import { AuthEngine, Principal, UserAdminEngine } from "../index.js";
import { Querier, TransactionalDatabase } from "@platform-modules/db";
import { DeriveBitsFn } from "@platform-modules/util/password";
//#region src/engine-custom/password.d.ts
type PepperBinding = {
  /** Active pepper version label, e.g. `v1`. */
  currentVersion: string;
  /** Version → secret from a CF binding — never stored in the DB. */
  secrets: Record<string, string>;
};
/**
 * Returns `pbkdf2sha512-pep$<pepperVer>$<iter>$<saltB64>$<hmacB64>`.
 * Pepper is applied AFTER PBKDF2 — never pbkdf2(HMAC(pw, pepper)).
 */
declare function hashPassword(plain: string, pepper: PepperBinding, opts?: {
  deriveBits?: DeriveBitsFn;
}): Promise<string>;
/**
 * Returns true when the stored hash should be re-hashed on next successful login:
 * the pepper version is stale OR the stored work factor is below canonical ITERATIONS —
 * but never when the stored factor exceeds ITERATIONS (never silently downgrade a hash
 * imported at higher cost — raise ITERATIONS instead).
 *
 * Pepper rotation runbook:
 *   1. Add new version to secrets; set currentVersion to it.
 *   2. Monitor via countStalePasswordHashes until 0 old-version hashes remain.
 *   3. Only then remove the old version from secrets.
 * Skipping step 2 creates a timing gap: old-version hashes hit the early-return in verifyPassword
 * while the sentinel runs the full KDF, leaking which emails have un-migrated accounts.
 */
declare function shouldUpgradeHash(stored: string, currentPepperVersion: string): boolean;
/** Parses iter, salt, and pepper version from `stored` — never from module constants alone. */
declare function verifyPassword(plain: string, stored: string, pepper: PepperBinding, opts?: {
  deriveBits?: DeriveBitsFn;
}): Promise<boolean>;
//#endregion
//#region src/engine-custom/schema.d.ts
/** Engine-owned identity row — `sessionVersion` drives `sv` revocation. */
declare const authUsers: import("drizzle-orm/pg-core").PgTableWithColumns<{
  name: "auth_users";
  schema: undefined;
  columns: {
    id: import("drizzle-orm/pg-core").PgColumn<{
      name: "id";
      tableName: "auth_users";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: true;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    email: import("drizzle-orm/pg-core").PgColumn<{
      name: "email";
      tableName: "auth_users";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    passwordHash: import("drizzle-orm/pg-core").PgColumn<{
      name: "password_hash";
      tableName: "auth_users";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: false;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    sessionVersion: import("drizzle-orm/pg-core").PgColumn<{
      name: "session_version";
      tableName: "auth_users";
      dataType: "number";
      columnType: "PgInteger";
      data: number;
      driverParam: string | number;
      notNull: true;
      hasDefault: true;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    roles: import("drizzle-orm/pg-core").PgColumn<{
      name: "roles";
      tableName: "auth_users";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: true;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    status: import("drizzle-orm/pg-core").PgColumn<{
      name: "status";
      tableName: "auth_users";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: true;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    createdAt: import("drizzle-orm/pg-core").PgColumn<{
      name: "created_at";
      tableName: "auth_users";
      dataType: "date";
      columnType: "PgTimestamp";
      data: Date;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
  };
  dialect: "pg";
}>;
/** Idempotent DDL to create the auth_users table (neon-http: one statement). FK root — run first. */
declare const authUsersCreationSql: () => string;
/** Idempotent DDL to create the user_sessions table (neon-http: one statement). FKs auth_users. */
declare const userSessionsCreationSql: () => string;
/** Idempotent DDL for adopters migrating existing auth_users tables (neon-http: one statement). */
declare const authUsersStatusMigrationSql: () => string;
/** Idempotent DDL to create the service_tokens table (neon-http: one statement). FKs auth_users. */
declare const serviceTokensCreationSql: () => string;
/** One refresh-token row per device/session — no access-token hash column. */
declare const userSessions: import("drizzle-orm/pg-core").PgTableWithColumns<{
  name: "user_sessions";
  schema: undefined;
  columns: {
    id: import("drizzle-orm/pg-core").PgColumn<{
      name: "id";
      tableName: "user_sessions";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: true;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    userId: import("drizzle-orm/pg-core").PgColumn<{
      name: "user_id";
      tableName: "user_sessions";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    refreshTokenHash: import("drizzle-orm/pg-core").PgColumn<{
      name: "refresh_token_hash";
      tableName: "user_sessions";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    previousRefreshTokenHash: import("drizzle-orm/pg-core").PgColumn<{
      name: "previous_refresh_token_hash";
      tableName: "user_sessions";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: false;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    lastRefreshedAt: import("drizzle-orm/pg-core").PgColumn<{
      name: "last_refreshed_at";
      tableName: "user_sessions";
      dataType: "date";
      columnType: "PgTimestamp";
      data: Date;
      driverParam: string;
      notNull: false;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
      name: "expires_at";
      tableName: "user_sessions";
      dataType: "date";
      columnType: "PgTimestamp";
      data: Date;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    status: import("drizzle-orm/pg-core").PgColumn<{
      name: "status";
      tableName: "user_sessions";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: true;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
  };
  dialect: "pg";
}>;
/** Opaque machine/agent credential (PAT shape) — independent of userSessions; not rotating. */
declare const serviceTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
  name: "service_tokens";
  schema: undefined;
  columns: {
    id: import("drizzle-orm/pg-core").PgColumn<{
      name: "id";
      tableName: "service_tokens";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: true;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    userId: import("drizzle-orm/pg-core").PgColumn<{
      name: "user_id";
      tableName: "service_tokens";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    tokenHash: import("drizzle-orm/pg-core").PgColumn<{
      name: "token_hash";
      tableName: "service_tokens";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    label: import("drizzle-orm/pg-core").PgColumn<{
      name: "label";
      tableName: "service_tokens";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
      name: "expires_at";
      tableName: "service_tokens";
      dataType: "date";
      columnType: "PgTimestamp";
      data: Date;
      driverParam: string;
      notNull: false;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    status: import("drizzle-orm/pg-core").PgColumn<{
      name: "status";
      tableName: "service_tokens";
      dataType: "string";
      columnType: "PgText";
      data: string;
      driverParam: string;
      notNull: true;
      hasDefault: true;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: [string, ...string[]];
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    createdAt: import("drizzle-orm/pg-core").PgColumn<{
      name: "created_at";
      tableName: "service_tokens";
      dataType: "date";
      columnType: "PgTimestamp";
      data: Date;
      driverParam: string;
      notNull: true;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
    lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
      name: "last_used_at";
      tableName: "service_tokens";
      dataType: "date";
      columnType: "PgTimestamp";
      data: Date;
      driverParam: string;
      notNull: false;
      hasDefault: false;
      isPrimaryKey: false;
      isAutoincrement: false;
      hasRuntimeDefault: false;
      enumValues: undefined;
      baseColumn: never;
      identity: undefined;
      generated: undefined;
    }, {}, {}>;
  };
  dialect: "pg";
}>;
declare const customAuthSchema: {
  authUsers: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "auth_users";
    schema: undefined;
    columns: {
      id: import("drizzle-orm/pg-core").PgColumn<{
        name: "id";
        tableName: "auth_users";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: true;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      email: import("drizzle-orm/pg-core").PgColumn<{
        name: "email";
        tableName: "auth_users";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      passwordHash: import("drizzle-orm/pg-core").PgColumn<{
        name: "password_hash";
        tableName: "auth_users";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: false;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      sessionVersion: import("drizzle-orm/pg-core").PgColumn<{
        name: "session_version";
        tableName: "auth_users";
        dataType: "number";
        columnType: "PgInteger";
        data: number;
        driverParam: string | number;
        notNull: true;
        hasDefault: true;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      roles: import("drizzle-orm/pg-core").PgColumn<{
        name: "roles";
        tableName: "auth_users";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: true;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      status: import("drizzle-orm/pg-core").PgColumn<{
        name: "status";
        tableName: "auth_users";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: true;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      createdAt: import("drizzle-orm/pg-core").PgColumn<{
        name: "created_at";
        tableName: "auth_users";
        dataType: "date";
        columnType: "PgTimestamp";
        data: Date;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
    };
    dialect: "pg";
  }>;
  userSessions: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "user_sessions";
    schema: undefined;
    columns: {
      id: import("drizzle-orm/pg-core").PgColumn<{
        name: "id";
        tableName: "user_sessions";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: true;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      userId: import("drizzle-orm/pg-core").PgColumn<{
        name: "user_id";
        tableName: "user_sessions";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      refreshTokenHash: import("drizzle-orm/pg-core").PgColumn<{
        name: "refresh_token_hash";
        tableName: "user_sessions";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      previousRefreshTokenHash: import("drizzle-orm/pg-core").PgColumn<{
        name: "previous_refresh_token_hash";
        tableName: "user_sessions";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: false;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      lastRefreshedAt: import("drizzle-orm/pg-core").PgColumn<{
        name: "last_refreshed_at";
        tableName: "user_sessions";
        dataType: "date";
        columnType: "PgTimestamp";
        data: Date;
        driverParam: string;
        notNull: false;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      expiresAt: import("drizzle-orm/pg-core").PgColumn<{
        name: "expires_at";
        tableName: "user_sessions";
        dataType: "date";
        columnType: "PgTimestamp";
        data: Date;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      status: import("drizzle-orm/pg-core").PgColumn<{
        name: "status";
        tableName: "user_sessions";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: true;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
    };
    dialect: "pg";
  }>;
  serviceTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "service_tokens";
    schema: undefined;
    columns: {
      id: import("drizzle-orm/pg-core").PgColumn<{
        name: "id";
        tableName: "service_tokens";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: true;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      userId: import("drizzle-orm/pg-core").PgColumn<{
        name: "user_id";
        tableName: "service_tokens";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      tokenHash: import("drizzle-orm/pg-core").PgColumn<{
        name: "token_hash";
        tableName: "service_tokens";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      label: import("drizzle-orm/pg-core").PgColumn<{
        name: "label";
        tableName: "service_tokens";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      expiresAt: import("drizzle-orm/pg-core").PgColumn<{
        name: "expires_at";
        tableName: "service_tokens";
        dataType: "date";
        columnType: "PgTimestamp";
        data: Date;
        driverParam: string;
        notNull: false;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      status: import("drizzle-orm/pg-core").PgColumn<{
        name: "status";
        tableName: "service_tokens";
        dataType: "string";
        columnType: "PgText";
        data: string;
        driverParam: string;
        notNull: true;
        hasDefault: true;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: [string, ...string[]];
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      createdAt: import("drizzle-orm/pg-core").PgColumn<{
        name: "created_at";
        tableName: "service_tokens";
        dataType: "date";
        columnType: "PgTimestamp";
        data: Date;
        driverParam: string;
        notNull: true;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
      lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
        name: "last_used_at";
        tableName: "service_tokens";
        dataType: "date";
        columnType: "PgTimestamp";
        data: Date;
        driverParam: string;
        notNull: false;
        hasDefault: false;
        isPrimaryKey: false;
        isAutoincrement: false;
        hasRuntimeDefault: false;
        enumValues: undefined;
        baseColumn: never;
        identity: undefined;
        generated: undefined;
      }, {}, {}>;
    };
    dialect: "pg";
  }>;
};
//#endregion
//#region src/engine-custom/refresh.d.ts
type SessionUserRow = {
  sessionId: string;
  userId: string;
  sessionVersion: number;
  roles: string[];
};
type RotateRefreshResult = {
  kind: 'rotated';
  user: SessionUserRow;
  accessToken: string;
  refreshToken: string;
} | {
  kind: 'grace';
  user: SessionUserRow;
  accessToken: string;
} | {
  kind: 'race_lost';
  user: SessionUserRow;
  accessToken: string;
} | {
  kind: 'reuse_detected';
  userId: string;
  sessionId: string;
  newSessionVersion: number;
} | {
  kind: 'invalid';
};
declare function rotateRefreshToken<S extends Record<string, unknown>>(db: Querier<S>, tables: {
  authUsers: typeof authUsers;
  userSessions: typeof userSessions;
}, rawRefreshToken: string, jwtSecrets: string[]): Promise<RotateRefreshResult>;
declare function bumpSessionVersion<S extends Record<string, unknown>>(db: Querier<S>, usersTable: typeof authUsers, userId: string): Promise<number>;
//#endregion
//#region src/engine-custom/service-token.d.ts
declare function issueServiceToken<S extends Record<string, unknown>>(db: Querier<S>, tables: {
  authUsers: typeof authUsers;
  serviceTokens: typeof serviceTokens;
}, input: {
  userId: string;
  label: string;
  ttlMs?: number;
  now?: Date;
}): Promise<{
  id: string;
  token: string;
}>;
declare function resolveServiceToken<S extends Record<string, unknown>>(db: Querier<S>, tables: {
  authUsers: typeof authUsers;
  serviceTokens: typeof serviceTokens;
}, rawToken: string, opts?: {
  now?: Date;
}): Promise<Principal | null>;
declare function listServiceTokensForUser<S extends Record<string, unknown>>(db: Querier<S>, tables: {
  serviceTokens: typeof serviceTokens;
}, userId: string): Promise<Array<{
  id: string;
  label: string;
  createdAt: Date;
  expiresAt: Date | null;
  lastUsedAt: Date | null;
  status: string;
}>>;
declare function revokeServiceToken<S extends Record<string, unknown>>(db: Querier<S>, serviceTokensTable: typeof serviceTokens, id: string): Promise<void>;
declare function revokeServiceTokensForUser<S extends Record<string, unknown>>(db: Querier<S>, serviceTokensTable: typeof serviceTokens, userId: string): Promise<void>;
//#endregion
//#region src/engine-custom/session.d.ts
/**
 * Raw Web-Crypto HS256 session tokens.
 * Recomputes HMAC over received `header.payload`; never trusts header `alg`.
 */
type AccessClaims = {
  sub: string;
  sid: string;
  sv: number;
  iat: number;
  exp: number;
};
declare function signSession(claims: Omit<AccessClaims, 'iat' | 'exp'>, secret: string, ttlSec?: number): Promise<string>;
/** Verify against one or more secrets (rotation). Returns null on any failure — never throws. */
declare function verifySession(jwt: string, secrets: string | string[], opts?: {
  minSessionVersion?: number;
}): Promise<AccessClaims | null>;
declare const ACCESS_TOKEN_TTL_SECS: number;
declare const REFRESH_TOKEN_TTL_SECS: number;
//#endregion
//#region src/engine-custom/index.d.ts
type RateLimitScope = 'auth.login' | 'auth.refresh';
type RateLimitHook = (scope: RateLimitScope, subjectKey: string) => Promise<{
  allowed: boolean;
}>;
type CustomEngineConfig<S extends Record<string, unknown> = typeof customAuthSchema> = {
  db: TransactionalDatabase<S>;
  schema?: S;
  jwtSecrets: string[];
  pepper: PepperBinding;
  accessCookieName?: string;
  refreshCookieName?: string;
  rateLimit?: RateLimitHook;
};
declare class InvalidEngineConfigError extends Error {
  readonly field: 'jwtSecrets' | 'pepper';
  readonly name = "InvalidEngineConfigError";
  constructor(message: string, field: 'jwtSecrets' | 'pepper');
}
type UserSessionState = {
  sessionVersion: number;
  roles: string[];
  status: 'active' | 'disabled';
};
declare function lookupUserSessionState<S extends Record<string, unknown>>(db: Querier<S>, userId: string, usersTable?: typeof authUsers): Promise<UserSessionState | null>;
declare function createCustomEngine<S extends Record<string, unknown> = typeof customAuthSchema>(config: CustomEngineConfig<S>): AuthEngine & UserAdminEngine;
/**
 * Returns the count of password hashes NOT on the current pepper version.
 * Zero means every active hash has been lazily upgraded — safe to drop the old version
 * from `PepperBinding.secrets` without opening a timing gap. See `shouldUpgradeHash` runbook.
 */
declare function countStalePasswordHashes<S extends Record<string, unknown>>(db: Querier<S>, currentPepperVersion: string, usersTable?: typeof authUsers): Promise<number>;
//#endregion
export { ACCESS_TOKEN_TTL_SECS, type AccessClaims, CustomEngineConfig, InvalidEngineConfigError, type PepperBinding, REFRESH_TOKEN_TTL_SECS, RateLimitHook, RateLimitScope, UserSessionState, authUsers, authUsersCreationSql, authUsersStatusMigrationSql, bumpSessionVersion, countStalePasswordHashes, createCustomEngine, customAuthSchema, hashPassword, issueServiceToken, listServiceTokensForUser, lookupUserSessionState, resolveServiceToken, revokeServiceToken, revokeServiceTokensForUser, rotateRefreshToken, serviceTokens, serviceTokensCreationSql, shouldUpgradeHash, signSession, userSessions, userSessionsCreationSql, verifySession as verifyAccessToken, verifyPassword };