@happyvertical/smrt-users 0.55.18 → 0.55.19

package/dist/index.js

@@ -1,27 +1,29 @@
-import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as UsersLoginAttemptCollection, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as UsersPasswordCredentialCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as GroupRoleCollection, H as DeviceCredentialForbiddenError, Ht as MembershipOverrideCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupMember, K as PIN_PERMISSION_DEFINITIONS, Kt as GroupRole, L as resolveOidcProviderConfig, Lt as UsersPinCredentialCollection, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as UsersLoginAuditEvent, Rt as UsersPinCredential, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as MembershipOverride, V as DeviceCredentialError, Vt as UsersPasswordCredential, W as DeviceCredentialService, Wt as MembershipCollection, X as PermissionResolver, Xt as Group, Y as SessionService, Yt as GroupCollection, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as UsersLoginAuditEventCollection, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as isValidEmail, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SESSION_DATA_KEYS, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Role, dt as normalizeAncestorReadPolicy, en as UsersLoginAttempt, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as Permission, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as User, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as Session, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as SessionCollection, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as normalizeEmail, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as Membership, pt as UserCollection, q as PinVerifier, qt as GroupMemberCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersCliAuthRequest, rt as InvalidCredentialsError, s as TerminalAuthService, sn as DEFAULT_SESSION_TTL, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersCliAuthRequestCollection, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as generateSessionId, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as PermissionCollection } from "./chunks/TerminalAuthService-DjGsRtqb.js";
+import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as UsersLoginAttemptCollection, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as UsersPasswordCredentialCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as GroupRoleCollection, H as DeviceCredentialForbiddenError, Ht as MembershipOverrideCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupMember, K as PIN_PERMISSION_DEFINITIONS, Kt as GroupRole, L as resolveOidcProviderConfig, Lt as UsersPinCredentialCollection, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as UsersLoginAuditEvent, Rt as UsersPinCredential, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as MembershipOverride, V as DeviceCredentialError, Vt as UsersPasswordCredential, W as DeviceCredentialService, Wt as MembershipCollection, X as PermissionResolver, Xt as Group, Y as SessionService, Yt as GroupCollection, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as UsersLoginAuditEventCollection, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as isValidEmail, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SESSION_DATA_KEYS, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Role, dt as normalizeAncestorReadPolicy, en as UsersLoginAttempt, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as Permission, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as User, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as Session, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as SessionCollection, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as normalizeEmail, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as Membership, pt as UserCollection, q as PinVerifier, qt as GroupMemberCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersCliAuthRequest, rt as InvalidCredentialsError, s as TerminalAuthService, sn as DEFAULT_SESSION_TTL, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersCliAuthRequestCollection, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as generateSessionId, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as PermissionCollection } from "./chunks/TerminalAuthService-DWPeKl3k.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
 import { createHash, randomUUID } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
 import { createLogger } from "@happyvertical/logger";
 import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
 import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
+import { OAuthServerError } from "@happyvertical/auth/server";
 //#region src/models/ResourceGrant.ts
-var __defProp$4 = Object.defineProperty;
-var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
-var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, {
+var __defProp$5 = Object.defineProperty;
+var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, {
 	enumerable: true,
 	configurable: true,
 	writable: true,
 	value
 }) : obj[key] = value;
-var __decorateClass$4 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
+var __decorateClass$5 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$5(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$4(target, key, result);
+	if (kind && result) __defProp$5(target, key, result);
 	return result;
 };
-var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __publicField$5 = (obj, key, value) => __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
 var ResourceGrant = class extends SmrtObject {
 	tenantId;
 	userId;
@@ -48,32 +50,32 @@ var ResourceGrant = class extends SmrtObject {
 		return !this.revokedAt;
 	}
 };
-__publicField$4(ResourceGrant, "__smrtPackage__", "@happyvertical/smrt-users");
-__decorateClass$4([foreignKey("Tenant", { required: true })], ResourceGrant.prototype, "tenantId", 2);
-__decorateClass$4([field({ description: "The person receiving this record-specific access rule." }), foreignKey("User", { required: true })], ResourceGrant.prototype, "userId", 2);
-__decorateClass$4([field({
+__publicField$5(ResourceGrant, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$5([foreignKey("Tenant", { required: true })], ResourceGrant.prototype, "tenantId", 2);
+__decorateClass$5([field({ description: "The person receiving this record-specific access rule." }), foreignKey("User", { required: true })], ResourceGrant.prototype, "userId", 2);
+__decorateClass$5([field({
 	description: "The kind of record this access rule applies to.",
 	type: "text"
 })], ResourceGrant.prototype, "resourceType", 2);
-__decorateClass$4([field({
+__decorateClass$5([field({
 	description: "The specific record covered by this access rule.",
 	type: "text"
 })], ResourceGrant.prototype, "resourceId", 2);
-__decorateClass$4([field({
+__decorateClass$5([field({
 	description: "The action this rule allows or denies for the record.",
 	type: "text"
 })], ResourceGrant.prototype, "permission", 2);
-__decorateClass$4([field({
+__decorateClass$5([field({
 	description: "Whether this rule grants access or denies it. Denies take precedence.",
 	type: "text"
 })], ResourceGrant.prototype, "effect", 2);
-__decorateClass$4([field({ description: "Whether the recipient may pass this grant on to another person." })], ResourceGrant.prototype, "canDelegate", 2);
-__decorateClass$4([field({ description: "The earlier grant from which this access was delegated." }), foreignKey("ResourceGrant")], ResourceGrant.prototype, "parentGrantId", 2);
-__decorateClass$4([field({
+__decorateClass$5([field({ description: "Whether the recipient may pass this grant on to another person." })], ResourceGrant.prototype, "canDelegate", 2);
+__decorateClass$5([field({ description: "The earlier grant from which this access was delegated." }), foreignKey("ResourceGrant")], ResourceGrant.prototype, "parentGrantId", 2);
+__decorateClass$5([field({
 	description: "When this access rule was revoked, if it has ended.",
 	type: "text"
 })], ResourceGrant.prototype, "revokedAt", 2);
-ResourceGrant = __decorateClass$4([smrt({
+ResourceGrant = __decorateClass$5([smrt({
 	tenantScoped: true,
 	api: { include: [] },
 	mcp: { include: [] },
@@ -179,21 +181,21 @@ var UsersRolesAndPermissionsRecipe = class extends SmrtRecipe {
 };
 //#endregion
 //#region src/models/MagicLinkToken.ts
-var __defProp$3 = Object.defineProperty;
-var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
-var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, {
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, {
 	enumerable: true,
 	configurable: true,
 	writable: true,
 	value
 }) : obj[key] = value;
-var __decorateClass$3 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$3(target, key, result);
+	if (kind && result) __defProp$4(target, key, result);
 	return result;
 };
-var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
 var UsersMagicLinkToken = class extends SmrtObject {
 	nonce = "";
@@ -218,16 +220,16 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
-__publicField$3(UsersMagicLinkToken, "__smrtPackage__", "@happyvertical/smrt-users");
-__decorateClass$3([field({
+__publicField$4(UsersMagicLinkToken, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$4([field({
 	required: true,
 	unique: true
 })], UsersMagicLinkToken.prototype, "nonce", 2);
-__decorateClass$3([field({
+__decorateClass$4([field({
 	type: "datetime",
 	indexed: true
 })], UsersMagicLinkToken.prototype, "expiresAt", 2);
-UsersMagicLinkToken = __decorateClass$3([smrt({
+UsersMagicLinkToken = __decorateClass$4([smrt({
 	tableName: "users_magic_link_tokens",
 	sensitive: true,
 	api: { include: [] },
@@ -279,6 +281,395 @@ var UsersMagicLinkTokenCollection = class extends SmrtCollection {
 	}
 };
 //#endregion
+//#region src/models/OAuthAuthorization.ts
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$3(target, key, result);
+	return result;
+};
+var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
+function stringArray(value) {
+	if (Array.isArray(value) && value.every((item) => typeof item === "string")) return [...value];
+	if (typeof value !== "string") return [];
+	try {
+		const parsed = JSON.parse(value);
+		return Array.isArray(parsed) && parsed.every((item) => typeof item === "string") ? parsed : [];
+	} catch {
+		return [];
+	}
+}
+function tokenClaims(value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) return Object.fromEntries(Object.entries(value).filter(([, item]) => typeof item === "string" || typeof item === "number" || typeof item === "boolean"));
+	if (typeof value !== "string") return {};
+	try {
+		return tokenClaims(JSON.parse(value));
+	} catch {
+		return {};
+	}
+}
+var UsersOAuthClient = class extends SmrtObject {
+	clientId = "";
+	redirectUris = "[]";
+	allowedScopes = "[]";
+	tokenEndpointAuthMethod = "none";
+	secretHash = null;
+	allowedResources = "null";
+	createdAt = /* @__PURE__ */ new Date();
+	getRedirectUris() {
+		return stringArray(this.redirectUris);
+	}
+	getAllowedScopes() {
+		return stringArray(this.allowedScopes);
+	}
+	getAllowedResources() {
+		return this.allowedResources === "null" ? void 0 : stringArray(this.allowedResources);
+	}
+};
+__publicField$3(UsersOAuthClient, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$3([field({
+	type: "text",
+	required: true,
+	unique: true
+})], UsersOAuthClient.prototype, "clientId", 2);
+__decorateClass$3([field({
+	nullable: true,
+	sensitive: true
+})], UsersOAuthClient.prototype, "secretHash", 2);
+__decorateClass$3([field({ type: "datetime" })], UsersOAuthClient.prototype, "createdAt", 2);
+UsersOAuthClient = __decorateClass$3([smrt({
+	tableName: "users_oauth_clients",
+	sensitive: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], UsersOAuthClient);
+var UsersOAuthAuthorizationCode = class extends SmrtObject {
+	authorizationId = null;
+	codeHash = "";
+	clientId = "";
+	subject = "";
+	tenantId = null;
+	claims = "{}";
+	redirectUri = "";
+	scopes = "[]";
+	resource = null;
+	codeChallenge = "";
+	expiresAt = /* @__PURE__ */ new Date();
+	consumedAt = null;
+	getScopes() {
+		return stringArray(this.scopes);
+	}
+	getClaims() {
+		return tokenClaims(this.claims);
+	}
+};
+__publicField$3(UsersOAuthAuthorizationCode, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$3([field({
+	nullable: true,
+	indexed: true
+})], UsersOAuthAuthorizationCode.prototype, "authorizationId", 2);
+__decorateClass$3([field({
+	type: "text",
+	required: true,
+	unique: true,
+	sensitive: true
+})], UsersOAuthAuthorizationCode.prototype, "codeHash", 2);
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthAuthorizationCode.prototype, "clientId", 2);
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthAuthorizationCode.prototype, "subject", 2);
+__decorateClass$3([field({
+	nullable: true,
+	indexed: true
+})], UsersOAuthAuthorizationCode.prototype, "tenantId", 2);
+__decorateClass$3([field({ nullable: true })], UsersOAuthAuthorizationCode.prototype, "resource", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	indexed: true
+})], UsersOAuthAuthorizationCode.prototype, "expiresAt", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	nullable: true
+})], UsersOAuthAuthorizationCode.prototype, "consumedAt", 2);
+UsersOAuthAuthorizationCode = __decorateClass$3([smrt({
+	tableName: "users_oauth_authorization_codes",
+	sensitive: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], UsersOAuthAuthorizationCode);
+var UsersOAuthRefreshGrant = class extends SmrtObject {
+	authorizationId = null;
+	tokenHash = "";
+	familyId = "";
+	clientId = "";
+	subject = "";
+	tenantId = null;
+	claims = "{}";
+	scopes = "[]";
+	resource = null;
+	expiresAt = /* @__PURE__ */ new Date();
+	consumedAt = null;
+	revokedAt = null;
+	getScopes() {
+		return stringArray(this.scopes);
+	}
+	getClaims() {
+		return tokenClaims(this.claims);
+	}
+};
+__publicField$3(UsersOAuthRefreshGrant, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$3([field({
+	nullable: true,
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "authorizationId", 2);
+__decorateClass$3([field({
+	type: "text",
+	required: true,
+	unique: true,
+	sensitive: true
+})], UsersOAuthRefreshGrant.prototype, "tokenHash", 2);
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "familyId", 2);
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "clientId", 2);
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "subject", 2);
+__decorateClass$3([field({
+	nullable: true,
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "tenantId", 2);
+__decorateClass$3([field({ nullable: true })], UsersOAuthRefreshGrant.prototype, "resource", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "expiresAt", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	nullable: true
+})], UsersOAuthRefreshGrant.prototype, "consumedAt", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	nullable: true,
+	indexed: true
+})], UsersOAuthRefreshGrant.prototype, "revokedAt", 2);
+UsersOAuthRefreshGrant = __decorateClass$3([smrt({
+	tableName: "users_oauth_refresh_grants",
+	sensitive: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], UsersOAuthRefreshGrant);
+var UsersOAuthAccessTokenRevocation = class extends SmrtObject {
+	jti = "";
+	expiresAt = /* @__PURE__ */ new Date();
+};
+__publicField$3(UsersOAuthAccessTokenRevocation, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$3([field({
+	type: "text",
+	required: true,
+	unique: true,
+	sensitive: true
+})], UsersOAuthAccessTokenRevocation.prototype, "jti", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	indexed: true
+})], UsersOAuthAccessTokenRevocation.prototype, "expiresAt", 2);
+UsersOAuthAccessTokenRevocation = __decorateClass$3([smrt({
+	tableName: "users_oauth_access_token_revocations",
+	sensitive: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], UsersOAuthAccessTokenRevocation);
+var UsersOAuthAuthorization = class extends SmrtObject {
+	subject = "";
+	sessionId = "";
+	clientId = "";
+	tenantId = null;
+	scopes = "[]";
+	permissionCeiling = "[]";
+	resource = null;
+	revokedAt = null;
+	getPermissionCeiling() {
+		return stringArray(this.permissionCeiling);
+	}
+	getScopes() {
+		return stringArray(this.scopes);
+	}
+};
+__publicField$3(UsersOAuthAuthorization, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthAuthorization.prototype, "subject", 2);
+__decorateClass$3([field({
+	type: "text",
+	sensitive: true
+})], UsersOAuthAuthorization.prototype, "sessionId", 2);
+__decorateClass$3([field({
+	type: "text",
+	indexed: true
+})], UsersOAuthAuthorization.prototype, "clientId", 2);
+__decorateClass$3([field({ nullable: true })], UsersOAuthAuthorization.prototype, "tenantId", 2);
+__decorateClass$3([field({ nullable: true })], UsersOAuthAuthorization.prototype, "resource", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	nullable: true
+})], UsersOAuthAuthorization.prototype, "revokedAt", 2);
+UsersOAuthAuthorization = __decorateClass$3([smrt({
+	tableName: "users_oauth_authorizations",
+	sensitive: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], UsersOAuthAuthorization);
+var UsersOAuthRefreshFamily = class extends SmrtObject {
+	authorizationId = null;
+	revokedAt = null;
+};
+__publicField$3(UsersOAuthRefreshFamily, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$3([field({
+	nullable: true,
+	indexed: true
+})], UsersOAuthRefreshFamily.prototype, "authorizationId", 2);
+__decorateClass$3([field({
+	type: "datetime",
+	nullable: true
+})], UsersOAuthRefreshFamily.prototype, "revokedAt", 2);
+UsersOAuthRefreshFamily = __decorateClass$3([smrt({
+	tableName: "users_oauth_refresh_families",
+	sensitive: true,
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], UsersOAuthRefreshFamily);
+//#endregion
+//#region src/collections/OAuthAuthorizationCollection.ts
+var UsersOAuthClientCollection = class extends SmrtCollection {
+	static _itemClass = UsersOAuthClient;
+	findByClientId(clientId) {
+		return this.findOne({ where: { clientId } });
+	}
+};
+var UsersOAuthAuthorizationCodeCollection = class extends SmrtCollection {
+	static _itemClass = UsersOAuthAuthorizationCode;
+	async consume(id, codeHash, clientId, redirectUri, resource, now) {
+		return (await this.db.query(`UPDATE ${this.tableName} SET consumed_at = ?, updated_at = ? WHERE id = ? AND code_hash = ? AND client_id = ? AND redirect_uri = ? AND ${resource === null ? "resource IS NULL" : "resource = ?"} AND consumed_at IS NULL AND expires_at > ?`, now.toISOString(), now.toISOString(), id, codeHash, clientId, redirectUri, ...resource === null ? [] : [resource], now.toISOString())).rowCount === 1;
+	}
+};
+var UsersOAuthRefreshGrantCollection = class extends SmrtCollection {
+	static _itemClass = UsersOAuthRefreshGrant;
+	async consume(id, tokenHash, clientId, resource, now) {
+		return (await this.db.query(`UPDATE ${this.tableName} SET consumed_at = ?, updated_at = ? WHERE id = ? AND token_hash = ? AND client_id = ? AND ${resource === null ? "resource IS NULL" : "resource = ?"} AND consumed_at IS NULL AND revoked_at IS NULL AND expires_at > ?`, now.toISOString(), now.toISOString(), id, tokenHash, clientId, ...resource === null ? [] : [resource], now.toISOString())).rowCount === 1;
+	}
+	async revokeFamily(familyId, now) {
+		await this.db.query(`UPDATE ${this.tableName} SET revoked_at = ?, updated_at = ? WHERE family_id = ? AND revoked_at IS NULL`, now.toISOString(), now.toISOString(), familyId);
+	}
+};
+var UsersOAuthAccessTokenRevocationCollection = class extends SmrtCollection {
+	static _itemClass = UsersOAuthAccessTokenRevocation;
+	async findByJti(jti) {
+		const result = await this.db.query(`SELECT id FROM ${this.tableName} WHERE jti = ?`, jti);
+		return result.rows[0] ? this.get(String(result.rows[0].id)) : null;
+	}
+};
+var UsersOAuthAuthorizationCollection = class extends SmrtCollection {
+	static _itemClass = UsersOAuthAuthorization;
+};
+var UsersOAuthRefreshFamilyCollection = class extends SmrtCollection {
+	static _itemClass = UsersOAuthRefreshFamily;
+	async lock(id, now) {
+		return (await this.db.query(`UPDATE ${this.tableName} SET updated_at = ? WHERE id = ?`, now.toISOString(), id)).rowCount === 1;
+	}
+	async revoke(id, now) {
+		await this.db.query(`UPDATE ${this.tableName} SET revoked_at = ?, updated_at = ? WHERE id = ?`, now.toISOString(), now.toISOString(), id);
+	}
+};
+//#endregion
+//#region src/services/oauth-transaction.ts
+async function withOAuthTransaction(db, action) {
+	if (!db.transaction) throw new Error("OAuth persistence requires transaction support.");
+	for (let attempt = 0;; attempt++) try {
+		return await db.transaction(action);
+	} catch (error) {
+		let current = error;
+		let retryable = false;
+		let invalidated = false;
+		for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
+			const failure = current;
+			if ([
+				"SQLITE_BUSY",
+				"SQLITE_BUSY_SNAPSHOT",
+				"40001",
+				"40P01"
+			].includes(String(failure.code))) retryable = true;
+			invalidated ||= failure.connectionInvalidated === true;
+			current = failure.cause;
+		}
+		if (attempt >= 6 || !retryable || invalidated) throw error;
+		await setTimeout(5 * 2 ** attempt);
+	}
+}
+//#endregion
+//#region src/services/oauth-retention.ts
+var OAUTH_REFRESH_REPLAY_RETENTION_MS = 720 * 60 * 60 * 1e3;
+async function pruneOAuthCredentials(db, options = {}) {
+	const now = options.now ?? /* @__PURE__ */ new Date();
+	const cutoff = (/* @__PURE__ */ new Date(now.getTime() - OAUTH_REFRESH_REPLAY_RETENTION_MS)).toISOString();
+	const codes = await UsersOAuthAuthorizationCodeCollection.create({ db });
+	const revocations = await UsersOAuthAccessTokenRevocationCollection.create({ db });
+	const grants = await UsersOAuthRefreshGrantCollection.create({ db });
+	const families = await UsersOAuthRefreshFamilyCollection.create({ db });
+	let total = 0;
+	for (const table of [codes.tableName, revocations.tableName]) {
+		const prune = async (tx) => {
+			if (!options.dryRun) return (await tx.query(`DELETE FROM ${table} WHERE expires_at < ? RETURNING id`, now.toISOString())).rows.length;
+			const counted = await tx.query(`SELECT COUNT(*) AS total FROM ${table} WHERE expires_at < ?`, now.toISOString());
+			return Number(counted.rows[0]?.total ?? 0);
+		};
+		total += options.dryRun ? await prune(db) : await withOAuthTransaction(db, prune);
+	}
+	const candidates = await db.query(`SELECT id FROM ${families.tableName} f WHERE EXISTS (SELECT 1 FROM ${grants.tableName} g WHERE g.family_id = CAST(f.id AS TEXT) AND g.expires_at < ?) OR NOT EXISTS (SELECT 1 FROM ${grants.tableName} g WHERE g.family_id = CAST(f.id AS TEXT)) ORDER BY id`, cutoff);
+	for (const candidate of candidates.rows) {
+		const id = String(candidate.id);
+		const prune = async (tx) => {
+			if (!options.dryRun) {
+				if ((await tx.query(`UPDATE ${families.tableName} SET updated_at = ? WHERE id = ?`, now.toISOString(), id)).rowCount !== 1) return 0;
+			}
+			const counted = await tx.query(`SELECT COUNT(*) AS total FROM ${grants.tableName} WHERE family_id = ? AND expires_at < ?`, id, cutoff);
+			const retained = await tx.query(`SELECT COUNT(*) AS total FROM ${grants.tableName} WHERE family_id = ? AND expires_at >= ?`, id, cutoff);
+			const empty = Number(retained.rows[0]?.total ?? 0) === 0;
+			if (!options.dryRun) {
+				await tx.query(`DELETE FROM ${grants.tableName} WHERE family_id = ? AND expires_at < ?`, id, cutoff);
+				if (empty) await tx.query(`DELETE FROM ${families.tableName} WHERE id = ?`, id);
+			}
+			return Number(counted.rows[0]?.total ?? 0) + Number(empty);
+		};
+		total += options.dryRun ? await prune(db) : await withOAuthTransaction(db, prune);
+	}
+	return total;
+}
+//#endregion
 //#region src/retention.ts
 var SESSIONS_RETENTION_TASK = "users-sessions";
 var MAGIC_LINK_RETENTION_TASK = "users-magic-link-tokens";
@@ -286,7 +677,9 @@ var CLI_AUTH_RETENTION_TASK = "users-cli-auth-requests";
 var LOGIN_ATTEMPTS_RETENTION_TASK = "users-login-attempts";
 var LOGIN_AUDIT_RETENTION_TASK = "users-login-audit-events";
 var DEFAULT_LOGIN_AUDIT_RETENTION_DAYS = 90;
+var OAUTH_CREDENTIALS_RETENTION_TASK = "users-oauth-credentials";
 var USER_RETENTION_TASKS = [
+	OAUTH_CREDENTIALS_RETENTION_TASK,
 	SESSIONS_RETENTION_TASK,
 	MAGIC_LINK_RETENTION_TASK,
 	CLI_AUTH_RETENTION_TASK,
@@ -294,6 +687,14 @@ var USER_RETENTION_TASKS = [
 	LOGIN_AUDIT_RETENTION_TASK
 ];
 function registerUserRetentionTasks() {
+	registerRetentionTask({
+		name: OAUTH_CREDENTIALS_RETENTION_TASK,
+		description: "Delete expired OAuth credentials after their replay window",
+		run: (db, context) => pruneOAuthCredentials(db, {
+			dryRun: context.dryRun,
+			now: context.now
+		})
+	});
 	registerRetentionTask({
 		name: SESSIONS_RETENTION_TASK,
 		description: "Delete expired and revoked sessions",
@@ -1492,7 +1893,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-DjGsRtqb.js").then((n) => n.R);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-DWPeKl3k.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1521,7 +1922,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DjGsRtqb.js").then((n) => n.R);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DWPeKl3k.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1555,6 +1956,404 @@ var MagicLinkService = class MagicLinkService {
 	}
 };
 //#endregion
+//#region src/services/OAuthAuthorizationStorage.ts
+var SMRT_OAUTH_GRANT_CLAIM = "smrt_grant_id";
+function authorizationId(grant) {
+	const id = grant.claims?.[SMRT_OAUTH_GRANT_CLAIM];
+	return typeof id === "string" ? id : null;
+}
+function codeGrant(row) {
+	return {
+		id: row.id,
+		codeHash: row.codeHash,
+		clientId: row.clientId,
+		subject: row.subject,
+		...row.tenantId ? { tenantId: row.tenantId } : {},
+		claims: row.getClaims(),
+		redirectUri: row.redirectUri,
+		scopes: row.getScopes(),
+		...row.resource ? { resource: row.resource } : {},
+		codeChallenge: row.codeChallenge,
+		expiresAt: row.expiresAt
+	};
+}
+function refreshGrant(row) {
+	return {
+		id: row.id,
+		tokenHash: row.tokenHash,
+		familyId: row.familyId,
+		clientId: row.clientId,
+		subject: row.subject,
+		...row.tenantId ? { tenantId: row.tenantId } : {},
+		claims: row.getClaims(),
+		scopes: row.getScopes(),
+		...row.resource ? { resource: row.resource } : {},
+		expiresAt: row.expiresAt
+	};
+}
+var SmrtOAuthAuthorizationStorage = class SmrtOAuthAuthorizationStorage {
+	constructor(db, recoverDatabase) {
+		this.db = db;
+		this.recoverDatabase = recoverDatabase;
+	}
+	db;
+	recoverDatabase;
+	recovering = null;
+	async execute(action) {
+		for (let attempt = 0;; attempt++) {
+			const previous = this.db;
+			try {
+				return await action();
+			} catch (error) {
+				let cause = error;
+				let invalidated = false;
+				for (let depth = 0; depth < 6 && cause && typeof cause === "object"; depth++) {
+					const failure = cause;
+					invalidated ||= failure.connectionInvalidated === true;
+					cause = failure.cause;
+				}
+				const recover = this.recoverDatabase;
+				if (!invalidated || !recover || attempt >= 6) throw error;
+				if (this.db === previous) {
+					this.recovering ??= (async () => {
+						const db = await recover();
+						if (!db.transaction) throw new Error("OAuth recovery requires transaction support.");
+						this.db = db;
+					})().finally(() => {
+						this.recovering = null;
+					});
+					await this.recovering;
+				}
+				await setTimeout(5 * 2 ** attempt);
+			}
+		}
+	}
+	static async create(options) {
+		const rows = await UsersOAuthClientCollection.create(options.recoverDatabase ? {
+			...options,
+			db: await options.recoverDatabase()
+		} : options);
+		if (!rows.db.transaction) throw new Error("OAuth storage requires transaction support.");
+		return new SmrtOAuthAuthorizationStorage(rows.db, options.recoverDatabase);
+	}
+	async lockAuthorization(db, id, now) {
+		if (!id) return true;
+		return (await db.query("UPDATE users_oauth_authorizations SET updated_at = ? WHERE id = ? AND revoked_at IS NULL", now.toISOString(), id)).rowCount === 1;
+	}
+	async revokeAuthorization(db, id, now) {
+		if (!id) return;
+		const time = now.toISOString();
+		await db.query("UPDATE users_oauth_authorizations SET revoked_at = ?, updated_at = ? WHERE id = ?", time, time, id);
+		await db.query("UPDATE users_oauth_authorization_codes SET consumed_at = ? WHERE authorization_id = ? AND consumed_at IS NULL", time, id);
+		await db.query("UPDATE users_oauth_refresh_families SET revoked_at = ? WHERE authorization_id = ?", time, id);
+		await db.query("UPDATE users_oauth_refresh_grants SET revoked_at = ? WHERE authorization_id = ?", time, id);
+	}
+	async getClient(clientId) {
+		return this.execute(async () => {
+			const client = await (await UsersOAuthClientCollection.create({ db: this.db })).findByClientId(clientId);
+			return client ? {
+				id: client.clientId,
+				redirectUris: client.getRedirectUris(),
+				allowedScopes: client.getAllowedScopes(),
+				tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
+				...client.secretHash ? { secretHash: client.secretHash } : {},
+				...client.getAllowedResources() !== void 0 ? { allowedResources: client.getAllowedResources() } : {},
+				createdAt: client.createdAt
+			} : null;
+		});
+	}
+	async registerClient(client) {
+		return this.execute(async () => {
+			await (await (await UsersOAuthClientCollection.create({ db: this.db })).create({
+				clientId: client.id,
+				redirectUris: JSON.stringify(client.redirectUris),
+				allowedScopes: JSON.stringify(client.allowedScopes),
+				tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
+				secretHash: client.secretHash ?? null,
+				allowedResources: JSON.stringify(client.allowedResources ?? null),
+				createdAt: client.createdAt,
+				_insertOnly: true
+			})).save();
+		});
+	}
+	async createAuthorizationCode(grant) {
+		return this.execute(async () => {
+			await withOAuthTransaction(this.db, async (db) => {
+				if (!await this.lockAuthorization(db, authorizationId(grant), /* @__PURE__ */ new Date())) throw new Error("Authorization is revoked.");
+				await (await (await UsersOAuthAuthorizationCodeCollection.create({ db })).create({
+					id: grant.id,
+					authorizationId: authorizationId(grant),
+					codeHash: grant.codeHash,
+					clientId: grant.clientId,
+					subject: grant.subject,
+					tenantId: grant.tenantId ?? null,
+					claims: JSON.stringify(grant.claims ?? {}),
+					redirectUri: grant.redirectUri,
+					scopes: JSON.stringify(grant.scopes),
+					resource: grant.resource ?? null,
+					codeChallenge: grant.codeChallenge,
+					expiresAt: grant.expiresAt,
+					consumedAt: null,
+					_insertOnly: true
+				})).save();
+			});
+		});
+	}
+	async consumeAuthorizationCode(input) {
+		return this.execute(async () => {
+			const row = await (await UsersOAuthAuthorizationCodeCollection.create({ db: this.db })).get(input.id);
+			if (!row || row.codeHash !== input.codeHash || row.clientId !== input.clientId || row.redirectUri !== input.redirectUri || (row.resource ?? void 0) !== input.resource) return { status: "invalid" };
+			return withOAuthTransaction(this.db, async (db) => {
+				if (!await this.lockAuthorization(db, row.authorizationId, input.now)) return { status: "invalid" };
+				const rows = await UsersOAuthAuthorizationCodeCollection.create({ db });
+				if (await rows.consume(input.id, input.codeHash, input.clientId, input.redirectUri, input.resource ?? null, input.now)) return {
+					status: "consumed",
+					grant: codeGrant(row)
+				};
+				const current = await rows.get(input.id);
+				return { status: current?.consumedAt ? "replayed" : current && current.expiresAt <= input.now ? "expired" : "invalid" };
+			});
+		});
+	}
+	async createRefreshGrant(grant) {
+		return this.execute(async () => {
+			await withOAuthTransaction(this.db, async (db) => {
+				if (!await this.lockAuthorization(db, authorizationId(grant), /* @__PURE__ */ new Date())) throw new Error("Authorization is revoked.");
+				await (await (await UsersOAuthRefreshFamilyCollection.create({ db })).create({
+					id: grant.familyId,
+					authorizationId: authorizationId(grant),
+					revokedAt: null,
+					_insertOnly: true
+				})).save();
+				await this.saveRefresh(await UsersOAuthRefreshGrantCollection.create({ db }), grant);
+			});
+		});
+	}
+	async rotateRefreshGrant(input) {
+		return this.execute(async () => {
+			const initial = await (await UsersOAuthRefreshGrantCollection.create({ db: this.db })).get(input.id);
+			if (!initial || initial.tokenHash !== input.tokenHash || initial.clientId !== input.clientId || (initial.resource ?? void 0) !== input.resource) return { status: "invalid" };
+			return withOAuthTransaction(this.db, async (db) => {
+				if (!await this.lockAuthorization(db, initial.authorizationId, input.now)) return { status: "revoked" };
+				const families = await UsersOAuthRefreshFamilyCollection.create({ db });
+				if (!await families.lock(initial.familyId, input.now)) return { status: "invalid" };
+				const family = await families.get(initial.familyId);
+				const rows = await UsersOAuthRefreshGrantCollection.create({ db });
+				const row = await rows.get(input.id);
+				if (!row) return { status: "invalid" };
+				if (family?.revokedAt || row.revokedAt) return { status: "revoked" };
+				if (row.consumedAt) {
+					await families.revoke(row.familyId, input.now);
+					await rows.revokeFamily(row.familyId, input.now);
+					await this.revokeAuthorization(db, row.authorizationId, input.now);
+					return { status: "replayed" };
+				}
+				if (row.expiresAt <= input.now) return { status: "expired" };
+				if (!await rows.consume(input.id, input.tokenHash, input.clientId, input.resource ?? null, input.now)) return { status: "invalid" };
+				const grant = refreshGrant(row);
+				await this.saveRefresh(rows, {
+					...grant,
+					...input.replacement
+				});
+				return {
+					status: "rotated",
+					grant
+				};
+			});
+		});
+	}
+	/** Persist a narrowed replacement before the SDK exposes it to a caller. */
+	async narrowRefreshGrant(input) {
+		return this.execute(async () => {
+			const initial = await (await UsersOAuthRefreshGrantCollection.create({ db: this.db })).get(input.id);
+			if (!initial || initial.tokenHash !== input.tokenHash) throw new Error("Invalid refresh grant.");
+			await withOAuthTransaction(this.db, async (db) => {
+				const now = /* @__PURE__ */ new Date();
+				if (!await this.lockAuthorization(db, initial.authorizationId, now)) throw new Error("Authorization is revoked.");
+				const families = await UsersOAuthRefreshFamilyCollection.create({ db });
+				if (!await families.lock(initial.familyId, now)) throw new Error("Invalid refresh family.");
+				const family = await families.get(initial.familyId);
+				const row = await (await UsersOAuthRefreshGrantCollection.create({ db })).get(input.id);
+				if (!row || row.tokenHash !== input.tokenHash || family?.revokedAt || row.revokedAt || row.consumedAt || row.expiresAt <= now || input.scopes.some((scope) => !row.getScopes().includes(scope))) throw new Error("Invalid refresh scope narrowing.");
+				await db.query("UPDATE users_oauth_refresh_grants SET scopes = ?, claims = ?, updated_at = ? WHERE id = ?", JSON.stringify(input.scopes), JSON.stringify(input.claims ?? {}), now.toISOString(), input.id);
+			});
+		});
+	}
+	async revokeRefreshGrant(input) {
+		return this.execute(async () => {
+			const row = await (await UsersOAuthRefreshGrantCollection.create({ db: this.db })).get(input.id);
+			if (!row || row.tokenHash !== input.tokenHash) return;
+			await withOAuthTransaction(this.db, async (db) => {
+				await this.lockAuthorization(db, row.authorizationId, input.now);
+				const families = await UsersOAuthRefreshFamilyCollection.create({ db });
+				await families.lock(row.familyId, input.now);
+				await families.revoke(row.familyId, input.now);
+				await this.revokeAuthorization(db, row.authorizationId, input.now);
+				await (await UsersOAuthRefreshGrantCollection.create({ db })).revokeFamily(row.familyId, input.now);
+			});
+		});
+	}
+	async revokeAccessToken(input) {
+		return this.execute(async () => {
+			await withOAuthTransaction(this.db, async (db) => {
+				await db.query("INSERT INTO users_oauth_access_token_revocations (id, slug, jti, expires_at) VALUES (?, ?, ?, ?) ON CONFLICT (jti) DO NOTHING", randomUUID(), randomUUID(), input.jti, input.expiresAt.toISOString());
+			});
+		});
+	}
+	async isAccessTokenRevoked(jti, now) {
+		return this.execute(async () => {
+			const row = await (await UsersOAuthAccessTokenRevocationCollection.create({ db: this.db })).findByJti(jti);
+			return !!row && row.expiresAt > now;
+		});
+	}
+	async saveRefresh(rows, grant) {
+		await (await rows.create({
+			id: grant.id,
+			authorizationId: authorizationId(grant),
+			tokenHash: grant.tokenHash,
+			familyId: grant.familyId,
+			clientId: grant.clientId,
+			subject: grant.subject,
+			tenantId: grant.tenantId ?? null,
+			claims: JSON.stringify(grant.claims ?? {}),
+			scopes: JSON.stringify(grant.scopes),
+			resource: grant.resource ?? null,
+			expiresAt: grant.expiresAt,
+			consumedAt: null,
+			revokedAt: null,
+			_insertOnly: true
+		})).save();
+	}
+};
+//#endregion
+//#region src/services/OAuthAuthorizationService.ts
+var SmrtOAuthAuthorizationService = class SmrtOAuthAuthorizationService {
+	constructor(options, sessions, grants) {
+		this.options = options;
+		this.sessions = sessions;
+		this.grants = grants;
+	}
+	options;
+	sessions;
+	grants;
+	static async create(options) {
+		const sessions = await SessionService.create({
+			...options,
+			autoExtend: false
+		});
+		return new SmrtOAuthAuthorizationService(options, sessions, await UsersOAuthAuthorizationCollection.create({ db: sessions.getDatabase() }));
+	}
+	/** Suitable for createAuthorizationServer({ identity: service.identity }). */
+	identity = {
+		refreshConsent: (context, grant) => this.revalidateConsent(context, grant),
+		revalidateConsent: (context, grant) => this.revalidateConsent(context, grant)
+	};
+	async liveSession(sessionId) {
+		const context = await this.sessions.loadSessionContext(sessionId);
+		if (!context) return null;
+		if (context.tenantId) {
+			if (!context.tenantAuthorization?.membershipId) return null;
+			if (!(await (await TenantCollection.create({ db: this.sessions.getDatabase() })).get(context.tenantId))?.isActive()) return null;
+		}
+		return context;
+	}
+	permits(context, scopes) {
+		return scopes.every((scope) => Object.hasOwn(this.options.scopePermissions, scope) && this.options.scopePermissions[scope].every((permission) => context.permissions.includes(permission)));
+	}
+	/** Call only after an explicit user consent action; the session is loaded again. */
+	async approve(server, request, sessionId) {
+		const context = await this.liveSession(sessionId);
+		if (!context || !this.permits(context, request.scopes)) throw new OAuthServerError("access_denied", "Authorization denied.", 403);
+		const row = await this.grants.create({
+			subject: context.user.id,
+			sessionId,
+			clientId: request.clientId,
+			tenantId: context.tenantId,
+			scopes: JSON.stringify(request.scopes),
+			permissionCeiling: JSON.stringify(context.permissions),
+			resource: request.resource ?? null,
+			revokedAt: null,
+			_insertOnly: true
+		});
+		await row.save();
+		try {
+			return await server.approve(request, {
+				subject: context.user.id,
+				...context.tenantId ? { tenantId: context.tenantId } : {},
+				claims: { [SMRT_OAUTH_GRANT_CLAIM]: row.id }
+			});
+		} catch (error) {
+			await this.revokeOwned(context.user.id, row.id);
+			throw error;
+		}
+	}
+	async resolve(grantId, subject, tenantId, clientId, scopes, resource) {
+		if (typeof grantId !== "string" || typeof subject !== "string" || typeof clientId !== "string") return null;
+		const grant = await this.grants.get(grantId);
+		if (!grant || grant.revokedAt || grant.subject !== subject || grant.clientId !== clientId || (grant.tenantId ?? void 0) !== (tenantId ?? void 0) || grant.resource && grant.resource !== resource || scopes.some((scope) => !grant.getScopes().includes(scope))) return null;
+		const context = await this.liveSession(grant.sessionId);
+		if (!context || context.user.id !== grant.subject || context.tenantId !== grant.tenantId || !this.permits(context, scopes) || scopes.some((scope) => this.options.scopePermissions[scope]?.some((permission) => !grant.getPermissionCeiling().includes(permission)))) return null;
+		const current = await this.grants.get(grantId);
+		if (!current || current.revokedAt) return null;
+		const allowed = new Set(scopes.flatMap((scope) => this.options.scopePermissions[scope] ?? []));
+		const permissions = context.permissions.filter((permission) => allowed.has(permission));
+		return {
+			...context,
+			permissions,
+			permissionCeiling: permissions
+		};
+	}
+	async revalidateConsent(context, grant) {
+		return await this.resolve(context.claims?.["smrt_grant_id"], grant.subject, grant.tenantId, grant.clientId, grant.scopes, grant.resource) && context.subject === grant.subject && context.tenantId === grant.tenantId ? context : null;
+	}
+	/** Call after SDK signature/audience/revocation verification, never on decoded-only JWTs. */
+	async validateAccessTokenClaims(payload) {
+		if (typeof payload.scope !== "string") return null;
+		return this.resolve(payload[SMRT_OAUTH_GRANT_CLAIM], payload.sub, payload.tenant_id, payload.client_id, payload.scope.split(" ").filter(Boolean), payload.aud);
+	}
+	/** Lists only the current authenticated user's consent decisions. */
+	async listGrants(sessionId) {
+		const context = await this.liveSession(sessionId);
+		if (!context) throw new OAuthServerError("access_denied", "Sign in required.", 401);
+		const result = await this.sessions.getDatabase().query("SELECT id FROM users_oauth_authorizations WHERE subject = ? ORDER BY created_at DESC", context.user.id);
+		const grants = [];
+		for (const row of result.rows) {
+			const grant = await this.grants.get(String(row.id));
+			if (grant) grants.push(this.summary(grant));
+		}
+		return grants;
+	}
+	/** Revocation is idempotent and confined to the authenticated subject. */
+	async revokeGrant(sessionId, grantId) {
+		const context = await this.liveSession(sessionId);
+		if (!context) throw new OAuthServerError("access_denied", "Sign in required.", 401);
+		return this.revokeOwned(context.user.id, grantId);
+	}
+	async revokeOwned(subject, grantId) {
+		const db = this.sessions.getDatabase();
+		if (!db.transaction) throw new Error("OAuth revocation requires transaction support.");
+		return withOAuthTransaction(db, async (db2) => {
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			if ((await db2.query("UPDATE users_oauth_authorizations SET revoked_at = ?, updated_at = ? WHERE id = ? AND subject = ?", now, now, grantId, subject)).rowCount !== 1) return false;
+			await db2.query("UPDATE users_oauth_authorization_codes SET consumed_at = ? WHERE authorization_id = ? AND consumed_at IS NULL", now, grantId);
+			await db2.query("UPDATE users_oauth_refresh_families SET revoked_at = ? WHERE authorization_id = ?", now, grantId);
+			await db2.query("UPDATE users_oauth_refresh_grants SET revoked_at = ? WHERE authorization_id = ?", now, grantId);
+			return true;
+		});
+	}
+	summary(grant) {
+		return {
+			id: grant.id,
+			clientId: grant.clientId,
+			tenantId: grant.tenantId,
+			scopes: grant.getScopes(),
+			resource: grant.resource,
+			createdAt: grant.created_at ?? null,
+			revokedAt: grant.revokedAt
+		};
+	}
+};
+//#endregion
 //#region src/services/PostgresPermissionPolicies.ts
 function toSnakeCase(value) {
 	return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
@@ -2119,6 +2918,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, PasswordPolicyError, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, Session, SessionCollection, SessionService, SessionStatus, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersPasswordCredential, UsersPasswordCredentialCollection, UsersPinCredential, UsersPinCredentialCollection, UsersRolesAndPermissionsRecipe, UsersSignInRecipe, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePasswordPermissionsRegistered, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OAUTH_CREDENTIALS_RETENTION_TASK, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, PasswordPolicyError, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, SMRT_OAUTH_GRANT_CLAIM, Session, SessionCollection, SessionService, SessionStatus, SmrtOAuthAuthorizationService, SmrtOAuthAuthorizationStorage, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersOAuthAccessTokenRevocation, UsersOAuthAccessTokenRevocationCollection, UsersOAuthAuthorization, UsersOAuthAuthorizationCode, UsersOAuthAuthorizationCodeCollection, UsersOAuthAuthorizationCollection, UsersOAuthClient, UsersOAuthClientCollection, UsersOAuthRefreshFamily, UsersOAuthRefreshFamilyCollection, UsersOAuthRefreshGrant, UsersOAuthRefreshGrantCollection, UsersPasswordCredential, UsersPasswordCredentialCollection, UsersPinCredential, UsersPinCredentialCollection, UsersRolesAndPermissionsRecipe, UsersSignInRecipe, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePasswordPermissionsRegistered, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map