alepha 0.23.0 → 0.24.0

package/dist/api/users/index.d.ts

@@ -1,20 +1,22 @@
 import { Alepha, AlephaError, Page, PageQuery, Primitive, SchemaValidator, Static, StaticEncode, TNull, TObject, TOptional, TSchema, TUnion } from "alepha";
-import { CryptoProvider, IssuerPrimitive, IssuerPrimitiveOptions, SecurityProvider, UserAccount } from "alepha/security";
+import { CryptoProvider, IssuerPrimitive, IssuerPrimitiveOptions, SecurityProvider, SigningConfig, UserAccount } from "alepha/security";
 import { Page as Page$1, Repository } from "alepha/orm";
+import { VerificationController, VerificationService } from "alepha/api/verifications";
 import { CaptchaProvider } from "alepha/captcha";
 import { OAuth2Profile, ServerAuthProvider, WithLinkFn, WithLoginFn } from "alepha/server/auth";
-import { VerificationController, VerificationService } from "alepha/api/verifications";
 import { CacheProvider } from "alepha/cache";
 import { DateTime, DateTimeProvider } from "alepha/datetime";
 import { FileSystemProvider } from "alepha/system";
 import { ParameterPrimitive } from "alepha/api/parameters";
 import { BuildExtraConfigColumns, SQL, SQLWrapper } from "drizzle-orm";
 import { LockConfig, LockStrength, PgColumn, PgColumnBuilderBase, PgDatabase, PgInsertValue, PgSelectBase, PgSequenceOptions, PgTableExtraConfigValue, PgTableWithColumns, PgTransaction, UpdateDeleteAction } from "drizzle-orm/pg-core";
+import "drizzle-orm/pg-core/foreign-keys";
 import { PgTransactionConfig } from "drizzle-orm/pg-core/session";
 import { CryptoProvider as CryptoProvider$1 } from "alepha/crypto";
 import * as DrizzleKit from "drizzle-kit/api";
+import "drizzle-orm/d1";
+import "drizzle-orm/sqlite-core";
 import { FileController } from "alepha/api/files";
-
 //#region ../../src/api/users/atoms/realmAuthSettingsAtom.d.ts
 /**
  * Tri-state field requirement for realm auth settings.
@@ -35,42 +37,42 @@ type FieldRequirement = "none" | "optional" | "required";
  *   collision behavior.
  */
 type UsernameFieldRequirement = FieldRequirement | "email";
-declare const realmAuthSettingsAtom: import("alepha").Atom<import("typebox").TObject<{
-  displayName: import("typebox").TOptional<import("typebox").TString>;
-  description: import("typebox").TOptional<import("typebox").TString>;
-  logoUrl: import("typebox").TOptional<import("typebox").TString>;
-  registrationAllowed: import("typebox").TBoolean;
-  email: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-  username: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">, import("typebox").TLiteral<"email">]>;
-  usernameRegExp: import("typebox").TString;
-  usernameBlocklist: import("typebox").TArray<import("typebox").TString>;
-  phoneNumber: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-  verifyEmailRequired: import("typebox").TBoolean;
-  verifyPhoneRequired: import("typebox").TBoolean;
-  firstNameLastName: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-  resetPasswordAllowed: import("typebox").TBoolean;
-  captchaRequired: import("typebox").TBoolean;
-  adminEmails: import("typebox").TArray<import("typebox").TString>;
-  adminUsernames: import("typebox").TArray<import("typebox").TString>;
-  defaultRoles: import("typebox").TArray<import("typebox").TString>;
-  verifyEmailUrl: import("typebox").TOptional<import("typebox").TString>;
-  passwordPolicy: import("typebox").TObject<{
-    minLength: import("typebox").TInteger;
-    requireUppercase: import("typebox").TBoolean;
-    requireLowercase: import("typebox").TBoolean;
-    requireNumbers: import("typebox").TBoolean;
-    requireSpecialCharacters: import("typebox").TBoolean;
-  }>;
-  loginRateLimit: import("typebox").TObject<{
-    ipMaxAttempts: import("typebox").TInteger;
-    accountMaxAttempts: import("typebox").TInteger;
-    windowMs: import("typebox").TInteger;
-  }>;
-  registrationIpMaxAttempts: import("typebox").TInteger;
-  refreshToken: import("typebox").TObject<{
-    expirationIdle: import("typebox").TOptional<import("typebox").TInteger>;
-  }>;
-}>, "alepha.api.users.realmAuthSettings">;
+declare const realmAuthSettingsAtom: import("alepha").Atom<import("zod").ZodObject<{
+  displayName: import("zod").ZodOptional<import("zod").ZodString>;
+  description: import("zod").ZodOptional<import("zod").ZodString>;
+  logoUrl: import("zod").ZodOptional<import("zod").ZodString>;
+  registrationAllowed: import("zod").ZodBoolean;
+  email: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+  username: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">, import("zod").ZodLiteral<"email">]>;
+  usernameRegExp: import("zod").ZodString;
+  usernameBlocklist: import("zod").ZodArray<import("zod").ZodString>;
+  phoneNumber: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+  verifyEmailRequired: import("zod").ZodBoolean;
+  verifyPhoneRequired: import("zod").ZodBoolean;
+  firstNameLastName: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+  resetPasswordAllowed: import("zod").ZodBoolean;
+  captchaRequired: import("zod").ZodBoolean;
+  adminEmails: import("zod").ZodArray<import("zod").ZodString>;
+  adminUsernames: import("zod").ZodArray<import("zod").ZodString>;
+  defaultRoles: import("zod").ZodArray<import("zod").ZodString>;
+  verifyEmailUrl: import("zod").ZodOptional<import("zod").ZodString>;
+  passwordPolicy: import("zod").ZodObject<{
+    minLength: import("zod").ZodDefault<import("zod").ZodInt>;
+    requireUppercase: import("zod").ZodBoolean;
+    requireLowercase: import("zod").ZodBoolean;
+    requireNumbers: import("zod").ZodBoolean;
+    requireSpecialCharacters: import("zod").ZodBoolean;
+  }, import("zod/v4/core").$strip>;
+  loginRateLimit: import("zod").ZodObject<{
+    ipMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+    accountMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+    windowMs: import("zod").ZodDefault<import("zod").ZodInt>;
+  }, import("zod/v4/core").$strip>;
+  registrationIpMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+  refreshToken: import("zod").ZodObject<{
+    expirationIdle: import("zod").ZodOptional<import("zod").ZodInt>;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>, "alepha.api.users.realmAuthSettings">;
 type RealmAuthSettings = Static<typeof realmAuthSettingsAtom.schema>;
 //#endregion
 //#region ../../src/api/users/audits/SessionAudits.d.ts
@@ -130,15 +132,13 @@ declare class UserBuckets {
  * Before: { name: string; age: number(default=0); fullName: generated }
  * After:  { name: string; age?: number; }
  */
-type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["properties"] as T["properties"][K] extends {
+type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["shape"] as T["shape"][K] extends {
   [PG_GENERATED]: any;
-} ? never : K]: T["properties"][K] extends {
+} ? never : K]: T["shape"][K] extends {
   [PG_DEFAULT]: any;
 } | {
   [PG_ORGANIZATION]: any;
-} | {
-  "~optional": true;
-} ? TOptional<T["properties"][K]> : T["properties"][K] }>;
+} ? TOptional<Extract<T["shape"][K], TSchema>> : T["shape"][K]; }>;
 //#endregion
 //#region ../../src/orm/core/schemas/updateSchema.d.ts
 /**
@@ -150,9 +150,9 @@ type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["properties"] as
  * Before: { name?: string; age: number; fullName: generated }
  * After:  { name?: string | null; age: number; }
  */
-type TObjectUpdate<T extends TObject> = TObject<{ [K in keyof T["properties"] as T["properties"][K] extends {
+type TObjectUpdate<T extends TObject> = TObject<{ [K in keyof T["shape"] as T["shape"][K] extends {
   [PG_GENERATED]: any;
-} ? never : K]: T["properties"][K] extends TOptional<infer U> ? TOptional<TUnion<[U, TNull]>> : T["properties"][K] }>;
+} ? never : K]: T["shape"][K] extends TOptional<infer U extends TSchema> ? TOptional<TUnion<[U, TNull]>> : T["shape"][K]; }>;
 //#endregion
 //#region ../../src/orm/core/primitives/$entity.d.ts
 interface EntityPrimitiveOptions<T extends TObject, Keys = keyof Static<T>> {
@@ -312,24 +312,26 @@ declare class EntityPrimitive<T extends TObject = TObject> {
   get cols(): EntityColumns<T>;
   get name(): string;
   get schema(): T;
+  protected _insertSchema?: TObjectInsert<T>;
   get insertSchema(): TObjectInsert<T>;
+  protected _updateSchema?: TObjectUpdate<T>;
   get updateSchema(): TObjectUpdate<T>;
 }
 /**
  * Convert a schema to columns.
  */
-type FromSchema<T extends TObject> = { [key in keyof T["properties"]]: PgColumnBuilderBase };
+type FromSchema<T extends TObject> = { [key in keyof T["properties"]]: PgColumnBuilderBase; };
 type SchemaToTableConfig<T extends TObject> = {
   name: string;
   schema: string | undefined;
-  columns: { [key in keyof T["properties"]]: PgColumn };
+  columns: { [key in keyof T["properties"]]: PgColumn; };
   dialect: string;
 };
 type EntityColumn<T extends TObject> = {
   name: string;
   entity: EntityPrimitive<T>;
 };
-type EntityColumns<T extends TObject> = { [key in keyof T["properties"]]: EntityColumn<T> };
+type EntityColumns<T extends TObject> = { [key in keyof T["properties"]]: EntityColumn<T>; };
 //#endregion
 //#region ../../src/orm/core/constants/PG_SYMBOLS.d.ts
 declare const PG_DEFAULT: unique symbol;
@@ -358,13 +360,24 @@ type PgSymbols = {
   [PG_REF]: PgRefOptions;
   [PG_ENUM]: PgEnumOptions;
   [PG_GENERATED]: PgGeneratedOptions;
-  [PG_ORGANIZATION]: {};
+  [PG_ORGANIZATION]: PgOrganizationOptions;
   /**
    * @deprecated Use `PG_IDENTITY` instead.
    */
   [PG_SERIAL]: {};
 };
 type PgSymbolKeys = keyof PgSymbols;
+interface PgOrganizationOptions {
+  /**
+   * Fail-closed tenant scoping. When `true`, the repository (a) refuses any
+   * read/write with no resolved tenant instead of falling through to an
+   * unfiltered "see/write everything" query, and (b) drops the
+   * `OR organizationId IS NULL` "global row" escape — a scoped tenant never
+   * sees NULL/global rows. Use for security-sensitive tables. Defaults to
+   * `false` (the historic fail-open semantics).
+   */
+  strict?: boolean;
+}
 type PgIdentityOptions = {
   mode: "always" | "byDefault";
 } & PgSequenceOptions & {
@@ -407,7 +420,7 @@ declare class DbError extends AlephaError {
 /**
  * Type representation.
  */
-type PgAttr<T extends TSchema, TAttr extends PgSymbolKeys> = T & { [K in TAttr]: PgSymbols[K] };
+type PgAttr<T extends TSchema, TAttr extends PgSymbolKeys> = T & { [K in TAttr]: PgSymbols[K]; };
 interface PgAttrField {
   key: string;
   type: TSchema;
@@ -863,7 +876,7 @@ interface PgQuery<T extends TObject = TObject> {
   orderBy?: OrderBy<Static<T>>;
   groupBy?: (keyof Static<T>)[];
 }
-type PgStatic<T extends TObject, Relations extends PgRelationMap<T>> = Static<T> & { [K in keyof Relations]: Static<Relations[K]["join"]["schema"]> & (Relations[K]["with"] extends PgRelationMap<TObject> ? PgStatic<Relations[K]["join"]["schema"], Relations[K]["with"]> : {}) };
+type PgStatic<T extends TObject, Relations extends PgRelationMap<T>> = Static<T> & { [K in keyof Relations]: Static<Relations[K]["join"]["schema"]> & (Relations[K]["with"] extends PgRelationMap<TObject> ? PgStatic<Relations[K]["join"]["schema"], Relations[K]["with"]> : {}); };
 interface PgQueryRelations<T extends TObject = TObject, Relations extends PgRelationMap<T> | undefined = undefined> extends PgQuery<T> {
   with?: Relations;
   where?: PgQueryWhereOrSQL<T, Relations>;
@@ -884,7 +897,7 @@ type PgRelation<Base extends TObject> = {
 //#region ../../src/orm/core/interfaces/PgQueryWhere.d.ts
 type PgQueryWhere<T extends TObject, Relations extends PgRelationMap<TObject> | undefined = undefined> = (PgQueryWhereOperators<T> & PgQueryWhereConditions<T>) | (PgQueryWhereRelations<Relations> & PgQueryWhereOperators<T> & PgQueryWhereConditions<T, Relations>);
 type PgQueryWhereOrSQL<T extends TObject, Relations extends PgRelationMap<TObject> | undefined = undefined> = SQLWrapper | PgQueryWhere<T, Relations>;
-type PgQueryWhereOperators<T extends TObject> = { [Key in keyof Static<T>]?: FilterOperators<Static<T>[Key]> | Static<T>[Key] };
+type PgQueryWhereOperators<T extends TObject> = { [Key in keyof Static<T>]?: FilterOperators<Static<T>[Key]> | Static<T>[Key]; };
 type PgQueryWhereConditions<T extends TObject, Relations extends PgRelationMap<TObject> | undefined = undefined> = {
   /**
    * Combine a list of conditions with the `and` operator. Conditions
@@ -960,7 +973,7 @@ type PgQueryWhereConditions<T extends TObject, Relations extends PgRelationMap<T
    */
   notExists?: SQLWrapper;
 };
-type PgQueryWhereRelations<Relations extends PgRelationMap<TObject> | undefined = undefined> = Relations extends PgRelationMap<TObject> ? { [K in keyof Relations]?: PgQueryWhere<Relations[K]["join"]["schema"], Relations[K]["with"]> } : {};
+type PgQueryWhereRelations<Relations extends PgRelationMap<TObject> | undefined = undefined> = Relations extends PgRelationMap<TObject> ? { [K in keyof Relations]?: PgQueryWhere<Relations[K]["join"]["schema"], Relations[K]["with"]>; } : {};
 //#endregion
 //#region ../../src/orm/core/interfaces/AggregateQuery.d.ts
 type AggregateOp = "count" | "sum" | "avg" | "min" | "max";
@@ -970,17 +983,17 @@ type AggregateOp = "count" | "sum" | "avg" | "min" | "max";
  * - `{ sum: true, avg: true, ... }` means compute those aggregations.
  */
 type AggregateColumnSelect = true | Partial<Record<AggregateOp, true>>;
-type AggregateSelect<T extends TObject> = { [K in keyof Static<T>]?: AggregateColumnSelect };
+type AggregateSelect<T extends TObject> = { [K in keyof Static<T>]?: AggregateColumnSelect; };
 /**
  * Maps a single column's select definition to its result type.
  * - `true` → original column type
  * - `{ sum: true, avg: true }` → `{ sum: number; avg: number }`
  */
-type AggregateColumnResult<TValue, TSelect> = TSelect extends true ? TValue : { [Op in AggregateOp as TSelect extends Record<Op, true> ? Op : never]: number };
+type AggregateColumnResult<TValue, TSelect> = TSelect extends true ? TValue : { [Op in AggregateOp as TSelect extends Record<Op, true> ? Op : never]: number; };
 /**
  * Result type for an aggregate query.
  */
-type AggregateResult<T extends TObject, S extends AggregateSelect<T>> = { [K in keyof S & keyof Static<T>]: AggregateColumnResult<Static<T>[K], NonNullable<S[K]>> };
+type AggregateResult<T extends TObject, S extends AggregateSelect<T>> = { [K in keyof S & keyof Static<T>]: AggregateColumnResult<Static<T>[K], NonNullable<S[K]>>; };
 /**
  * HAVING clause for aggregate queries.
  * Only applies to columns with aggregate operations (not `true`).
@@ -992,7 +1005,7 @@ type AggregateHaving<T extends TObject, S extends AggregateSelect<T>> = { [K in
   lte?: number;
   eq?: number;
   ne?: number;
-} } };
+}; }; };
 /**
  * Full aggregate query definition.
  */
@@ -1085,14 +1098,14 @@ declare class DbCacheProvider {
  * the engine behind that call.
  */
 declare class SequenceProvider {
-  protected readonly repository: Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    name: import("typebox").TString;
-    scope: import("typebox").TString;
-    value: import("typebox").TInteger;
-  }>>;
+  protected readonly repository: Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    name: import("zod").ZodString;
+    scope: import("zod").ZodString;
+    value: import("zod").ZodInt;
+  }, import("zod/v4/core").$strip>>;
   protected readonly crypto: CryptoProvider$1;
   /**
    * Atomically advance the counter for `(name, scope)` and return the new value.
@@ -1865,7 +1878,7 @@ declare abstract class Repository$1<T extends TObject> {
   protected getPrimaryKey(schema: TObject): {
     key: string;
     col: PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>;
-    type: TSchema;
+    type: import("alepha").ZType;
   };
 }
 /**
@@ -1917,7 +1930,7 @@ interface StatementOptions {
     key?: string;
   };
 }
-type WithSQL<T> = { [P in keyof T]?: T[P] | SQL };
+type WithSQL<T> = { [P in keyof T]?: T[P] | SQL; };
 //#endregion
 //#region ../../src/orm/core/schemas/databaseEnvSchema.d.ts
 /**
@@ -1933,93 +1946,73 @@ type WithSQL<T> = { [P in keyof T]?: T[P] | SQL };
  * - `d1://BINDING_NAME` — Cloudflare D1
  * - `hyperdrive://BINDING_NAME` — Cloudflare Hyperdrive
  */
-declare const databaseEnvSchema: import("typebox").TObject<{
-  DATABASE_URL: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Enable or disable push-based schema synchronization (drizzle-kit push).
-   *
-   * Defaults to `true` in development and test, `false` in production.
-   * Set to `false` in development to skip automatic schema sync
-   * (e.g. when managing migrations manually).
-   */
-  DATABASE_SYNC: import("typebox").TOptional<import("typebox").TBoolean>;
-}>;
+declare const databaseEnvSchema: import("zod").ZodObject<{
+  DATABASE_URL: import("zod").ZodOptional<import("zod").ZodString>;
+  DATABASE_SYNC: import("zod").ZodOptional<import("zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>;
 declare module "alepha" {
   interface Env extends Partial<Static<typeof databaseEnvSchema>> {}
-} //# sourceMappingURL=databaseEnvSchema.d.ts.map
+}
 //#endregion
 //#region ../../src/api/users/entities/identities.d.ts
-declare const identities: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-  password: import("typebox").TOptional<import("typebox").TString>;
-  provider: import("typebox").TString;
-  providerUserId: import("typebox").TOptional<import("typebox").TString>;
-  providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-}>>;
+declare const identities: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+  password: import("zod").ZodOptional<import("zod").ZodString>;
+  provider: import("zod").ZodString;
+  providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+  providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+}, import("zod/v4/core").$strip>>;
 type IdentityEntity = Static<typeof identities.schema>;
 //#endregion
 //#region ../../src/api/users/entities/sessions.d.ts
-declare const sessions: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  refreshToken: import("typebox").TString;
-  userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-  /**
-   * OAuth client this session was minted for, when it was created via the
-   * OAuth 2.1 authorization flow — the `client_id` of an `oauth_clients`
-   * row. Null for first-party logins. Deliberately NOT a DB-level foreign
-   * key: `sessions` is a core entity and must not depend on the optional
-   * OAuth module's table; the join to `oauth_clients` is done at query time.
-   */
-  clientId: import("typebox").TOptional<import("typebox").TString>;
-  expiresAt: import("typebox").TString;
-  /**
-   * Last time the session was used to refresh an access token.
-   * Used by realm `refreshToken.expirationIdle` to invalidate idle sessions.
-   * `null` on existing rows pre-migration — falls back to `createdAt`.
-   */
-  lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-  ip: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * ISO 3166-1 alpha-2 country code derived from the request geo headers
-   * (`cf-ipcountry` on Cloudflare, CDN equivalents elsewhere) at login time.
-   * `null` on pre-migration rows and where geo isn't available.
-   */
-  country: import("typebox").TOptional<import("typebox").TString>;
-  userAgent: import("typebox").TOptional<import("typebox").TObject<{
-    os: import("typebox").TString;
-    browser: import("typebox").TString;
-    device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-  }>>;
-}>>;
+declare const sessions: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  refreshToken: import("zod").ZodString;
+  userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+  clientId: import("zod").ZodOptional<import("zod").ZodString>;
+  expiresAt: import("zod").ZodString;
+  lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+  ip: import("zod").ZodOptional<import("zod").ZodString>;
+  country: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+    os: import("zod").ZodString;
+    browser: import("zod").ZodString;
+    device: import("zod").ZodEnum<{
+      DESKTOP: "DESKTOP";
+      MOBILE: "MOBILE";
+      TABLET: "TABLET";
+    }>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>>;
 type SessionEntity = Static<typeof sessions.schema>;
 //#endregion
 //#region ../../src/api/users/entities/users.d.ts
 declare const DEFAULT_USER_REALM_NAME = "default";
-declare const users: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  realm: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
-  username: import("typebox").TOptional<import("typebox").TString>;
-  email: import("typebox").TOptional<import("typebox").TString>;
-  phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-  roles: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-  firstName: import("typebox").TOptional<import("typebox").TString>;
-  lastName: import("typebox").TOptional<import("typebox").TString>;
-  picture: import("typebox").TOptional<import("typebox").TString>;
-  enabled: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-  emailVerified: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-  lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-  organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-}>>;
+declare const users: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  realm: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
+  username: import("zod").ZodOptional<import("zod").ZodString>;
+  email: import("zod").ZodOptional<import("zod").ZodString>;
+  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+  roles: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+  firstName: import("zod").ZodOptional<import("zod").ZodString>;
+  lastName: import("zod").ZodOptional<import("zod").ZodString>;
+  picture: import("zod").ZodOptional<import("zod").ZodString>;
+  enabled: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  emailVerified: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+  organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+}, import("zod/v4/core").$strip>>;
 type UserEntity = Static<typeof users.schema>;
 //#endregion
 //#region ../../src/api/users/primitives/$realm.d.ts
@@ -2108,6 +2101,12 @@ interface RealmOptions {
    * If not provided, the secret from the SecurityProvider will be used (usually from the APP_SECRET environment variable).
    */
   secret?: string;
+  /**
+   * Asymmetric signing config for this realm's tokens (OIDC provider mode).
+   * When set, issued tokens are signed asymmetrically and the public keys are
+   * JWKS-publishable. Default is HS256 via `secret`.
+   */
+  signing?: SigningConfig;
   /**
    * Issuer configuration options.
    *
@@ -2131,19 +2130,6 @@ interface RealmOptions {
     facebook?: true;
     microsoft?: true;
     franceconnect?: true;
-    /**
-     * Federated social login via a central broker (the platform).
-     *
-     * The broker performs the real OIDC dance with Google/Apple on a single
-     * shared OAuth client and hands this realm a short-lived, asymmetric-signed
-     * assertion. This realm verifies it (broker `publicKey`), links a local
-     * user, and establishes a session — no per-tenant OAuth client required.
-     */
-    federated?: {
-      /** Broker origin (assertion `iss`), e.g. https://alepha.club. */brokerUrl: string; /** Broker EdDSA public key (SPKI PEM) used to verify assertions. */
-      publicKey: string; /** Providers to surface as broker login buttons. */
-      providers: Array<"google" | "apple">;
-    };
   };
   /**
    * Enable or disable realm features.
@@ -2164,67 +2150,62 @@ interface Realm {
   repositories: RealmRepositories;
   settings: RealmAuthSettings;
   features: RealmFeatures;
-  /**
-   * Federated (broker) login config surfaced to the login UI, when the realm
-   * declares `identities.federated`. The broker public key is intentionally
-   * omitted — only the broker URL + provider list are client-facing.
-   */
-  federated?: {
-    brokerUrl: string;
-    providers: Array<"google" | "apple">;
-  };
   settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
   getSettings(): Promise<RealmAuthSettings>;
 }
 declare class RealmProvider {
   protected readonly alepha: Alepha;
-  protected readonly defaultIdentities: Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-    password: import("typebox").TOptional<import("typebox").TString>;
-    provider: import("typebox").TString;
-    providerUserId: import("typebox").TOptional<import("typebox").TString>;
-    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  }>>;
-  protected readonly defaultSessions: Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    refreshToken: import("typebox").TString;
-    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-    clientId: import("typebox").TOptional<import("typebox").TString>;
-    expiresAt: import("typebox").TString;
-    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-    ip: import("typebox").TOptional<import("typebox").TString>;
-    country: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TObject<{
-      os: import("typebox").TString;
-      browser: import("typebox").TString;
-      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-    }>>;
-  }>>;
-  protected readonly defaultUsers: Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    realm: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-    roles: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-    firstName: import("typebox").TOptional<import("typebox").TString>;
-    lastName: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    enabled: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-    emailVerified: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-    organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-  }>>;
+  protected readonly defaultIdentities: Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+    password: import("zod").ZodOptional<import("zod").ZodString>;
+    provider: import("zod").ZodString;
+    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  }, import("zod/v4/core").$strip>>;
+  protected readonly defaultSessions: Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    refreshToken: import("zod").ZodString;
+    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    ip: import("zod").ZodOptional<import("zod").ZodString>;
+    country: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+      os: import("zod").ZodString;
+      browser: import("zod").ZodString;
+      device: import("zod").ZodEnum<{
+        DESKTOP: "DESKTOP";
+        MOBILE: "MOBILE";
+        TABLET: "TABLET";
+      }>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
+  protected readonly defaultUsers: Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    realm: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    enabled: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    emailVerified: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+    organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+  }, import("zod/v4/core").$strip>>;
   protected realms: Map<string, Realm>;
   register(realmName: string, realmOptions?: RealmOptions): Realm;
   /**
@@ -2237,13 +2218,13 @@ declare class RealmProvider {
 }
 //#endregion
 //#region ../../src/api/users/schemas/identityQuerySchema.d.ts
-declare const identityQuerySchema: import("typebox").TObject<{
-  page: import("typebox").TOptional<import("typebox").TInteger>;
-  size: import("typebox").TOptional<import("typebox").TInteger>;
-  sort: import("typebox").TOptional<import("typebox").TString>;
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  provider: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const identityQuerySchema: import("zod").ZodObject<{
+  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  sort: import("zod").ZodOptional<import("zod").ZodString>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  provider: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type IdentityQuery = Static<typeof identityQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/IdentityService.d.ts
@@ -2252,17 +2233,17 @@ declare class IdentityService {
   protected readonly log: import("alepha/logger").Logger;
   protected readonly realmProvider: RealmProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
-  identities(userRealmName?: string): import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-    password: import("typebox").TOptional<import("typebox").TString>;
-    provider: import("typebox").TString;
-    providerUserId: import("typebox").TOptional<import("typebox").TString>;
-    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  }>>;
+  identities(userRealmName?: string): import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+    password: import("zod").ZodOptional<import("zod").ZodString>;
+    provider: import("zod").ZodString;
+    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Find identities with pagination and filtering.
    */
@@ -2282,99 +2263,117 @@ declare class AdminIdentityController {
   protected readonly url = "/identities";
   protected readonly group = "admin:identities";
   protected readonly identityService: IdentityService;
+  protected readonly securityProvider: SecurityProvider;
   /**
    * Find identities with pagination and filtering.
    */
   readonly findIdentities: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      page: import("typebox").TOptional<import("typebox").TInteger>;
-      size: import("typebox").TOptional<import("typebox").TInteger>;
-      sort: import("typebox").TOptional<import("typebox").TString>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      provider: import("typebox").TOptional<import("typebox").TString>;
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("alepha").TPage<import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-      provider: import("typebox").TString;
-      providerUserId: import("typebox").TOptional<import("typebox").TString>;
-      providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-    }>>;
+    query: import("zod").ZodObject<{
+      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      sort: import("zod").ZodOptional<import("zod").ZodString>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      provider: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      content: import("zod").ZodArray<import("zod").ZodObject<{
+        id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+        version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+        createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+        updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+        userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+        provider: import("zod").ZodString;
+        providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+        providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+      }, import("zod/v4/core").$strip>>;
+      page: import("zod").ZodObject<{
+        number: import("zod").ZodInt;
+        size: import("zod").ZodInt;
+        offset: import("zod").ZodInt;
+        numberOfElements: import("zod").ZodInt;
+        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
+        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
+        isEmpty: import("zod").ZodBoolean;
+        isFirst: import("zod").ZodBoolean;
+        isLast: import("zod").ZodBoolean;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get an identity by ID.
    */
   readonly getIdentity: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-      provider: import("typebox").TString;
-      providerUserId: import("typebox").TOptional<import("typebox").TString>;
-      providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+      provider: import("zod").ZodString;
+      providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+      providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Delete an identity.
    */
   readonly deleteIdentity: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      ok: import("typebox").TBoolean;
-      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
-      count: import("typebox").TOptional<import("typebox").TNumber>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      ok: import("zod").ZodBoolean;
+      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
+      count: import("zod").ZodOptional<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>;
   }>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/sessionQuerySchema.d.ts
-declare const sessionQuerySchema: import("typebox").TObject<{
-  page: import("typebox").TOptional<import("typebox").TInteger>;
-  size: import("typebox").TOptional<import("typebox").TInteger>;
-  sort: import("typebox").TOptional<import("typebox").TString>;
-  userId: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const sessionQuerySchema: import("zod").ZodObject<{
+  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  sort: import("zod").ZodOptional<import("zod").ZodString>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type SessionQuery = Static<typeof sessionQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/SessionCrudService.d.ts
 declare class SessionCrudService {
   protected readonly log: import("alepha/logger").Logger;
   protected readonly realmProvider: RealmProvider;
-  sessions(userRealmName?: string): import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    refreshToken: import("typebox").TString;
-    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-    clientId: import("typebox").TOptional<import("typebox").TString>;
-    expiresAt: import("typebox").TString;
-    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-    ip: import("typebox").TOptional<import("typebox").TString>;
-    country: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TObject<{
-      os: import("typebox").TString;
-      browser: import("typebox").TString;
-      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-    }>>;
-  }>>;
+  sessions(userRealmName?: string): import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    refreshToken: import("zod").ZodString;
+    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    ip: import("zod").ZodOptional<import("zod").ZodString>;
+    country: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+      os: import("zod").ZodString;
+      browser: import("zod").ZodString;
+      device: import("zod").ZodEnum<{
+        DESKTOP: "DESKTOP";
+        MOBILE: "MOBILE";
+        TABLET: "TABLET";
+      }>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Find sessions with pagination and filtering.
    */
@@ -2398,188 +2397,210 @@ declare class AdminSessionController {
   protected readonly url = "/sessions";
   protected readonly group = "admin:sessions";
   protected readonly sessionService: SessionCrudService;
+  protected readonly securityProvider: SecurityProvider;
   /**
    * Find sessions with pagination and filtering.
    */
   readonly findSessions: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      page: import("typebox").TOptional<import("typebox").TInteger>;
-      size: import("typebox").TOptional<import("typebox").TInteger>;
-      sort: import("typebox").TOptional<import("typebox").TString>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("alepha").TPage<import("typebox").TObject<{
-      id: import("typebox").TString;
-      version: import("typebox").TNumber;
-      createdAt: import("typebox").TString;
-      updatedAt: import("typebox").TString;
-      refreshToken: import("typebox").TString;
-      userId: import("typebox").TString;
-      expiresAt: import("typebox").TString;
-      ip: import("typebox").TOptional<import("typebox").TString>;
-      country: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TObject<{
-        os: import("typebox").TString;
-        browser: import("typebox").TString;
-        device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-      }>>;
-      user: import("typebox").TOptional<import("typebox").TObject<{
-        id: import("typebox").TString;
-        email: import("typebox").TOptional<import("typebox").TString>;
-        username: import("typebox").TOptional<import("typebox").TString>;
-        firstName: import("typebox").TOptional<import("typebox").TString>;
-        lastName: import("typebox").TOptional<import("typebox").TString>;
-      }>>;
-    }>>;
+    query: import("zod").ZodObject<{
+      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      sort: import("zod").ZodOptional<import("zod").ZodString>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      content: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        version: import("zod").ZodNumber;
+        createdAt: import("zod").ZodString;
+        updatedAt: import("zod").ZodString;
+        refreshToken: import("zod").ZodString;
+        userId: import("zod").ZodString;
+        expiresAt: import("zod").ZodString;
+        ip: import("zod").ZodOptional<import("zod").ZodString>;
+        country: import("zod").ZodOptional<import("zod").ZodString>;
+        userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+          os: import("zod").ZodString;
+          browser: import("zod").ZodString;
+          device: import("zod").ZodEnum<{
+            DESKTOP: "DESKTOP";
+            MOBILE: "MOBILE";
+            TABLET: "TABLET";
+          }>;
+        }, import("zod/v4/core").$strip>>;
+        user: import("zod").ZodOptional<import("zod").ZodObject<{
+          id: import("zod").ZodString;
+          email: import("zod").ZodOptional<import("zod").ZodString>;
+          username: import("zod").ZodOptional<import("zod").ZodString>;
+          firstName: import("zod").ZodOptional<import("zod").ZodString>;
+          lastName: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+      }, import("zod/v4/core").$strip>>;
+      page: import("zod").ZodObject<{
+        number: import("zod").ZodInt;
+        size: import("zod").ZodInt;
+        offset: import("zod").ZodInt;
+        numberOfElements: import("zod").ZodInt;
+        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
+        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
+        isEmpty: import("zod").ZodBoolean;
+        isFirst: import("zod").ZodBoolean;
+        isLast: import("zod").ZodBoolean;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get a session by ID.
    */
   readonly getSession: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      id: import("typebox").TString;
-      version: import("typebox").TNumber;
-      createdAt: import("typebox").TString;
-      updatedAt: import("typebox").TString;
-      refreshToken: import("typebox").TString;
-      userId: import("typebox").TString;
-      expiresAt: import("typebox").TString;
-      ip: import("typebox").TOptional<import("typebox").TString>;
-      country: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TObject<{
-        os: import("typebox").TString;
-        browser: import("typebox").TString;
-        device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-      }>>;
-      user: import("typebox").TOptional<import("typebox").TObject<{
-        id: import("typebox").TString;
-        email: import("typebox").TOptional<import("typebox").TString>;
-        username: import("typebox").TOptional<import("typebox").TString>;
-        firstName: import("typebox").TOptional<import("typebox").TString>;
-        lastName: import("typebox").TOptional<import("typebox").TString>;
-      }>>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      version: import("zod").ZodNumber;
+      createdAt: import("zod").ZodString;
+      updatedAt: import("zod").ZodString;
+      refreshToken: import("zod").ZodString;
+      userId: import("zod").ZodString;
+      expiresAt: import("zod").ZodString;
+      ip: import("zod").ZodOptional<import("zod").ZodString>;
+      country: import("zod").ZodOptional<import("zod").ZodString>;
+      userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+        os: import("zod").ZodString;
+        browser: import("zod").ZodString;
+        device: import("zod").ZodEnum<{
+          DESKTOP: "DESKTOP";
+          MOBILE: "MOBILE";
+          TABLET: "TABLET";
+        }>;
+      }, import("zod/v4/core").$strip>>;
+      user: import("zod").ZodOptional<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        username: import("zod").ZodOptional<import("zod").ZodString>;
+        firstName: import("zod").ZodOptional<import("zod").ZodString>;
+        lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Delete a session.
    */
   readonly deleteSession: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      ok: import("typebox").TBoolean;
-      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
-      count: import("typebox").TOptional<import("typebox").TNumber>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      ok: import("zod").ZodBoolean;
+      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
+      count: import("zod").ZodOptional<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Delete many sessions in one repository call.
    */
   readonly deleteSessions: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      ids: import("typebox").TArray<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      deleted: import("typebox").TArray<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      ids: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      deleted: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
 }
 //#endregion
 //#region ../../src/api/users/notifications/UserNotifications.d.ts
 declare class UserNotifications {
-  readonly passwordReset: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
-    email: import("typebox").TString;
-    code: import("typebox").TString;
-    expiresInMinutes: import("typebox").TNumber;
-  }>>;
-  readonly emailVerification: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
-    email: import("typebox").TString;
-    code: import("typebox").TString;
-    expiresInMinutes: import("typebox").TNumber;
-  }>>;
-  readonly phoneVerification: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
-    phoneNumber: import("typebox").TString;
-    code: import("typebox").TString;
-    expiresInMinutes: import("typebox").TNumber;
-  }>>;
-  readonly passwordResetLink: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
-    email: import("typebox").TString;
-    resetUrl: import("typebox").TString;
-    expiresInMinutes: import("typebox").TNumber;
-  }>>;
-  readonly accountLockout: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
-    email: import("typebox").TString;
-    lockoutMinutes: import("typebox").TNumber;
-  }>>;
-  readonly emailVerificationLink: import("alepha/api/notifications").NotificationPrimitive<import("typebox").TObject<{
-    email: import("typebox").TString;
-    verifyUrl: import("typebox").TString;
-    expiresInMinutes: import("typebox").TNumber;
-  }>>;
+  readonly passwordReset: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
+    email: import("zod").ZodString;
+    code: import("zod").ZodString;
+    expiresInMinutes: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
+  readonly emailVerification: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
+    email: import("zod").ZodString;
+    code: import("zod").ZodString;
+    expiresInMinutes: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
+  readonly phoneVerification: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
+    phoneNumber: import("zod").ZodString;
+    code: import("zod").ZodString;
+    expiresInMinutes: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
+  readonly passwordResetLink: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
+    email: import("zod").ZodString;
+    resetUrl: import("zod").ZodString;
+    expiresInMinutes: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
+  readonly accountLockout: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
+    email: import("zod").ZodString;
+    lockoutMinutes: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
+  readonly emailVerificationLink: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
+    email: import("zod").ZodString;
+    verifyUrl: import("zod").ZodString;
+    expiresInMinutes: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/createUserSchema.d.ts
-declare const createUserSchema: import("typebox").TObject<{
-  enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-  email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  id: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
-  version: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
-  createdAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
-  updatedAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
-  username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
-  firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-  lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
-}>;
+declare const createUserSchema: import("zod").ZodObject<{
+  id: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
+  version: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>>;
+  createdAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
+  updatedAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
+  username: import("zod").ZodOptional<import("zod").ZodString>;
+  email: import("zod").ZodOptional<import("zod").ZodString>;
+  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+  roles: import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>;
+  firstName: import("zod").ZodOptional<import("zod").ZodString>;
+  lastName: import("zod").ZodOptional<import("zod").ZodString>;
+  picture: import("zod").ZodOptional<import("zod").ZodString>;
+  enabled: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
+  emailVerified: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
+  lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+  organizationId: import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>;
+}, import("zod/v4/core").$strip>;
 type CreateUser = Static<typeof createUserSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/updateUserSchema.d.ts
-declare const updateUserSchema: import("typebox").TObject<{
-  enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-  email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  realm: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_DEFAULT>>;
-  username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
-  firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-  lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-  organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
-}>;
+declare const updateUserSchema: import("zod").ZodObject<{
+  realm: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodString, typeof PG_DEFAULT>>>;
+  username: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  email: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  phoneNumber: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  roles: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>>;
+  firstName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  lastName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  picture: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  enabled: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
+  emailVerified: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
+  lastLoginAt: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+  organizationId: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>>;
+}, import("zod/v4/core").$strip>;
 type UpdateUser = Static<typeof updateUserSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/userQuerySchema.d.ts
-declare const userQuerySchema: import("typebox").TObject<{
-  page: import("typebox").TOptional<import("typebox").TInteger>;
-  size: import("typebox").TOptional<import("typebox").TInteger>;
-  sort: import("typebox").TOptional<import("typebox").TString>;
-  search: import("typebox").TOptional<import("typebox").TString>;
-  email: import("typebox").TOptional<import("typebox").TString>;
-  enabled: import("typebox").TOptional<import("typebox").TBoolean>;
-  emailVerified: import("typebox").TOptional<import("typebox").TBoolean>;
-  roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-}>;
+declare const userQuerySchema: import("zod").ZodObject<{
+  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  sort: import("zod").ZodOptional<import("zod").ZodString>;
+  search: import("zod").ZodOptional<import("zod").ZodString>;
+  email: import("zod").ZodOptional<import("zod").ZodString>;
+  enabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+  emailVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+  roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+}, import("zod/v4/core").$strip>;
 type UserQuery = Static<typeof userQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/UserService.d.ts
@@ -2587,28 +2608,29 @@ declare class UserService {
   protected readonly alepha: Alepha;
   protected readonly log: import("alepha/logger").Logger;
   protected readonly verificationController: import("alepha/server/links").HttpVirtualClient<VerificationController>;
+  protected readonly verificationService: VerificationService;
   protected readonly realmProvider: RealmProvider;
   protected readonly cryptoProvider: CryptoProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  users(userRealmName?: string): import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    realm: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-    roles: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-    firstName: import("typebox").TOptional<import("typebox").TString>;
-    lastName: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    enabled: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-    emailVerified: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-    organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-  }>>;
+  users(userRealmName?: string): import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    realm: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    enabled: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    emailVerified: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+    organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Request email verification for a user.
    * @param email - The email address to verify.
@@ -2666,163 +2688,176 @@ declare class AdminUserController {
    * role picker and grey out defaults (which cannot be removed).
    */
   readonly findRoles: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TArray<import("typebox").TObject<{
-      name: import("typebox").TString;
-      default: import("typebox").TOptional<import("typebox").TBoolean>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodArray<import("zod").ZodObject<{
+      name: import("zod").ZodString;
+      default: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      description: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
   }>;
   /**
    * Find users with pagination and filtering.
    */
   readonly findUsers: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      page: import("typebox").TOptional<import("typebox").TInteger>;
-      size: import("typebox").TOptional<import("typebox").TInteger>;
-      sort: import("typebox").TOptional<import("typebox").TString>;
-      search: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      enabled: import("typebox").TOptional<import("typebox").TBoolean>;
-      emailVerified: import("typebox").TOptional<import("typebox").TBoolean>;
-      roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("alepha").TPage<import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>>;
+    query: import("zod").ZodObject<{
+      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      sort: import("zod").ZodOptional<import("zod").ZodString>;
+      search: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      emailVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      content: import("zod").ZodArray<import("zod").ZodObject<{
+        id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+        version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+        createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+        updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+        realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+        username: import("zod").ZodOptional<import("zod").ZodString>;
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+        roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+        firstName: import("zod").ZodOptional<import("zod").ZodString>;
+        lastName: import("zod").ZodOptional<import("zod").ZodString>;
+        picture: import("zod").ZodOptional<import("zod").ZodString>;
+        enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+        emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+        lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+        organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+      }, import("zod/v4/core").$strip>>;
+      page: import("zod").ZodObject<{
+        number: import("zod").ZodInt;
+        size: import("zod").ZodInt;
+        offset: import("zod").ZodInt;
+        numberOfElements: import("zod").ZodInt;
+        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
+        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
+        isEmpty: import("zod").ZodBoolean;
+        isFirst: import("zod").ZodBoolean;
+        isLast: import("zod").ZodBoolean;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get a user by ID.
    */
   readonly getUser: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Create a new user.
    */
   readonly createUser: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-      email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      id: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
-      version: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
-      createdAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
-      updatedAt: import("typebox").TOptional<PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
-      username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
-      firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
-    }>;
-    response: import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      id: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
+      version: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>>;
+      createdAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
+      updatedAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
+      emailVerified: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Update a user.
    */
   readonly updateUser: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      enabled: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-      email: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      realm: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_DEFAULT>>;
-      username: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      roles: import("typebox").TOptional<PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>>;
-      firstName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      lastName: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      picture: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      emailVerified: import("typebox").TOptional<PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TOptional<import("typebox").TString>>;
-      organizationId: import("typebox").TOptional<PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>>;
-    }>;
-    response: import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      realm: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodString, typeof PG_DEFAULT>>>;
+      username: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      email: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      roles: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>>;
+      firstName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      lastName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      picture: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      enabled: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
+      emailVerified: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+      organizationId: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Set (or reset) a user's password. Admin-only flow — does NOT
@@ -2830,36 +2865,36 @@ declare class AdminUserController {
    * "credentials" identity for the user (upsert).
    */
   readonly setUserPassword: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      password: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      ok: import("typebox").TBoolean;
-      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
-      count: import("typebox").TOptional<import("typebox").TNumber>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      password: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      ok: import("zod").ZodBoolean;
+      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
+      count: import("zod").ZodOptional<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Delete a user.
    */
   readonly deleteUser: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      ok: import("typebox").TBoolean;
-      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
-      count: import("typebox").TOptional<import("typebox").TNumber>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      ok: import("zod").ZodBoolean;
+      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
+      count: import("zod").ZodOptional<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Delete many users in one request. Each id is processed sequentially so
@@ -2867,15 +2902,118 @@ declare class AdminUserController {
    * id surface with that id in the response.
    */
   readonly deleteUsers: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      ids: import("typebox").TArray<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      deleted: import("typebox").TArray<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      ids: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      deleted: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+  }>;
+}
+//#endregion
+//#region ../../src/api/users/controllers/MySessionController.d.ts
+/**
+ * A session as exposed to ITS OWNER — `refreshToken` is deliberately
+ * omitted (returning it would let any XSS exfiltrate a long-lived
+ * credential); `current` flags the session backing the calling request.
+ */
+declare const mySessionSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  createdAt: import("zod").ZodString;
+  expiresAt: import("zod").ZodString;
+  lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+  ip: import("zod").ZodOptional<import("zod").ZodString>;
+  country: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+    os: import("zod").ZodString;
+    browser: import("zod").ZodString;
+    device: import("zod").ZodEnum<{
+      DESKTOP: "DESKTOP";
+      MOBILE: "MOBILE";
+      TABLET: "TABLET";
+    }>;
+  }, import("zod/v4/core").$strip>>;
+  current: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strip>;
+type MySession = Static<typeof mySessionSchema>;
+/**
+ * Self-service session management — the "where am I signed in?" page of an
+ * account area. Counterpart of {@link AdminSessionController}, scoped to the
+ * CALLER's own sessions: list them, revoke one (a stolen laptop), or revoke
+ * everything except the current one.
+ */
+declare class MySessionController {
+  protected readonly realmProvider: RealmProvider;
+  protected sessions(realm?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: import("zod").ZodString;
+    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    ip: import("zod").ZodOptional<import("zod").ZodString>;
+    country: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+      os: import("zod").ZodString;
+      browser: import("zod").ZodString;
+      device: import("zod").ZodEnum<{
+        DESKTOP: "DESKTOP";
+        MOBILE: "MOBILE";
+        TABLET: "TABLET";
+      }>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
+  protected toMySession(session: {
+    id: string;
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt?: string;
+    ip?: string;
+    country?: string;
+    userAgent?: {
+      os: string;
+      browser: string;
+      device: string;
+    };
+  }, currentSessionId: string | undefined): MySession;
+  listMySessions: import("alepha/server").ActionPrimitiveFn<{
+    response: import("zod").ZodArray<import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      createdAt: import("zod").ZodString;
+      expiresAt: import("zod").ZodString;
+      lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+      ip: import("zod").ZodOptional<import("zod").ZodString>;
+      country: import("zod").ZodOptional<import("zod").ZodString>;
+      userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+        os: import("zod").ZodString;
+        browser: import("zod").ZodString;
+        device: import("zod").ZodEnum<{
+          DESKTOP: "DESKTOP";
+          MOBILE: "MOBILE";
+          TABLET: "TABLET";
+        }>;
+      }, import("zod/v4/core").$strip>>;
+      current: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>>;
+  }>;
+  deleteMySession: import("alepha/server").ActionPrimitiveFn<{
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      ok: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>;
+  }>;
+  deleteMyOtherSessions: import("alepha/server").ActionPrimitiveFn<{
+    response: import("zod").ZodObject<{
+      revoked: import("zod").ZodInt;
+    }, import("zod/v4/core").$strip>;
   }>;
 }
 //#endregion
@@ -2895,68 +3033,68 @@ declare class RealmController {
    * This endpoint is not exposed in the API documentation.
    */
   readonly getRealmConfig: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      realmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      settings: import("typebox").TObject<{
-        displayName: import("typebox").TOptional<import("typebox").TString>;
-        description: import("typebox").TOptional<import("typebox").TString>;
-        logoUrl: import("typebox").TOptional<import("typebox").TString>;
-        registrationAllowed: import("typebox").TBoolean;
-        email: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-        username: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">, import("typebox").TLiteral<"email">]>;
-        usernameRegExp: import("typebox").TString;
-        usernameBlocklist: import("typebox").TArray<import("typebox").TString>;
-        phoneNumber: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-        verifyEmailRequired: import("typebox").TBoolean;
-        verifyPhoneRequired: import("typebox").TBoolean;
-        firstNameLastName: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-        resetPasswordAllowed: import("typebox").TBoolean;
-        captchaRequired: import("typebox").TBoolean;
-        adminEmails: import("typebox").TArray<import("typebox").TString>;
-        adminUsernames: import("typebox").TArray<import("typebox").TString>;
-        defaultRoles: import("typebox").TArray<import("typebox").TString>;
-        verifyEmailUrl: import("typebox").TOptional<import("typebox").TString>;
-        passwordPolicy: import("typebox").TObject<{
-          minLength: import("typebox").TInteger;
-          requireUppercase: import("typebox").TBoolean;
-          requireLowercase: import("typebox").TBoolean;
-          requireNumbers: import("typebox").TBoolean;
-          requireSpecialCharacters: import("typebox").TBoolean;
-        }>;
-        loginRateLimit: import("typebox").TObject<{
-          ipMaxAttempts: import("typebox").TInteger;
-          accountMaxAttempts: import("typebox").TInteger;
-          windowMs: import("typebox").TInteger;
+    query: import("zod").ZodObject<{
+      realmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      settings: import("zod").ZodObject<{
+        displayName: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        logoUrl: import("zod").ZodOptional<import("zod").ZodString>;
+        registrationAllowed: import("zod").ZodBoolean;
+        email: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+        username: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">, import("zod").ZodLiteral<"email">]>;
+        usernameRegExp: import("zod").ZodString;
+        usernameBlocklist: import("zod").ZodArray<import("zod").ZodString>;
+        phoneNumber: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+        verifyEmailRequired: import("zod").ZodBoolean;
+        verifyPhoneRequired: import("zod").ZodBoolean;
+        firstNameLastName: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+        resetPasswordAllowed: import("zod").ZodBoolean;
+        captchaRequired: import("zod").ZodBoolean;
+        adminEmails: import("zod").ZodArray<import("zod").ZodString>;
+        adminUsernames: import("zod").ZodArray<import("zod").ZodString>;
+        defaultRoles: import("zod").ZodArray<import("zod").ZodString>;
+        verifyEmailUrl: import("zod").ZodOptional<import("zod").ZodString>;
+        passwordPolicy: import("zod").ZodObject<{
+          minLength: import("zod").ZodDefault<import("zod").ZodInt>;
+          requireUppercase: import("zod").ZodBoolean;
+          requireLowercase: import("zod").ZodBoolean;
+          requireNumbers: import("zod").ZodBoolean;
+          requireSpecialCharacters: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strip>;
+        loginRateLimit: import("zod").ZodObject<{
+          ipMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+          accountMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+          windowMs: import("zod").ZodDefault<import("zod").ZodInt>;
+        }, import("zod/v4/core").$strip>;
+        registrationIpMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+        refreshToken: import("zod").ZodObject<{
+          expirationIdle: import("zod").ZodOptional<import("zod").ZodInt>;
+        }, import("zod/v4/core").$strip>;
+      }, import("zod/v4/core").$strip>;
+      realmName: import("zod").ZodString;
+      authenticationMethods: import("zod").ZodArray<import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        type: import("zod").ZodEnum<{
+          CREDENTIALS: "CREDENTIALS";
+          OAUTH2: "OAUTH2";
+          OIDC: "OIDC";
         }>;
-        registrationIpMaxAttempts: import("typebox").TInteger;
-        refreshToken: import("typebox").TObject<{
-          expirationIdle: import("typebox").TOptional<import("typebox").TInteger>;
-        }>;
-      }>;
-      realmName: import("typebox").TString;
-      authenticationMethods: import("typebox").TArray<import("typebox").TObject<{
-        name: import("typebox").TString;
-        type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
-      }>>;
-      captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
-      federated: import("typebox").TOptional<import("typebox").TObject<{
-        brokerUrl: import("typebox").TString;
-        providers: import("typebox").TArray<import("typebox").TUnion<[import("typebox").TLiteral<"google">, import("typebox").TLiteral<"apple">]>>;
-      }>>;
-    }>;
+      }, import("zod/v4/core").$strip>>;
+      captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   readonly checkUsernameAvailability: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      realmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      username: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      available: import("typebox").TBoolean;
-    }>;
+    query: import("zod").ZodObject<{
+      realmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      username: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      available: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>;
   }>;
 }
 //#endregion
@@ -2967,11 +3105,11 @@ declare class RealmController {
  * Requires the intent ID from Phase 1, the verification code,
  * and the new password.
  */
-declare const completePasswordResetRequestSchema: import("typebox").TObject<{
-  intentId: import("typebox").TString;
-  code: import("typebox").TString;
-  newPassword: import("typebox").TString;
-}>;
+declare const completePasswordResetRequestSchema: import("zod").ZodObject<{
+  intentId: import("zod").ZodString;
+  code: import("zod").ZodString;
+  newPassword: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/passwordResetIntentResponseSchema.d.ts
@@ -2981,10 +3119,10 @@ type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSc
  * Contains the intent ID needed for Phase 2 completion,
  * along with expiration time.
  */
-declare const passwordResetIntentResponseSchema: import("typebox").TObject<{
-  intentId: import("typebox").TString;
-  expiresAt: import("typebox").TString;
-}>;
+declare const passwordResetIntentResponseSchema: import("zod").ZodObject<{
+  intentId: import("zod").ZodString;
+  expiresAt: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type PasswordResetIntentResponse = Static<typeof passwordResetIntentResponseSchema>;
 //#endregion
 //#region ../../src/api/users/services/CredentialService.d.ts
@@ -3009,53 +3147,57 @@ declare class CredentialService {
   protected sessionAudits(realmName?: string): SessionAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
   protected readonly intentCache: import("alepha/cache").CacheMiddlewareFn<PasswordResetIntent>;
-  users(userRealmName?: string): Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-    roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-    firstName: import("typebox").TOptional<import("typebox").TString>;
-    lastName: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-    emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-    organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-  }>>;
-  sessions(userRealmName?: string): Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    refreshToken: import("typebox").TString;
-    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-    clientId: import("typebox").TOptional<import("typebox").TString>;
-    expiresAt: import("typebox").TString;
-    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-    ip: import("typebox").TOptional<import("typebox").TString>;
-    country: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TObject<{
-      os: import("typebox").TString;
-      browser: import("typebox").TString;
-      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-    }>>;
-  }>>;
-  identities(userRealmName?: string): Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-    password: import("typebox").TOptional<import("typebox").TString>;
-    provider: import("typebox").TString;
-    providerUserId: import("typebox").TOptional<import("typebox").TString>;
-    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  }>>;
+  users(userRealmName?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+    emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+    organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+  }, import("zod/v4/core").$strip>>;
+  sessions(userRealmName?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: import("zod").ZodString;
+    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    ip: import("zod").ZodOptional<import("zod").ZodString>;
+    country: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+      os: import("zod").ZodString;
+      browser: import("zod").ZodString;
+      device: import("zod").ZodEnum<{
+        DESKTOP: "DESKTOP";
+        MOBILE: "MOBILE";
+        TABLET: "TABLET";
+      }>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
+  identities(userRealmName?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+    password: import("zod").ZodOptional<import("zod").ZodString>;
+    provider: import("zod").ZodString;
+    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Validate a password against the realm's password policy.
    */
@@ -3095,12 +3237,12 @@ declare class CredentialService {
 }
 //#endregion
 //#region ../../src/api/users/schemas/completeRegistrationRequestSchema.d.ts
-declare const completeRegistrationRequestSchema: import("typebox").TObject<{
-  intentId: import("typebox").TString;
-  emailCode: import("typebox").TOptional<import("typebox").TString>;
-  phoneCode: import("typebox").TOptional<import("typebox").TString>;
-  captchaToken: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const completeRegistrationRequestSchema: import("zod").ZodObject<{
+  intentId: import("zod").ZodString;
+  emailCode: import("zod").ZodOptional<import("zod").ZodString>;
+  phoneCode: import("zod").ZodOptional<import("zod").ZodString>;
+  captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registerRequestSchema.d.ts
@@ -3108,27 +3250,27 @@ type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSche
  * Schema for user registration request body.
  * Password is always required, other fields depend on realm settings.
  */
-declare const registerRequestSchema: import("typebox").TObject<{
-  password: import("typebox").TString;
-  username: import("typebox").TOptional<import("typebox").TString>;
-  email: import("typebox").TOptional<import("typebox").TString>;
-  phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-  firstName: import("typebox").TOptional<import("typebox").TString>;
-  lastName: import("typebox").TOptional<import("typebox").TString>;
-  picture: import("typebox").TOptional<import("typebox").TString>;
-  captchaToken: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const registerRequestSchema: import("zod").ZodObject<{
+  password: import("zod").ZodString;
+  username: import("zod").ZodOptional<import("zod").ZodString>;
+  email: import("zod").ZodOptional<import("zod").ZodString>;
+  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+  firstName: import("zod").ZodOptional<import("zod").ZodString>;
+  lastName: import("zod").ZodOptional<import("zod").ZodString>;
+  picture: import("zod").ZodOptional<import("zod").ZodString>;
+  captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type RegisterRequest = Static<typeof registerRequestSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registrationIntentResponseSchema.d.ts
-declare const registrationIntentResponseSchema: import("typebox").TObject<{
-  intentId: import("typebox").TString;
-  expectCaptcha: import("typebox").TBoolean;
-  captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
-  expectEmailVerification: import("typebox").TBoolean;
-  expectPhoneVerification: import("typebox").TBoolean;
-  expiresAt: import("typebox").TString;
-}>;
+declare const registrationIntentResponseSchema: import("zod").ZodObject<{
+  intentId: import("zod").ZodString;
+  expectCaptcha: import("zod").ZodBoolean;
+  captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
+  expectEmailVerification: import("zod").ZodBoolean;
+  expectPhoneVerification: import("zod").ZodBoolean;
+  expiresAt: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type RegistrationIntentResponse = Static<typeof registrationIntentResponseSchema>;
 //#endregion
 //#region ../../src/api/users/services/UsernameSlugger.d.ts
@@ -3249,6 +3391,7 @@ declare class RegistrationService {
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly cryptoProvider: CryptoProvider;
   protected readonly verificationController: import("alepha/server/links").HttpVirtualClient<VerificationController>;
+  protected readonly verificationService: VerificationService;
   protected readonly realmProvider: RealmProvider;
   protected readonly credentialService: CredentialService;
   protected readonly captchaProvider: CaptchaProvider;
@@ -3305,135 +3448,135 @@ declare class UserController {
    * Validates data, creates verification sessions, and stores intent in cache.
    */
   readonly createRegistrationIntent: import("alepha/server").ActionPrimitiveFn<{
-    body: import("typebox").TObject<{
-      password: import("typebox").TString;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      captchaToken: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      intentId: import("typebox").TString;
-      expectCaptcha: import("typebox").TBoolean;
-      captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
-      expectEmailVerification: import("typebox").TBoolean;
-      expectPhoneVerification: import("typebox").TBoolean;
-      expiresAt: import("typebox").TString;
-    }>;
+    body: import("zod").ZodObject<{
+      password: import("zod").ZodString;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      intentId: import("zod").ZodString;
+      expectCaptcha: import("zod").ZodBoolean;
+      captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
+      expectEmailVerification: import("zod").ZodBoolean;
+      expectPhoneVerification: import("zod").ZodBoolean;
+      expiresAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Phase 2: Complete registration using an intent.
    * Validates verification codes and creates the user.
    */
   readonly createUserFromIntent: import("alepha/server").ActionPrimitiveFn<{
-    body: import("typebox").TObject<{
-      intentId: import("typebox").TString;
-      emailCode: import("typebox").TOptional<import("typebox").TString>;
-      phoneCode: import("typebox").TOptional<import("typebox").TString>;
-      captchaToken: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>;
+    body: import("zod").ZodObject<{
+      intentId: import("zod").ZodString;
+      emailCode: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneCode: import("zod").ZodOptional<import("zod").ZodString>;
+      captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Phase 1: Create a password reset intent.
    * Validates email, sends verification code, and stores intent in cache.
    */
   readonly createPasswordResetIntent: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      email: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      intentId: import("typebox").TString;
-      expiresAt: import("typebox").TString;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      intentId: import("zod").ZodString;
+      expiresAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Phase 2: Complete password reset using an intent.
    * Validates verification code, updates password, and invalidates sessions.
    */
   readonly completePasswordReset: import("alepha/server").ActionPrimitiveFn<{
-    body: import("typebox").TObject<{
-      intentId: import("typebox").TString;
-      code: import("typebox").TString;
-      newPassword: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      ok: import("typebox").TBoolean;
-      id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TInteger]>>;
-      count: import("typebox").TOptional<import("typebox").TNumber>;
-    }>;
+    body: import("zod").ZodObject<{
+      intentId: import("zod").ZodString;
+      code: import("zod").ZodString;
+      newPassword: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      ok: import("zod").ZodBoolean;
+      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
+      count: import("zod").ZodOptional<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * @deprecated Use createPasswordResetIntent instead
    */
   requestPasswordReset: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      email: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      success: import("typebox").TBoolean;
-      message: import("typebox").TString;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      success: import("zod").ZodBoolean;
+      message: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * @deprecated Use completePasswordReset instead
    */
   validateResetToken: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      email: import("typebox").TString;
-      token: import("typebox").TString;
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      valid: import("typebox").TBoolean;
-      email: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+      token: import("zod").ZodString;
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      valid: import("zod").ZodBoolean;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * @deprecated Use completePasswordReset instead
    */
   resetPassword: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      email: import("typebox").TString;
-      token: import("typebox").TString;
-      newPassword: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      success: import("typebox").TBoolean;
-      message: import("typebox").TString;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+      token: import("zod").ZodString;
+      newPassword: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      success: import("zod").ZodBoolean;
+      message: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Request email verification.
@@ -3442,46 +3585,49 @@ declare class UserController {
    * @param verifyUrl - Required when method is "link". The base URL for the verification link. Token and email will be appended as query params.
    */
   requestEmailVerification: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-      method: import("typebox").TOptional<import("typebox").TUnsafe<"link" | "code">>;
-    }>;
-    body: import("typebox").TObject<{
-      email: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      success: import("typebox").TBoolean;
-      message: import("typebox").TString;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+      method: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+        code: "code";
+        link: "link";
+      }>>>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      success: import("zod").ZodBoolean;
+      message: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Verify email with a valid token.
    * Updates the user's emailVerified status.
    */
   verifyEmail: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      email: import("typebox").TString;
-      token: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      success: import("typebox").TBoolean;
-      message: import("typebox").TString;
-    }>;
+    query: import("zod").ZodObject<{
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+      token: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      success: import("zod").ZodBoolean;
+      message: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Check if an email is verified.
    */
   checkEmailVerification: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      email: import("typebox").TString;
-      userRealmName: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      verified: import("typebox").TBoolean;
-    }>;
+    query: import("zod").ZodObject<{
+      email: import("zod").ZodString;
+      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      verified: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>;
   }>;
 }
 //#endregion
@@ -3500,24 +3646,28 @@ declare class UserController {
 declare class UserJobs {
   protected readonly log: import("alepha/logger").Logger;
   protected readonly dateTimeProvider: DateTimeProvider;
-  protected readonly sessionRepository: import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TInteger, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    refreshToken: import("typebox").TString;
-    userId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_REF>;
-    clientId: import("typebox").TOptional<import("typebox").TString>;
-    expiresAt: import("typebox").TString;
-    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-    ip: import("typebox").TOptional<import("typebox").TString>;
-    country: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TObject<{
-      os: import("typebox").TString;
-      browser: import("typebox").TString;
-      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-    }>>;
-  }>>;
+  protected readonly sessionRepository: import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    refreshToken: import("zod").ZodString;
+    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    ip: import("zod").ZodOptional<import("zod").ZodString>;
+    country: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+      os: import("zod").ZodString;
+      browser: import("zod").ZodString;
+      device: import("zod").ZodEnum<{
+        DESKTOP: "DESKTOP";
+        MOBILE: "MOBILE";
+        TABLET: "TABLET";
+      }>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
   protected readonly realmProvider: RealmProvider;
   /**
    * Purge expired sessions from the database.
@@ -3531,104 +3681,100 @@ declare class UserJobs {
    * The idle sweep is best-effort cleanup — runtime enforcement happens in
    * `SessionService.refreshSession()`.
    */
-  readonly purgeExpiredSessions: import("alepha/api/jobs").JobPrimitive<import("typebox").TSchema>;
+  readonly purgeExpiredSessions: import("alepha/api/jobs").JobPrimitive<import("alepha").ZType>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/identityResourceSchema.d.ts
-declare const identityResourceSchema: import("typebox").TObject<{
-  id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-  userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-  provider: import("typebox").TString;
-  providerUserId: import("typebox").TOptional<import("typebox").TString>;
-  providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-}>;
+declare const identityResourceSchema: import("zod").ZodObject<{
+  id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+  userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+  provider: import("zod").ZodString;
+  providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+  providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+}, import("zod/v4/core").$strip>;
 type IdentityResource = Static<typeof identityResourceSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/loginSchema.d.ts
-declare const loginSchema: import("typebox").TObject<{
-  username: import("typebox").TString;
-  password: import("typebox").TString;
-}>;
+declare const loginSchema: import("zod").ZodObject<{
+  username: import("zod").ZodString;
+  password: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type LoginInput = Static<typeof loginSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/realmConfigSchema.d.ts
-declare const realmConfigSchema: import("typebox").TObject<{
-  settings: import("typebox").TObject<{
-    displayName: import("typebox").TOptional<import("typebox").TString>;
-    description: import("typebox").TOptional<import("typebox").TString>;
-    logoUrl: import("typebox").TOptional<import("typebox").TString>;
-    registrationAllowed: import("typebox").TBoolean;
-    email: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-    username: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">, import("typebox").TLiteral<"email">]>;
-    usernameRegExp: import("typebox").TString;
-    usernameBlocklist: import("typebox").TArray<import("typebox").TString>;
-    phoneNumber: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-    verifyEmailRequired: import("typebox").TBoolean;
-    verifyPhoneRequired: import("typebox").TBoolean;
-    firstNameLastName: import("typebox").TUnion<[import("typebox").TLiteral<"none">, import("typebox").TLiteral<"optional">, import("typebox").TLiteral<"required">]>;
-    resetPasswordAllowed: import("typebox").TBoolean;
-    captchaRequired: import("typebox").TBoolean;
-    adminEmails: import("typebox").TArray<import("typebox").TString>;
-    adminUsernames: import("typebox").TArray<import("typebox").TString>;
-    defaultRoles: import("typebox").TArray<import("typebox").TString>;
-    verifyEmailUrl: import("typebox").TOptional<import("typebox").TString>;
-    passwordPolicy: import("typebox").TObject<{
-      minLength: import("typebox").TInteger;
-      requireUppercase: import("typebox").TBoolean;
-      requireLowercase: import("typebox").TBoolean;
-      requireNumbers: import("typebox").TBoolean;
-      requireSpecialCharacters: import("typebox").TBoolean;
-    }>;
-    loginRateLimit: import("typebox").TObject<{
-      ipMaxAttempts: import("typebox").TInteger;
-      accountMaxAttempts: import("typebox").TInteger;
-      windowMs: import("typebox").TInteger;
-    }>;
-    registrationIpMaxAttempts: import("typebox").TInteger;
-    refreshToken: import("typebox").TObject<{
-      expirationIdle: import("typebox").TOptional<import("typebox").TInteger>;
-    }>;
-  }>;
-  realmName: import("typebox").TString;
-  authenticationMethods: import("typebox").TArray<import("typebox").TObject<{
-    name: import("typebox").TString;
-    type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
-  }>>;
-  captchaSiteKey: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Federated (broker) social login. When present, the login UI renders one
-   * button per provider linking to `{brokerUrl}/auth/federated/start`.
-   */
-  federated: import("typebox").TOptional<import("typebox").TObject<{
-    brokerUrl: import("typebox").TString;
-    providers: import("typebox").TArray<import("typebox").TUnion<[import("typebox").TLiteral<"google">, import("typebox").TLiteral<"apple">]>>;
-  }>>;
-}>;
+declare const realmConfigSchema: import("zod").ZodObject<{
+  settings: import("zod").ZodObject<{
+    displayName: import("zod").ZodOptional<import("zod").ZodString>;
+    description: import("zod").ZodOptional<import("zod").ZodString>;
+    logoUrl: import("zod").ZodOptional<import("zod").ZodString>;
+    registrationAllowed: import("zod").ZodBoolean;
+    email: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+    username: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">, import("zod").ZodLiteral<"email">]>;
+    usernameRegExp: import("zod").ZodString;
+    usernameBlocklist: import("zod").ZodArray<import("zod").ZodString>;
+    phoneNumber: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+    verifyEmailRequired: import("zod").ZodBoolean;
+    verifyPhoneRequired: import("zod").ZodBoolean;
+    firstNameLastName: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
+    resetPasswordAllowed: import("zod").ZodBoolean;
+    captchaRequired: import("zod").ZodBoolean;
+    adminEmails: import("zod").ZodArray<import("zod").ZodString>;
+    adminUsernames: import("zod").ZodArray<import("zod").ZodString>;
+    defaultRoles: import("zod").ZodArray<import("zod").ZodString>;
+    verifyEmailUrl: import("zod").ZodOptional<import("zod").ZodString>;
+    passwordPolicy: import("zod").ZodObject<{
+      minLength: import("zod").ZodDefault<import("zod").ZodInt>;
+      requireUppercase: import("zod").ZodBoolean;
+      requireLowercase: import("zod").ZodBoolean;
+      requireNumbers: import("zod").ZodBoolean;
+      requireSpecialCharacters: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>;
+    loginRateLimit: import("zod").ZodObject<{
+      ipMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+      accountMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+      windowMs: import("zod").ZodDefault<import("zod").ZodInt>;
+    }, import("zod/v4/core").$strip>;
+    registrationIpMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
+    refreshToken: import("zod").ZodObject<{
+      expirationIdle: import("zod").ZodOptional<import("zod").ZodInt>;
+    }, import("zod/v4/core").$strip>;
+  }, import("zod/v4/core").$strip>;
+  realmName: import("zod").ZodString;
+  authenticationMethods: import("zod").ZodArray<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    type: import("zod").ZodEnum<{
+      CREDENTIALS: "CREDENTIALS";
+      OAUTH2: "OAUTH2";
+      OIDC: "OIDC";
+    }>;
+  }, import("zod/v4/core").$strip>>;
+  captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type RealmConfig = Static<typeof realmConfigSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registerSchema.d.ts
-declare const registerSchema: import("typebox").TObject<{
-  username: import("typebox").TString;
-  email: import("typebox").TString;
-  password: import("typebox").TString;
-  confirmPassword: import("typebox").TString;
-  firstName: import("typebox").TOptional<import("typebox").TString>;
-  lastName: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const registerSchema: import("zod").ZodObject<{
+  username: import("zod").ZodString;
+  email: import("zod").ZodString;
+  password: import("zod").ZodString;
+  confirmPassword: import("zod").ZodString;
+  firstName: import("zod").ZodOptional<import("zod").ZodString>;
+  lastName: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type RegisterInput = Static<typeof registerSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/resetPasswordSchema.d.ts
-declare const resetPasswordRequestSchema: import("typebox").TObject<{
-  email: import("typebox").TString;
-}>;
-declare const resetPasswordSchema: import("typebox").TObject<{
-  token: import("typebox").TString;
-  password: import("typebox").TString;
-  confirmPassword: import("typebox").TString;
-}>;
+declare const resetPasswordRequestSchema: import("zod").ZodObject<{
+  email: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const resetPasswordSchema: import("zod").ZodObject<{
+  token: import("zod").ZodString;
+  password: import("zod").ZodString;
+  confirmPassword: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 type ResetPasswordRequest = Static<typeof resetPasswordRequestSchema>;
 type ResetPasswordInput = Static<typeof resetPasswordSchema>;
 //#endregion
@@ -3639,57 +3785,61 @@ type ResetPasswordInput = Static<typeof resetPasswordSchema>;
  * back via a left join, so it's optional (a session whose user was deleted
  * still returns; `user` is undefined).
  */
-declare const sessionUserSummarySchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  email: import("typebox").TOptional<import("typebox").TString>;
-  username: import("typebox").TOptional<import("typebox").TString>;
-  firstName: import("typebox").TOptional<import("typebox").TString>;
-  lastName: import("typebox").TOptional<import("typebox").TString>;
-}>;
-declare const sessionResourceSchema: import("typebox").TObject<{
-  id: import("typebox").TString;
-  version: import("typebox").TNumber;
-  createdAt: import("typebox").TString;
-  updatedAt: import("typebox").TString;
-  refreshToken: import("typebox").TString;
-  userId: import("typebox").TString;
-  expiresAt: import("typebox").TString;
-  ip: import("typebox").TOptional<import("typebox").TString>;
-  country: import("typebox").TOptional<import("typebox").TString>;
-  userAgent: import("typebox").TOptional<import("typebox").TObject<{
-    os: import("typebox").TString;
-    browser: import("typebox").TString;
-    device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-  }>>;
-  user: import("typebox").TOptional<import("typebox").TObject<{
-    id: import("typebox").TString;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    firstName: import("typebox").TOptional<import("typebox").TString>;
-    lastName: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-}>;
+declare const sessionUserSummarySchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  email: import("zod").ZodOptional<import("zod").ZodString>;
+  username: import("zod").ZodOptional<import("zod").ZodString>;
+  firstName: import("zod").ZodOptional<import("zod").ZodString>;
+  lastName: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+declare const sessionResourceSchema: import("zod").ZodObject<{
+  id: import("zod").ZodString;
+  version: import("zod").ZodNumber;
+  createdAt: import("zod").ZodString;
+  updatedAt: import("zod").ZodString;
+  refreshToken: import("zod").ZodString;
+  userId: import("zod").ZodString;
+  expiresAt: import("zod").ZodString;
+  ip: import("zod").ZodOptional<import("zod").ZodString>;
+  country: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+    os: import("zod").ZodString;
+    browser: import("zod").ZodString;
+    device: import("zod").ZodEnum<{
+      DESKTOP: "DESKTOP";
+      MOBILE: "MOBILE";
+      TABLET: "TABLET";
+    }>;
+  }, import("zod/v4/core").$strip>>;
+  user: import("zod").ZodOptional<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
 type SessionResource = Static<typeof sessionResourceSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/userResourceSchema.d.ts
-declare const userResourceSchema: import("typebox").TObject<{
-  id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-  realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-  username: import("typebox").TOptional<import("typebox").TString>;
-  email: import("typebox").TOptional<import("typebox").TString>;
-  phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-  roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-  firstName: import("typebox").TOptional<import("typebox").TString>;
-  lastName: import("typebox").TOptional<import("typebox").TString>;
-  picture: import("typebox").TOptional<import("typebox").TString>;
-  enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-  emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-  lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-  organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-}>;
+declare const userResourceSchema: import("zod").ZodObject<{
+  id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+  realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+  username: import("zod").ZodOptional<import("zod").ZodString>;
+  email: import("zod").ZodOptional<import("zod").ZodString>;
+  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+  roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+  firstName: import("zod").ZodOptional<import("zod").ZodString>;
+  lastName: import("zod").ZodOptional<import("zod").ZodString>;
+  picture: import("zod").ZodOptional<import("zod").ZodString>;
+  enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+  emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+  lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+  organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+}, import("zod/v4/core").$strip>;
 type UserResource = Static<typeof userResourceSchema>;
 //#endregion
 //#region ../../src/api/users/services/SessionService.d.ts
@@ -3706,53 +3856,57 @@ declare class SessionService {
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected sessionAudits(realmName?: string): SessionAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  users(userRealmName?: string): Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-    roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-    firstName: import("typebox").TOptional<import("typebox").TString>;
-    lastName: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-    emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-    lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-    organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-  }>>;
-  sessions(userRealmName?: string): Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    refreshToken: import("typebox").TString;
-    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-    clientId: import("typebox").TOptional<import("typebox").TString>;
-    expiresAt: import("typebox").TString;
-    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-    ip: import("typebox").TOptional<import("typebox").TString>;
-    country: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TObject<{
-      os: import("typebox").TString;
-      browser: import("typebox").TString;
-      device: import("typebox").TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
-    }>>;
-  }>>;
-  identities(userRealmName?: string): Repository$1<import("typebox").TObject<{
-    id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    userId: PgAttr<import("typebox").TString, typeof PG_REF>;
-    password: import("typebox").TOptional<import("typebox").TString>;
-    provider: import("typebox").TString;
-    providerUserId: import("typebox").TOptional<import("typebox").TString>;
-    providerData: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  }>>;
+  users(userRealmName?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+    emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+    organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+  }, import("zod/v4/core").$strip>>;
+  sessions(userRealmName?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: import("zod").ZodString;
+    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    ip: import("zod").ZodOptional<import("zod").ZodString>;
+    country: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
+      os: import("zod").ZodString;
+      browser: import("zod").ZodString;
+      device: import("zod").ZodEnum<{
+        DESKTOP: "DESKTOP";
+        MOBILE: "MOBILE";
+        TABLET: "TABLET";
+      }>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
+  identities(userRealmName?: string): Repository$1<import("zod").ZodObject<{
+    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
+    password: import("zod").ZodOptional<import("zod").ZodString>;
+    provider: import("zod").ZodString;
+    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
+    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Check if user should be auto-promoted to admin based on adminEmails/adminUsernames settings.
    * If user matches and doesn't have admin role, promote them.
@@ -3800,62 +3954,62 @@ declare class SessionService {
     sessionId: string;
   }>;
   refreshSession(refreshToken: string, userRealmName?: string): Promise<{
-    user: PgStatic<import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>, PgRelationMap<import("typebox").TObject<{
-      id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<import("typebox").TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<import("typebox").TString, typeof PG_DEFAULT>;
-      username: import("typebox").TOptional<import("typebox").TString>;
-      email: import("typebox").TOptional<import("typebox").TString>;
-      phoneNumber: import("typebox").TOptional<import("typebox").TString>;
-      roles: PgAttr<import("typebox").TArray<import("typebox").TString>, typeof PG_DEFAULT>;
-      firstName: import("typebox").TOptional<import("typebox").TString>;
-      lastName: import("typebox").TOptional<import("typebox").TString>;
-      picture: import("typebox").TOptional<import("typebox").TString>;
-      enabled: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-      lastLoginAt: import("typebox").TOptional<import("typebox").TString>;
-      organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-    }>>>;
+    user: PgStatic<import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+    }, import("zod/v4/core").$strip>, PgRelationMap<import("zod").ZodObject<{
+      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
+      username: import("zod").ZodOptional<import("zod").ZodString>;
+      email: import("zod").ZodOptional<import("zod").ZodString>;
+      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
+      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
+      firstName: import("zod").ZodOptional<import("zod").ZodString>;
+      lastName: import("zod").ZodOptional<import("zod").ZodString>;
+      picture: import("zod").ZodOptional<import("zod").ZodString>;
+      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
+      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+    }, import("zod/v4/core").$strip>>>;
     expiresIn: number;
     sessionId: string;
   }>;
   deleteSession(refreshToken: string, userRealmName?: string): Promise<void>;
   link(provider: string, profile: OAuth2Profile, userRealmName?: string): Promise<{
-    email?: string | undefined;
-    phoneNumber?: string | undefined;
-    username?: string | undefined;
-    firstName?: string | undefined;
-    lastName?: string | undefined;
-    picture?: string | undefined;
-    lastLoginAt?: string | undefined;
-    enabled: boolean;
     id: string;
     version: number;
     createdAt: string;
     updatedAt: string;
     realm: string;
+    username?: string | undefined;
+    email?: string | undefined;
+    phoneNumber?: string | undefined;
     roles: string[];
+    firstName?: string | undefined;
+    lastName?: string | undefined;
+    picture?: string | undefined;
+    enabled: boolean;
     emailVerified: boolean;
-    organizationId: string;
+    lastLoginAt?: string | undefined;
+    organizationId: string | undefined;
   } | {
     sub: string;
     email?: string;
@@ -3906,5 +4060,5 @@ declare class SessionService {
  */
 declare const AlephaApiUsers: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionAudits, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserQuery, UserResource, UserService, UsernameFieldRequirement, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, MySession, MySessionController, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionAudits, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserQuery, UserResource, UserService, UsernameFieldRequirement, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, mySessionSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 //# sourceMappingURL=index.d.ts.map