@spfn/auth 0.3.0-beta.5 → 0.3.0-beta.7

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, l as OAuthProvider, j as VerificationPurpose, h as PermissionCategory, n as AuthContext } from './authenticate-Ctul07Sc.js';
-export { o as AuthProfileOutcome, p as AuthProfileVerifier, C as ChangePasswordParams, D as DeviceNameSchema, E as EmailSchema, I as IssueOneTimeTokenResult, q as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, r as LoginParams, L as LoginResult, s as LogoutParams, N as NativeVerifyOptions, t as NormalizedIdentity, u as OAuthCallbackParams, v as OAuthCallbackResult, w as OAuthCodeExchangeOptions, x as OAuthNativeParams, d as OAuthNativeResult, y as OAuthStartParams, O as OAuthStartResult, z as OAuthTokens, B as PasswordSchema, F as PhoneSchema, G as PlatformSchema, H as RegisterParams, J as RegisterPublicKeyParams, a as RegisterResult, M as RevokeAllKeysParams, c as RevokeAllKeysResult, Q as RevokeKeyParams, T as RotateKeyParams, b as RotateKeyResult, W as SendVerificationCodeParams, S as SendVerificationCodeResult, X as TargetTypeSchema, Y as UnlinkNotification, Z as UnlinkNotifyRejection, _ as UnlinkNotifyRequest, $ as UnlinkNotifyResult, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, a0 as VerificationPurposeSchema, k as VerificationTargetType, a1 as VerifyCodeParams, a2 as VerifyCodeResult, m as authRouter, a3 as authenticate, a4 as buildOAuthErrorUrl, a5 as changePasswordService, a6 as getEnabledOAuthProviders, a7 as getGoogleAccessToken, a8 as getOAuthProvider, a9 as getRegisteredProviders, aa as isOAuthProviderEnabled, ab as issueOneTimeTokenService, ac as listKeysService, ad as loginService, ae as logoutService, af as oauthCallbackService, ag as oauthNativeService, ah as oauthStartService, ai as oauthUnlinkNotifyService, aj as optionalAuth, ak as registerOAuthProvider, al as registerPublicKeyService, am as registerService, an as requireEnabledProvider, ao as resolveAuthenticatedUser, ap as revokeAllKeysService, aq as revokeKeyService, ar as rotateKeyService, as as runAuthProfile, at as selectAuthProfile, au as sendVerificationCodeService, av as verifyCodeService, aw as verifyOneTimeTokenService } from './authenticate-Ctul07Sc.js';
+import { A as AuthInitOptions, n as OAuthProvider, k as VerificationPurpose, i as PermissionCategory, o as AuthContext } from './authenticate-Mg9D7Nys.js';
+export { p as AuthProfileOutcome, q as AuthProfileVerifier, r as ChangePasswordParams, s as CompleteSignupParams, t as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, D as DeviceNameSchema, E as EmailSchema, I as IssueOneTimeTokenResult, u as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, v as LoginParams, L as LoginResult, w as LogoutParams, N as NativeVerifyOptions, x as NormalizedIdentity, y as OAuthCallbackParams, z as OAuthCallbackResult, B as OAuthCodeExchangeOptions, F as OAuthNativeParams, e as OAuthNativeResult, G as OAuthStartParams, O as OAuthStartResult, H as OAuthTokens, J as PasswordSchema, M as PhoneSchema, Q as PlatformSchema, T as RegisterParams, W as RegisterPublicKeyParams, a as RegisterResult, X as RequestSignupLinkParams, b as RequestSignupLinkResult, Y as RevokeAllKeysParams, d as RevokeAllKeysResult, Z as RevokeKeyParams, _ as RotateKeyParams, c as RotateKeyResult, $ as SendVerificationCodeParams, S as SendVerificationCodeResult, a0 as TargetTypeSchema, a1 as UnlinkNotification, a2 as UnlinkNotifyRejection, a3 as UnlinkNotifyRequest, a4 as UnlinkNotifyResult, V as VERIFICATION_PURPOSES, j as VERIFICATION_TARGET_TYPES, a5 as VerificationPurposeSchema, l as VerificationTargetType, a6 as VerifyCodeParams, a7 as VerifyCodeResult, m as authRouter, a8 as authenticate, a9 as buildOAuthErrorUrl, aa as changePasswordService, ab as completeSignupService, ac as confirmSignupLinkService, ad as getEnabledOAuthProviders, ae as getGoogleAccessToken, af as getOAuthProvider, ag as getRegisteredProviders, ah as isOAuthProviderEnabled, ai as isSafeReturnPath, aj as issueOneTimeTokenService, ak as listKeysService, al as loginService, am as logoutService, an as oauthCallbackService, ao as oauthNativeService, ap as oauthStartService, aq as oauthUnlinkNotifyService, ar as optionalAuth, as as registerAuthProfile, at as registerOAuthProvider, au as registerPublicKeyService, av as registerService, aw as requestSignupLinkService, ax as requireEnabledProvider, ay as resolveAuthenticatedUser, az as revokeAllKeysService, aA as revokeKeyService, aB as rotateKeyService, aC as runAuthProfile, aD as selectAuthProfile, aE as sendVerificationCodeService, aF as verifyCodeService, aG as verifyOneTimeTokenService } from './authenticate-Mg9D7Nys.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { K as KeyAlgorithmType, d as InvitationStatus, j as SocialProvider, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -1355,7 +1355,7 @@ declare function getAuthSessionService(userId: string | number | bigint): Promis
         id: number;
         name: string;
         displayName: string;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
     }[];
     userId: number;
     publicId: string;
@@ -1801,7 +1801,7 @@ declare const accountDeletionRequests: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "account_deletion_requests";
             dataType: "string enum";
-            data: "admin" | "self";
+            data: "self" | "admin";
             driverParam: string;
             notNull: true;
             hasDefault: true;
@@ -3093,6 +3093,209 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
 type VerificationCode = typeof verificationCodes.$inferSelect;
 type NewVerificationCode = typeof verificationCodes.$inferInsert;
 
+/**
+ * @spfn/auth - Signup Link Tokens Entity
+ *
+ * Backs the verified-email signup flow: a one-time confirmation link is emailed,
+ * opening it mints a short-lived setup session, and setting a password on that
+ * session creates the account.
+ *
+ * A separate table from `verification_codes` on purpose. That table stores its
+ * six-digit code in plaintext, which is acceptable for a short-lived numeric code
+ * bounded by an attempt counter, but a link token is a bearer credential sitting
+ * in someone's mailbox and must only ever be stored as a hash. Sharing one table
+ * would make "plaintext or hash" a per-row property that nothing enforces.
+ */
+declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "signup_link_tokens";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        email: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        returnPath: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        completedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type SignupLinkToken = typeof signupLinkTokens.$inferSelect;
+type NewSignupLinkToken = typeof signupLinkTokens.$inferInsert;
+
 /**
  * @spfn/auth - Permissions Entity
  *
@@ -3202,7 +3405,7 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "permissions";
             dataType: "string enum";
-            data: "auth" | "custom" | "user" | "rbac" | "system";
+            data: "custom" | "user" | "auth" | "rbac" | "system";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3823,15 +4026,15 @@ declare class UsersRepository extends BaseRepository {
     create(data: NewUser): Promise<{
         email: string | null;
         phone: string | null;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        username: string | null;
         id: number;
+        createdAt: Date;
+        updatedAt: Date;
         publicId: string;
-        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        createdAt: Date;
-        updatedAt: Date;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3983,15 +4186,15 @@ declare class UsersRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string | null;
         phone: string | null;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        username: string | null;
         id: number;
+        createdAt: Date;
+        updatedAt: Date;
         publicId: string;
-        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        createdAt: Date;
-        updatedAt: Date;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -4016,7 +4219,7 @@ declare class UsersRepository extends BaseRepository {
             id: number;
             name: string;
             displayName: string;
-            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
         }[];
     }>;
     /**
@@ -4171,23 +4374,23 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewUserPublicKey): Promise<{
-        publicKey: string;
-        keyId: string;
-        fingerprint: string;
-        algorithm: "ES256" | "RS256";
-        deviceName: string | null;
-        platform: "ios" | "android" | "web" | "desktop" | null;
         userId: number;
+        keyId: string;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
-        lastUsedAt: Date | null;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -4273,23 +4476,23 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     deleteByKeyIdAndUserId(keyId: string, userId: number): Promise<{
-        publicKey: string;
-        keyId: string;
-        fingerprint: string;
-        algorithm: "ES256" | "RS256";
-        deviceName: string | null;
-        platform: "ios" | "android" | "web" | "desktop" | null;
         userId: number;
+        keyId: string;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
-        lastUsedAt: Date | null;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -4477,14 +4680,14 @@ declare class VerificationCodesRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewVerificationCode): Promise<{
-        target: string;
-        targetType: "email" | "phone";
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        code: string;
         id: number;
         createdAt: Date;
         updatedAt: Date;
         expiresAt: Date;
+        target: string;
+        targetType: "email" | "phone";
+        code: string;
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         usedAt: Date | null;
         attempts: number;
     }>;
@@ -4541,6 +4744,75 @@ declare class VerificationCodesRepository extends BaseRepository {
 }
 declare const verificationCodesRepository: VerificationCodesRepository;
 
+/**
+ * Signup Link Tokens Repository
+ *
+ * Data access for the verified-email signup flow. Extends BaseRepository for
+ * transaction-context detection and read/write splitting.
+ *
+ * The two claim methods (`claimLink`, `claimSetupSession`) update conditionally
+ * and return the row only if THIS call was the one that moved it. Two concurrent
+ * confirms — or two concurrent password submits — therefore produce one winner
+ * and one refusal, rather than both proceeding on a row they each read as
+ * unclaimed. Read-then-write would lose that race.
+ */
+
+declare class SignupLinkTokensRepository extends BaseRepository {
+    /**
+     * Create a signup link row.
+     * Write primary.
+     */
+    create(data: NewSignupLinkToken): Promise<SignupLinkToken>;
+    /**
+     * Find a row by the hash of an emailed token, in any state.
+     *
+     * Deliberately unfiltered: the caller decides why a link is refused, and a
+     * row filtered out here would be indistinguishable from an unknown token in
+     * the logs.
+     *
+     * Read replica.
+     */
+    findByTokenHash(tokenHash: string): Promise<SignupLinkToken | null>;
+    /**
+     * Find a row by the hash of a setup session secret, in any state.
+     * Read replica.
+     */
+    findBySetupSecretHash(setupSecretHash: string): Promise<SignupLinkToken | null>;
+    /**
+     * Consume a link and open a setup session on it, but only if it is still
+     * unconsumed and not superseded.
+     *
+     * @returns the updated row, or null if another request claimed it first
+     */
+    claimLink(id: number, setupSecretHash: string, setupExpiresAt: Date): Promise<SignupLinkToken | null>;
+    /**
+     * Mark a setup session as completed, but only if it has not completed
+     * already.
+     *
+     * @returns the updated row, or null if another request completed it first
+     */
+    claimSetupSession(id: number): Promise<SignupLinkToken | null>;
+    /**
+     * Supersede every live link for an address, so requesting a new one
+     * invalidates the previous one and any setup session opened from it.
+     *
+     * Write primary.
+     *
+     * @returns number of rows superseded
+     */
+    supersedeLiveForEmail(email: string): Promise<number>;
+    /**
+     * Delete every signup link row for an address (account destruction).
+     *
+     * Rows key on the email text and carry no user FK, so destruction has to
+     * clean them up by address the way verification codes are cleaned up.
+     *
+     * Write primary.
+     */
+    deleteByEmail(email: string): Promise<number>;
+}
+declare const signupLinkTokensRepository: SignupLinkTokensRepository;
+
 /**
  * Roles Repository
  *
@@ -4617,8 +4889,8 @@ declare class RolesRepository extends BaseRepository {
      */
     create(data: NewRoleEntity): Promise<{
         description: string | null;
-        name: string;
         id: number;
+        name: string;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
@@ -4647,8 +4919,8 @@ declare class RolesRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
-        name: string;
         id: number;
+        name: string;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
@@ -4681,7 +4953,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -4697,7 +4969,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -4737,7 +5009,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -4748,16 +5020,16 @@ declare class PermissionsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
-        metadata: Record<string, any> | null;
-        name: string;
         id: number;
+        name: string;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
         createdAt: Date;
         updatedAt: Date;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
+        metadata: Record<string, any> | null;
+        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
     }>;
 }
 declare const permissionsRepository: PermissionsRepository;
@@ -4802,9 +5074,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     createMany(data: NewRolePermission[]): Promise<{
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
+        roleId: number;
         permissionId: number;
     }[]>;
     /**
@@ -4820,9 +5092,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     setPermissionsForRole(roleId: number, permissionIds: number[]): Promise<{
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
+        roleId: number;
         permissionId: number;
     }[]>;
 }
@@ -4887,9 +5159,9 @@ declare class UserPermissionsRepository extends BaseRepository {
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        permissionId: number;
-        reason: string | null;
         expiresAt: Date | null;
+        reason: string | null;
+        permissionId: number;
         granted: boolean;
     }>;
     /**
@@ -4913,9 +5185,9 @@ declare class UserPermissionsRepository extends BaseRepository {
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        permissionId: number;
-        reason: string | null;
         expiresAt: Date | null;
+        reason: string | null;
+        permissionId: number;
         granted: boolean;
     }>;
     /**
@@ -4994,7 +5266,6 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 생성
      */
     create(data: NewUserProfile): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5012,6 +5283,7 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 업데이트 (by ID)
@@ -5063,7 +5335,6 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 삭제 (by ID)
      */
     deleteById(id: number): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5081,12 +5352,12 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 삭제 (by User ID)
      */
     deleteByUserId(userId: number): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5104,6 +5375,7 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 Upsert (by User ID)
@@ -5112,7 +5384,6 @@ declare class UserProfilesRepository extends BaseRepository {
      * 새로 생성 시 displayName은 필수 (없으면 'User'로 설정)
      */
     upsertByUserId(userId: number, data: Partial<Omit<NewUserProfile, 'userId'>>): Promise<{
-        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5130,6 +5401,7 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
+        metadata: Record<string, any> | null;
     }>;
     /**
      * User ID로 프로필 데이터 조회 (formatted)
@@ -5257,15 +5529,15 @@ declare class InvitationsRepository extends BaseRepository {
      */
     create(data: NewInvitation): Promise<{
         email: string;
-        metadata: Record<string, any> | null;
+        status: "pending" | "accepted" | "expired" | "cancelled";
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "pending" | "accepted" | "expired" | "cancelled";
+        roleId: number;
+        metadata: Record<string, any> | null;
+        expiresAt: Date;
         token: string;
         invitedBy: number;
-        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -5291,15 +5563,15 @@ declare class InvitationsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         email: string;
-        metadata: Record<string, any> | null;
+        status: "pending" | "accepted" | "expired" | "cancelled";
         id: number;
-        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "pending" | "accepted" | "expired" | "cancelled";
+        roleId: number;
+        metadata: Record<string, any> | null;
+        expiresAt: Date;
         token: string;
         invitedBy: number;
-        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -5537,9 +5809,9 @@ declare class SocialAccountsRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-        accessToken: string | null;
         providerUserId: string;
         providerEmail: string | null;
+        accessToken: string | null;
         refreshToken: string | null;
         tokenExpiresAt: Date | null;
     }>;
@@ -5553,9 +5825,9 @@ declare class SocialAccountsRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-        accessToken: string | null;
         providerUserId: string;
         providerEmail: string | null;
+        accessToken: string | null;
         refreshToken: string | null;
         tokenExpiresAt: Date | null;
     }>;
@@ -5615,7 +5887,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5634,7 +5906,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5656,7 +5928,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5675,7 +5947,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5687,17 +5959,17 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
      */
     create(data: NewAccountDeletionRequest): Promise<{
         userId: number | null;
+        status: "pending" | "cancelled" | "completed";
+        purgeScheduledAt: Date;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "pending" | "cancelled" | "completed";
-        reason: string | null;
-        purgeScheduledAt: Date;
+        completedAt: Date | null;
         cancelledAt: Date | null;
         userPublicId: string;
         requestedAt: Date;
-        requestedBy: "admin" | "self";
-        completedAt: Date | null;
+        requestedBy: "self" | "admin";
+        reason: string | null;
         purgeStrategy: "anonymize" | "hard-delete" | null;
     }>;
     /**
@@ -5717,7 +5989,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5742,7 +6014,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "admin" | "self";
+        requestedBy: "self" | "admin";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -6280,15 +6552,15 @@ declare function getUser(c: Context | {
 }): {
     email: string | null;
     phone: string | null;
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+    username: string | null;
     id: number;
+    createdAt: Date;
+    updatedAt: Date;
     publicId: string;
-    username: string | null;
     passwordHash: string | null;
     passwordChangeRequired: boolean;
     roleId: number;
-    createdAt: Date;
-    updatedAt: Date;
-    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
@@ -6377,6 +6649,8 @@ declare const COOKIE_NAMES: {
     readonly OAUTH_PENDING: string;
     /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
     readonly OAUTH_CSRF: string;
+    /** Password-setup session for verified-email signup — temporary, single-purpose */
+    readonly SIGNUP_SETUP: string;
 };
 /**
  * OAuth CSRF 쿠키를 PORT 접미사와 무관하게 전부 수집한다.
@@ -6919,7 +7193,7 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -6942,7 +7216,7 @@ declare const authRegisterEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
 }>;
 /**
  * auth.invitation.created - 초대 생성 이벤트
@@ -6970,9 +7244,9 @@ declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
     } | undefined;
     email: string;
     roleId: number;
+    expiresAt: string;
     token: string;
     invitedBy: string;
-    expiresAt: string;
     invitationId: string;
     isResend: boolean;
 }>;
@@ -7016,7 +7290,7 @@ declare const authDeletionRequestedEvent: _spfn_core_event.EventDef<{
     userId: string;
     purgeScheduledAt: string;
     userPublicId: string;
-    requestedBy: "admin" | "self";
+    requestedBy: "self" | "admin";
 }>;
 /**
  * auth.deletion.cancelled - 계정 탈퇴 복구 이벤트
@@ -7061,7 +7335,7 @@ declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
 declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
     reason?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
     providerUserId: string;
 }>;
 /**
@@ -7076,4 +7350,4 @@ type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
 type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
-export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewOpsToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type OpsToken, OpsTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, issueOpsTokenService, kakaoProvider, keysRepository, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeStoredEmails, oauthUnlinkedEvent, oneTimeTokenAuth, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken };
+export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewOpsToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type OpsToken, OpsTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, issueOpsTokenService, kakaoProvider, keysRepository, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeStoredEmails, oauthUnlinkedEvent, oneTimeTokenAuth, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken };