alepha 0.21.2 → 0.23.0

package/dist/api/users/index.d.ts

@@ -1,27 +1,14 @@
-import * as _$alepha from "alepha";
 import { Alepha, AlephaError, Page, PageQuery, Primitive, SchemaValidator, Static, StaticEncode, TNull, TObject, TOptional, TSchema, TUnion } from "alepha";
-import { AuditService, CreateAudit } from "alepha/api/audits";
-import * as _$alepha_bucket0 from "alepha/bucket";
-import { CryptoProvider, IssuerPrimitive, IssuerPrimitiveOptions, UserAccount } from "alepha/security";
-import * as _$alepha_server0 from "alepha/server";
-import * as _$alepha_orm0 from "alepha/orm";
+import { CryptoProvider, IssuerPrimitive, IssuerPrimitiveOptions, SecurityProvider, UserAccount } from "alepha/security";
 import { Page as Page$1, Repository } from "alepha/orm";
-import * as _$alepha_logger0 from "alepha/logger";
-import * as _$alepha_server_links0 from "alepha/server/links";
-import * as _$alepha_api_notifications0 from "alepha/api/notifications";
 import { CaptchaProvider } from "alepha/captcha";
 import { OAuth2Profile, ServerAuthProvider, WithLinkFn, WithLoginFn } from "alepha/server/auth";
 import { VerificationController, VerificationService } from "alepha/api/verifications";
-import * as _$alepha_cache0 from "alepha/cache";
 import { CacheProvider } from "alepha/cache";
 import { DateTime, DateTimeProvider } from "alepha/datetime";
-import * as _$alepha_api_jobs0 from "alepha/api/jobs";
 import { FileSystemProvider } from "alepha/system";
 import { ParameterPrimitive } from "alepha/api/parameters";
-import * as _$typebox from "typebox";
-import * as _$drizzle_orm0 from "drizzle-orm";
 import { BuildExtraConfigColumns, SQL, SQLWrapper } from "drizzle-orm";
-import * as _$drizzle_orm_pg_core0 from "drizzle-orm/pg-core";
 import { LockConfig, LockStrength, PgColumn, PgColumnBuilderBase, PgDatabase, PgInsertValue, PgSelectBase, PgSequenceOptions, PgTableExtraConfigValue, PgTableWithColumns, PgTransaction, UpdateDeleteAction } from "drizzle-orm/pg-core";
 import { PgTransactionConfig } from "drizzle-orm/pg-core/session";
 import { CryptoProvider as CryptoProvider$1 } from "alepha/crypto";
@@ -48,128 +35,72 @@ type FieldRequirement = "none" | "optional" | "required";
  *   collision behavior.
  */
 type UsernameFieldRequirement = FieldRequirement | "email";
-declare const realmAuthSettingsAtom: _$alepha.Atom<_$typebox.TObject<{
-  displayName: _$typebox.TOptional<_$typebox.TString>;
-  description: _$typebox.TOptional<_$typebox.TString>;
-  logoUrl: _$typebox.TOptional<_$typebox.TString>;
-  registrationAllowed: _$typebox.TBoolean;
-  email: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-  username: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">, _$typebox.TLiteral<"email">]>;
-  usernameRegExp: _$typebox.TString;
-  usernameBlocklist: _$typebox.TArray<_$typebox.TString>;
-  phoneNumber: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-  verifyEmailRequired: _$typebox.TBoolean;
-  verifyPhoneRequired: _$typebox.TBoolean;
-  firstNameLastName: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-  resetPasswordAllowed: _$typebox.TBoolean;
-  captchaRequired: _$typebox.TBoolean;
-  adminEmails: _$typebox.TArray<_$typebox.TString>;
-  adminUsernames: _$typebox.TArray<_$typebox.TString>;
-  defaultRoles: _$typebox.TArray<_$typebox.TString>;
-  verifyEmailUrl: _$typebox.TOptional<_$typebox.TString>;
-  passwordPolicy: _$typebox.TObject<{
-    minLength: _$typebox.TInteger;
-    requireUppercase: _$typebox.TBoolean;
-    requireLowercase: _$typebox.TBoolean;
-    requireNumbers: _$typebox.TBoolean;
-    requireSpecialCharacters: _$typebox.TBoolean;
+declare const realmAuthSettingsAtom: import("alepha").Atom<import("typebox").TObject<{
+  displayName: import("typebox").TOptional<import("typebox").TString>;
+  description: import("typebox").TOptional<import("typebox").TString>;
+  logoUrl: import("typebox").TOptional<import("typebox").TString>;
+  registrationAllowed: import("typebox").TBoolean;
+  email: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+  username: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">, import("typebox").TLiteral<"email">]>;
+  usernameRegExp: import("typebox").TString;
+  usernameBlocklist: import("typebox").TArray<import("typebox").TString>;
+  phoneNumber: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+  verifyEmailRequired: import("typebox").TBoolean;
+  verifyPhoneRequired: import("typebox").TBoolean;
+  firstNameLastName: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+  resetPasswordAllowed: import("typebox").TBoolean;
+  captchaRequired: import("typebox").TBoolean;
+  adminEmails: import("typebox").TArray<import("typebox").TString>;
+  adminUsernames: import("typebox").TArray<import("typebox").TString>;
+  defaultRoles: import("typebox").TArray<import("typebox").TString>;
+  verifyEmailUrl: import("typebox").TOptional<import("typebox").TString>;
+  passwordPolicy: import("typebox").TObject<{
+    minLength: import("typebox").TInteger;
+    requireUppercase: import("typebox").TBoolean;
+    requireLowercase: import("typebox").TBoolean;
+    requireNumbers: import("typebox").TBoolean;
+    requireSpecialCharacters: import("typebox").TBoolean;
   }>;
-  loginRateLimit: _$typebox.TObject<{
-    ipMaxAttempts: _$typebox.TInteger;
-    accountMaxAttempts: _$typebox.TInteger;
-    windowMs: _$typebox.TInteger;
+  loginRateLimit: import("typebox").TObject<{
+    ipMaxAttempts: import("typebox").TInteger;
+    accountMaxAttempts: import("typebox").TInteger;
+    windowMs: import("typebox").TInteger;
   }>;
-  registrationIpMaxAttempts: _$typebox.TInteger;
-  refreshToken: _$typebox.TObject<{
-    expirationIdle: _$typebox.TOptional<_$typebox.TInteger>;
+  registrationIpMaxAttempts: import("typebox").TInteger;
+  refreshToken: import("typebox").TObject<{
+    expirationIdle: import("typebox").TOptional<import("typebox").TInteger>;
   }>;
 }>, "alepha.api.users.realmAuthSettings">;
 type RealmAuthSettings = Static<typeof realmAuthSettingsAtom.schema>;
 //#endregion
-//#region ../../src/api/users/audits/UserAudits.d.ts
-type AuditContext = Omit<CreateAudit, "type" | "action">;
+//#region ../../src/api/users/audits/SessionAudits.d.ts
 /**
- * User-specific audit wrapper service.
+ * Authentication & session-security audit events.
  *
- * This service wraps the core AuditService to provide user-related audit logging.
+ * Holds two audit types:
+ * - `auth` — login / logout / token refresh / MFA.
+ * - `security` — rate limiting, session invalidation, and related guards.
  *
- * Declared as a module variant — not auto-injected. It is instantiated
- * lazily the first time something calls `alepha.inject(UserAudits)`.
+ * Failed events are logged with `success: false`; severity (`warning`) is
+ * derived centrally in `AuditService.create`. Register as a module variant
+ * and log via the exposed primitives:
+ * `sessionAudits(realm)?.auth.log("login", { success: false, … })`.
+ */
+declare class SessionAudits {
+  readonly auth: import("alepha/api/audits").AuditPrimitive;
+  readonly security: import("alepha/api/audits").AuditPrimitive;
+}
+//#endregion
+//#region ../../src/api/users/audits/UserAudits.d.ts
+/**
+ * User-management audit events.
+ *
+ * Holds the `user` audit type. Mirrors the `$notification`/`$job` holder
+ * pattern (see {@link UserNotifications}) — register as a module variant and
+ * log via the exposed primitive: `userAudits(realm)?.user.log("create", …)`.
  */
 declare class UserAudits {
-  protected readonly auditService: AuditService;
-  /**
-   * Record a user-related audit event.
-   */
-  recordUser(action: "create" | "update" | "delete" | "role_change" | "enable" | "disable", context: AuditContext): Promise<{
-    description?: string | undefined;
-    userId?: string | undefined;
-    userRealm?: string | undefined;
-    userEmail?: string | undefined;
-    resourceType?: string | undefined;
-    resourceId?: string | undefined;
-    metadata?: Record<string, any> | undefined;
-    ipAddress?: string | undefined;
-    userAgent?: string | undefined;
-    sessionId?: string | undefined;
-    requestId?: string | undefined;
-    errorMessage?: string | undefined;
-    type: string;
-    action: string;
-    severity: "info" | "warning" | "critical";
-    success: boolean;
-    id: string;
-    createdAt: string;
-    organizationId: string;
-  }>;
-  /**
-   * Record an authentication-related audit event.
-   */
-  recordAuth(action: "login" | "logout" | "login_failed" | "token_refresh", context: AuditContext): Promise<{
-    description?: string | undefined;
-    userId?: string | undefined;
-    userRealm?: string | undefined;
-    userEmail?: string | undefined;
-    resourceType?: string | undefined;
-    resourceId?: string | undefined;
-    metadata?: Record<string, any> | undefined;
-    ipAddress?: string | undefined;
-    userAgent?: string | undefined;
-    sessionId?: string | undefined;
-    requestId?: string | undefined;
-    errorMessage?: string | undefined;
-    type: string;
-    action: string;
-    severity: "info" | "warning" | "critical";
-    success: boolean;
-    id: string;
-    createdAt: string;
-    organizationId: string;
-  }>;
-  /**
-   * Record a generic audit event.
-   */
-  record(category: string, action: string, context: AuditContext): Promise<{
-    description?: string | undefined;
-    userId?: string | undefined;
-    userRealm?: string | undefined;
-    userEmail?: string | undefined;
-    resourceType?: string | undefined;
-    resourceId?: string | undefined;
-    metadata?: Record<string, any> | undefined;
-    ipAddress?: string | undefined;
-    userAgent?: string | undefined;
-    sessionId?: string | undefined;
-    requestId?: string | undefined;
-    errorMessage?: string | undefined;
-    type: string;
-    action: string;
-    severity: "info" | "warning" | "critical";
-    success: boolean;
-    id: string;
-    createdAt: string;
-    organizationId: string;
-  }>;
+  readonly user: import("alepha/api/audits").AuditPrimitive;
 }
 //#endregion
 //#region ../../src/api/users/buckets/UserBuckets.d.ts
@@ -186,7 +117,7 @@ declare class UserBuckets {
   /**
    * Bucket for user avatar storage.
    */
-  readonly avatars: _$alepha_bucket0.BucketPrimitive;
+  readonly avatars: import("alepha/bucket").BucketPrimitive;
 }
 //#endregion
 //#region ../../src/orm/core/schemas/insertSchema.d.ts
@@ -944,7 +875,7 @@ type PgRelation<Base extends TObject> = {
     schema: TObject;
     name: string;
   };
-  on: SQLWrapper | [keyof Static<Base>, {
+  on: SQLWrapper | readonly [keyof Static<Base>, {
     name: string;
   }];
   with?: PgRelationMap<TObject>;
@@ -1154,13 +1085,13 @@ declare class DbCacheProvider {
  * the engine behind that call.
  */
 declare class SequenceProvider {
-  protected readonly repository: Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    name: _$typebox.TString;
-    scope: _$typebox.TString;
-    value: _$typebox.TInteger;
+  protected readonly repository: Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    name: import("typebox").TString;
+    scope: import("typebox").TString;
+    value: import("typebox").TInteger;
   }>>;
   protected readonly crypto: CryptoProvider$1;
   /**
@@ -1298,7 +1229,7 @@ declare abstract class ModelBuilder {
 //#endregion
 //#region ../../src/orm/core/providers/DrizzleKitProvider.d.ts
 declare class DrizzleKitProvider {
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly dateTime: DateTimeProvider;
   protected readonly alepha: Alepha;
   /**
@@ -1390,7 +1321,7 @@ type SQLLike = SQLWrapper | string;
 declare abstract class DatabaseProvider {
   protected readonly alepha: Alepha;
   protected readonly dateTime: DateTimeProvider;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected abstract readonly builder: ModelBuilder;
   protected readonly kit: DrizzleKitProvider;
   abstract readonly db: PgDatabase<any>;
@@ -1547,7 +1478,7 @@ declare class QueryManager {
   createPagination<T>(entities: T[], limit?: number, offset?: number, sort?: Array<{
     column: string;
     direction: "asc" | "desc";
-  }>): _$alepha.Page<T>;
+  }>): import("alepha").Page<T>;
 }
 interface PgJoin {
   table: string;
@@ -1582,7 +1513,7 @@ declare class PgRelationManager {
 declare abstract class Repository$1<T extends TObject> {
   readonly entity: EntityPrimitive<T>;
   readonly provider: DatabaseProvider;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly relationManager: PgRelationManager;
   protected readonly queryManager: QueryManager;
   protected readonly dateTimeProvider: DateTimeProvider;
@@ -1656,15 +1587,15 @@ declare abstract class Repository$1<T extends TObject> {
   /**
    * Start a SELECT query on the table.
    */
-  protected rawSelect(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgSelectBase<string, Record<string, PgColumn<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, {}, {}>>, "single", Record<string, "not-null">, false, never, {
+  protected rawSelect(opts?: StatementOptions): import("drizzle-orm/pg-core").PgSelectBase<string, Record<string, PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>>, "single", Record<string, "not-null">, false, never, {
     [x: string]: unknown;
   }[], {
-    [x: string]: PgColumn<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, {}, {}>;
+    [x: string]: PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>;
   }>;
   /**
    * Start a SELECT DISTINCT query on the table.
    */
-  protected rawSelectDistinct(opts?: StatementOptions, columns?: (keyof Static<T>)[]): _$drizzle_orm_pg_core0.PgSelectBase<string, Record<string, any>, "partial", Record<string, "not-null">, false, never, {
+  protected rawSelectDistinct(opts?: StatementOptions, columns?: (keyof Static<T>)[]): import("drizzle-orm/pg-core").PgSelectBase<string, Record<string, any>, "partial", Record<string, "not-null">, false, never, {
     [x: string]: any;
   }[], {
     [x: string]: any;
@@ -1672,15 +1603,15 @@ declare abstract class Repository$1<T extends TObject> {
   /**
    * Start an INSERT query on the table.
    */
-  protected rawInsert(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgInsertBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any, false>;
+  protected rawInsert(opts?: StatementOptions): import("drizzle-orm/pg-core").PgInsertBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any, false>;
   /**
    * Start an UPDATE query on the table.
    */
-  protected rawUpdate(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgUpdateBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any>;
+  protected rawUpdate(opts?: StatementOptions): import("drizzle-orm/pg-core").PgUpdateBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any>;
   /**
    * Start a DELETE query on the table.
    */
-  protected rawDelete(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgDeleteBase<PgTableWithColumns<SchemaToTableConfig<T>>, any, undefined, undefined, false, never>;
+  protected rawDelete(opts?: StatementOptions): import("drizzle-orm/pg-core").PgDeleteBase<PgTableWithColumns<SchemaToTableConfig<T>>, any, undefined, undefined, false, never>;
   /**
    * Create a Drizzle `select` query based on a JSON query object.
    *
@@ -1709,12 +1640,30 @@ declare abstract class Repository$1<T extends TObject> {
   }): Promise<Page<PgStatic<T, R>>>;
   /**
    * Find an entity by ID. Returns `undefined` if not found.
+   *
+   * Pass `with` to eager-load relations on the result — same `with` map
+   * shape as `findOne` / `paginate`. Without `with`, returns the plain
+   * row.
+   *
+   * @example
+   * ```ts
+   * const session = await sessions.findById(id, {
+   *   with: { user: { join: users, on: ["userId", users.cols.id] as const } },
+   * });
+   * session?.user?.email;
+   * ```
    */
-  findById(id: string | number, opts?: StatementOptions): Promise<Static<T> | undefined>;
+  findById<R extends PgRelationMap<T>>(id: string | number, opts?: StatementOptions & {
+    with?: R;
+  }): Promise<PgStatic<T, R> | undefined>;
   /**
    * Find an entity by ID. Throws `DbEntityNotFoundError` if not found.
+   *
+   * Pass `with` to eager-load relations — see {@link findById}.
    */
-  getById(id: string | number, opts?: StatementOptions): Promise<Static<T>>;
+  getById<R extends PgRelationMap<T>>(id: string | number, opts?: StatementOptions & {
+    with?: R;
+  }): Promise<PgStatic<T, R>>;
   /**
    * Helper to create a type-safe query object.
    */
@@ -1915,7 +1864,7 @@ declare abstract class Repository$1<T extends TObject> {
    */
   protected getPrimaryKey(schema: TObject): {
     key: string;
-    col: PgColumn<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, {}, {}>;
+    col: PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>;
     type: TSchema;
   };
 }
@@ -1984,8 +1933,8 @@ type WithSQL<T> = { [P in keyof T]?: T[P] | SQL };
  * - `d1://BINDING_NAME` — Cloudflare D1
  * - `hyperdrive://BINDING_NAME` — Cloudflare Hyperdrive
  */
-declare const databaseEnvSchema: _$typebox.TObject<{
-  DATABASE_URL: _$typebox.TOptional<_$typebox.TString>;
+declare const databaseEnvSchema: import("typebox").TObject<{
+  DATABASE_URL: import("typebox").TOptional<import("typebox").TString>;
   /**
    * Enable or disable push-based schema synchronization (drizzle-kit push).
    *
@@ -1993,34 +1942,34 @@ declare const databaseEnvSchema: _$typebox.TObject<{
    * Set to `false` in development to skip automatic schema sync
    * (e.g. when managing migrations manually).
    */
-  DATABASE_SYNC: _$typebox.TOptional<_$typebox.TBoolean>;
+  DATABASE_SYNC: import("typebox").TOptional<import("typebox").TBoolean>;
 }>;
 declare module "alepha" {
   interface Env extends Partial<Static<typeof databaseEnvSchema>> {}
 } //# sourceMappingURL=databaseEnvSchema.d.ts.map
 //#endregion
 //#region ../../src/api/users/entities/identities.d.ts
-declare const identities: _$alepha_orm0.EntityPrimitive<_$typebox.TObject<{
-  id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-  version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-  createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-  updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-  userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
-  password: _$typebox.TOptional<_$typebox.TString>;
-  provider: _$typebox.TString;
-  providerUserId: _$typebox.TOptional<_$typebox.TString>;
-  providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+declare const identities: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
+  password: import("typebox").TOptional<import("typebox").TString>;
+  provider: import("typebox").TString;
+  providerUserId: import("typebox").TOptional<import("typebox").TString>;
+  providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
 }>>;
 type IdentityEntity = Static<typeof identities.schema>;
 //#endregion
 //#region ../../src/api/users/entities/sessions.d.ts
-declare const sessions: _$alepha_orm0.EntityPrimitive<_$typebox.TObject<{
-  id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-  version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-  createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-  updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-  refreshToken: _$typebox.TString;
-  userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
+declare const sessions: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  refreshToken: import("typebox").TString;
+  userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
   /**
    * OAuth client this session was minted for, when it was created via the
    * OAuth 2.1 authorization flow — the `client_id` of an `oauth_clients`
@@ -2028,41 +1977,48 @@ declare const sessions: _$alepha_orm0.EntityPrimitive<_$typebox.TObject<{
    * key: `sessions` is a core entity and must not depend on the optional
    * OAuth module's table; the join to `oauth_clients` is done at query time.
    */
-  clientId: _$typebox.TOptional<_$typebox.TString>;
-  expiresAt: _$typebox.TString;
+  clientId: import("typebox").TOptional<import("typebox").TString>;
+  expiresAt: import("typebox").TString;
   /**
    * Last time the session was used to refresh an access token.
    * Used by realm `refreshToken.expirationIdle` to invalidate idle sessions.
    * `null` on existing rows pre-migration — falls back to `createdAt`.
    */
-  lastUsedAt: _$typebox.TOptional<_$typebox.TString>;
-  ip: _$typebox.TOptional<_$typebox.TString>;
-  userAgent: _$typebox.TOptional<_$typebox.TObject<{
-    os: _$typebox.TString;
-    browser: _$typebox.TString;
-    device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
+  ip: import("typebox").TOptional<import("typebox").TString>;
+  /**
+   * ISO 3166-1 alpha-2 country code derived from the request geo headers
+   * (`cf-ipcountry` on Cloudflare, CDN equivalents elsewhere) at login time.
+   * `null` on pre-migration rows and where geo isn't available.
+   */
+  country: import("typebox").TOptional<import("typebox").TString>;
+  userAgent: import("typebox").TOptional<import("typebox").TObject<{
+    os: import("typebox").TString;
+    browser: import("typebox").TString;
+    device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
   }>>;
 }>>;
 type SessionEntity = Static<typeof sessions.schema>;
 //#endregion
 //#region ../../src/api/users/entities/users.d.ts
 declare const DEFAULT_USER_REALM_NAME = "default";
-declare const users: _$alepha_orm0.EntityPrimitive<_$typebox.TObject<{
-  id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-  version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-  createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-  updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-  realm: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_DEFAULT>;
-  username: _$typebox.TOptional<_$typebox.TString>;
-  email: _$typebox.TOptional<_$typebox.TString>;
-  phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-  roles: _$alepha_orm0.PgAttr<_$typebox.TArray<_$typebox.TString>, typeof _$alepha_orm0.PG_DEFAULT>;
-  firstName: _$typebox.TOptional<_$typebox.TString>;
-  lastName: _$typebox.TOptional<_$typebox.TString>;
-  picture: _$typebox.TOptional<_$typebox.TString>;
-  enabled: _$alepha_orm0.PgAttr<_$typebox.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
-  emailVerified: _$alepha_orm0.PgAttr<_$typebox.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
-  organizationId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_ORGANIZATION>;
+declare const users: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  realm: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
+  username: import("typebox").TOptional<import("typebox").TString>;
+  email: import("typebox").TOptional<import("typebox").TString>;
+  phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+  roles: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
+  firstName: import("typebox").TOptional<import("typebox").TString>;
+  lastName: import("typebox").TOptional<import("typebox").TString>;
+  picture: import("typebox").TOptional<import("typebox").TString>;
+  enabled: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  emailVerified: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+  organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
 }>>;
 type UserEntity = Static<typeof users.schema>;
 //#endregion
@@ -2175,6 +2131,19 @@ interface RealmOptions {
     facebook?: true;
     microsoft?: true;
     franceconnect?: true;
+    /**
+     * Federated social login via a central broker (the platform).
+     *
+     * The broker performs the real OIDC dance with Google/Apple on a single
+     * shared OAuth client and hands this realm a short-lived, asymmetric-signed
+     * assertion. This realm verifies it (broker `publicKey`), links a local
+     * user, and establishes a session — no per-tenant OAuth client required.
+     */
+    federated?: {
+      /** Broker origin (assertion `iss`), e.g. https://alepha.club. */brokerUrl: string; /** Broker EdDSA public key (SPKI PEM) used to verify assertions. */
+      publicKey: string; /** Providers to surface as broker login buttons. */
+      providers: Array<"google" | "apple">;
+    };
   };
   /**
    * Enable or disable realm features.
@@ -2195,55 +2164,66 @@ interface Realm {
   repositories: RealmRepositories;
   settings: RealmAuthSettings;
   features: RealmFeatures;
+  /**
+   * Federated (broker) login config surfaced to the login UI, when the realm
+   * declares `identities.federated`. The broker public key is intentionally
+   * omitted — only the broker URL + provider list are client-facing.
+   */
+  federated?: {
+    brokerUrl: string;
+    providers: Array<"google" | "apple">;
+  };
   settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
   getSettings(): Promise<RealmAuthSettings>;
 }
 declare class RealmProvider {
   protected readonly alepha: Alepha;
-  protected readonly defaultIdentities: Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
-    password: _$typebox.TOptional<_$typebox.TString>;
-    provider: _$typebox.TString;
-    providerUserId: _$typebox.TOptional<_$typebox.TString>;
-    providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+  protected readonly defaultIdentities: Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
+    password: import("typebox").TOptional<import("typebox").TString>;
+    provider: import("typebox").TString;
+    providerUserId: import("typebox").TOptional<import("typebox").TString>;
+    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
   }>>;
-  protected readonly defaultSessions: Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    refreshToken: _$typebox.TString;
-    userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
-    clientId: _$typebox.TOptional<_$typebox.TString>;
-    expiresAt: _$typebox.TString;
-    lastUsedAt: _$typebox.TOptional<_$typebox.TString>;
-    ip: _$typebox.TOptional<_$typebox.TString>;
-    userAgent: _$typebox.TOptional<_$typebox.TObject<{
-      os: _$typebox.TString;
-      browser: _$typebox.TString;
-      device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  protected readonly defaultSessions: Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    refreshToken: import("typebox").TString;
+    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
+    clientId: import("typebox").TOptional<import("typebox").TString>;
+    expiresAt: import("typebox").TString;
+    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
+    ip: import("typebox").TOptional<import("typebox").TString>;
+    country: import("typebox").TOptional<import("typebox").TString>;
+    userAgent: import("typebox").TOptional<import("typebox").TObject<{
+      os: import("typebox").TString;
+      browser: import("typebox").TString;
+      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
-  protected readonly defaultUsers: Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    realm: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_DEFAULT>;
-    username: _$typebox.TOptional<_$typebox.TString>;
-    email: _$typebox.TOptional<_$typebox.TString>;
-    phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-    roles: _$alepha_orm0.PgAttr<_$typebox.TArray<_$typebox.TString>, typeof _$alepha_orm0.PG_DEFAULT>;
-    firstName: _$typebox.TOptional<_$typebox.TString>;
-    lastName: _$typebox.TOptional<_$typebox.TString>;
-    picture: _$typebox.TOptional<_$typebox.TString>;
-    enabled: _$alepha_orm0.PgAttr<_$typebox.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
-    emailVerified: _$alepha_orm0.PgAttr<_$typebox.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
-    organizationId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_ORGANIZATION>;
+  protected readonly defaultUsers: Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    realm: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+    roles: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
+    firstName: import("typebox").TOptional<import("typebox").TString>;
+    lastName: import("typebox").TOptional<import("typebox").TString>;
+    picture: import("typebox").TOptional<import("typebox").TString>;
+    enabled: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    emailVerified: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+    organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
   }>>;
   protected realms: Map<string, Realm>;
   register(realmName: string, realmOptions?: RealmOptions): Realm;
@@ -2257,31 +2237,31 @@ declare class RealmProvider {
 }
 //#endregion
 //#region ../../src/api/users/schemas/identityQuerySchema.d.ts
-declare const identityQuerySchema: _$typebox.TObject<{
-  page: _$typebox.TOptional<_$typebox.TInteger>;
-  size: _$typebox.TOptional<_$typebox.TInteger>;
-  sort: _$typebox.TOptional<_$typebox.TString>;
-  userId: _$typebox.TOptional<_$typebox.TString>;
-  provider: _$typebox.TOptional<_$typebox.TString>;
+declare const identityQuerySchema: import("typebox").TObject<{
+  page: import("typebox").TOptional<import("typebox").TInteger>;
+  size: import("typebox").TOptional<import("typebox").TInteger>;
+  sort: import("typebox").TOptional<import("typebox").TString>;
+  userId: import("typebox").TOptional<import("typebox").TString>;
+  provider: import("typebox").TOptional<import("typebox").TString>;
 }>;
 type IdentityQuery = Static<typeof identityQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/IdentityService.d.ts
 declare class IdentityService {
   protected readonly alepha: Alepha;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly realmProvider: RealmProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
-  identities(userRealmName?: string): _$alepha_orm0.Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
-    password: _$typebox.TOptional<_$typebox.TString>;
-    provider: _$typebox.TString;
-    providerUserId: _$typebox.TOptional<_$typebox.TString>;
-    providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+  identities(userRealmName?: string): import("alepha/orm").Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
+    password: import("typebox").TOptional<import("typebox").TString>;
+    provider: import("typebox").TString;
+    providerUserId: import("typebox").TOptional<import("typebox").TString>;
+    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
   }>>;
   /**
    * Find identities with pagination and filtering.
@@ -2305,93 +2285,94 @@ declare class AdminIdentityController {
   /**
    * Find identities with pagination and filtering.
    */
-  readonly findIdentities: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      page: _$typebox.TOptional<_$typebox.TInteger>;
-      size: _$typebox.TOptional<_$typebox.TInteger>;
-      sort: _$typebox.TOptional<_$typebox.TString>;
-      userId: _$typebox.TOptional<_$typebox.TString>;
-      provider: _$typebox.TOptional<_$typebox.TString>;
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$alepha.TPage<_$typebox.TObject<{
-      userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      provider: _$typebox.TString;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      providerUserId: _$typebox.TOptional<_$typebox.TString>;
-      providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+  readonly findIdentities: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      page: import("typebox").TOptional<import("typebox").TInteger>;
+      size: import("typebox").TOptional<import("typebox").TInteger>;
+      sort: import("typebox").TOptional<import("typebox").TString>;
+      userId: import("typebox").TOptional<import("typebox").TString>;
+      provider: import("typebox").TOptional<import("typebox").TString>;
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("alepha").TPage<import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+      provider: import("typebox").TString;
+      providerUserId: import("typebox").TOptional<import("typebox").TString>;
+      providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
     }>>;
   }>;
   /**
    * Get an identity by ID.
    */
-  readonly getIdentity: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
+  readonly getIdentity: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
     }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      provider: _$typebox.TString;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      providerUserId: _$typebox.TOptional<_$typebox.TString>;
-      providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+    response: import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+      provider: import("typebox").TString;
+      providerUserId: import("typebox").TOptional<import("typebox").TString>;
+      providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
     }>;
   }>;
   /**
    * Delete an identity.
    */
-  readonly deleteIdentity: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
+  readonly deleteIdentity: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
     }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      ok: _$typebox.TBoolean;
-      id: _$typebox.TOptional<_$typebox.TUnion<[_$typebox.TString, _$typebox.TInteger]>>;
-      count: _$typebox.TOptional<_$typebox.TNumber>;
+    response: import("typebox").TObject<{
+      ok: import("typebox").TBoolean;
+      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
+      count: import("typebox").TOptional<import("typebox").TNumber>;
     }>;
   }>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/sessionQuerySchema.d.ts
-declare const sessionQuerySchema: _$typebox.TObject<{
-  page: _$typebox.TOptional<_$typebox.TInteger>;
-  size: _$typebox.TOptional<_$typebox.TInteger>;
-  sort: _$typebox.TOptional<_$typebox.TString>;
-  userId: _$typebox.TOptional<_$typebox.TString>;
+declare const sessionQuerySchema: import("typebox").TObject<{
+  page: import("typebox").TOptional<import("typebox").TInteger>;
+  size: import("typebox").TOptional<import("typebox").TInteger>;
+  sort: import("typebox").TOptional<import("typebox").TString>;
+  userId: import("typebox").TOptional<import("typebox").TString>;
 }>;
 type SessionQuery = Static<typeof sessionQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/SessionCrudService.d.ts
 declare class SessionCrudService {
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly realmProvider: RealmProvider;
-  sessions(userRealmName?: string): _$alepha_orm0.Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    refreshToken: _$typebox.TString;
-    userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
-    clientId: _$typebox.TOptional<_$typebox.TString>;
-    expiresAt: _$typebox.TString;
-    lastUsedAt: _$typebox.TOptional<_$typebox.TString>;
-    ip: _$typebox.TOptional<_$typebox.TString>;
-    userAgent: _$typebox.TOptional<_$typebox.TObject<{
-      os: _$typebox.TString;
-      browser: _$typebox.TString;
-      device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  sessions(userRealmName?: string): import("alepha/orm").Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    refreshToken: import("typebox").TString;
+    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
+    clientId: import("typebox").TOptional<import("typebox").TString>;
+    expiresAt: import("typebox").TString;
+    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
+    ip: import("typebox").TOptional<import("typebox").TString>;
+    country: import("typebox").TOptional<import("typebox").TString>;
+    userAgent: import("typebox").TOptional<import("typebox").TObject<{
+      os: import("typebox").TString;
+      browser: import("typebox").TString;
+      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
   /**
@@ -2420,190 +2401,213 @@ declare class AdminSessionController {
   /**
    * Find sessions with pagination and filtering.
    */
-  readonly findSessions: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      page: _$typebox.TOptional<_$typebox.TInteger>;
-      size: _$typebox.TOptional<_$typebox.TInteger>;
-      sort: _$typebox.TOptional<_$typebox.TString>;
-      userId: _$typebox.TOptional<_$typebox.TString>;
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$alepha.TPage<_$typebox.TObject<{
-      id: _$typebox.TString;
-      version: _$typebox.TNumber;
-      createdAt: _$typebox.TString;
-      updatedAt: _$typebox.TString;
-      refreshToken: _$typebox.TString;
-      userId: _$typebox.TString;
-      expiresAt: _$typebox.TString;
-      ip: _$typebox.TOptional<_$typebox.TString>;
-      userAgent: _$typebox.TOptional<_$typebox.TObject<{
-        os: _$typebox.TString;
-        browser: _$typebox.TString;
-        device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  readonly findSessions: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      page: import("typebox").TOptional<import("typebox").TInteger>;
+      size: import("typebox").TOptional<import("typebox").TInteger>;
+      sort: import("typebox").TOptional<import("typebox").TString>;
+      userId: import("typebox").TOptional<import("typebox").TString>;
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("alepha").TPage<import("typebox").TObject<{
+      id: import("typebox").TString;
+      version: import("typebox").TNumber;
+      createdAt: import("typebox").TString;
+      updatedAt: import("typebox").TString;
+      refreshToken: import("typebox").TString;
+      userId: import("typebox").TString;
+      expiresAt: import("typebox").TString;
+      ip: import("typebox").TOptional<import("typebox").TString>;
+      country: import("typebox").TOptional<import("typebox").TString>;
+      userAgent: import("typebox").TOptional<import("typebox").TObject<{
+        os: import("typebox").TString;
+        browser: import("typebox").TString;
+        device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+      }>>;
+      user: import("typebox").TOptional<import("typebox").TObject<{
+        id: import("typebox").TString;
+        email: import("typebox").TOptional<import("typebox").TString>;
+        username: import("typebox").TOptional<import("typebox").TString>;
+        firstName: import("typebox").TOptional<import("typebox").TString>;
+        lastName: import("typebox").TOptional<import("typebox").TString>;
       }>>;
     }>>;
   }>;
   /**
    * Get a session by ID.
    */
-  readonly getSession: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
-    }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$typebox.TObject<{
-      id: _$typebox.TString;
-      version: _$typebox.TNumber;
-      createdAt: _$typebox.TString;
-      updatedAt: _$typebox.TString;
-      refreshToken: _$typebox.TString;
-      userId: _$typebox.TString;
-      expiresAt: _$typebox.TString;
-      ip: _$typebox.TOptional<_$typebox.TString>;
-      userAgent: _$typebox.TOptional<_$typebox.TObject<{
-        os: _$typebox.TString;
-        browser: _$typebox.TString;
-        device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  readonly getSession: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
+    }>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("typebox").TObject<{
+      id: import("typebox").TString;
+      version: import("typebox").TNumber;
+      createdAt: import("typebox").TString;
+      updatedAt: import("typebox").TString;
+      refreshToken: import("typebox").TString;
+      userId: import("typebox").TString;
+      expiresAt: import("typebox").TString;
+      ip: import("typebox").TOptional<import("typebox").TString>;
+      country: import("typebox").TOptional<import("typebox").TString>;
+      userAgent: import("typebox").TOptional<import("typebox").TObject<{
+        os: import("typebox").TString;
+        browser: import("typebox").TString;
+        device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+      }>>;
+      user: import("typebox").TOptional<import("typebox").TObject<{
+        id: import("typebox").TString;
+        email: import("typebox").TOptional<import("typebox").TString>;
+        username: import("typebox").TOptional<import("typebox").TString>;
+        firstName: import("typebox").TOptional<import("typebox").TString>;
+        lastName: import("typebox").TOptional<import("typebox").TString>;
       }>>;
     }>;
   }>;
   /**
    * Delete a session.
    */
-  readonly deleteSession: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
+  readonly deleteSession: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
     }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      ok: _$typebox.TBoolean;
-      id: _$typebox.TOptional<_$typebox.TUnion<[_$typebox.TString, _$typebox.TInteger]>>;
-      count: _$typebox.TOptional<_$typebox.TNumber>;
+    response: import("typebox").TObject<{
+      ok: import("typebox").TBoolean;
+      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
+      count: import("typebox").TOptional<import("typebox").TNumber>;
     }>;
   }>;
   /**
    * Delete many sessions in one repository call.
    */
-  readonly deleteSessions: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  readonly deleteSessions: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      ids: _$typebox.TArray<_$typebox.TString>;
+    body: import("typebox").TObject<{
+      ids: import("typebox").TArray<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      deleted: _$typebox.TArray<_$typebox.TString>;
+    response: import("typebox").TObject<{
+      deleted: import("typebox").TArray<import("typebox").TString>;
     }>;
   }>;
 }
 //#endregion
 //#region ../../src/api/users/notifications/UserNotifications.d.ts
 declare class UserNotifications {
-  readonly passwordReset: _$alepha_api_notifications0.NotificationPrimitive<_$typebox.TObject<{
-    email: _$typebox.TString;
-    code: _$typebox.TString;
-    expiresInMinutes: _$typebox.TNumber;
+  readonly passwordReset: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
+    email: import("typebox").TString;
+    code: import("typebox").TString;
+    expiresInMinutes: import("typebox").TNumber;
   }>>;
-  readonly emailVerification: _$alepha_api_notifications0.NotificationPrimitive<_$typebox.TObject<{
-    email: _$typebox.TString;
-    code: _$typebox.TString;
-    expiresInMinutes: _$typebox.TNumber;
+  readonly emailVerification: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
+    email: import("typebox").TString;
+    code: import("typebox").TString;
+    expiresInMinutes: import("typebox").TNumber;
   }>>;
-  readonly phoneVerification: _$alepha_api_notifications0.NotificationPrimitive<_$typebox.TObject<{
-    phoneNumber: _$typebox.TString;
-    code: _$typebox.TString;
-    expiresInMinutes: _$typebox.TNumber;
+  readonly phoneVerification: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
+    phoneNumber: import("typebox").TString;
+    code: import("typebox").TString;
+    expiresInMinutes: import("typebox").TNumber;
   }>>;
-  readonly passwordResetLink: _$alepha_api_notifications0.NotificationPrimitive<_$typebox.TObject<{
-    email: _$typebox.TString;
-    resetUrl: _$typebox.TString;
-    expiresInMinutes: _$typebox.TNumber;
+  readonly passwordResetLink: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
+    email: import("typebox").TString;
+    resetUrl: import("typebox").TString;
+    expiresInMinutes: import("typebox").TNumber;
   }>>;
-  readonly accountLockout: _$alepha_api_notifications0.NotificationPrimitive<_$typebox.TObject<{
-    email: _$typebox.TString;
-    lockoutMinutes: _$typebox.TNumber;
+  readonly accountLockout: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
+    email: import("typebox").TString;
+    lockoutMinutes: import("typebox").TNumber;
   }>>;
-  readonly emailVerificationLink: _$alepha_api_notifications0.NotificationPrimitive<_$typebox.TObject<{
-    email: _$typebox.TString;
-    verifyUrl: _$typebox.TString;
-    expiresInMinutes: _$typebox.TNumber;
+  readonly emailVerificationLink: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
+    email: import("typebox").TString;
+    verifyUrl: import("typebox").TString;
+    expiresInMinutes: import("typebox").TNumber;
   }>>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/createUserSchema.d.ts
-declare const createUserSchema: _$typebox.TObject<{
-  email: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  id: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
-  createdAt: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
-  organizationId: _$typebox.TOptional<PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>>;
-  phoneNumber: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  version: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
-  updatedAt: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
-  username: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  roles: _$typebox.TOptional<PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>>;
-  firstName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  lastName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  picture: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  enabled: _$typebox.TOptional<PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>>;
-  emailVerified: _$typebox.TOptional<PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>>;
+declare const createUserSchema: import("typebox").TObject<{
+  enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+  email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  id: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
+  version: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
+  createdAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
+  updatedAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
+  username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
+  firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+  lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
 }>;
 type CreateUser = Static<typeof createUserSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/updateUserSchema.d.ts
-declare const updateUserSchema: _$typebox.TObject<{
-  email: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  organizationId: _$typebox.TOptional<PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>>;
-  phoneNumber: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  realm: _$typebox.TOptional<PgAttr<_$typebox.TString, typeof PG_DEFAULT>>;
-  roles: _$typebox.TOptional<PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>>;
-  firstName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  lastName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  picture: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-  enabled: _$typebox.TOptional<PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>>;
+declare const updateUserSchema: import("typebox").TObject<{
+  enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+  email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  realm: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_DEFAULT>>;
+  username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
+  firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+  lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+  organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
 }>;
 type UpdateUser = Static<typeof updateUserSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/userQuerySchema.d.ts
-declare const userQuerySchema: _$typebox.TObject<{
-  page: _$typebox.TOptional<_$typebox.TInteger>;
-  size: _$typebox.TOptional<_$typebox.TInteger>;
-  sort: _$typebox.TOptional<_$typebox.TString>;
-  email: _$typebox.TOptional<_$typebox.TString>;
-  enabled: _$typebox.TOptional<_$typebox.TBoolean>;
-  emailVerified: _$typebox.TOptional<_$typebox.TBoolean>;
-  roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+declare const userQuerySchema: import("typebox").TObject<{
+  page: import("typebox").TOptional<import("typebox").TInteger>;
+  size: import("typebox").TOptional<import("typebox").TInteger>;
+  sort: import("typebox").TOptional<import("typebox").TString>;
+  search: import("typebox").TOptional<import("typebox").TString>;
+  email: import("typebox").TOptional<import("typebox").TString>;
+  enabled: import("typebox").TOptional<import("typebox").TBoolean>;
+  emailVerified: import("typebox").TOptional<import("typebox").TBoolean>;
+  roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
 }>;
 type UserQuery = Static<typeof userQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/UserService.d.ts
 declare class UserService {
   protected readonly alepha: Alepha;
-  protected readonly log: _$alepha_logger0.Logger;
-  protected readonly verificationController: _$alepha_server_links0.HttpVirtualClient<VerificationController>;
+  protected readonly log: import("alepha/logger").Logger;
+  protected readonly verificationController: import("alepha/server/links").HttpVirtualClient<VerificationController>;
   protected readonly realmProvider: RealmProvider;
+  protected readonly cryptoProvider: CryptoProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  users(userRealmName?: string): _$alepha_orm0.Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    realm: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_DEFAULT>;
-    username: _$typebox.TOptional<_$typebox.TString>;
-    email: _$typebox.TOptional<_$typebox.TString>;
-    phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-    roles: _$alepha_orm0.PgAttr<_$typebox.TArray<_$typebox.TString>, typeof _$alepha_orm0.PG_DEFAULT>;
-    firstName: _$typebox.TOptional<_$typebox.TString>;
-    lastName: _$typebox.TOptional<_$typebox.TString>;
-    picture: _$typebox.TOptional<_$typebox.TString>;
-    enabled: _$alepha_orm0.PgAttr<_$typebox.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
-    emailVerified: _$alepha_orm0.PgAttr<_$typebox.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
-    organizationId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_ORGANIZATION>;
+  users(userRealmName?: string): import("alepha/orm").Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    realm: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+    roles: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
+    firstName: import("typebox").TOptional<import("typebox").TString>;
+    lastName: import("typebox").TOptional<import("typebox").TString>;
+    picture: import("typebox").TOptional<import("typebox").TString>;
+    enabled: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    emailVerified: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+    organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
   }>>;
   /**
    * Request email verification for a user.
@@ -2638,6 +2642,13 @@ declare class UserService {
    * Update an existing user.
    */
   updateUser(id: string, data: UpdateUser, userRealmName?: string): Promise<UserEntity>;
+  /**
+   * Set (or reset) a user's password. Upserts a "credentials" identity
+   * with the new hash. Used by admin password-set flows; does NOT
+   * verify any old password or token — the caller is responsible for
+   * authorization.
+   */
+  setPassword(id: string, newPassword: string, userRealmName?: string): Promise<void>;
   /**
    * Delete a user by ID.
    */
@@ -2649,160 +2660,205 @@ declare class AdminUserController {
   protected readonly url = "/users";
   protected readonly group = "admin:users";
   protected readonly userService: UserService;
+  protected readonly securityProvider: SecurityProvider;
+  /**
+   * List roles available in a realm. Used by the admin UI to render the
+   * role picker and grey out defaults (which cannot be removed).
+   */
+  readonly findRoles: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("typebox").TArray<import("typebox").TObject<{
+      name: import("typebox").TString;
+      default: import("typebox").TOptional<import("typebox").TBoolean>;
+      description: import("typebox").TOptional<import("typebox").TString>;
+    }>>;
+  }>;
   /**
    * Find users with pagination and filtering.
    */
-  readonly findUsers: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      page: _$typebox.TOptional<_$typebox.TInteger>;
-      size: _$typebox.TOptional<_$typebox.TInteger>;
-      sort: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      enabled: _$typebox.TOptional<_$typebox.TBoolean>;
-      emailVerified: _$typebox.TOptional<_$typebox.TBoolean>;
-      roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$alepha.TPage<_$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  readonly findUsers: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      page: import("typebox").TOptional<import("typebox").TInteger>;
+      size: import("typebox").TOptional<import("typebox").TInteger>;
+      sort: import("typebox").TOptional<import("typebox").TString>;
+      search: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      enabled: import("typebox").TOptional<import("typebox").TBoolean>;
+      emailVerified: import("typebox").TOptional<import("typebox").TBoolean>;
+      roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("alepha").TPage<import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
     }>>;
   }>;
   /**
    * Get a user by ID.
    */
-  readonly getUser: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
-    }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  readonly getUser: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
+    }>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Create a new user.
    */
-  readonly createUser: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      id: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
-      createdAt: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
-      organizationId: _$typebox.TOptional<PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      version: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
-      updatedAt: _$typebox.TOptional<PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
-      username: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      roles: _$typebox.TOptional<PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>>;
-      firstName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      lastName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      picture: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      enabled: _$typebox.TOptional<PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>>;
-      emailVerified: _$typebox.TOptional<PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>>;
-    }>;
-    response: _$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  readonly createUser: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    body: import("typebox").TObject<{
+      enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+      email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      id: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
+      version: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
+      createdAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
+      updatedAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
+      username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
+      firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
+    }>;
+    response: import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Update a user.
    */
-  readonly updateUser: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
-    }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      organizationId: _$typebox.TOptional<PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      realm: _$typebox.TOptional<PgAttr<_$typebox.TString, typeof PG_DEFAULT>>;
-      roles: _$typebox.TOptional<PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>>;
-      firstName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      lastName: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      picture: _$typebox.TOptional<_$typebox.TOptional<_$typebox.TString>>;
-      enabled: _$typebox.TOptional<PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>>;
-    }>;
-    response: _$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  readonly updateUser: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
+    }>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    body: import("typebox").TObject<{
+      enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+      email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      realm: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_DEFAULT>>;
+      username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
+      firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
+      organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
+    }>;
+    response: import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
+    }>;
+  }>;
+  /**
+   * Set (or reset) a user's password. Admin-only flow — does NOT
+   * require knowing the previous password. Hash is stored as a
+   * "credentials" identity for the user (upsert).
+   */
+  readonly setUserPassword: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
+    }>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    body: import("typebox").TObject<{
+      password: import("typebox").TString;
+    }>;
+    response: import("typebox").TObject<{
+      ok: import("typebox").TBoolean;
+      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
+      count: import("typebox").TOptional<import("typebox").TNumber>;
     }>;
   }>;
   /**
    * Delete a user.
    */
-  readonly deleteUser: _$alepha_server0.ActionPrimitiveFn<{
-    params: _$typebox.TObject<{
-      id: _$typebox.TString;
+  readonly deleteUser: import("alepha/server").ActionPrimitiveFn<{
+    params: import("typebox").TObject<{
+      id: import("typebox").TString;
     }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      ok: _$typebox.TBoolean;
-      id: _$typebox.TOptional<_$typebox.TUnion<[_$typebox.TString, _$typebox.TInteger]>>;
-      count: _$typebox.TOptional<_$typebox.TNumber>;
+    response: import("typebox").TObject<{
+      ok: import("typebox").TBoolean;
+      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
+      count: import("typebox").TOptional<import("typebox").TNumber>;
     }>;
   }>;
   /**
@@ -2810,15 +2866,15 @@ declare class AdminUserController {
    * cascades and side-effects run as if called one-by-one. Errors on a single
    * id surface with that id in the response.
    */
-  readonly deleteUsers: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  readonly deleteUsers: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      ids: _$typebox.TArray<_$typebox.TString>;
+    body: import("typebox").TObject<{
+      ids: import("typebox").TArray<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      deleted: _$typebox.TArray<_$typebox.TString>;
+    response: import("typebox").TObject<{
+      deleted: import("typebox").TArray<import("typebox").TString>;
     }>;
   }>;
 }
@@ -2838,64 +2894,68 @@ declare class RealmController {
    * Get realm configuration settings.
    * This endpoint is not exposed in the API documentation.
    */
-  readonly getRealmConfig: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      realmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$typebox.TObject<{
-      settings: _$typebox.TObject<{
-        displayName: _$typebox.TOptional<_$typebox.TString>;
-        description: _$typebox.TOptional<_$typebox.TString>;
-        logoUrl: _$typebox.TOptional<_$typebox.TString>;
-        registrationAllowed: _$typebox.TBoolean;
-        email: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-        username: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">, _$typebox.TLiteral<"email">]>;
-        usernameRegExp: _$typebox.TString;
-        usernameBlocklist: _$typebox.TArray<_$typebox.TString>;
-        phoneNumber: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-        verifyEmailRequired: _$typebox.TBoolean;
-        verifyPhoneRequired: _$typebox.TBoolean;
-        firstNameLastName: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-        resetPasswordAllowed: _$typebox.TBoolean;
-        captchaRequired: _$typebox.TBoolean;
-        adminEmails: _$typebox.TArray<_$typebox.TString>;
-        adminUsernames: _$typebox.TArray<_$typebox.TString>;
-        defaultRoles: _$typebox.TArray<_$typebox.TString>;
-        verifyEmailUrl: _$typebox.TOptional<_$typebox.TString>;
-        passwordPolicy: _$typebox.TObject<{
-          minLength: _$typebox.TInteger;
-          requireUppercase: _$typebox.TBoolean;
-          requireLowercase: _$typebox.TBoolean;
-          requireNumbers: _$typebox.TBoolean;
-          requireSpecialCharacters: _$typebox.TBoolean;
+  readonly getRealmConfig: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      realmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("typebox").TObject<{
+      settings: import("typebox").TObject<{
+        displayName: import("typebox").TOptional<import("typebox").TString>;
+        description: import("typebox").TOptional<import("typebox").TString>;
+        logoUrl: import("typebox").TOptional<import("typebox").TString>;
+        registrationAllowed: import("typebox").TBoolean;
+        email: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+        username: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">, import("typebox").TLiteral<"email">]>;
+        usernameRegExp: import("typebox").TString;
+        usernameBlocklist: import("typebox").TArray<import("typebox").TString>;
+        phoneNumber: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+        verifyEmailRequired: import("typebox").TBoolean;
+        verifyPhoneRequired: import("typebox").TBoolean;
+        firstNameLastName: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+        resetPasswordAllowed: import("typebox").TBoolean;
+        captchaRequired: import("typebox").TBoolean;
+        adminEmails: import("typebox").TArray<import("typebox").TString>;
+        adminUsernames: import("typebox").TArray<import("typebox").TString>;
+        defaultRoles: import("typebox").TArray<import("typebox").TString>;
+        verifyEmailUrl: import("typebox").TOptional<import("typebox").TString>;
+        passwordPolicy: import("typebox").TObject<{
+          minLength: import("typebox").TInteger;
+          requireUppercase: import("typebox").TBoolean;
+          requireLowercase: import("typebox").TBoolean;
+          requireNumbers: import("typebox").TBoolean;
+          requireSpecialCharacters: import("typebox").TBoolean;
         }>;
-        loginRateLimit: _$typebox.TObject<{
-          ipMaxAttempts: _$typebox.TInteger;
-          accountMaxAttempts: _$typebox.TInteger;
-          windowMs: _$typebox.TInteger;
+        loginRateLimit: import("typebox").TObject<{
+          ipMaxAttempts: import("typebox").TInteger;
+          accountMaxAttempts: import("typebox").TInteger;
+          windowMs: import("typebox").TInteger;
         }>;
-        registrationIpMaxAttempts: _$typebox.TInteger;
-        refreshToken: _$typebox.TObject<{
-          expirationIdle: _$typebox.TOptional<_$typebox.TInteger>;
+        registrationIpMaxAttempts: import("typebox").TInteger;
+        refreshToken: import("typebox").TObject<{
+          expirationIdle: import("typebox").TOptional<import("typebox").TInteger>;
         }>;
       }>;
-      realmName: _$typebox.TString;
-      authenticationMethods: _$typebox.TArray<_$typebox.TObject<{
-        name: _$typebox.TString;
-        type: _$typebox.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+      realmName: import("typebox").TString;
+      authenticationMethods: import("typebox").TArray<import("typebox").TObject<{
+        name: import("typebox").TString;
+        type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+      }>>;
+      captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
+      federated: import("typebox").TOptional<import("typebox").TObject<{
+        brokerUrl: import("typebox").TString;
+        providers: import("typebox").TArray<import("typebox").TUnion<[import("typebox").TLiteral<"google">, import("typebox").TLiteral<"apple">]>>;
       }>>;
-      captchaSiteKey: _$typebox.TOptional<_$typebox.TString>;
     }>;
   }>;
-  readonly checkUsernameAvailability: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      realmName: _$typebox.TOptional<_$typebox.TString>;
+  readonly checkUsernameAvailability: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      realmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      username: _$typebox.TString;
+    body: import("typebox").TObject<{
+      username: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      available: _$typebox.TBoolean;
+    response: import("typebox").TObject<{
+      available: import("typebox").TBoolean;
     }>;
   }>;
 }
@@ -2907,10 +2967,10 @@ declare class RealmController {
  * Requires the intent ID from Phase 1, the verification code,
  * and the new password.
  */
-declare const completePasswordResetRequestSchema: _$typebox.TObject<{
-  intentId: _$typebox.TString;
-  code: _$typebox.TString;
-  newPassword: _$typebox.TString;
+declare const completePasswordResetRequestSchema: import("typebox").TObject<{
+  intentId: import("typebox").TString;
+  code: import("typebox").TString;
+  newPassword: import("typebox").TString;
 }>;
 type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSchema>;
 //#endregion
@@ -2921,9 +2981,9 @@ type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSc
  * Contains the intent ID needed for Phase 2 completion,
  * along with expiration time.
  */
-declare const passwordResetIntentResponseSchema: _$typebox.TObject<{
-  intentId: _$typebox.TString;
-  expiresAt: _$typebox.TString;
+declare const passwordResetIntentResponseSchema: import("typebox").TObject<{
+  intentId: import("typebox").TString;
+  expiresAt: import("typebox").TString;
 }>;
 type PasswordResetIntentResponse = Static<typeof passwordResetIntentResponseSchema>;
 //#endregion
@@ -2940,58 +3000,61 @@ interface PasswordResetIntent {
 }
 declare class CredentialService {
   protected readonly alepha: Alepha;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly cryptoProvider: CryptoProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly verificationService: VerificationService;
   protected readonly realmProvider: RealmProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
+  protected sessionAudits(realmName?: string): SessionAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  protected readonly intentCache: _$alepha_cache0.CacheMiddlewareFn<PasswordResetIntent>;
-  users(userRealmName?: string): Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-    username: _$typebox.TOptional<_$typebox.TString>;
-    email: _$typebox.TOptional<_$typebox.TString>;
-    phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-    roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-    firstName: _$typebox.TOptional<_$typebox.TString>;
-    lastName: _$typebox.TOptional<_$typebox.TString>;
-    picture: _$typebox.TOptional<_$typebox.TString>;
-    enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-    emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-    organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  protected readonly intentCache: import("alepha/cache").CacheMiddlewareFn<PasswordResetIntent>;
+  users(userRealmName?: string): Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+    roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+    firstName: import("typebox").TOptional<import("typebox").TString>;
+    lastName: import("typebox").TOptional<import("typebox").TString>;
+    picture: import("typebox").TOptional<import("typebox").TString>;
+    enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+    emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+    organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
   }>>;
-  sessions(userRealmName?: string): Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    refreshToken: _$typebox.TString;
-    userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-    clientId: _$typebox.TOptional<_$typebox.TString>;
-    expiresAt: _$typebox.TString;
-    lastUsedAt: _$typebox.TOptional<_$typebox.TString>;
-    ip: _$typebox.TOptional<_$typebox.TString>;
-    userAgent: _$typebox.TOptional<_$typebox.TObject<{
-      os: _$typebox.TString;
-      browser: _$typebox.TString;
-      device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  sessions(userRealmName?: string): Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: import("typebox").TString;
+    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+    clientId: import("typebox").TOptional<import("typebox").TString>;
+    expiresAt: import("typebox").TString;
+    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
+    ip: import("typebox").TOptional<import("typebox").TString>;
+    country: import("typebox").TOptional<import("typebox").TString>;
+    userAgent: import("typebox").TOptional<import("typebox").TObject<{
+      os: import("typebox").TString;
+      browser: import("typebox").TString;
+      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
-  identities(userRealmName?: string): Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-    password: _$typebox.TOptional<_$typebox.TString>;
-    provider: _$typebox.TString;
-    providerUserId: _$typebox.TOptional<_$typebox.TString>;
-    providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+  identities(userRealmName?: string): Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+    password: import("typebox").TOptional<import("typebox").TString>;
+    provider: import("typebox").TString;
+    providerUserId: import("typebox").TOptional<import("typebox").TString>;
+    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
   }>>;
   /**
    * Validate a password against the realm's password policy.
@@ -3032,11 +3095,11 @@ declare class CredentialService {
 }
 //#endregion
 //#region ../../src/api/users/schemas/completeRegistrationRequestSchema.d.ts
-declare const completeRegistrationRequestSchema: _$typebox.TObject<{
-  intentId: _$typebox.TString;
-  emailCode: _$typebox.TOptional<_$typebox.TString>;
-  phoneCode: _$typebox.TOptional<_$typebox.TString>;
-  captchaToken: _$typebox.TOptional<_$typebox.TString>;
+declare const completeRegistrationRequestSchema: import("typebox").TObject<{
+  intentId: import("typebox").TString;
+  emailCode: import("typebox").TOptional<import("typebox").TString>;
+  phoneCode: import("typebox").TOptional<import("typebox").TString>;
+  captchaToken: import("typebox").TOptional<import("typebox").TString>;
 }>;
 type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSchema>;
 //#endregion
@@ -3045,26 +3108,26 @@ type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSche
  * Schema for user registration request body.
  * Password is always required, other fields depend on realm settings.
  */
-declare const registerRequestSchema: _$typebox.TObject<{
-  password: _$typebox.TString;
-  username: _$typebox.TOptional<_$typebox.TString>;
-  email: _$typebox.TOptional<_$typebox.TString>;
-  phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-  firstName: _$typebox.TOptional<_$typebox.TString>;
-  lastName: _$typebox.TOptional<_$typebox.TString>;
-  picture: _$typebox.TOptional<_$typebox.TString>;
-  captchaToken: _$typebox.TOptional<_$typebox.TString>;
+declare const registerRequestSchema: import("typebox").TObject<{
+  password: import("typebox").TString;
+  username: import("typebox").TOptional<import("typebox").TString>;
+  email: import("typebox").TOptional<import("typebox").TString>;
+  phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+  firstName: import("typebox").TOptional<import("typebox").TString>;
+  lastName: import("typebox").TOptional<import("typebox").TString>;
+  picture: import("typebox").TOptional<import("typebox").TString>;
+  captchaToken: import("typebox").TOptional<import("typebox").TString>;
 }>;
 type RegisterRequest = Static<typeof registerRequestSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registrationIntentResponseSchema.d.ts
-declare const registrationIntentResponseSchema: _$typebox.TObject<{
-  intentId: _$typebox.TString;
-  expectCaptcha: _$typebox.TBoolean;
-  captchaSiteKey: _$typebox.TOptional<_$typebox.TString>;
-  expectEmailVerification: _$typebox.TBoolean;
-  expectPhoneVerification: _$typebox.TBoolean;
-  expiresAt: _$typebox.TString;
+declare const registrationIntentResponseSchema: import("typebox").TObject<{
+  intentId: import("typebox").TString;
+  expectCaptcha: import("typebox").TBoolean;
+  captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
+  expectEmailVerification: import("typebox").TBoolean;
+  expectPhoneVerification: import("typebox").TBoolean;
+  expiresAt: import("typebox").TString;
 }>;
 type RegistrationIntentResponse = Static<typeof registrationIntentResponseSchema>;
 //#endregion
@@ -3094,7 +3157,7 @@ type RegistrationIntentResponse = Static<typeof registrationIntentResponseSchema
  */
 declare class UsernameSlugger {
   protected readonly realmProvider: RealmProvider;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   /**
    * Floor for derived usernames. Shorter slugs are padded with random
    * alphanumerics. Matches the lower bound of the default `usernameRegExp`.
@@ -3182,16 +3245,16 @@ interface RegistrationIntent {
 }
 declare class RegistrationService {
   protected readonly alepha: Alepha;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly cryptoProvider: CryptoProvider;
-  protected readonly verificationController: _$alepha_server_links0.HttpVirtualClient<VerificationController>;
+  protected readonly verificationController: import("alepha/server/links").HttpVirtualClient<VerificationController>;
   protected readonly realmProvider: RealmProvider;
   protected readonly credentialService: CredentialService;
   protected readonly captchaProvider: CaptchaProvider;
   protected readonly usernameSlugger: UsernameSlugger;
-  protected readonly intentCache: _$alepha_cache0.CacheMiddlewareFn<RegistrationIntent>;
-  protected readonly rateLimitCache: _$alepha_cache0.CacheMiddlewareFn<number>;
+  protected readonly intentCache: import("alepha/cache").CacheMiddlewareFn<RegistrationIntent>;
+  protected readonly rateLimitCache: import("alepha/cache").CacheMiddlewareFn<number>;
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications;
   /**
@@ -3241,134 +3304,135 @@ declare class UserController {
    * Phase 1: Create a registration intent.
    * Validates data, creates verification sessions, and stores intent in cache.
    */
-  readonly createRegistrationIntent: _$alepha_server0.ActionPrimitiveFn<{
-    body: _$typebox.TObject<{
-      password: _$typebox.TString;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      captchaToken: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$typebox.TObject<{
-      intentId: _$typebox.TString;
-      expectCaptcha: _$typebox.TBoolean;
-      captchaSiteKey: _$typebox.TOptional<_$typebox.TString>;
-      expectEmailVerification: _$typebox.TBoolean;
-      expectPhoneVerification: _$typebox.TBoolean;
-      expiresAt: _$typebox.TString;
+  readonly createRegistrationIntent: import("alepha/server").ActionPrimitiveFn<{
+    body: import("typebox").TObject<{
+      password: import("typebox").TString;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      captchaToken: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("typebox").TObject<{
+      intentId: import("typebox").TString;
+      expectCaptcha: import("typebox").TBoolean;
+      captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
+      expectEmailVerification: import("typebox").TBoolean;
+      expectPhoneVerification: import("typebox").TBoolean;
+      expiresAt: import("typebox").TString;
     }>;
   }>;
   /**
    * Phase 2: Complete registration using an intent.
    * Validates verification codes and creates the user.
    */
-  readonly createUserFromIntent: _$alepha_server0.ActionPrimitiveFn<{
-    body: _$typebox.TObject<{
-      intentId: _$typebox.TString;
-      emailCode: _$typebox.TOptional<_$typebox.TString>;
-      phoneCode: _$typebox.TOptional<_$typebox.TString>;
-      captchaToken: _$typebox.TOptional<_$typebox.TString>;
-    }>;
-    response: _$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  readonly createUserFromIntent: import("alepha/server").ActionPrimitiveFn<{
+    body: import("typebox").TObject<{
+      intentId: import("typebox").TString;
+      emailCode: import("typebox").TOptional<import("typebox").TString>;
+      phoneCode: import("typebox").TOptional<import("typebox").TString>;
+      captchaToken: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    response: import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Phase 1: Create a password reset intent.
    * Validates email, sends verification code, and stores intent in cache.
    */
-  readonly createPasswordResetIntent: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  readonly createPasswordResetIntent: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TString;
+    body: import("typebox").TObject<{
+      email: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      intentId: _$typebox.TString;
-      expiresAt: _$typebox.TString;
+    response: import("typebox").TObject<{
+      intentId: import("typebox").TString;
+      expiresAt: import("typebox").TString;
     }>;
   }>;
   /**
    * Phase 2: Complete password reset using an intent.
    * Validates verification code, updates password, and invalidates sessions.
    */
-  readonly completePasswordReset: _$alepha_server0.ActionPrimitiveFn<{
-    body: _$typebox.TObject<{
-      intentId: _$typebox.TString;
-      code: _$typebox.TString;
-      newPassword: _$typebox.TString;
+  readonly completePasswordReset: import("alepha/server").ActionPrimitiveFn<{
+    body: import("typebox").TObject<{
+      intentId: import("typebox").TString;
+      code: import("typebox").TString;
+      newPassword: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      ok: _$typebox.TBoolean;
-      id: _$typebox.TOptional<_$typebox.TUnion<[_$typebox.TString, _$typebox.TInteger]>>;
-      count: _$typebox.TOptional<_$typebox.TNumber>;
+    response: import("typebox").TObject<{
+      ok: import("typebox").TBoolean;
+      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
+      count: import("typebox").TOptional<import("typebox").TNumber>;
     }>;
   }>;
   /**
    * @deprecated Use createPasswordResetIntent instead
    */
-  requestPasswordReset: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  requestPasswordReset: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TString;
+    body: import("typebox").TObject<{
+      email: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      success: _$typebox.TBoolean;
-      message: _$typebox.TString;
+    response: import("typebox").TObject<{
+      success: import("typebox").TBoolean;
+      message: import("typebox").TString;
     }>;
   }>;
   /**
    * @deprecated Use completePasswordReset instead
    */
-  validateResetToken: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      email: _$typebox.TString;
-      token: _$typebox.TString;
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  validateResetToken: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      email: import("typebox").TString;
+      token: import("typebox").TString;
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      valid: _$typebox.TBoolean;
-      email: _$typebox.TOptional<_$typebox.TString>;
+    response: import("typebox").TObject<{
+      valid: import("typebox").TBoolean;
+      email: import("typebox").TOptional<import("typebox").TString>;
     }>;
   }>;
   /**
    * @deprecated Use completePasswordReset instead
    */
-  resetPassword: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  resetPassword: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TString;
-      token: _$typebox.TString;
-      newPassword: _$typebox.TString;
+    body: import("typebox").TObject<{
+      email: import("typebox").TString;
+      token: import("typebox").TString;
+      newPassword: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      success: _$typebox.TBoolean;
-      message: _$typebox.TString;
+    response: import("typebox").TObject<{
+      success: import("typebox").TBoolean;
+      message: import("typebox").TString;
     }>;
   }>;
   /**
@@ -3377,46 +3441,46 @@ declare class UserController {
    * @param method - The verification method: "code" (default) sends a 6-digit code, "link" sends a clickable verification link.
    * @param verifyUrl - Required when method is "link". The base URL for the verification link. Token and email will be appended as query params.
    */
-  requestEmailVerification: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
-      method: _$typebox.TOptional<_$typebox.TUnsafe<"link" | "code">>;
+  requestEmailVerification: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
+      method: import("typebox").TOptional<import("typebox").TUnsafe<"link" | "code">>;
     }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TString;
+    body: import("typebox").TObject<{
+      email: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      success: _$typebox.TBoolean;
-      message: _$typebox.TString;
+    response: import("typebox").TObject<{
+      success: import("typebox").TBoolean;
+      message: import("typebox").TString;
     }>;
   }>;
   /**
    * Verify email with a valid token.
    * Updates the user's emailVerified status.
    */
-  verifyEmail: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  verifyEmail: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      email: _$typebox.TString;
-      token: _$typebox.TString;
+    body: import("typebox").TObject<{
+      email: import("typebox").TString;
+      token: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      success: _$typebox.TBoolean;
-      message: _$typebox.TString;
+    response: import("typebox").TObject<{
+      success: import("typebox").TBoolean;
+      message: import("typebox").TString;
     }>;
   }>;
   /**
    * Check if an email is verified.
    */
-  checkEmailVerification: _$alepha_server0.ActionPrimitiveFn<{
-    query: _$typebox.TObject<{
-      email: _$typebox.TString;
-      userRealmName: _$typebox.TOptional<_$typebox.TString>;
+  checkEmailVerification: import("alepha/server").ActionPrimitiveFn<{
+    query: import("typebox").TObject<{
+      email: import("typebox").TString;
+      userRealmName: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      verified: _$typebox.TBoolean;
+    response: import("typebox").TObject<{
+      verified: import("typebox").TBoolean;
     }>;
   }>;
 }
@@ -3434,23 +3498,24 @@ declare class UserController {
  * lazily the first time something calls `alepha.inject(UserJobs)`.
  */
 declare class UserJobs {
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly dateTimeProvider: DateTimeProvider;
-  protected readonly sessionRepository: _$alepha_orm0.Repository<_$typebox.TObject<{
-    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
-    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
-    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
-    refreshToken: _$typebox.TString;
-    userId: _$alepha_orm0.PgAttr<_$typebox.TString, typeof _$alepha_orm0.PG_REF>;
-    clientId: _$typebox.TOptional<_$typebox.TString>;
-    expiresAt: _$typebox.TString;
-    lastUsedAt: _$typebox.TOptional<_$typebox.TString>;
-    ip: _$typebox.TOptional<_$typebox.TString>;
-    userAgent: _$typebox.TOptional<_$typebox.TObject<{
-      os: _$typebox.TString;
-      browser: _$typebox.TString;
-      device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  protected readonly sessionRepository: import("alepha/orm").Repository<import("typebox").TObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    refreshToken: import("typebox").TString;
+    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
+    clientId: import("typebox").TOptional<import("typebox").TString>;
+    expiresAt: import("typebox").TString;
+    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
+    ip: import("typebox").TOptional<import("typebox").TString>;
+    country: import("typebox").TOptional<import("typebox").TString>;
+    userAgent: import("typebox").TOptional<import("typebox").TObject<{
+      os: import("typebox").TString;
+      browser: import("typebox").TString;
+      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
   protected readonly realmProvider: RealmProvider;
@@ -3466,134 +3531,164 @@ declare class UserJobs {
    * The idle sweep is best-effort cleanup — runtime enforcement happens in
    * `SessionService.refreshSession()`.
    */
-  readonly purgeExpiredSessions: _$alepha_api_jobs0.JobPrimitive<_$typebox.TSchema>;
+  readonly purgeExpiredSessions: import("alepha/api/jobs").JobPrimitive<import("typebox").TSchema>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/identityResourceSchema.d.ts
-declare const identityResourceSchema: _$typebox.TObject<{
-  userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-  id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  provider: _$typebox.TString;
-  version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-  updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-  providerUserId: _$typebox.TOptional<_$typebox.TString>;
-  providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+declare const identityResourceSchema: import("typebox").TObject<{
+  id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+  userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+  provider: import("typebox").TString;
+  providerUserId: import("typebox").TOptional<import("typebox").TString>;
+  providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
 }>;
 type IdentityResource = Static<typeof identityResourceSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/loginSchema.d.ts
-declare const loginSchema: _$typebox.TObject<{
-  username: _$typebox.TString;
-  password: _$typebox.TString;
+declare const loginSchema: import("typebox").TObject<{
+  username: import("typebox").TString;
+  password: import("typebox").TString;
 }>;
 type LoginInput = Static<typeof loginSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/realmConfigSchema.d.ts
-declare const realmConfigSchema: _$typebox.TObject<{
-  settings: _$typebox.TObject<{
-    displayName: _$typebox.TOptional<_$typebox.TString>;
-    description: _$typebox.TOptional<_$typebox.TString>;
-    logoUrl: _$typebox.TOptional<_$typebox.TString>;
-    registrationAllowed: _$typebox.TBoolean;
-    email: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-    username: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">, _$typebox.TLiteral<"email">]>;
-    usernameRegExp: _$typebox.TString;
-    usernameBlocklist: _$typebox.TArray<_$typebox.TString>;
-    phoneNumber: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-    verifyEmailRequired: _$typebox.TBoolean;
-    verifyPhoneRequired: _$typebox.TBoolean;
-    firstNameLastName: _$typebox.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
-    resetPasswordAllowed: _$typebox.TBoolean;
-    captchaRequired: _$typebox.TBoolean;
-    adminEmails: _$typebox.TArray<_$typebox.TString>;
-    adminUsernames: _$typebox.TArray<_$typebox.TString>;
-    defaultRoles: _$typebox.TArray<_$typebox.TString>;
-    verifyEmailUrl: _$typebox.TOptional<_$typebox.TString>;
-    passwordPolicy: _$typebox.TObject<{
-      minLength: _$typebox.TInteger;
-      requireUppercase: _$typebox.TBoolean;
-      requireLowercase: _$typebox.TBoolean;
-      requireNumbers: _$typebox.TBoolean;
-      requireSpecialCharacters: _$typebox.TBoolean;
-    }>;
-    loginRateLimit: _$typebox.TObject<{
-      ipMaxAttempts: _$typebox.TInteger;
-      accountMaxAttempts: _$typebox.TInteger;
-      windowMs: _$typebox.TInteger;
-    }>;
-    registrationIpMaxAttempts: _$typebox.TInteger;
-    refreshToken: _$typebox.TObject<{
-      expirationIdle: _$typebox.TOptional<_$typebox.TInteger>;
+declare const realmConfigSchema: import("typebox").TObject<{
+  settings: import("typebox").TObject<{
+    displayName: import("typebox").TOptional<import("typebox").TString>;
+    description: import("typebox").TOptional<import("typebox").TString>;
+    logoUrl: import("typebox").TOptional<import("typebox").TString>;
+    registrationAllowed: import("typebox").TBoolean;
+    email: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+    username: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">, import("typebox").TLiteral<"email">]>;
+    usernameRegExp: import("typebox").TString;
+    usernameBlocklist: import("typebox").TArray<import("typebox").TString>;
+    phoneNumber: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+    verifyEmailRequired: import("typebox").TBoolean;
+    verifyPhoneRequired: import("typebox").TBoolean;
+    firstNameLastName: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
+    resetPasswordAllowed: import("typebox").TBoolean;
+    captchaRequired: import("typebox").TBoolean;
+    adminEmails: import("typebox").TArray<import("typebox").TString>;
+    adminUsernames: import("typebox").TArray<import("typebox").TString>;
+    defaultRoles: import("typebox").TArray<import("typebox").TString>;
+    verifyEmailUrl: import("typebox").TOptional<import("typebox").TString>;
+    passwordPolicy: import("typebox").TObject<{
+      minLength: import("typebox").TInteger;
+      requireUppercase: import("typebox").TBoolean;
+      requireLowercase: import("typebox").TBoolean;
+      requireNumbers: import("typebox").TBoolean;
+      requireSpecialCharacters: import("typebox").TBoolean;
+    }>;
+    loginRateLimit: import("typebox").TObject<{
+      ipMaxAttempts: import("typebox").TInteger;
+      accountMaxAttempts: import("typebox").TInteger;
+      windowMs: import("typebox").TInteger;
+    }>;
+    registrationIpMaxAttempts: import("typebox").TInteger;
+    refreshToken: import("typebox").TObject<{
+      expirationIdle: import("typebox").TOptional<import("typebox").TInteger>;
     }>;
   }>;
-  realmName: _$typebox.TString;
-  authenticationMethods: _$typebox.TArray<_$typebox.TObject<{
-    name: _$typebox.TString;
-    type: _$typebox.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+  realmName: import("typebox").TString;
+  authenticationMethods: import("typebox").TArray<import("typebox").TObject<{
+    name: import("typebox").TString;
+    type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+  }>>;
+  captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
+  /**
+   * Federated (broker) social login. When present, the login UI renders one
+   * button per provider linking to `{brokerUrl}/auth/federated/start`.
+   */
+  federated: import("typebox").TOptional<import("typebox").TObject<{
+    brokerUrl: import("typebox").TString;
+    providers: import("typebox").TArray<import("typebox").TUnion<[import("typebox").TLiteral<"google">, import("typebox").TLiteral<"apple">]>>;
   }>>;
-  captchaSiteKey: _$typebox.TOptional<_$typebox.TString>;
 }>;
 type RealmConfig = Static<typeof realmConfigSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registerSchema.d.ts
-declare const registerSchema: _$typebox.TObject<{
-  username: _$typebox.TString;
-  email: _$typebox.TString;
-  password: _$typebox.TString;
-  confirmPassword: _$typebox.TString;
-  firstName: _$typebox.TOptional<_$typebox.TString>;
-  lastName: _$typebox.TOptional<_$typebox.TString>;
+declare const registerSchema: import("typebox").TObject<{
+  username: import("typebox").TString;
+  email: import("typebox").TString;
+  password: import("typebox").TString;
+  confirmPassword: import("typebox").TString;
+  firstName: import("typebox").TOptional<import("typebox").TString>;
+  lastName: import("typebox").TOptional<import("typebox").TString>;
 }>;
 type RegisterInput = Static<typeof registerSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/resetPasswordSchema.d.ts
-declare const resetPasswordRequestSchema: _$typebox.TObject<{
-  email: _$typebox.TString;
+declare const resetPasswordRequestSchema: import("typebox").TObject<{
+  email: import("typebox").TString;
 }>;
-declare const resetPasswordSchema: _$typebox.TObject<{
-  token: _$typebox.TString;
-  password: _$typebox.TString;
-  confirmPassword: _$typebox.TString;
+declare const resetPasswordSchema: import("typebox").TObject<{
+  token: import("typebox").TString;
+  password: import("typebox").TString;
+  confirmPassword: import("typebox").TString;
 }>;
 type ResetPasswordRequest = Static<typeof resetPasswordRequestSchema>;
 type ResetPasswordInput = Static<typeof resetPasswordSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/sessionResourceSchema.d.ts
-declare const sessionResourceSchema: _$typebox.TObject<{
-  id: _$typebox.TString;
-  version: _$typebox.TNumber;
-  createdAt: _$typebox.TString;
-  updatedAt: _$typebox.TString;
-  refreshToken: _$typebox.TString;
-  userId: _$typebox.TString;
-  expiresAt: _$typebox.TString;
-  ip: _$typebox.TOptional<_$typebox.TString>;
-  userAgent: _$typebox.TOptional<_$typebox.TObject<{
-    os: _$typebox.TString;
-    browser: _$typebox.TString;
-    device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+/**
+ * Slim view of the session's owner — embedded by the admin listing so the
+ * UI can render a human-readable identifier instead of just a UUID. Comes
+ * back via a left join, so it's optional (a session whose user was deleted
+ * still returns; `user` is undefined).
+ */
+declare const sessionUserSummarySchema: import("typebox").TObject<{
+  id: import("typebox").TString;
+  email: import("typebox").TOptional<import("typebox").TString>;
+  username: import("typebox").TOptional<import("typebox").TString>;
+  firstName: import("typebox").TOptional<import("typebox").TString>;
+  lastName: import("typebox").TOptional<import("typebox").TString>;
+}>;
+declare const sessionResourceSchema: import("typebox").TObject<{
+  id: import("typebox").TString;
+  version: import("typebox").TNumber;
+  createdAt: import("typebox").TString;
+  updatedAt: import("typebox").TString;
+  refreshToken: import("typebox").TString;
+  userId: import("typebox").TString;
+  expiresAt: import("typebox").TString;
+  ip: import("typebox").TOptional<import("typebox").TString>;
+  country: import("typebox").TOptional<import("typebox").TString>;
+  userAgent: import("typebox").TOptional<import("typebox").TObject<{
+    os: import("typebox").TString;
+    browser: import("typebox").TString;
+    device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  }>>;
+  user: import("typebox").TOptional<import("typebox").TObject<{
+    id: import("typebox").TString;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    firstName: import("typebox").TOptional<import("typebox").TString>;
+    lastName: import("typebox").TOptional<import("typebox").TString>;
   }>>;
 }>;
 type SessionResource = Static<typeof sessionResourceSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/userResourceSchema.d.ts
-declare const userResourceSchema: _$typebox.TObject<{
-  id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-  realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-  username: _$typebox.TOptional<_$typebox.TString>;
-  email: _$typebox.TOptional<_$typebox.TString>;
-  phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-  roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-  firstName: _$typebox.TOptional<_$typebox.TString>;
-  lastName: _$typebox.TOptional<_$typebox.TString>;
-  picture: _$typebox.TOptional<_$typebox.TString>;
-  enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-  emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-  organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+declare const userResourceSchema: import("typebox").TObject<{
+  id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+  realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+  username: import("typebox").TOptional<import("typebox").TString>;
+  email: import("typebox").TOptional<import("typebox").TString>;
+  phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+  roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+  firstName: import("typebox").TOptional<import("typebox").TString>;
+  lastName: import("typebox").TOptional<import("typebox").TString>;
+  picture: import("typebox").TOptional<import("typebox").TString>;
+  enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+  emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+  lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+  organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
 }>;
 type UserResource = Static<typeof userResourceSchema>;
 //#endregion
@@ -3603,57 +3698,60 @@ declare class SessionService {
   protected readonly fsp: FileSystemProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly cryptoProvider: CryptoProvider;
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly realmProvider: RealmProvider;
-  protected readonly fileController: _$alepha_server_links0.HttpVirtualClient<FileController>;
+  protected readonly fileController: import("alepha/server/links").HttpVirtualClient<FileController>;
   protected readonly cacheProvider: CacheProvider;
   protected readonly usernameSlugger: UsernameSlugger;
   protected userAudits(realmName?: string): UserAudits | undefined;
+  protected sessionAudits(realmName?: string): SessionAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  users(userRealmName?: string): Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-    username: _$typebox.TOptional<_$typebox.TString>;
-    email: _$typebox.TOptional<_$typebox.TString>;
-    phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-    roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-    firstName: _$typebox.TOptional<_$typebox.TString>;
-    lastName: _$typebox.TOptional<_$typebox.TString>;
-    picture: _$typebox.TOptional<_$typebox.TString>;
-    enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-    emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-    organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+  users(userRealmName?: string): Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+    roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+    firstName: import("typebox").TOptional<import("typebox").TString>;
+    lastName: import("typebox").TOptional<import("typebox").TString>;
+    picture: import("typebox").TOptional<import("typebox").TString>;
+    enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+    emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+    organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
   }>>;
-  sessions(userRealmName?: string): Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    refreshToken: _$typebox.TString;
-    userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-    clientId: _$typebox.TOptional<_$typebox.TString>;
-    expiresAt: _$typebox.TString;
-    lastUsedAt: _$typebox.TOptional<_$typebox.TString>;
-    ip: _$typebox.TOptional<_$typebox.TString>;
-    userAgent: _$typebox.TOptional<_$typebox.TObject<{
-      os: _$typebox.TString;
-      browser: _$typebox.TString;
-      device: _$typebox.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  sessions(userRealmName?: string): Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: import("typebox").TString;
+    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+    clientId: import("typebox").TOptional<import("typebox").TString>;
+    expiresAt: import("typebox").TString;
+    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
+    ip: import("typebox").TOptional<import("typebox").TString>;
+    country: import("typebox").TOptional<import("typebox").TString>;
+    userAgent: import("typebox").TOptional<import("typebox").TObject<{
+      os: import("typebox").TString;
+      browser: import("typebox").TString;
+      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
-  identities(userRealmName?: string): Repository$1<_$typebox.TObject<{
-    id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    userId: PgAttr<_$typebox.TString, typeof PG_REF>;
-    password: _$typebox.TOptional<_$typebox.TString>;
-    provider: _$typebox.TString;
-    providerUserId: _$typebox.TOptional<_$typebox.TString>;
-    providerData: _$typebox.TOptional<_$typebox.TRecord<string, _$typebox.TAny>>;
+  identities(userRealmName?: string): Repository$1<import("typebox").TObject<{
+    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
+    password: import("typebox").TOptional<import("typebox").TString>;
+    provider: import("typebox").TString;
+    providerUserId: import("typebox").TOptional<import("typebox").TString>;
+    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
   }>>;
   /**
    * Check if user should be auto-promoted to admin based on adminEmails/adminUsernames settings.
@@ -3702,38 +3800,40 @@ declare class SessionService {
     sessionId: string;
   }>;
   refreshSession(refreshToken: string, userRealmName?: string): Promise<{
-    user: PgStatic<_$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
-    }>, PgRelationMap<_$typebox.TObject<{
-      id: PgAttr<PgAttr<_$typebox.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<_$typebox.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<_$typebox.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<_$typebox.TString, typeof PG_DEFAULT>;
-      username: _$typebox.TOptional<_$typebox.TString>;
-      email: _$typebox.TOptional<_$typebox.TString>;
-      phoneNumber: _$typebox.TOptional<_$typebox.TString>;
-      roles: PgAttr<_$typebox.TArray<_$typebox.TString>, typeof PG_DEFAULT>;
-      firstName: _$typebox.TOptional<_$typebox.TString>;
-      lastName: _$typebox.TOptional<_$typebox.TString>;
-      picture: _$typebox.TOptional<_$typebox.TString>;
-      enabled: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<_$typebox.TBoolean, typeof PG_DEFAULT>;
-      organizationId: PgAttr<_$typebox.TString, typeof PG_ORGANIZATION>;
+    user: PgStatic<import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
+    }>, PgRelationMap<import("typebox").TObject<{
+      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
+      username: import("typebox").TOptional<import("typebox").TString>;
+      email: import("typebox").TOptional<import("typebox").TString>;
+      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
+      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
+      firstName: import("typebox").TOptional<import("typebox").TString>;
+      lastName: import("typebox").TOptional<import("typebox").TString>;
+      picture: import("typebox").TOptional<import("typebox").TString>;
+      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
+      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
     }>>>;
     expiresIn: number;
     sessionId: string;
@@ -3746,15 +3846,16 @@ declare class SessionService {
     firstName?: string | undefined;
     lastName?: string | undefined;
     picture?: string | undefined;
+    lastLoginAt?: string | undefined;
+    enabled: boolean;
     id: string;
-    createdAt: string;
-    organizationId: string;
     version: number;
+    createdAt: string;
     updatedAt: string;
     realm: string;
     roles: string[];
-    enabled: boolean;
     emailVerified: boolean;
+    organizationId: string;
   } | {
     sub: string;
     email?: string;
@@ -3803,7 +3904,7 @@ declare class SessionService {
  *
  * @module alepha.api.users
  */
-declare const AlephaApiUsers: _$alepha.Service<_$alepha.Module>;
+declare const AlephaApiUsers: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserQuery, UserResource, UserService, UsernameFieldRequirement, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionAudits, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserQuery, UserResource, UserService, UsernameFieldRequirement, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 //# sourceMappingURL=index.d.ts.map