@spfn/auth 0.3.0-beta.7 → 0.3.0-beta.8

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, n as OAuthProvider, k as VerificationPurpose, i as PermissionCategory, o as AuthContext } from './authenticate-Mg9D7Nys.js';
-export { p as AuthProfileOutcome, q as AuthProfileVerifier, r as ChangePasswordParams, s as CompleteSignupParams, t as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, D as DeviceNameSchema, E as EmailSchema, I as IssueOneTimeTokenResult, u as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, v as LoginParams, L as LoginResult, w as LogoutParams, N as NativeVerifyOptions, x as NormalizedIdentity, y as OAuthCallbackParams, z as OAuthCallbackResult, B as OAuthCodeExchangeOptions, F as OAuthNativeParams, e as OAuthNativeResult, G as OAuthStartParams, O as OAuthStartResult, H as OAuthTokens, J as PasswordSchema, M as PhoneSchema, Q as PlatformSchema, T as RegisterParams, W as RegisterPublicKeyParams, a as RegisterResult, X as RequestSignupLinkParams, b as RequestSignupLinkResult, Y as RevokeAllKeysParams, d as RevokeAllKeysResult, Z as RevokeKeyParams, _ as RotateKeyParams, c as RotateKeyResult, $ as SendVerificationCodeParams, S as SendVerificationCodeResult, a0 as TargetTypeSchema, a1 as UnlinkNotification, a2 as UnlinkNotifyRejection, a3 as UnlinkNotifyRequest, a4 as UnlinkNotifyResult, V as VERIFICATION_PURPOSES, j as VERIFICATION_TARGET_TYPES, a5 as VerificationPurposeSchema, l as VerificationTargetType, a6 as VerifyCodeParams, a7 as VerifyCodeResult, m as authRouter, a8 as authenticate, a9 as buildOAuthErrorUrl, aa as changePasswordService, ab as completeSignupService, ac as confirmSignupLinkService, ad as getEnabledOAuthProviders, ae as getGoogleAccessToken, af as getOAuthProvider, ag as getRegisteredProviders, ah as isOAuthProviderEnabled, ai as isSafeReturnPath, aj as issueOneTimeTokenService, ak as listKeysService, al as loginService, am as logoutService, an as oauthCallbackService, ao as oauthNativeService, ap as oauthStartService, aq as oauthUnlinkNotifyService, ar as optionalAuth, as as registerAuthProfile, at as registerOAuthProvider, au as registerPublicKeyService, av as registerService, aw as requestSignupLinkService, ax as requireEnabledProvider, ay as resolveAuthenticatedUser, az as revokeAllKeysService, aA as revokeKeyService, aB as rotateKeyService, aC as runAuthProfile, aD as selectAuthProfile, aE as sendVerificationCodeService, aF as verifyCodeService, aG as verifyOneTimeTokenService } from './authenticate-Mg9D7Nys.js';
+import { A as AuthInitOptions, o as OAuthProvider, l as VerificationPurpose, j as PermissionCategory, p as AuthContext } from './machine-principals-Bd5hp76H.js';
+export { q as ApproveDeviceAuthParams, r as AuthProfileOutcome, s as AuthProfileVerifier, t as ChangePasswordParams, u as CompleteSignupParams, v as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, w as DenyDeviceAuthParams, x as DeviceAuthApprovedResult, y as DeviceAuthInfoParams, D as DeviceAuthInfoResult, z as DeviceAuthPendingResult, B as DeviceAuthPollResponseSchema, E as DeviceNameSchema, F as EmailSchema, G as FingerprintSchema, I as IssueOneTimeTokenResult, H as KEY_FINGERPRINT_PREFIX_LENGTH, J as KeyIdSchema, K as KeySummary, M as LoginParams, L as LoginResult, N as LogoutParams, Q as MachinePrincipal, T as MachineVerifierRegistration, W as NativeVerifyOptions, X as NormalizedIdentity, Y as OAuthCallbackParams, Z as OAuthCallbackResult, _ as OAuthCodeExchangeOptions, $ as OAuthNativeParams, f as OAuthNativeResult, a0 as OAuthStartParams, O as OAuthStartResult, a1 as OAuthTokens, a2 as PasswordSchema, a3 as PhoneSchema, a4 as PlatformSchema, a5 as PollDeviceAuthParams, a6 as PollDeviceAuthResult, a7 as PublicKeySchema, a8 as RegisterParams, a9 as RegisterPublicKeyParams, a as RegisterResult, aa as RequestSignupLinkParams, b as RequestSignupLinkResult, ab as RevokeAllKeysParams, e as RevokeAllKeysResult, ac as RevokeKeyParams, ad as RotateKeyParams, d as RotateKeyResult, ae as SendVerificationCodeParams, S as SendVerificationCodeResult, af as StartDeviceAuthParams, c as StartDeviceAuthResult, ag as TargetTypeSchema, ah as UnlinkNotification, ai as UnlinkNotifyRejection, aj as UnlinkNotifyRequest, ak as UnlinkNotifyResult, al as UserCodeSchema, V as VERIFICATION_PURPOSES, k as VERIFICATION_TARGET_TYPES, am as VerificationPurposeSchema, n as VerificationTargetType, an as VerifyCodeParams, ao as VerifyCodeResult, ap as approveDeviceAuthService, m as authRouter, aq as authenticate, ar as buildOAuthErrorUrl, as as changePasswordService, at as completeSignupService, au as confirmSignupLinkService, av as denyDeviceAuthService, aw as getDeviceAuthInfoService, ax as getEnabledOAuthProviders, ay as getGoogleAccessToken, az as getMachinePrincipal, aA as getOAuthProvider, aB as getRegisteredProviders, aC as isOAuthProviderEnabled, aD as isSafeReturnPath, aE as issueOneTimeTokenService, aF as listKeysService, aG as loginService, aH as logoutService, aI as machineAuth, aJ as oauthCallbackService, aK as oauthNativeService, aL as oauthStartService, aM as oauthUnlinkNotifyService, aN as optionalAuth, aO as pollDeviceAuthService, aP as registerAuthProfile, aQ as registerMachineVerifier, aR as registerOAuthProvider, aS as registerPublicKeyService, aT as registerService, aU as requestSignupLinkService, aV as requireEnabledProvider, aW as requireMachineScope, aX as resolveAuthenticatedUser, aY as revokeAllKeysService, aZ as revokeKeyService, a_ as rotateKeyService, a$ as runAuthProfile, b0 as selectAuthProfile, b1 as sendVerificationCodeService, b2 as startDeviceAuthService, b3 as verifyCodeService, b4 as verifyOneTimeTokenService } from './machine-principals-Bd5hp76H.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { K as KeyAlgorithmType, d as InvitationStatus, j as SocialProvider, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -1355,7 +1355,7 @@ declare function getAuthSessionService(userId: string | number | bigint): Promis
         id: number;
         name: string;
         displayName: string;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
     }[];
     userId: number;
     publicId: string;
@@ -1801,7 +1801,7 @@ declare const accountDeletionRequests: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "account_deletion_requests";
             dataType: "string enum";
-            data: "self" | "admin";
+            data: "admin" | "self";
             driverParam: string;
             notNull: true;
             hasDefault: true;
@@ -3296,6 +3296,288 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
 type SignupLinkToken = typeof signupLinkTokens.$inferSelect;
 type NewSignupLinkToken = typeof signupLinkTokens.$inferInsert;
 
+/**
+ * @spfn/auth - Device Authorizations Entity
+ *
+ * Backs device-code login: a device with no key on file yet parks its public key
+ * here, shows a short code, and an already-authenticated device approves it. The
+ * parked key is registered against the approving user's account when the waiting
+ * device polls.
+ *
+ * The pending key material duplicates the `user_public_keys` columns rather than
+ * writing a row there early. A key in `user_public_keys` can sign requests, and
+ * nothing about a row here has been approved yet — one table means "registered"
+ * and the other means "asked to be", and neither is a state of the other.
+ *
+ * Nothing sweeps this table. Rows are judged by `expiresAt` on read, so a stale
+ * row cannot authorize anything; it only keeps its user code out of circulation,
+ * and 31^8 codes do not run out.
+ */
+/**
+ * Lifecycle of one device-code request.
+ *
+ * Every transition is one-way and the two terminal states differ: `denied` is a
+ * refusal the waiting device is told about, `consumed` is a completed login that
+ * answers as if it never existed. `pending -> approved -> consumed` is the only
+ * path to a registered key.
+ *
+ * `denied` is also where a global revocation puts a record — a revoke-all, a
+ * password change, a deletion request — including one already approved. The
+ * account has withdrawn it, and what the waiting device is owed for that is the
+ * answer a refusal gives.
+ */
+declare const DEVICE_AUTH_STATUSES: readonly ["pending", "approved", "denied", "consumed"];
+type DeviceAuthStatus = typeof DEVICE_AUTH_STATUSES[number];
+declare const deviceAuthorizations: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "device_authorizations";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        deviceCodeHash: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userCode: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        algorithm: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string enum";
+            data: "ES256" | "RS256";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ES256", "RS256"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        platform: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        status: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["pending", "approved", "denied", "consumed"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string enum";
+            data: "pending" | "approved" | "denied" | "consumed";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["pending", "approved", "denied", "consumed"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgBigInt53Builder, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        approvedAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type DeviceAuthorization = typeof deviceAuthorizations.$inferSelect;
+type NewDeviceAuthorization = typeof deviceAuthorizations.$inferInsert;
+
 /**
  * @spfn/auth - Permissions Entity
  *
@@ -3405,7 +3687,7 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "permissions";
             dataType: "string enum";
-            data: "custom" | "user" | "auth" | "rbac" | "system";
+            data: "auth" | "custom" | "user" | "rbac" | "system";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -4027,14 +4309,14 @@ declare class UsersRepository extends BaseRepository {
         email: string | null;
         phone: string | null;
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
-        username: string | null;
-        id: number;
-        createdAt: Date;
-        updatedAt: Date;
         publicId: string;
-        passwordHash: string | null;
         passwordChangeRequired: boolean;
+        id: number;
+        username: string | null;
+        passwordHash: string | null;
         roleId: number;
+        createdAt: Date;
+        updatedAt: Date;
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -4187,14 +4469,14 @@ declare class UsersRepository extends BaseRepository {
         email: string | null;
         phone: string | null;
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
-        username: string | null;
-        id: number;
-        createdAt: Date;
-        updatedAt: Date;
         publicId: string;
-        passwordHash: string | null;
         passwordChangeRequired: boolean;
+        id: number;
+        username: string | null;
+        passwordHash: string | null;
         roleId: number;
+        createdAt: Date;
+        updatedAt: Date;
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -4219,7 +4501,7 @@ declare class UsersRepository extends BaseRepository {
             id: number;
             name: string;
             displayName: string;
-            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
+            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
         }[];
     }>;
     /**
@@ -4374,23 +4656,23 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewUserPublicKey): Promise<{
-        userId: number;
-        keyId: string;
-        id: number;
-        isActive: boolean;
-        createdAt: Date;
         publicKey: string;
-        algorithm: "ES256" | "RS256";
+        keyId: string;
         fingerprint: string;
+        algorithm: "ES256" | "RS256";
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        userId: number;
+        id: number;
+        isActive: boolean;
+        createdAt: Date;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        lastUsedAt: Date | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
-        lastUsedAt: Date | null;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -4476,23 +4758,23 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     deleteByKeyIdAndUserId(keyId: string, userId: number): Promise<{
-        userId: number;
-        keyId: string;
-        id: number;
-        isActive: boolean;
-        createdAt: Date;
         publicKey: string;
-        algorithm: "ES256" | "RS256";
+        keyId: string;
         fingerprint: string;
+        algorithm: "ES256" | "RS256";
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        userId: number;
+        id: number;
+        isActive: boolean;
+        createdAt: Date;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        lastUsedAt: Date | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
-        lastUsedAt: Date | null;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -4680,14 +4962,14 @@ declare class VerificationCodesRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewVerificationCode): Promise<{
+        target: string;
+        targetType: "email" | "phone";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        code: string;
         id: number;
         createdAt: Date;
         updatedAt: Date;
         expiresAt: Date;
-        target: string;
-        targetType: "email" | "phone";
-        code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         usedAt: Date | null;
         attempts: number;
     }>;
@@ -4813,6 +5095,118 @@ declare class SignupLinkTokensRepository extends BaseRepository {
 }
 declare const signupLinkTokensRepository: SignupLinkTokensRepository;
 
+/**
+ * Device Authorizations Repository
+ *
+ * Data access for device-code login. Extends BaseRepository for transaction
+ * context detection and read/write splitting.
+ *
+ * Every state change here is a conditional UPDATE naming the exact state it is
+ * allowed to move from, returning the row only when THIS call was the one that
+ * moved it. That is what makes the operations safe to race: two polls on one
+ * approved record, or a deny arriving while an approve is in flight, produce one
+ * winner and one refusal instead of both callers acting on a row they each read
+ * as still theirs to move. Read-then-write would lose that.
+ *
+ * Each of those transitions also carries the TTL, as `now()` evaluated by the
+ * database. The service reads a record before it acts on it, and a record can
+ * pass its expiry in the gap between that read and this UPDATE — an approved one
+ * most of all, since the poll that spends it is the one call that registers a
+ * key. Judging the clock only in the read would let that key be registered after
+ * the code was dead.
+ */
+
+declare class DeviceAuthorizationsRepository extends BaseRepository {
+    /**
+     * Insert a pending authorization, unless one of its codes is already taken.
+     *
+     * `onConflictDoNothing` rather than letting the unique index raise: the start
+     * route runs inside a transaction, and a raised unique violation aborts it,
+     * so the retry that a generated-code collision calls for could not run — every
+     * statement after it would fail with "current transaction is aborted" instead.
+     * An empty result is the collision signal, and the caller draws a fresh code.
+     *
+     * Write primary.
+     *
+     * @returns the inserted row, or null if either code collided
+     */
+    create(data: NewDeviceAuthorization): Promise<DeviceAuthorization | null>;
+    /**
+     * Find a record by its normalized user code, in any state.
+     *
+     * Deliberately unfiltered: which refusal a caller is owed — expired, already
+     * handled, unknown — is the service's decision, and a row filtered out here
+     * would be indistinguishable from a code that was never issued.
+     *
+     * Read replica.
+     */
+    findByUserCode(userCode: string): Promise<DeviceAuthorization | null>;
+    /**
+     * Find a record by the hash of a device code, in any state.
+     * Unfiltered for the same reason as `findByUserCode`.
+     *
+     * Read replica.
+     */
+    findByDeviceCodeHash(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
+    /**
+     * Bind the approving user and move the record to `approved`, but only from
+     * `pending`.
+     *
+     * `userId` comes from the approver's authenticated session — never from a
+     * request body — so this is the point where the record gains an owner.
+     *
+     * @returns the updated row, or null if it was no longer pending, or expired
+     */
+    approve(id: number, userId: number): Promise<DeviceAuthorization | null>;
+    /**
+     * Move the record to `denied`, but only from `pending`.
+     *
+     * No user is bound: a refusal should leave no record of who was asked.
+     *
+     * @returns the updated row, or null if it was no longer pending, or expired
+     */
+    deny(id: number): Promise<DeviceAuthorization | null>;
+    /**
+     * Refuse every authorization a user still has in flight.
+     *
+     * This is the device-code half of a global revocation. Revoking
+     * `user_public_keys` alone leaves an approved-but-uncollected record behind,
+     * and the next poll on it registers a brand-new active key — so "sign every
+     * device out" would hand one straight back to whoever was still waiting,
+     * which is exactly the person a revoke-all is usually aimed at.
+     *
+     * `denied` rather than a status of its own: a swept record owes its holder
+     * the answer a refused one owes, on all four operations — the waiting device
+     * is told no and stops polling, and info/approve/deny say the request was
+     * already answered. Adding a fourth live status would add a migration and a
+     * case-table row to record a distinction nothing acts on.
+     *
+     * Expired rows are swept too. A global revoke is not the place to reason
+     * about which dead rows were about to die anyway.
+     *
+     * `pending` alongside `approved` even though a pending row carries no
+     * `userId` today, so only approved rows can match: the state list says which
+     * states this is meant to close, and a later change that binds the user
+     * earlier should not silently reopen the hole.
+     *
+     * @returns the rows this call refused
+     */
+    denyAllActiveByUserId(userId: number): Promise<DeviceAuthorization[]>;
+    /**
+     * Spend an approved record, but only from `approved`, and address it by the
+     * device code hash the caller actually presented.
+     *
+     * This is the one-shot: the winner of two concurrent polls registers the key,
+     * and the loser sees no approved record and is answered as if the code were
+     * unknown. Matching on the hash rather than on an id read a moment ago keeps
+     * the whole decision in one statement.
+     *
+     * @returns the spent row, or null if it was not approved (any more), or expired
+     */
+    consumeApproved(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
+}
+declare const deviceAuthorizationsRepository: DeviceAuthorizationsRepository;
+
 /**
  * Roles Repository
  *
@@ -4889,8 +5283,8 @@ declare class RolesRepository extends BaseRepository {
      */
     create(data: NewRoleEntity): Promise<{
         description: string | null;
-        id: number;
         name: string;
+        id: number;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
@@ -4919,8 +5313,8 @@ declare class RolesRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
-        id: number;
         name: string;
+        id: number;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
@@ -4953,7 +5347,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -4969,7 +5363,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -5009,7 +5403,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -5020,16 +5414,16 @@ declare class PermissionsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
-        id: number;
+        metadata: Record<string, any> | null;
         name: string;
+        id: number;
         displayName: string;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
         createdAt: Date;
         updatedAt: Date;
-        metadata: Record<string, any> | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
     }>;
 }
 declare const permissionsRepository: PermissionsRepository;
@@ -5074,9 +5468,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     createMany(data: NewRolePermission[]): Promise<{
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
         permissionId: number;
     }[]>;
     /**
@@ -5092,9 +5486,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     setPermissionsForRole(roleId: number, permissionIds: number[]): Promise<{
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
         permissionId: number;
     }[]>;
 }
@@ -5159,9 +5553,9 @@ declare class UserPermissionsRepository extends BaseRepository {
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        expiresAt: Date | null;
-        reason: string | null;
         permissionId: number;
+        reason: string | null;
+        expiresAt: Date | null;
         granted: boolean;
     }>;
     /**
@@ -5185,9 +5579,9 @@ declare class UserPermissionsRepository extends BaseRepository {
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        expiresAt: Date | null;
-        reason: string | null;
         permissionId: number;
+        reason: string | null;
+        expiresAt: Date | null;
         granted: boolean;
     }>;
     /**
@@ -5266,6 +5660,7 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 생성
      */
     create(data: NewUserProfile): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5283,7 +5678,6 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 업데이트 (by ID)
@@ -5335,6 +5729,7 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 삭제 (by ID)
      */
     deleteById(id: number): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5352,12 +5747,12 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 삭제 (by User ID)
      */
     deleteByUserId(userId: number): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5375,7 +5770,6 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 Upsert (by User ID)
@@ -5384,6 +5778,7 @@ declare class UserProfilesRepository extends BaseRepository {
      * 새로 생성 시 displayName은 필수 (없으면 'User'로 설정)
      */
     upsertByUserId(userId: number, data: Partial<Omit<NewUserProfile, 'userId'>>): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
         displayName: string | null;
@@ -5401,7 +5796,6 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * User ID로 프로필 데이터 조회 (formatted)
@@ -5529,15 +5923,15 @@ declare class InvitationsRepository extends BaseRepository {
      */
     create(data: NewInvitation): Promise<{
         email: string;
+        metadata: Record<string, any> | null;
+        token: string;
         status: "pending" | "accepted" | "expired" | "cancelled";
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
-        metadata: Record<string, any> | null;
-        expiresAt: Date;
-        token: string;
         invitedBy: number;
+        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -5563,15 +5957,15 @@ declare class InvitationsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         email: string;
+        metadata: Record<string, any> | null;
+        token: string;
         status: "pending" | "accepted" | "expired" | "cancelled";
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
-        metadata: Record<string, any> | null;
-        expiresAt: Date;
-        token: string;
         invitedBy: number;
+        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -5809,9 +6203,9 @@ declare class SocialAccountsRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        accessToken: string | null;
         providerUserId: string;
         providerEmail: string | null;
-        accessToken: string | null;
         refreshToken: string | null;
         tokenExpiresAt: Date | null;
     }>;
@@ -5825,9 +6219,9 @@ declare class SocialAccountsRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        accessToken: string | null;
         providerUserId: string;
         providerEmail: string | null;
-        accessToken: string | null;
         refreshToken: string | null;
         tokenExpiresAt: Date | null;
     }>;
@@ -5887,7 +6281,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "self" | "admin";
+        requestedBy: "admin" | "self";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5906,7 +6300,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "self" | "admin";
+        requestedBy: "admin" | "self";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5928,7 +6322,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "self" | "admin";
+        requestedBy: "admin" | "self";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5947,7 +6341,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "self" | "admin";
+        requestedBy: "admin" | "self";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -5958,18 +6352,18 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewAccountDeletionRequest): Promise<{
-        userId: number | null;
         status: "pending" | "cancelled" | "completed";
-        purgeScheduledAt: Date;
+        userId: number | null;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        completedAt: Date | null;
+        reason: string | null;
+        purgeScheduledAt: Date;
         cancelledAt: Date | null;
+        completedAt: Date | null;
         userPublicId: string;
         requestedAt: Date;
-        requestedBy: "self" | "admin";
-        reason: string | null;
+        requestedBy: "admin" | "self";
         purgeStrategy: "anonymize" | "hard-delete" | null;
     }>;
     /**
@@ -5989,7 +6383,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "self" | "admin";
+        requestedBy: "admin" | "self";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -6014,7 +6408,7 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         requestedAt: Date;
         purgeScheduledAt: Date;
         status: "pending" | "cancelled" | "completed";
-        requestedBy: "self" | "admin";
+        requestedBy: "admin" | "self";
         reason: string | null;
         cancelledAt: Date | null;
         completedAt: Date | null;
@@ -6553,14 +6947,14 @@ declare function getUser(c: Context | {
     email: string | null;
     phone: string | null;
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
-    username: string | null;
-    id: number;
-    createdAt: Date;
-    updatedAt: Date;
     publicId: string;
-    passwordHash: string | null;
     passwordChangeRequired: boolean;
+    id: number;
+    username: string | null;
+    passwordHash: string | null;
     roleId: number;
+    createdAt: Date;
+    updatedAt: Date;
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
@@ -6651,6 +7045,8 @@ declare const COOKIE_NAMES: {
     readonly OAUTH_CSRF: string;
     /** Password-setup session for verified-email signup — temporary, single-purpose */
     readonly SIGNUP_SETUP: string;
+    /** CSRF token — the only cookie here the browser can read */
+    readonly CSRF: string;
 };
 /**
  * OAuth CSRF 쿠키를 PORT 접미사와 무관하게 전부 수집한다.
@@ -6712,6 +7108,36 @@ interface BeforeRegisterContext {
     /** App-supplied registration metadata (register params / OAuth start params / invitation) */
     metadata?: Record<string, unknown>;
 }
+/**
+ * How the Next.js proxy treats a cookie-authenticated mutation that arrives
+ * without a valid CSRF header.
+ *
+ * - `off`: no check
+ * - `warn`: allow it through, log one line per request that would be refused
+ * - `enforce`: refuse it with 403
+ */
+type CsrfMode = 'off' | 'warn' | 'enforce';
+/**
+ * CSRF configuration for the Next.js proxy
+ */
+interface AuthCsrfConfig {
+    /**
+     * @default 'warn' — an existing app gets signal before it gets breakage.
+     *          `SPFN_AUTH_CSRF` sets it when this is not; new apps scaffolded by
+     *          `spfn init` are given `enforce`.
+     */
+    mode?: CsrfMode;
+    /**
+     * Backend paths that skip the check, matched exactly.
+     *
+     * These are route paths as the backend sees them (`/webhooks/stripe`), not
+     * `/api/rpc/...` URLs, with route params already substituted. Intended for
+     * endpoints a browser session never calls — webhook receivers and the like.
+     * A path listed here is unprotected for cookie callers too, so list only
+     * endpoints that carry their own authentication.
+     */
+    exemptPaths?: string[];
+}
 /**
  * Auth configuration
  */
@@ -6755,6 +7181,17 @@ interface AuthConfig {
      * ```
      */
     beforeRegister?: (context: BeforeRegisterContext) => void | Promise<void>;
+    /**
+     * CSRF protection for cookie-session mutations, enforced in the Next.js proxy.
+     *
+     * @example
+     * ```typescript
+     * configureAuth({
+     *     csrf: { mode: 'enforce', exemptPaths: ['/webhooks/stripe'] },
+     * });
+     * ```
+     */
+    csrf?: AuthCsrfConfig;
 }
 /**
  * Configure global auth settings
@@ -6796,6 +7233,64 @@ declare function runBeforeRegister(context: BeforeRegisterContext): Promise<void
  * 4. Default (7 days)
  */
 declare function getSessionTtl(override?: string | number): number;
+/**
+ * Get the CSRF mode
+ *
+ * Priority:
+ * 1. Global config (configureAuth)
+ * 2. Environment variable (SPFN_AUTH_CSRF)
+ * 3. Default ('warn')
+ *
+ * An unrecognized value is a typo in the one setting that turns the check on;
+ * it resolves to `enforce` and says so, rather than quietly leaving mutations
+ * unprotected. It says so once per process: this runs on every mutation, so a
+ * per-call error would be pure repetition burying the rest of the log.
+ */
+declare function getCsrfMode(): CsrfMode;
+/**
+ * Get the paths exempted from the CSRF check (exact match, backend route paths)
+ */
+declare function getCsrfExemptPaths(): string[];
+
+/**
+ * @spfn/auth - CSRF token derivation
+ *
+ * The token is an HMAC of the session's key id under a subkey derived from the
+ * session secret. Two properties follow from that shape:
+ *
+ * - The proxy recomputes it from the session it just unsealed, so a value an
+ *   attacker planted in the readable cookie (sibling-subdomain cookie tossing)
+ *   never verifies. Nothing here compares a cookie against a header.
+ * - It is bound to the key id, so rotating the session key invalidates it.
+ *
+ * No new secret: the subkey is a labelled HMAC of SPFN_AUTH_SESSION_SECRET, so
+ * the key that encrypts sessions is never used verbatim as the token key.
+ */
+/** Header the readable CSRF cookie is mirrored into by the client. */
+declare const CSRF_HEADER = "x-spfn-csrf";
+/**
+ * Derive the CSRF token for a session key id.
+ *
+ * @param keyId - Session key id (`SessionData.keyId`)
+ * @returns 64-char hex token — safe to put in a readable cookie, it reveals
+ *          neither the secret nor the key id
+ */
+declare function deriveCsrfToken(keyId: string): Promise<string>;
+/**
+ * Whether a presented header value carries the expected token.
+ *
+ * The header may carry several comma-separated candidates — a browser sees every
+ * `spfn_csrf*` cookie set on the host and cannot tell which dev instance owns
+ * which, nor which of two same-named cookies a sibling subdomain tossed in.
+ *
+ * Every candidate the client is allowed to send is checked — the cap here is the
+ * one it selects against — so a genuine value is never evicted by tossed ones
+ * that happen to sort ahead of it. A header longer than that can only come from a
+ * client that ignored the shared bound, and its surplus is dropped. Accepting any
+ * match is no weaker than accepting one: a candidate the attacker chose still has
+ * to equal a value recomputed from the session.
+ */
+declare function matchesCsrfToken(expected: string, presented: string | null | undefined): boolean;
 
 /**
  * One-Time Token Manager
@@ -6898,6 +7393,107 @@ declare function configureDeletion(options?: Partial<AuthDeletionConfig>): void;
  */
 declare function getDeletionConfig(): AuthDeletionConfig;
 
+/**
+ * Device-code Login Configuration
+ *
+ * Singleton config for device-code login, mirroring `lib/deletion-config.ts`: a
+ * mutable module-level value, set once during `createAuthLifecycle()` and read at
+ * request time.
+ *
+ * Both knobs are answers the server hands to a client that cannot ask again — the
+ * waiting device is told its expiry and its poll interval in the `start` response
+ * and then just obeys them — so they have to be resolved before any request is
+ * served, not read from an environment variable at each use.
+ */
+interface AuthDeviceAuthConfig {
+    /** How long a device code stays usable, in milliseconds. */
+    ttlMs: number;
+    /** How long the waiting device should wait between polls, in milliseconds. */
+    intervalMs: number;
+}
+/**
+ * Ten minutes. Long enough to walk to the other device and type the code, short
+ * enough that a code glimpsed over a shoulder is worthless soon after.
+ */
+declare const DEFAULT_DEVICE_AUTH_TTL_MS: number;
+/** Five seconds. The interval the server asks for; the rate limit is what enforces it. */
+declare const DEFAULT_DEVICE_AUTH_INTERVAL_MS: number;
+/**
+ * Set the resolved device-auth config. Called synchronously from
+ * `createAuthLifecycle()` for the same reason `configureDeletion` is: it must
+ * take effect before any handler that reads `getDeviceAuthConfig()` can run.
+ *
+ * Both knobs are whole millisecond counts, and one that is not is refused here
+ * rather than served. `intervalMs` is the reason the check exists: it leaves as
+ * `intervalMillis` in the start and poll answers, which `DeviceAuthPollResponseSchema`
+ * declares an integer and the mobile contract exports as one, so a fractional
+ * value configured here would reach a generated client as a number its decoder
+ * refuses — at the one moment the flow depends on that client asking again.
+ */
+declare function configureDeviceAuth(options?: Partial<AuthDeviceAuthConfig>): void;
+/**
+ * Read the current device-auth config. Safe to call any time — defaults apply
+ * even if `createAuthLifecycle()` was never given a `deviceAuth` block.
+ */
+declare function getDeviceAuthConfig(): AuthDeviceAuthConfig;
+
+/**
+ * @spfn/auth - Device code generation
+ *
+ * The two codes device-code login runs on, and the one-way function between the
+ * device code and what is stored for it.
+ *
+ * They are different kinds of value and are treated differently everywhere. The
+ * device code is a credential: the polling device holds it, nothing else proves
+ * who that device is, so it is long, random, and stored only as a hash. The user
+ * code is read off one screen and typed on another, so it is short and stored in
+ * the clear — it authorizes nothing on its own, since only an already
+ * authenticated caller can act on it.
+ */
+/**
+ * Alphabet the user code is drawn from.
+ *
+ * 0/O and 1/I/L are the pairs a person mistypes when copying a code between two
+ * screens, so neither member of either pair is in the set. 31 characters over 8
+ * positions is ~2^39 codes, which the per-IP and per-account rate limits on
+ * every route that accepts one make unguessable in the ten minutes a code lives.
+ */
+declare const USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+/** Characters in a user code, not counting the dash it is displayed with. */
+declare const USER_CODE_LENGTH = 8;
+/**
+ * A fresh user code in stored form — uppercase, no dash.
+ *
+ * `randomInt` rather than `Math.random`: this is drawn from the same CSPRNG the
+ * device code is, and a predictable user code lets an attacker have a victim
+ * approve a code the attacker is polling.
+ */
+declare function generateUserCode(): string;
+/** The stored form as a person reads it: `XXXX-XXXX`. */
+declare function formatUserCode(userCode: string): string;
+/**
+ * Fold a typed user code back to the stored form.
+ *
+ * Someone reading `WXYZ-2345` off a screen types the dash, or spaces, or lower
+ * case. All of those name the same code, so all of them have to reach the same
+ * lookup — the alternative is a code that is on screen and still refused.
+ *
+ * Only the user code is normalized. The device code is a credential and is
+ * matched byte for byte: accepting variant spellings of a credential is how one
+ * token becomes several strings and a one-shot record is used twice.
+ */
+declare function normalizeUserCode(input: string): string;
+/** A fresh device code, returned to the new device once and never stored. */
+declare function generateDeviceCode(): string;
+/**
+ * What the row holds instead of the device code.
+ *
+ * Unsalted SHA-256, as with the ops-token and signup-link secrets: the input is
+ * 256 bits of CSPRNG output, so there is no dictionary to defend against and a
+ * per-row salt would only stop the exact-match lookup this has to support.
+ */
+declare function hashDeviceCode(deviceCode: string): string;
+
 /**
  * @spfn/auth - Centralized Logger
  *
@@ -6911,6 +7507,7 @@ declare const authLogger: {
         login: _spfn_core_logger.Logger;
         keyRotation: _spfn_core_logger.Logger;
         oauth: _spfn_core_logger.Logger;
+        csrf: _spfn_core_logger.Logger;
     };
     session: _spfn_core_logger.Logger;
     service: _spfn_core_logger.Logger;
@@ -7103,6 +7700,38 @@ interface AuthLifecycleOptions extends AuthInitOptions {
          */
         onBeforePurge?: (user: AccountDeletionPurgeUser) => Promise<void>;
     };
+    /**
+     * Device-code login configuration
+     *
+     * Controls the codes handed out by `POST /_auth/device/start` and obeyed by
+     * `POST /_auth/device/poll`. Both values are announced to the waiting device
+     * in the start response, so they are resolved here rather than read per call,
+     * and both must be a positive whole number of milliseconds — the interval is
+     * published as an integer and a fraction is refused at startup rather than
+     * handed to a client that cannot decode it.
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     deviceAuth: {
+     *         ttlMs: 5 * 60 * 1000,   // a code lives 5 minutes
+     *         intervalMs: 3000,       // poll every 3 seconds
+     *     },
+     * })
+     * ```
+     */
+    deviceAuth?: {
+        /**
+         * How long a device code stays usable, in milliseconds.
+         * @default 600000 (10 minutes)
+         */
+        ttlMs?: number;
+        /**
+         * Poll interval the server asks the waiting device to keep, in milliseconds.
+         * @default 5000
+         */
+        intervalMs?: number;
+    };
 }
 declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecycleConfig;
 
@@ -7181,6 +7810,7 @@ declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TL
  * 발행 시점:
  * - 이메일/전화 로그인 성공 시
  * - OAuth 기존 사용자 로그인 시
+ * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
  *
  * @example
  * ```typescript
@@ -7193,7 +7823,7 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -7216,7 +7846,7 @@ declare const authRegisterEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     userId: string;
-    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
 }>;
 /**
  * auth.invitation.created - 초대 생성 이벤트
@@ -7243,10 +7873,10 @@ declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     email: string;
-    roleId: number;
-    expiresAt: string;
     token: string;
+    roleId: number;
     invitedBy: string;
+    expiresAt: string;
     invitationId: string;
     isResend: boolean;
 }>;
@@ -7290,7 +7920,7 @@ declare const authDeletionRequestedEvent: _spfn_core_event.EventDef<{
     userId: string;
     purgeScheduledAt: string;
     userPublicId: string;
-    requestedBy: "self" | "admin";
+    requestedBy: "admin" | "self";
 }>;
 /**
  * auth.deletion.cancelled - 계정 탈퇴 복구 이벤트
@@ -7335,7 +7965,7 @@ declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
 declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
     reason?: string | undefined;
     userId: string;
-    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
     providerUserId: string;
 }>;
 /**
@@ -7350,4 +7980,4 @@ type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
 type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
-export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewOpsToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type OpsToken, OpsTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, issueOpsTokenService, kakaoProvider, keysRepository, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeStoredEmails, oauthUnlinkedEvent, oneTimeTokenAuth, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken };
+export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CsrfMode, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewOpsToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type OpsToken, OpsTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateDeviceCode, generateOAuthNonce, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, issueOpsTokenService, kakaoProvider, keysRepository, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeStoredEmails, normalizeUserCode, oauthUnlinkedEvent, oneTimeTokenAuth, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken };