wolpert · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/SECURITY.md b/SECURITY.md
@@ -4,14 +4,15 @@ pk-auth is an authentication library, so security reports are handled with prior
 
 ## Supported versions
 
-Fixes land on the latest published `1.x` line. Maven Central and npm releases are immutable, so a
+Fixes land on the latest published `2.x` line. Maven Central and npm releases are immutable, so a
 security fix ships as a new patch (or minor) release rather than a re-publish of an affected
 version. Upgrading to the latest release picks up the fix.
 
 | Version              | Supported                     |
 | -------------------- | ----------------------------- |
-| Latest `1.x` release | :white_check_mark:            |
-| Older `1.x` releases | Fix only via the next release |
+| Latest `2.x` release | :white_check_mark:            |
+| Older `2.x` releases | Fix only via the next release |
+| `1.x`                | :x: (upgrade to `2.x`)        |
 | `0.x` (pre-stable)   | :x:                           |
 
 The browser SDK (`@pk-auth/passkeys-browser`) shares the same version line as the JVM artifacts and

diff --git a/clients/passkeys-browser/package-lock.json b/clients/passkeys-browser/package-lock.json
diff --git a/clients/passkeys-browser/test/ceremonies.test.ts b/clients/passkeys-browser/test/ceremonies.test.ts
@@ -9,9 +9,12 @@ import {
   encodeRegistrationResponse,
 } from "../src/ceremonies";
 import type {
+  FinishAuthenticationRequest, FinishAuthenticationResponse,
   FinishRegistrationRequest, FinishRegistrationResponse,
   PublicKeyCredentialCreationOptionsJson,
-  PublicKeyCredentialRequestOptionsJson, StartRegistrationRequest, StartRegistrationResponse,
+  PublicKeyCredentialRequestOptionsJson,
+  StartAuthenticationRequest, StartAuthenticationResponse,
+  StartRegistrationRequest, StartRegistrationResponse,
 } from "../src/types";
 import {
   decodeJson,
@@ -25,12 +28,6 @@ import {
 import * as http from "node:http";
 import {CeremonyService} from "./helpers/ceremony";
 import {FakeAuthenticator} from "./helpers/fakeAuthenticator";
-import {
-  FinishAuthenticationRequest,
-  FinishAuthenticationResponse,
-  StartAuthenticationRequest,
-  StartAuthenticationResponse
-} from "../dist/src";
 
 const CREATE_OPTIONS_JSON: PublicKeyCredentialCreationOptionsJson = {
   rp: { id: "example.com", name: "Example" },

diff --git a/docs/adr/0001-record-architecture-decisions.md b/docs/adr/0001-record-architecture-decisions.md
@@ -1,4 +1,4 @@
-# 1. Record architecture decisions
+# 1. Architecture decision records
 
 Date: 2026-05-12
 

diff --git a/docs/adr/0004-dagger-for-dropwizard.md b/docs/adr/0004-dagger-for-dropwizard.md
@@ -1,4 +1,4 @@
-# 4. Use Dagger 2 for the Dropwizard adapter's DI
+# 4. Dagger 2 for Dropwizard adapter wiring
 
 Date: 2026-05-14
 

diff --git a/docs/adr/0006-userlookup-spi-not-owned.md b/docs/adr/0006-userlookup-spi-not-owned.md
@@ -1,4 +1,4 @@
-# 6. `UserLookup` is an SPI, not an owned table
+# 6. `UserLookup` as a host-implemented SPI
 
 Date: 2026-05-15
 

diff --git a/docs/adr/0008-dynamodb-single-table-design.md b/docs/adr/0008-dynamodb-single-table-design.md
@@ -1,4 +1,4 @@
-# 8. DynamoDB single-table design for auth items, separate users table
+# 8. DynamoDB single-table design with a separate users table
 
 Date: 2026-05-14
 

diff --git a/docs/adr/0010-dropwizard-track-latest.md b/docs/adr/0010-dropwizard-track-latest.md
@@ -1,4 +1,4 @@
-# 10. Track latest Dropwizard rather than pin to 4.x
+# 10. Latest Dropwizard release line over a 4.x pin
 
 Date: 2026-05-15
 

diff --git a/docs/adr/0011-spring-boot-4.md b/docs/adr/0011-spring-boot-4.md
@@ -1,4 +1,4 @@
-# 11. Spring Boot 4 / Spring Security 7 for the Spring starter
+# 11. Spring Boot 4 and Spring Security 7
 
 Date: 2026-05-16
 

diff --git a/docs/adr/0015-stateful-access-tokens.md b/docs/adr/0015-stateful-access-tokens.md
@@ -93,10 +93,9 @@ Adapter wiring:
 - Con: the store holds one row per issued token. Hosts that issue at high volume (millions per day)
   and do not need fast revocation should stay with `RevocationCheck` and a small deny-list. The
   library does not auto-detect this, and the operator picks the binding.
-- Con: the `ttl` field on `JwtClaims` is not yet a first-class device-id channel. When stateful,
-  `record(...)` always passes `Optional.empty()` for `deviceId`. A future ADR (when refresh tokens
-  land) extends this surface to bind issued JWTs to a refresh family or device for "log out this
-  device" granularity.
+- Con: `JwtClaims` carries no device identifier, so `PkAuthJwtIssuer` always passes
+  `Optional.empty()` for `deviceId` to `record(...)`. Binding issued JWTs to a refresh family or
+  device, for "log out this device" granularity, is left to a future ADR.
 - Con: the validator's hot path now includes a store lookup. For the noop case this is a
   hash-lookup-then-return, and for JDBI it is one indexed query per validate. Adopters needing the
   absolute lowest validation latency (for example CDN-near edge validation) should benchmark before

diff --git a/docs/adr/0016-user-deletion-fan-out.md b/docs/adr/0016-user-deletion-fan-out.md
@@ -1,4 +1,4 @@
-# 16. User deletion fan-out is sequential and best-effort
+# 16. Sequential best-effort user deletion fan-out
 
 Date: 2026-05-16
 

diff --git a/docs/adr/0018-remove-sonarqube-cloud.md b/docs/adr/0018-remove-sonarqube-cloud.md
@@ -1,4 +1,4 @@
-# 18. Remove SonarQube Cloud; enforce coverage with native JaCoCo line + branch gates
+# 18. Native JaCoCo coverage gates replacing SonarQube Cloud
 
 Date: 2026-06-11
 

diff --git a/docs/adr/README.md b/docs/adr/README.md
@@ -8,23 +8,23 @@ ADR is added and the prior one is marked `Superseded by NNNN`. See
 
 | # | Status | Date | Title |
 |---|---|---|---|
-| [0001](./0001-record-architecture-decisions.md) | Accepted | 2026-05-12 | Record architecture decisions |
+| [0001](./0001-record-architecture-decisions.md) | Accepted | 2026-05-12 | Architecture decision records |
 | [0002](./0002-webauthn4j-over-yubico.md) | Accepted | 2026-05-13 | WebAuthn4J over Yubico java-webauthn-server |
 | [0003](./0003-jdbi-over-jpa.md) | Accepted | 2026-05-14 | JDBI over JPA |
-| [0004](./0004-dagger-for-dropwizard.md) | Accepted | 2026-05-14 | Use Dagger 2 for the Dropwizard adapter's DI |
+| [0004](./0004-dagger-for-dropwizard.md) | Accepted | 2026-05-14 | Dagger 2 for Dropwizard adapter wiring |
 | [0005](./0005-stateless-jwt-default.md) | Accepted | 2026-05-14 | Stateless JWT as the default post-ceremony credential |
-| [0006](./0006-userlookup-spi-not-owned.md) | Accepted | 2026-05-15 | `UserLookup` is an SPI, not an owned table |
+| [0006](./0006-userlookup-spi-not-owned.md) | Accepted | 2026-05-15 | `UserLookup` as a host-implemented SPI |
 | [0007](./0007-dynamodb-local-vs-localstack.md) | Accepted | 2026-05-14 | DynamoDB Local over LocalStack for integration tests |
-| [0008](./0008-dynamodb-single-table-design.md) | Accepted | 2026-05-14 | DynamoDB single-table design for auth items, separate users table |
+| [0008](./0008-dynamodb-single-table-design.md) | Accepted | 2026-05-14 | DynamoDB single-table design with a separate users table |
 | [0009](./0009-jackson-3-over-jackson-2.md) | Accepted | 2026-05-13 | Jackson 3 (`tools.jackson`) over Jackson 2 (`com.fasterxml.jackson`) |
-| [0010](./0010-dropwizard-track-latest.md) | Accepted | 2026-05-15 | Track latest Dropwizard rather than pin to 4.x |
-| [0011](./0011-spring-boot-4.md) | Accepted | 2026-05-16 | Spring Boot 4 / Spring Security 7 for the Spring starter |
+| [0010](./0010-dropwizard-track-latest.md) | Accepted | 2026-05-15 | Latest Dropwizard release line over a 4.x pin |
+| [0011](./0011-spring-boot-4.md) | Accepted | 2026-05-16 | Spring Boot 4 and Spring Security 7 |
 | [0012](./0012-micronaut-4.md) | Accepted | 2026-05-16 | Micronaut 4 for the Micronaut adapter |
 | [0013](./0013-refresh-tokens-family-rotation.md) | Accepted | 2026-05-16 | Rotating refresh tokens with family-based replay detection |
 | [0014](./0014-per-audience-ttl-policy.md) | Accepted | 2026-05-16 | Per-audience JWT TTL via a TokenTtlPolicy SPI |
 | [0015](./0015-stateful-access-tokens.md) | Accepted | 2026-05-16 | Stateful access tokens via AccessTokenStore SPI |
-| [0016](./0016-user-deletion-fan-out.md) | Accepted | 2026-05-16 | User deletion fan-out is sequential and best-effort |
+| [0016](./0016-user-deletion-fan-out.md) | Accepted | 2026-05-16 | Sequential best-effort user deletion fan-out |
 | [0017](./0017-sonarqube-cloud-static-analysis.md) | Superseded by [0018](./0018-remove-sonarqube-cloud.md) | 2026-06-11 | SonarQube Cloud for static analysis and coverage tracking |
-| [0018](./0018-remove-sonarqube-cloud.md) | Accepted | 2026-06-11 | Remove SonarQube Cloud; enforce coverage with native JaCoCo line + branch gates |
+| [0018](./0018-remove-sonarqube-cloud.md) | Accepted | 2026-06-11 | Native JaCoCo coverage gates replacing SonarQube Cloud |
 | [0019](./0019-crypto-agility-post-quantum-readiness.md) | Accepted | 2026-06-17 | Crypto-agility and post-quantum readiness for passkey algorithms |
 | [0020](./0020-browser-sdk-testing-strategy.md) | Accepted | 2026-06-18 | Browser SDK testing strategy |