUaFamily: string | null;
@@ -6869,6 +6876,9 @@ declare class KeysRepository extends BaseRepository {
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         pendingMfaChallengeId: number | null;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -7153,14 +7163,14 @@ declare class VerificationCodesRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewVerificationCode): Promise<{
-        target: string;
-        targetType: "email" | "phone";
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        code: string;
-        expiresAt: Date;
         id: number;
         createdAt: Date;
         updatedAt: Date;
+        expiresAt: Date;
+        target: string;
+        targetType: "email" | "phone";
+        code: string;
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         usedAt: Date | null;
         attempts: number;
     }>;
@@ -7896,6 +7906,12 @@ declare const mfaEnrolmentRepository: MfaEnrolmentRepository;
  * most of all, since the poll that spends it is the one call that registers a
  * key. Judging the clock only in the read would let that key be registered after
  * the code was dead.
+ *
+ * The three transitions that answer a record — approve, deny, and the global
+ * revocation's sweep — also wake any long poll parked on it, after commit. That
+ * is done here rather than in each caller because the sweep has four callers
+ * across the revocation paths, and a caller that forgot would leave a waiting
+ * device on its slower recheck instead of telling it no.
  */
 
 declare class DeviceAuthorizationsRepository extends BaseRepository {
@@ -7930,6 +7946,16 @@ declare class DeviceAuthorizationsRepository extends BaseRepository {
      * Read replica.
      */
     findByDeviceCodeHash(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
+    /**
+     * `findByDeviceCodeHash`, read from the primary even outside a transaction.
+     *
+     * For the long poll's wait, which runs before any transaction opens: it is
+     * woken right after an answer commits, and a replica that has not caught up
+     * yet would show it the record still pending and send it back to sleep.
+     *
+     * Write primary.
+     */
+    findByDeviceCodeHashOnPrimary(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
     /**
      * Bind the approving user and move the record to `approved`, but only from
      * `pending`.
@@ -7986,9 +8012,165 @@ declare class DeviceAuthorizationsRepository extends BaseRepository {
      * @returns the spent row, or null if it was not approved (any more), or expired
      */
     consumeApproved(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
+    /** Wake the polls parked on a record this call moved, and hand the row back. */
+    private answered;
 }
 declare const deviceAuthorizationsRepository: DeviceAuthorizationsRepository;
 
+/**
+ * Device Links Repository
+ *
+ * Data access for device link. Extends BaseRepository for transaction context
+ * detection and read/write splitting.
+ *
+ * Built the way `device-authorizations.repository.ts` is, for its reasons: every
+ * state change is a conditional UPDATE naming the state it moves from and
+ * carrying the TTL as the database's `now()`, and returns the row only when this
+ * call was the one that moved it. Two devices redeeming one code, or two polls
+ * collecting one approval, produce one winner.
+ *
+ * One condition more than device-code login has: the issuing key. A link belongs
+ * to the key that signed its issue request, and it is worth nothing once that key
+ * is revoked or has run out — a signed-out session must not be able to let a new
+ * device into the account. The transitions that move a link toward a registered
+ * key (redeem, confirm, consume) carry that condition in the same statement, and
+ * lock the key row while they judge it, so a revocation committing at the same
+ * moment is either seen or waited for — never read around.
+ *
+ * Every read here gates authorization — who may see a link, whether a key may be
+ * parked or registered — so every read goes to the primary.
+ *
+ * Every transition wakes the long polls parked on the link, after commit.
+ */
+
+/** A link as read, with whether its issuing key can still sign. */
+type DeviceLinkRecord = DeviceLink & {
+    issuerKeyLive: boolean;
+};
+/** The key material and labels a redeeming device parks, with the codes drawn for it. */
+interface DeviceLinkRedemption {
+    deviceCodeHash: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm: DeviceLink['algorithm'];
+    deviceName?: string;
+    platform?: DeviceLink['platform'];
+    matchNumber: number;
+    choices: number[];
+}
+declare class DeviceLinksRepository extends BaseRepository {
+    /**
+     * Insert an issued link, unless its user code is already taken.
+     *
+     * `onConflictDoNothing` for the reason `DeviceAuthorizationsRepository.create`
+     * gives: a raised unique violation would abort the issue route's transaction
+     * and leave no way to retry with a fresh code.
+     *
+     * @returns the inserted row, or null if the code collided
+     */
+    create(data: NewDeviceLink): Promise<DeviceLink | null>;
+    /**
+     * Find a link by the issuer's handle, in any state.
+     *
+     * Unfiltered, as `DeviceAuthorizationsRepository.findByUserCode` is: which
+     * refusal a caller is owed is the service's decision.
+     */
+    findByLinkId(linkId: string): Promise<DeviceLinkRecord | null>;
+    /** Find a link by its normalized user code, in any state. */
+    findByUserCode(userCode: string): Promise<DeviceLinkRecord | null>;
+    /** Find a link by the hash of the device code its redeemer holds, in any state. */
+    findByDeviceCodeHash(deviceCodeHash: string): Promise<DeviceLinkRecord | null>;
+    /**
+     * Park a device's key on an issued link and move it to `redeemed`.
+     *
+     * From `issued` only, so of two devices redeeming one code exactly one wins;
+     * the other matches nothing and is answered as if the code were unknown.
+     *
+     * @returns the updated row, or null if it was no longer issued, expired, or its issuer signed out
+     */
+    redeem(id: number, redemption: DeviceLinkRedemption): Promise<DeviceLink | null>;
+    /**
+     * The issuer picked the right number: move the link to `approved`, from
+     * `redeemed` only.
+     *
+     * The key is not registered here, for the reason device-code approval gives:
+     * the redeeming device may never come back for it.
+     *
+     * @returns the updated row, or null if it was no longer redeemed, expired, or its issuer signed out
+     */
+    approve(id: number): Promise<DeviceLink | null>;
+    /**
+     * Refuse a redeemed link — the issuer said no, or picked the wrong number.
+     *
+     * No issuing-key condition: refusing is always safe, and a signed-out issuer's
+     * link is refused anyway.
+     *
+     * @returns the updated row, or null if it was no longer redeemed, or expired
+     */
+    deny(id: number): Promise<DeviceLink | null>;
+    /**
+     * The issuer closed the link before anyone was let in: `issued` or `redeemed`
+     * to `expired`.
+     *
+     * @returns the updated row, or null if it had moved past redeemed, or expired
+     */
+    cancel(id: number): Promise<DeviceLink | null>;
+    /**
+     * Spend an approved link, addressed by the device code hash the caller
+     * presented — the one-shot `DeviceAuthorizationsRepository.consumeApproved`
+     * is, with the issuing key judged in the same statement.
+     *
+     * @returns the spent row, or null if it was not approved (any more), expired, or its issuer signed out
+     */
+    consumeApproved(deviceCodeHash: string): Promise<DeviceLink | null>;
+    /**
+     * Lock the issuing key's row until the transaction ends, so two issues from
+     * one key run one after the other: each expires the other's link or waits for
+     * it to be inserted, and never both read "nothing live" and insert.
+     *
+     * `no key update` is the lock a plain UPDATE of the row takes: it conflicts
+     * with itself, with the share lock `issuerKeyLive(true)` takes and with a
+     * revocation's UPDATE, and it leaves foreign-key checks on the row alone.
+     * Taken first, before any link row, so every path that locks both — redeem,
+     * approve, consume and the revocations — locks the key row before the link.
+     */
+    lockIssuerKey(issuerKeyId: string): Promise<void>;
+    /**
+     * Expire the live link a key issued, so a fresh issue leaves one link per key.
+     *
+     * Race-free only after `lockIssuerKey` in the same transaction.
+     *
+     * @returns the rows this call expired
+     */
+    expireLiveByIssuerKey(issuerKeyId: string): Promise<DeviceLink[]>;
+    /**
+     * Expire every link an account still has in play — the device-link half of a
+     * global revocation, beside `DeviceAuthorizationsRepository.denyAllActiveByUserId`.
+     *
+     * A revoke-all that spares the calling device spares its key too, so the
+     * issuing-key condition alone would leave that device's link able to let a
+     * new device in seconds after the owner signed everything else out.
+     *
+     * @returns the rows this call expired
+     */
+    expireAllLiveByUserId(userId: number): Promise<DeviceLink[]>;
+    private expireLive;
+    /** Apply one conditional UPDATE, wake the waiters of the row it moved, and hand the row back. */
+    private transition;
+    /** One link with its issuing key's standing. */
+    private findOne;
+    /**
+     * Whether the link's issuing key is still registered to its issuer, active
+     * and unexpired — the test `authenticate` applies to the same row.
+     *
+     * @param lock take a share lock on the key row, so a transition waits for a
+     *   revocation in flight instead of judging the version before it
+     */
+    private issuerKeyLive;
+}
+declare const deviceLinksRepository: DeviceLinksRepository;
+
 /**
  * Roles Repository
  *
@@ -8065,8 +8247,8 @@ declare class RolesRepository extends BaseRepository {
      */
     create(data: NewRoleEntity): Promise<{
         description: string | null;
-        name: string;
         id: number;
+        name: string;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
@@ -8095,8 +8277,8 @@ declare class RolesRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
-        name: string;
         id: number;
+        name: string;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
@@ -8129,7 +8311,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -8145,7 +8327,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -8185,7 +8367,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -8196,16 +8378,16 @@ declare class PermissionsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
-        metadata: Record<string, any> | null;
-        name: string;
         id: number;
+        name: string;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
         createdAt: Date;
         updatedAt: Date;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        metadata: Record<string, any> | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
     }>;
 }
 declare const permissionsRepository: PermissionsRepository;
@@ -8250,9 +8432,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     createMany(data: NewRolePermission[]): Promise<{
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
+        roleId: number;
         permissionId: number;
     }[]>;
     /**
@@ -8268,9 +8450,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     setPermissionsForRole(roleId: number, permissionIds: number[]): Promise<{
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
+        roleId: number;
         permissionId: number;
     }[]>;
 }
@@ -8332,12 +8514,12 @@ declare class UserPermissionsRepository extends BaseRepository {
      */
     create(data: NewUserPermission): Promise<{
         userId: number;
-        expiresAt: Date | null;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        permissionId: number;
+        expiresAt: Date | null;
         reason: string | null;
+        permissionId: number;
         granted: boolean;
     }>;
     /**
@@ -8358,12 +8540,12 @@ declare class UserPermissionsRepository extends BaseRepository {
      */
     deleteByUserIdAndPermissionId(userId: number, permissionId: number): Promise<{
         userId: number;
-        expiresAt: Date | null;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        permissionId: number;
+        expiresAt: Date | null;
         reason: string | null;
+        permissionId: number;
         granted: boolean;
     }>;
     /**
@@ -8442,7 +8624,6 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 생성
      */
     create(data: NewUserProfile): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -8460,6 +8641,7 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 업데이트 (by ID)
@@ -8511,7 +8693,6 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 삭제 (by ID)
      */
     deleteById(id: number): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -8529,12 +8710,12 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 삭제 (by User ID)
      */
     deleteByUserId(userId: number): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -8552,6 +8733,7 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 Upsert (by User ID)
@@ -8560,7 +8742,6 @@ declare class UserProfilesRepository extends BaseRepository {
      * 새로 생성 시 displayName은 필수 (없으면 'User'로 설정)
      */
     upsertByUserId(userId: number, data: Partial<Omit<NewUserProfile, 'userId'>>): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -8578,6 +8759,7 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * User ID로 프로필 데이터 조회 (formatted)
@@ -8704,15 +8886,15 @@ declare class InvitationsRepository extends BaseRepository {
      * 초대 생성
      */
     create(data: NewInvitation): Promise<{
-        email: string;
-        metadata: Record<string, any> | null;
-        token: string;
         status: "pending" | "accepted" | "expired" | "cancelled";
-        expiresAt: Date;
+        email: string;
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
+        roleId: number;
+        metadata: Record<string, any> | null;
+        expiresAt: Date;
+        token: string;
         invitedBy: number;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
@@ -8738,15 +8920,15 @@ declare class InvitationsRepository extends BaseRepository {
      * 초대 삭제
      */
     deleteById(id: number): Promise<{
-        email: string;
-        metadata: Record<string, any> | null;
-        token: string;
         status: "pending" | "accepted" | "expired" | "cancelled";
-        expiresAt: Date;
+        email: string;
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
+        roleId: number;
+        metadata: Record<string, any> | null;
+        expiresAt: Date;
+        token: string;
         invitedBy: number;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
@@ -8985,9 +9167,9 @@ declare class SocialAccountsRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-        accessToken: string | null;
         providerUserId: string;
         providerEmail: string | null;
+        accessToken: string | null;
         refreshToken: string | null;
         tokenExpiresAt: Date | null;
     }>;
@@ -9001,9 +9183,9 @@ declare class SocialAccountsRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-        accessToken: string | null;
         providerUserId: string;
         providerEmail: string | null;
+        accessToken: string | null;
         refreshToken: string | null;
         tokenExpiresAt: Date | null;
     }>;
@@ -9063,7 +9245,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -9082,7 +9264,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -9104,7 +9286,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -9123,7 +9305,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -9136,16 +9318,16 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
     create(data: NewAccountDeletionRequest): Promise<{
         status: "pending" | "cancelled" | "completed";
         userId: number | null;
+        purgeScheduledAt: Date;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        reason: string | null;
-        purgeScheduledAt: Date;
-        cancelledAt: Date | null;
         completedAt: Date | null;
+        reason: string | null;
         userPublicId: string;
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         purgeStrategy: "anonymize" | "hard-delete" | null;
+        cancelledAt: Date | null;
         requestedAt: Date;
     }>;
     /**
@@ -9165,7 +9347,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -9190,7 +9372,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -10084,18 +10266,18 @@ declare function getOptionalAuth(c: Context | {
 declare function getUser(c: Context | {
     raw: Context;
 }): {
-    email: string | null;
-    phone: string | null;
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     publicId: string;
+    email: string | null;
+    phone: string | null;
     passwordChangeRequired: boolean;
     sessionBinding: "none" | "passkey";
-    id: number;
     username: string | null;
-    passwordHash: string | null;
-    roleId: number;
+    id: number;
     createdAt: Date;
     updatedAt: Date;
+    passwordHash: string | null;
+    roleId: number;
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
@@ -10590,6 +10772,8 @@ interface AuthDeviceAuthConfig {
     ttlMs: number;
     /** How long the waiting device should wait between polls, in milliseconds. */
     intervalMs: number;
+    /** The longest a poll that asks to wait (`waitMillis`) is held open, in milliseconds. */
+    maxWaitMs: number;
 }
 /**
  * Ten minutes. Long enough to walk to the other device and type the code, short
@@ -10598,12 +10782,19 @@ interface AuthDeviceAuthConfig {
 declare const DEFAULT_DEVICE_AUTH_TTL_MS: number;
 /** Five seconds. The interval the server asks for; the rate limit is what enforces it. */
 declare const DEFAULT_DEVICE_AUTH_INTERVAL_MS: number;
+/**
+ * Twenty seconds. Load balancers commonly close a request that has sent nothing
+ * for 30 seconds (Google Cloud's backend service default among them), and a long
+ * poll cut off there reaches the device as a network error rather than as a
+ * pending answer. Twenty leaves room under that for the request's own work.
+ */
+declare const DEFAULT_DEVICE_AUTH_MAX_WAIT_MS: number;
 /**
  * Set the resolved device-auth config. Called synchronously from
  * `createAuthLifecycle()` for the same reason `configureDeletion` is: it must
  * take effect before any handler that reads `getDeviceAuthConfig()` can run.
  *
- * Both knobs are whole millisecond counts, and one that is not is refused here
+ * Every knob is a whole millisecond count, and one that is not is refused here
  * rather than served. `intervalMs` is the reason the check exists: it leaves as
  * `intervalMillis` in the start and poll answers, which `DeviceAuthPollResponseSchema`
  * declares an integer and the mobile contract exports as one, so a fractional
@@ -10617,6 +10808,41 @@ declare function configureDeviceAuth(options?: Partial<AuthDeviceAuthConfig>): v
  */
 declare function getDeviceAuthConfig(): AuthDeviceAuthConfig;
 
+/**
+ * Device Link Configuration
+ *
+ * Singleton config for device link, set once during `createAuthLifecycle()` and
+ * read at request time, as `device-auth-config.ts` is.
+ *
+ * One knob of its own. The poll interval and the long-poll cap are device-code
+ * login's (`deviceAuth.intervalMs`, `deviceAuth.maxWaitMs`): both flows wait the
+ * same way, behind the same proxies, so two settings for one idle timeout would
+ * only be two chances to get it wrong.
+ */
+interface AuthDeviceLinkConfig {
+    /** How long a link code stays usable, in milliseconds. */
+    ttlMs: number;
+}
+/**
+ * Five minutes. Half of device-code login's ten, because the code is on the
+ * issuer's own screen and the new device is in the same hand: there is no walk
+ * to another room, and a code left showing on a desk is worth less the sooner
+ * it dies.
+ */
+declare const DEFAULT_DEVICE_LINK_TTL_MS: number;
+/**
+ * Set the resolved device-link config. Called synchronously from
+ * `createAuthLifecycle()` beside `configureDeviceAuth`, so it takes effect before
+ * any handler can run.
+ *
+ * `ttlMs` leaves as `expiresAtMillis`, an integer in the issue and redeem
+ * answers, so a value that is not a positive whole number of milliseconds is
+ * refused here rather than served.
+ */
+declare function configureDeviceLink(options?: Partial<AuthDeviceLinkConfig>): void;
+/** Read the current device-link config. Defaults apply until `configureDeviceLink` runs. */
+declare function getDeviceLinkConfig(): AuthDeviceLinkConfig;
+
 /**
  * @spfn/auth - Device code generation
  *
@@ -10911,6 +11137,35 @@ interface AuthLifecycleOptions extends AuthInitOptions {
          * @default 5000
          */
         intervalMs?: number;
+        /**
+         * The longest a poll that sends `waitMillis` is held open, in milliseconds.
+         * Keep it under the idle timeout of every proxy in front of the server.
+         * @default 20000
+         */
+        maxWaitMs?: number;
+    };
+    /**
+     * Device link configuration
+     *
+     * Controls the codes handed out by `POST /_auth/device/link/issue`. The poll
+     * interval and the long-poll cap are `deviceAuth`'s: both flows wait the same
+     * way behind the same proxies.
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     deviceLink: {
+     *         ttlMs: 3 * 60 * 1000,   // a link code lives 3 minutes
+     *     },
+     * })
+     * ```
+     */
+    deviceLink?: {
+        /**
+         * How long a link code stays usable, in milliseconds.
+         * @default 300000 (5 minutes)
+         */
+        ttlMs?: number;
     };
     /**
      * OAuth 2.1 authorization server for MCP clients
@@ -11094,4 +11349,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, MfaChallenge, MfaChallengesRepository, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, NewMfaChallenge, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaChallengesRepository, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthDeviceLinkConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_MAX_WAIT_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_DEVICE_LINK_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, DeviceLink, type DeviceLinkRecord, type DeviceLinkRedemption, DeviceLinksRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, MfaChallenge, MfaChallengesRepository, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, NewDeviceLink, type NewInvitation, type NewKeyRevokeAllToken, NewMfaChallenge, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureDeviceLink, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, deviceLinksRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDeviceLinkConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaChallengesRepository, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };