@spfn/auth 0.2.0-beta.87 → 0.2.0-beta.89

package/dist/server.js

@@ -4454,13 +4454,31 @@ var init_esm = __esm({
   }
 });
 
+// src/server/types.ts
+var KEY_ALGORITHM, KEY_PLATFORM, KEY_DEVICE_NAME_MAX_LENGTH, INVITATION_STATUSES, USER_STATUSES, SOCIAL_PROVIDERS, ACCOUNT_DELETION_REQUEST_STATUSES, ACCOUNT_DELETION_REQUESTED_BY, PURGE_STRATEGIES;
+var init_types = __esm({
+  "src/server/types.ts"() {
+    "use strict";
+    KEY_ALGORITHM = ["ES256", "RS256"];
+    KEY_PLATFORM = ["ios", "android", "web", "desktop"];
+    KEY_DEVICE_NAME_MAX_LENGTH = 64;
+    INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
+    USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
+    SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
+    ACCOUNT_DELETION_REQUEST_STATUSES = ["pending", "cancelled", "completed"];
+    ACCOUNT_DELETION_REQUESTED_BY = ["self", "admin"];
+    PURGE_STRATEGIES = ["anonymize", "hard-delete"];
+  }
+});
+
 // src/server/routes/schema.ts
 import { EMAIL_PATTERN, PHONE_PATTERN } from "@spfn/auth";
-var EmailSchema, PhoneSchema, PasswordSchema, TargetTypeSchema, VERIFICATION_TARGET_TYPES, VerificationPurposeSchema, VERIFICATION_PURPOSES;
+var EmailSchema, PhoneSchema, DeviceNameSchema, PlatformSchema, PasswordSchema, TargetTypeSchema, VERIFICATION_TARGET_TYPES, VerificationPurposeSchema, VERIFICATION_PURPOSES;
 var init_schema3 = __esm({
   "src/server/routes/schema.ts"() {
     "use strict";
     init_esm();
+    init_types();
     EmailSchema = Type.String({
       pattern: EMAIL_PATTERN,
       description: "Email address"
@@ -4469,6 +4487,14 @@ var init_schema3 = __esm({
       pattern: PHONE_PATTERN,
       description: "Phone number in E.164 format (e.g., +821012345678)"
     });
+    DeviceNameSchema = Type.String({
+      maxLength: KEY_DEVICE_NAME_MAX_LENGTH,
+      description: `Device label shown in the key list (max ${KEY_DEVICE_NAME_MAX_LENGTH} chars)`
+    });
+    PlatformSchema = Type.Union(
+      KEY_PLATFORM.map((platform) => Type.Literal(platform)),
+      { description: "Platform the key lives on" }
+    );
     PasswordSchema = Type.String({
       minLength: 8,
       maxLength: 72,
@@ -4495,21 +4521,6 @@ var init_schema3 = __esm({
   }
 });
 
-// src/server/types.ts
-var KEY_ALGORITHM, INVITATION_STATUSES, USER_STATUSES, SOCIAL_PROVIDERS, ACCOUNT_DELETION_REQUEST_STATUSES, ACCOUNT_DELETION_REQUESTED_BY, PURGE_STRATEGIES;
-var init_types = __esm({
-  "src/server/types.ts"() {
-    "use strict";
-    KEY_ALGORITHM = ["ES256", "RS256"];
-    INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
-    USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
-    SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
-    ACCOUNT_DELETION_REQUEST_STATUSES = ["pending", "cancelled", "completed"];
-    ACCOUNT_DELETION_REQUESTED_BY = ["self", "admin"];
-    PURGE_STRATEGIES = ["anonymize", "hard-delete"];
-  }
-});
-
 // src/server/entities/schema.ts
 import { createSchema } from "@spfn/core/db";
 var authSchema;
@@ -4751,6 +4762,15 @@ var init_user_public_keys = __esm({
         // Format: hex-encoded string (64 chars)
         // Used for: duplicate detection, key verification
         fingerprint: text4("fingerprint").notNull(),
+        // Device label the client supplied at registration
+        // null: the client sent none (every key registered before this column existed)
+        // Used for: telling one entry apart from another in the key list
+        // Display only — nothing is authorized by it, so a client that lies gains nothing
+        deviceName: text4("device_name"),
+        // Platform the key lives on, as the client declared it
+        // null: the client sent none
+        // Used for: the same list, alongside deviceName
+        platform: enumText2("platform", KEY_PLATFORM),
         // Key status
         // false: Key is deactivated (cannot be used for verification)
         // Used for: soft key rotation, temporary key suspension
@@ -5677,7 +5697,7 @@ var init_users_repository = __esm({
 
 // src/server/repositories/keys.repository.ts
 import { BaseRepository as BaseRepository2 } from "@spfn/core/db";
-import { eq as eq2, and as and2, or, isNull, lt } from "drizzle-orm";
+import { eq as eq2, and as and2, or, isNull, lt, ne, desc } from "drizzle-orm";
 var LAST_USED_THROTTLE_MS, KeysRepository, keysRepository;
 var init_keys_repository = __esm({
   "src/server/repositories/keys.repository.ts"() {
@@ -5717,6 +5737,35 @@ var init_keys_repository = __esm({
           )
         );
       }
+      /**
+       * 키 목록 화면이 쓰는 공개키 조회 — 최근 등록순
+       *
+       * publicKey 원문은 고르지 않는다. 목록의 용도는 기기를 알아보고 지목하는 것이고,
+       * 공개키는 그 어느 쪽에도 필요 없다. fingerprint는 호출자가 잘라서 내보낸다.
+       *
+       * `includeRevoked`는 이미 끊은 기기까지 보여준다 — "내가 언제 무엇을 끊었나"를
+       * 확인하는 용도라, 폐기 시각과 사유를 함께 고른다.
+       * Read replica 사용
+       */
+      async listForUser(userId, includeRevoked = false) {
+        return this.readDb.select({
+          keyId: userPublicKeys.keyId,
+          deviceName: userPublicKeys.deviceName,
+          platform: userPublicKeys.platform,
+          algorithm: userPublicKeys.algorithm,
+          fingerprint: userPublicKeys.fingerprint,
+          isActive: userPublicKeys.isActive,
+          createdAt: userPublicKeys.createdAt,
+          lastUsedAt: userPublicKeys.lastUsedAt,
+          expiresAt: userPublicKeys.expiresAt,
+          revokedAt: userPublicKeys.revokedAt
+        }).from(userPublicKeys).where(
+          includeRevoked ? eq2(userPublicKeys.userId, userId) : and2(
+            eq2(userPublicKeys.userId, userId),
+            eq2(userPublicKeys.isActive, true)
+          )
+        ).orderBy(desc(userPublicKeys.createdAt));
+      }
       /**
        * 공개키 생성
        * Write primary 사용
@@ -5763,6 +5812,26 @@ var init_keys_repository = __esm({
           )
         ).returning();
       }
+      /**
+       * 지정한 키 하나만 남기고 사용자의 활성 공개키를 전부 revoke
+       *
+       * "다른 기기 전부 로그아웃" — 요청을 보낸 기기는 살려 둔다. 남길 키를 별도 조회로
+       * 확인하지 않고 조건에 담아, 그 사이에 다른 요청이 키를 바꾸는 경쟁을 만들지 않는다.
+       * Write primary 사용
+       */
+      async revokeAllActiveByUserIdExcept(userId, keepKeyId, reason) {
+        return await this.db.update(userPublicKeys).set({
+          isActive: false,
+          revokedAt: /* @__PURE__ */ new Date(),
+          revokedReason: reason
+        }).where(
+          and2(
+            eq2(userPublicKeys.userId, userId),
+            eq2(userPublicKeys.isActive, true),
+            ne(userPublicKeys.keyId, keepKeyId)
+          )
+        ).returning();
+      }
       /**
        * 공개키 삭제
        * Write primary 사용
@@ -5802,6 +5871,19 @@ var init_keys_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /**
+       * 만료 시각 연장 — 같은 사용자가 로그인으로 신원을 다시 증명했을 때 쓴다.
+       * Write primary 사용
+       */
+      async extendExpiry(keyId, userId, expiresAt) {
+        const result = await this.db.update(userPublicKeys).set({ expiresAt }).where(
+          and2(
+            eq2(userPublicKeys.keyId, keyId),
+            eq2(userPublicKeys.userId, userId)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
       /**
        * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
        *
@@ -6429,7 +6511,7 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq9, and as and6, lt as lt4, desc, sql as sql3 } from "drizzle-orm";
+import { eq as eq9, and as and6, lt as lt4, desc as desc2, sql as sql3 } from "drizzle-orm";
 import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
@@ -6595,7 +6677,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq9(userInvitations.roleId, roles.id)).innerJoin(users, eq9(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc(userInvitations.createdAt)).limit(limit).offset(offset);
+        }).from(userInvitations).innerJoin(roles, eq9(userInvitations.roleId, roles.id)).innerJoin(users, eq9(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc2(userInvitations.createdAt)).limit(limit).offset(offset);
         return {
           invitations: results,
           total,
@@ -7052,6 +7134,24 @@ var init_schema5 = __esm({
           ]
         })
       },
+      SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS: {
+        ...envString({
+          description: "Comma-separated Kakao app keys accepted as id_token audience for native sign-in (native app key). SPFN_AUTH_KAKAO_CLIENT_ID (REST API key) is also accepted automatically, so native sign-in is available when either variable is set. Requires OpenID Connect to be enabled in the Kakao developer console.",
+          required: false,
+          examples: [
+            "your-kakao-native-app-key"
+          ]
+        })
+      },
+      SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS: {
+        ...envString({
+          description: "Comma-separated Naver client IDs accepted as id_token audience for native sign-in. SPFN_AUTH_NAVER_CLIENT_ID is also accepted automatically, and one Naver application has a single client ID covering web and app environments \u2014 set this only when the app uses a separate application.",
+          required: false,
+          examples: [
+            "your-naver-app-client-id"
+          ]
+        })
+      },
       SPFN_AUTH_OAUTH_SUCCESS_URL: {
         ...envString({
           description: "OAuth callback page URL. This page should use OAuthCallback component to finalize session.",
@@ -7881,6 +7981,7 @@ function getKeyId(c) {
 
 // src/server/routes/auth/index.ts
 init_types();
+import { KeyNotFoundError } from "@spfn/auth/errors";
 
 // src/server/services/auth.service.ts
 init_repositories();
@@ -8174,17 +8275,27 @@ var KEY_TTL_DAYS = 90;
 
 // src/server/services/key.service.ts
 init_repositories();
-import { InvalidKeyFingerprintError } from "@spfn/auth/errors";
+import { InvalidKeyFingerprintError, KeyIdAlreadyRegisteredError } from "@spfn/auth/errors";
+var KEY_FINGERPRINT_PREFIX_LENGTH = 8;
 function getKeyExpiryDate() {
   const expiresAt = /* @__PURE__ */ new Date();
   expiresAt.setDate(expiresAt.getDate() + KEY_TTL_DAYS);
   return expiresAt;
 }
+function isExpired(expiresAt) {
+  return expiresAt !== null && /* @__PURE__ */ new Date() > expiresAt;
+}
 async function registerPublicKeyService(params) {
-  const { userId, keyId, publicKey, fingerprint, algorithm = "ES256" } = params;
-  const existing = await keysRepository.findActiveByKeyId(keyId);
+  const { userId, keyId, publicKey, fingerprint, algorithm = "ES256", deviceName, platform } = params;
+  const existing = await keysRepository.findByKeyId(keyId);
   if (existing) {
-    return;
+    if (existing.userId === userId && existing.isActive) {
+      if (isExpired(existing.expiresAt)) {
+        await keysRepository.extendExpiry(keyId, userId, getKeyExpiryDate());
+      }
+      return;
+    }
+    throw new KeyIdAlreadyRegisteredError();
   }
   const isValidFingerprint = verifyKeyFingerprint(publicKey, fingerprint);
   if (!isValidFingerprint) {
@@ -8196,6 +8307,8 @@ async function registerPublicKeyService(params) {
     publicKey,
     algorithm,
     fingerprint,
+    deviceName,
+    platform,
     isActive: true,
     createdAt: /* @__PURE__ */ new Date(),
     expiresAt: getKeyExpiryDate()
@@ -8207,6 +8320,7 @@ async function rotateKeyService(params) {
   if (!isValidFingerprint) {
     throw new InvalidKeyFingerprintError();
   }
+  const replaced = await keysRepository.findByKeyIdAndUserId(oldKeyId, userId);
   await keysRepository.revokeByKeyIdAndUserId(
     oldKeyId,
     userId,
@@ -8218,6 +8332,8 @@ async function rotateKeyService(params) {
     publicKey: newPublicKey,
     algorithm,
     fingerprint,
+    deviceName: params.deviceName ?? replaced?.deviceName ?? void 0,
+    platform: params.platform ?? replaced?.platform ?? void 0,
     isActive: true,
     createdAt: /* @__PURE__ */ new Date(),
     expiresAt: getKeyExpiryDate()
@@ -8229,7 +8345,29 @@ async function rotateKeyService(params) {
 }
 async function revokeKeyService(params) {
   const { userId, keyId, reason } = params;
-  await keysRepository.revokeByKeyIdAndUserId(keyId, userId, reason);
+  const revoked = await keysRepository.revokeByKeyIdAndUserId(keyId, userId, reason);
+  return revoked !== null;
+}
+async function listKeysService(params) {
+  const rows = await keysRepository.listForUser(params.userId, params.includeRevoked);
+  return rows.map((row) => ({
+    keyId: row.keyId,
+    deviceName: row.deviceName ?? void 0,
+    platform: row.platform ?? void 0,
+    algorithm: row.algorithm,
+    fingerprintPrefix: row.fingerprint.slice(0, KEY_FINGERPRINT_PREFIX_LENGTH),
+    createdAtMillis: row.createdAt.getTime(),
+    lastUsedAtMillis: row.lastUsedAt?.getTime(),
+    expiresAtMillis: row.expiresAt?.getTime(),
+    isExpired: isExpired(row.expiresAt),
+    isActive: row.isActive,
+    revokedAtMillis: row.revokedAt?.getTime()
+  }));
+}
+async function revokeAllKeysService(params) {
+  const { userId, currentKeyId, includeCurrent = false, reason } = params;
+  const revoked = includeCurrent ? await keysRepository.revokeAllActiveByUserId(userId, reason) : await keysRepository.revokeAllActiveByUserIdExcept(userId, currentKeyId, reason);
+  return { revokedCount: revoked.length, currentKeyRevoked: includeCurrent };
 }
 
 // src/server/services/user.service.ts
@@ -8755,7 +8893,9 @@ async function registerService(params) {
     keyId,
     publicKey,
     fingerprint,
-    algorithm
+    algorithm,
+    deviceName: params.deviceName,
+    platform: params.platform
   });
   const result = {
     userId: String(newUser.id),
@@ -8805,7 +8945,9 @@ async function loginService(params) {
     keyId,
     publicKey,
     fingerprint,
-    algorithm
+    algorithm,
+    deviceName: params.deviceName,
+    platform: params.platform
   });
   await updateLastLoginService(user.id);
   const result = {
@@ -9316,7 +9458,7 @@ function getOneTimeTokenManager() {
 async function issueOneTimeTokenService(userId) {
   const manager2 = getOneTimeTokenManager();
   const token = await manager2.issue(userId);
-  const expiresAt = new Date(Date.now() + 3e4).toISOString();
+  const expiresAt = new Date(Date.now() + manager2.ttlMs).toISOString();
   return { token, expiresAt };
 }
 async function verifyOneTimeTokenService(token) {
@@ -9410,8 +9552,12 @@ async function updateUserProfileService(userId, params) {
 // src/server/services/oauth.service.ts
 init_repositories();
 import { env as env11 } from "@spfn/auth/config";
-import { ValidationError as ValidationError9 } from "@spfn/core/errors";
-import { AccountDisabledError as AccountDisabledError2, AccountPendingDeletionError as AccountPendingDeletionError2 } from "@spfn/auth/errors";
+import { ValidationError as ValidationError8 } from "@spfn/core/errors";
+import {
+  AccountDisabledError as AccountDisabledError2,
+  AccountPendingDeletionError as AccountPendingDeletionError2,
+  UnverifiedEmailLinkError
+} from "@spfn/auth/errors";
 
 // src/server/lib/oauth/google.ts
 import { env as env7 } from "@spfn/auth/config";
@@ -9576,6 +9722,7 @@ function getRegisteredProviders() {
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { InvalidSocialTokenError } from "@spfn/auth/errors";
 var CLOCK_TOLERANCE_SECONDS = 30;
+var MAX_TOKEN_AGE_SECONDS = 600;
 var jwksByUri = /* @__PURE__ */ new Map();
 function getRemoteJwks(jwksUri) {
   const cached = jwksByUri.get(jwksUri);
@@ -9602,7 +9749,8 @@ async function verifySignature(params) {
       issuer: params.issuer,
       audience: params.audiences,
       algorithms: params.algorithms,
-      clockTolerance: CLOCK_TOLERANCE_SECONDS
+      clockTolerance: CLOCK_TOLERANCE_SECONDS,
+      maxTokenAge: MAX_TOKEN_AGE_SECONDS
     });
     return payload;
   } catch (err) {
@@ -9618,7 +9766,7 @@ init_token_cipher();
 
 // src/server/lib/oauth/google-provider.ts
 import { env as env9 } from "@spfn/auth/config";
-import { ValidationError as ValidationError4 } from "@spfn/core/errors";
+import { NativeSignInUnsupportedError } from "@spfn/auth/errors";
 var GOOGLE_JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs";
 var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 function getGoogleNativeAudiences() {
@@ -9661,7 +9809,7 @@ var googleProvider = {
   async verifyNativeIdToken(idToken, options) {
     const audiences = getGoogleNativeAudiences();
     if (audiences.length === 0) {
-      throw new ValidationError4({
+      throw new NativeSignInUnsupportedError({
         message: "Google native sign-in is not configured. Set SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS."
       });
     }
@@ -9687,7 +9835,8 @@ registerOAuthProvider(googleProvider);
 // src/server/lib/oauth/apple-provider.ts
 import { createHash as createHash2 } from "crypto";
 import { env as env10 } from "@spfn/auth/config";
-import { ValidationError as ValidationError5 } from "@spfn/core/errors";
+import { ValidationError as ValidationError4 } from "@spfn/core/errors";
+import { NativeSignInUnsupportedError as NativeSignInUnsupportedError2 } from "@spfn/auth/errors";
 var APPLE_JWKS_URI = "https://appleid.apple.com/auth/keys";
 var APPLE_ISSUER = "https://appleid.apple.com";
 function getAppleClientIds() {
@@ -9697,7 +9846,7 @@ function hashNonce(rawNonce) {
   return createHash2("sha256").update(rawNonce).digest("hex");
 }
 function unsupportedWebFlow() {
-  throw new ValidationError5({
+  throw new ValidationError4({
     message: "Apple provider supports native id_token sign-in only. Use POST /_auth/oauth/apple/native."
   });
 }
@@ -9718,7 +9867,7 @@ var appleProvider = {
   async verifyNativeIdToken(idToken, options) {
     const audiences = getAppleClientIds();
     if (audiences.length === 0) {
-      throw new ValidationError5({
+      throw new NativeSignInUnsupportedError2({
         message: "Apple native sign-in is not configured. Set SPFN_AUTH_APPLE_CLIENT_IDS."
       });
     }
@@ -9741,7 +9890,7 @@ registerOAuthProvider(appleProvider);
 
 // src/server/lib/oauth/github-provider.ts
 init_config();
-import { ValidationError as ValidationError6 } from "@spfn/core/errors";
+import { ValidationError as ValidationError5 } from "@spfn/core/errors";
 var GITHUB_AUTH_URL = "https://github.com/login/oauth/authorize";
 var GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var GITHUB_USERINFO_URL = "https://api.github.com/user";
@@ -9752,7 +9901,7 @@ function getGithubConfig() {
   const clientId = env3.SPFN_AUTH_GITHUB_CLIENT_ID;
   const clientSecret = env3.SPFN_AUTH_GITHUB_CLIENT_SECRET;
   if (!clientId || !clientSecret) {
-    throw new ValidationError6({
+    throw new ValidationError5({
       message: "GitHub OAuth is not configured. Set SPFN_AUTH_GITHUB_CLIENT_ID and SPFN_AUTH_GITHUB_CLIENT_SECRET."
     });
   }
@@ -9874,16 +10023,20 @@ registerOAuthProvider(githubProvider);
 
 // src/server/lib/oauth/kakao-provider.ts
 init_config();
-import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { ValidationError as ValidationError6 } from "@spfn/core/errors";
+import { NativeSignInUnsupportedError as NativeSignInUnsupportedError3 } from "@spfn/auth/errors";
 import { timingSafeEqual } from "crypto";
 var KAKAO_AUTH_URL = "https://kauth.kakao.com/oauth/authorize";
 var KAKAO_TOKEN_URL = "https://kauth.kakao.com/oauth/token";
 var KAKAO_USERINFO_URL = "https://kapi.kakao.com/v2/user/me";
+var KAKAO_ISSUER = "https://kauth.kakao.com";
+var KAKAO_JWKS_URI = "https://kauth.kakao.com/.well-known/jwks.json";
+var USERINFO_TIMEOUT_MS = 5e3;
 function getKakaoConfig() {
   const clientId = env3.SPFN_AUTH_KAKAO_CLIENT_ID;
   const clientSecret = env3.SPFN_AUTH_KAKAO_CLIENT_SECRET;
   if (!clientId) {
-    throw new ValidationError7({
+    throw new ValidationError6({
       message: "Kakao OAuth is not configured. Set SPFN_AUTH_KAKAO_CLIENT_ID."
     });
   }
@@ -9898,6 +10051,13 @@ function getKakaoScopes() {
   const configured2 = env3.SPFN_AUTH_KAKAO_SCOPES;
   return configured2 ? configured2.split(",").map((scope) => scope.trim()).filter(Boolean) : ["account_email"];
 }
+function getKakaoNativeAudiences() {
+  const ids = (env3.SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (env3.SPFN_AUTH_KAKAO_CLIENT_ID) {
+    ids.push(env3.SPFN_AUTH_KAKAO_CLIENT_ID);
+  }
+  return ids;
+}
 async function requestKakaoTokens(params) {
   const response = await fetch(KAKAO_TOKEN_URL, {
     method: "POST",
@@ -9918,8 +10078,61 @@ async function requestKakaoTokens(params) {
     expiresIn
   };
 }
+async function fetchKakaoIdentity(accessToken) {
+  const response = await fetch(KAKAO_USERINFO_URL, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: AbortSignal.timeout(USERINFO_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    throw new Error(`Kakao user-info request failed with status ${response.status}`);
+  }
+  const body = await response.json();
+  if (typeof body.id !== "number" && typeof body.id !== "string") {
+    throw new Error("Kakao user-info response is missing the provider user ID");
+  }
+  const account = body.kakao_account;
+  const email = typeof account?.email === "string" ? account.email : null;
+  return {
+    providerUserId: String(body.id),
+    email,
+    emailVerified: email !== null && account?.is_email_valid === true && account.is_email_verified === true,
+    name: typeof account?.profile?.nickname === "string" ? account.profile.nickname : void 0,
+    avatar: typeof account?.profile?.profile_image_url === "string" ? account.profile.profile_image_url : void 0
+  };
+}
+async function withKakaoVerifiedEmail(identity, accessToken) {
+  const fetched = await fetchKakaoIdentity(accessToken).catch((err) => {
+    authLogger.service.warn("Kakao user-info lookup failed; continuing without email verification", {
+      reason: err instanceof Error ? err.message : "unknown"
+    });
+    return null;
+  });
+  if (!fetched) {
+    return identity;
+  }
+  if (fetched.providerUserId !== identity.providerUserId) {
+    authLogger.service.warn("Kakao access token belongs to another user; ignoring it", {
+      subject: identity.providerUserId
+    });
+    return identity;
+  }
+  return {
+    ...fetched,
+    email: fetched.email ?? identity.email,
+    name: fetched.name ?? identity.name,
+    avatar: fetched.avatar ?? identity.avatar
+  };
+}
 var kakaoProvider = {
   id: "kakao",
+  /**
+   * 웹 authorization-code 흐름을 쓸 수 있는지만 판정한다.
+   *
+   * native 로그인은 이 값을 보지 않는다 — oauthNativeService는 verifyNativeIdToken의 존재만
+   * 확인하고, 허용 audience는 그 메서드가 직접 검사한다. 네이티브 앱 키만 설정한 서비스에서
+   * 이 값이 true가 되면 웹 흐름 게이트를 통과한 뒤 더 깊은 곳에서 REST API 키 부재로
+   * 실패하므로, 판정을 웹 키에 그대로 둔다.
+   */
   isEnabled() {
     return !!env3.SPFN_AUTH_KAKAO_CLIENT_ID;
   },
@@ -9948,25 +10161,41 @@ var kakaoProvider = {
     return requestKakaoTokens(params);
   },
   async getUserInfo(accessToken) {
-    const response = await fetch(KAKAO_USERINFO_URL, {
-      headers: { Authorization: `Bearer ${accessToken}` }
-    });
-    if (!response.ok) {
-      throw new Error(`Kakao user-info request failed with status ${response.status}`);
-    }
-    const body = await response.json();
-    if (typeof body.id !== "number" && typeof body.id !== "string") {
-      throw new Error("Kakao user-info response is missing the provider user ID");
+    return fetchKakaoIdentity(accessToken);
+  },
+  /**
+   * 네이티브/웹 SDK가 받은 카카오 id_token을 검증한다.
+   *
+   * 카카오는 표준 OIDC라 nonce를 raw 그대로 담는다(Apple 같은 SHA-256 해싱이 없다).
+   * 앱에서 id_token을 받으려면 개발자 콘솔에서 OpenID Connect를 켜고 로그인 요청 scope에
+   * openid를 넣어야 한다.
+   *
+   * emailVerified는 기본이 false다. id_token에는 이메일의 유효·인증 여부를 알려주는 claim이
+   * 없어서, 웹 흐름과 같은 강도로 판정하려면 access token이 함께 와야 한다.
+   */
+  async verifyNativeIdToken(idToken, options) {
+    const audiences = getKakaoNativeAudiences();
+    if (audiences.length === 0) {
+      throw new NativeSignInUnsupportedError3({
+        message: "Kakao native sign-in is not configured. Set SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS."
+      });
     }
-    const account = body.kakao_account;
-    const email = typeof account?.email === "string" ? account.email : null;
-    return {
-      providerUserId: String(body.id),
-      email,
-      emailVerified: email !== null && account?.is_email_valid === true && account.is_email_verified === true,
-      name: typeof account?.profile?.nickname === "string" ? account.profile.nickname : void 0,
-      avatar: typeof account?.profile?.profile_image_url === "string" ? account.profile.profile_image_url : void 0
+    const payload = await verifyIdToken({
+      idToken,
+      jwksUri: KAKAO_JWKS_URI,
+      issuer: KAKAO_ISSUER,
+      audiences,
+      algorithms: ["RS256"],
+      expectedNonce: options.nonce
+    });
+    const identity = {
+      providerUserId: payload.sub,
+      email: typeof payload.email === "string" ? payload.email : null,
+      emailVerified: false,
+      name: typeof payload.nickname === "string" ? payload.nickname : void 0,
+      avatar: typeof payload.picture === "string" ? payload.picture : void 0
     };
+    return options.accessToken ? withKakaoVerifiedEmail(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
     const config2 = getKakaoConfig();
@@ -10011,16 +10240,20 @@ registerOAuthProvider(kakaoProvider);
 
 // src/server/lib/oauth/naver-provider.ts
 init_config();
-import { ValidationError as ValidationError8 } from "@spfn/core/errors";
+import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { NativeSignInUnsupportedError as NativeSignInUnsupportedError4 } from "@spfn/auth/errors";
 import { createDecipheriv, createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var NAVER_AUTH_URL = "https://nid.naver.com/oauth2.0/authorize";
 var NAVER_TOKEN_URL = "https://nid.naver.com/oauth2.0/token";
 var NAVER_USERINFO_URL = "https://openapi.naver.com/v1/nid/me";
+var NAVER_ISSUER = "https://nid.naver.com";
+var NAVER_JWKS_URI = "https://nid.naver.com/oauth2/jwks";
+var USERINFO_TIMEOUT_MS2 = 5e3;
 function getNaverConfig() {
   const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
   const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
   if (!clientId || !clientSecret) {
-    throw new ValidationError8({
+    throw new ValidationError7({
       message: "Naver OAuth is not configured. Set SPFN_AUTH_NAVER_CLIENT_ID and SPFN_AUTH_NAVER_CLIENT_SECRET."
     });
   }
@@ -10031,6 +10264,13 @@ function getNaverConfig() {
     redirectUri: env3.SPFN_AUTH_NAVER_REDIRECT_URI || `${baseUrl}/_auth/oauth/naver/callback`
   };
 }
+function getNaverNativeAudiences() {
+  const ids = (env3.SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (env3.SPFN_AUTH_NAVER_CLIENT_ID) {
+    ids.push(env3.SPFN_AUTH_NAVER_CLIENT_ID);
+  }
+  return ids;
+}
 async function requestNaverTokens(params) {
   const response = await fetch(NAVER_TOKEN_URL, {
     method: "POST",
@@ -10070,6 +10310,53 @@ function decryptNaverUniqueId(encryptUniqueId, key) {
     return null;
   }
 }
+async function fetchNaverIdentity(accessToken) {
+  const response = await fetch(NAVER_USERINFO_URL, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: AbortSignal.timeout(USERINFO_TIMEOUT_MS2)
+  });
+  if (!response.ok) {
+    throw new Error(`Naver user-info request failed with status ${response.status}`);
+  }
+  const body = await response.json();
+  const profile = body.response;
+  if (body.resultcode !== "00" || typeof profile?.id !== "string") {
+    throw new Error("Naver user-info response is invalid");
+  }
+  return {
+    providerUserId: profile.id,
+    email: typeof profile.email === "string" ? profile.email : null,
+    // 존재하면 검증된 것으로 취급한다. 응답에는 검증 플래그가 없고, 근거는 네이버가
+    // 연락처 이메일을 바꿀 때 새 주소로 보낸 인증번호를 요구한다는 것 하나다. 그래서
+    // 이 값은 소유가 확인된 주소이지 안정적인 식별자는 아니다 — 사용자가 바꿀 수 있고,
+    // 하나의 주소를 최대 6개 아이디가 공유할 수 있으며, 아예 없을 수도 있다.
+    // 계정을 가리키는 유일 키는 providerUserId뿐이다.
+    //
+    // 카카오와 근거가 다르다. 카카오는 응답의 is_email_valid·is_email_verified를
+    // 직접 보고, 네이버는 변경 시점의 인증에 의존한다.
+    emailVerified: typeof profile.email === "string",
+    name: typeof profile.name === "string" ? profile.name : typeof profile.nickname === "string" ? profile.nickname : void 0,
+    avatar: typeof profile.profile_image === "string" ? profile.profile_image : void 0
+  };
+}
+async function withNaverProfile(identity, accessToken) {
+  const fetched = await fetchNaverIdentity(accessToken).catch((err) => {
+    authLogger.service.warn("Naver user-info lookup failed; continuing without email", {
+      reason: err instanceof Error ? err.message : "unknown"
+    });
+    return null;
+  });
+  if (!fetched) {
+    return identity;
+  }
+  if (fetched.providerUserId !== identity.providerUserId) {
+    authLogger.service.warn("Naver access token belongs to another user; ignoring it", {
+      subject: identity.providerUserId
+    });
+    return identity;
+  }
+  return fetched;
+}
 var naverProvider = {
   id: "naver",
   isEnabled() {
@@ -10097,26 +10384,39 @@ var naverProvider = {
     }));
   },
   async getUserInfo(accessToken) {
-    const response = await fetch(NAVER_USERINFO_URL, {
-      headers: { Authorization: `Bearer ${accessToken}` }
-    });
-    if (!response.ok) {
-      throw new Error(`Naver user-info request failed with status ${response.status}`);
-    }
-    const body = await response.json();
-    const profile = body.response;
-    if (body.resultcode !== "00" || typeof profile?.id !== "string") {
-      throw new Error("Naver user-info response is invalid");
+    return fetchNaverIdentity(accessToken);
+  },
+  /**
+   * 네이티브/웹 SDK가 받은 네이버 id_token을 검증한다.
+   *
+   * 표준 OIDC라 nonce는 raw 그대로 대조한다(Apple 같은 해싱이 없다). 다만 네이버는
+   * nonce의 끝 문자가 A일 때 그것을 떨어뜨려 돌려주므로, 클라이언트는 nonce를 소문자
+   * hex로 만들어야 한다 — 문자집합에 A가 없어야 이 경우를 만나지 않는다. base64url은
+   * 16바이트 값의 끝이 A·Q·g·w 중 하나라 4번에 1번, 대문자 hex는 16번에 1번 걸린다.
+   *
+   * id_token에는 이메일도 프로필도 없다. 이메일은 access token이 함께 왔을 때만 얻는다.
+   */
+  async verifyNativeIdToken(idToken, options) {
+    const audiences = getNaverNativeAudiences();
+    if (audiences.length === 0) {
+      throw new NativeSignInUnsupportedError4({
+        message: "Naver native sign-in is not configured. Set SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS."
+      });
     }
-    return {
-      providerUserId: profile.id,
-      email: typeof profile.email === "string" ? profile.email : null,
-      // 네이버 프로필 이메일은 네이버 계정 이메일이거나 인증 절차를 거친 연락처
-      // 이메일이다 — 존재하면 검증된 것으로 취급한다(카카오와 같은 신뢰 수준).
-      emailVerified: typeof profile.email === "string",
-      name: typeof profile.name === "string" ? profile.name : typeof profile.nickname === "string" ? profile.nickname : void 0,
-      avatar: typeof profile.profile_image === "string" ? profile.profile_image : void 0
+    const payload = await verifyIdToken({
+      idToken,
+      jwksUri: NAVER_JWKS_URI,
+      issuer: NAVER_ISSUER,
+      audiences,
+      algorithms: ["RS256"],
+      expectedNonce: options.nonce
+    });
+    const identity = {
+      providerUserId: payload.sub,
+      email: null,
+      emailVerified: false
     };
+    return options.accessToken ? withNaverProfile(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
     const config2 = getNaverConfig();
@@ -10174,12 +10474,12 @@ registerOAuthProvider(naverProvider);
 function requireEnabledProvider(provider) {
   const oauthProvider = getOAuthProvider(provider);
   if (!oauthProvider) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: `Unsupported OAuth provider: ${provider}. No provider is registered for this id.`
     });
   }
   if (!oauthProvider.isEnabled()) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: `OAuth provider '${provider}' is registered but not configured. Check its required environment variables.`
     });
   }
@@ -10187,7 +10487,7 @@ function requireEnabledProvider(provider) {
 }
 function tokenExpiryDate(expiresIn) {
   if (!Number.isFinite(expiresIn)) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: `Invalid token expiry returned from OAuth provider: ${expiresIn}`
     });
   }
@@ -10213,12 +10513,12 @@ async function oauthCallbackService(params) {
   const stateData = await verifyOAuthState(state);
   const nonceCandidates = typeof expectedNonce === "string" ? [expectedNonce] : expectedNonce ?? [];
   if (!stateData.nonce || !nonceCandidates.includes(stateData.nonce)) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: "OAuth state validation failed"
     });
   }
   if (stateData.provider !== provider) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: "OAuth state provider mismatch"
     });
   }
@@ -10285,7 +10585,7 @@ async function oauthCallbackService(params) {
 async function assertActiveForOAuthSession(userId) {
   const user = await usersRepository.findByIdOnPrimary(userId);
   if (!user) {
-    throw new ValidationError9({ message: "User not found" });
+    throw new ValidationError8({ message: "User not found" });
   }
   if (user.status === "active") {
     return;
@@ -10326,9 +10626,7 @@ async function createOrLinkUser(provider, identity, tokens, metadata) {
   let isNewUser = false;
   if (existingUser) {
     if (!identity.emailVerified) {
-      throw new ValidationError9({
-        message: "Cannot link to existing account with unverified email. Please verify your email with the provider first."
-      });
+      throw new UnverifiedEmailLinkError();
     }
     userId = existingUser.id;
     if (!existingUser.emailVerifiedAt) {
@@ -10397,16 +10695,16 @@ var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
 async function getGoogleAccessToken(userId) {
   const account = await socialAccountsRepository.findByUserIdAndProvider(userId, "google");
   if (!account) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: "No Google account linked. User must sign in with Google first."
     });
   }
-  const isExpired = !account.tokenExpiresAt || account.tokenExpiresAt.getTime() < Date.now() + TOKEN_EXPIRY_BUFFER_MS;
-  if (!isExpired && account.accessToken) {
+  const isExpired2 = !account.tokenExpiresAt || account.tokenExpiresAt.getTime() < Date.now() + TOKEN_EXPIRY_BUFFER_MS;
+  if (!isExpired2 && account.accessToken) {
     return account.accessToken;
   }
   if (!account.refreshToken) {
-    throw new ValidationError9({
+    throw new ValidationError8({
       message: "Google refresh token not available. User must re-authenticate with Google."
     });
   }
@@ -10439,22 +10737,38 @@ async function oauthUnlinkNotifyService(provider, notification) {
 }
 
 // src/server/services/oauth-native.service.ts
-init_repositories();
-import { ValidationError as ValidationError10 } from "@spfn/core/errors";
 import { runInTransaction as runInTransaction2, onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
+import {
+  InvalidKeyFingerprintError as InvalidKeyFingerprintError2,
+  NativeSignInUnsupportedError as NativeSignInUnsupportedError5,
+  NonceKeyBindingError
+} from "@spfn/auth/errors";
+init_repositories();
 async function oauthNativeService(params) {
   const oauthProvider = getOAuthProvider(params.provider);
   if (!oauthProvider?.verifyNativeIdToken) {
-    throw new ValidationError10({
+    throw new NativeSignInUnsupportedError5({
       message: `Provider '${params.provider}' does not support native id_token sign-in.`
     });
   }
-  const identity = await oauthProvider.verifyNativeIdToken(params.idToken, { nonce: params.nonce });
+  assertNonceBindsPublicKey(params);
+  const identity = await oauthProvider.verifyNativeIdToken(params.idToken, {
+    nonce: params.nonce,
+    accessToken: params.accessToken
+  });
   if (params.profile?.name && !identity.name) {
     identity.name = params.profile.name;
   }
   return persistNativeLogin(identity, params);
 }
+function assertNonceBindsPublicKey(params) {
+  if (params.nonce !== params.fingerprint) {
+    throw new NonceKeyBindingError();
+  }
+  if (!verifyKeyFingerprint(params.publicKey, params.fingerprint)) {
+    throw new InvalidKeyFingerprintError2();
+  }
+}
 async function persistNativeLogin(identity, params) {
   return runInTransaction2(async () => {
     const existing = await socialAccountsRepository.findByProviderAndProviderId(
@@ -10477,7 +10791,9 @@ async function persistNativeLogin(identity, params) {
       keyId: params.keyId,
       publicKey: params.publicKey,
       fingerprint: params.fingerprint,
-      algorithm: params.algorithm
+      algorithm: params.algorithm,
+      deviceName: params.deviceName,
+      platform: params.platform
     });
     await updateLastLoginService(userId);
     const eventPayload = {
@@ -10497,6 +10813,7 @@ import { Transactional } from "@spfn/core/db";
 import { rateLimitPolicy } from "@spfn/core/middleware";
 
 // src/server/lib/rate-limit-keys.ts
+import { createHash as createHash4 } from "crypto";
 import { getClientIp } from "@spfn/core/middleware";
 async function readJsonBody(c) {
   try {
@@ -10532,6 +10849,21 @@ function byIpAndAccount(options = {}) {
     ];
   };
 }
+function idTokenKey(body) {
+  if (typeof body.idToken !== "string" || !body.idToken) {
+    return void 0;
+  }
+  return `tok:${createHash4("sha256").update(body.idToken).digest("hex")}`;
+}
+function byIpAndIdToken(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      idTokenKey(body)
+    ];
+  };
+}
 function byIpAndTarget(options = {}) {
   return async (c) => {
     const body = await readJsonBody(c);
@@ -10596,7 +10928,9 @@ var register = route.post("/_auth/register").input({
     publicKey: Type.String({ description: "Client public key" }),
     keyId: Type.String({ description: "Key identifier" }),
     fingerprint: Type.String({ description: "Key fingerprint" }),
-    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
+    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
   })
 }).use([rateLimitPolicy("auth-register", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
@@ -10621,7 +10955,9 @@ var login = route.post("/_auth/login").input({
     keyId: Type.String({ description: "Key identifier" }),
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
-    oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" }))
+    oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" })),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
   })
 }).use([rateLimitPolicy("auth-login", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
@@ -10641,7 +10977,9 @@ var rotateKey = route.post("/_auth/keys/rotate").interceptor({
     publicKey: Type.String({ description: "New public key" }),
     keyId: Type.String({ description: "New key identifier" }),
     fingerprint: Type.String({ description: "New key fingerprint" }),
-    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
+    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
   })
 }).use([Transactional()]).handler(async (c) => {
   const { body } = await c.data();
@@ -10652,7 +10990,53 @@ var rotateKey = route.post("/_auth/keys/rotate").interceptor({
     newKeyId: body.keyId,
     newPublicKey: body.publicKey,
     fingerprint: body.fingerprint,
-    algorithm: body.algorithm
+    algorithm: body.algorithm,
+    deviceName: body.deviceName,
+    platform: body.platform
+  });
+});
+var listKeys = route.post("/_auth/keys/list").input({
+  body: Type.Object({
+    includeRevoked: Type.Optional(Type.Boolean({
+      description: "Also return keys already revoked, for reviewing what was cut off. Default false."
+    }))
+  })
+}).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId } = getAuth(c);
+  return { keys: await listKeysService({ userId: Number(userId), includeRevoked: body.includeRevoked }) };
+});
+var revokeKey = route.post("/_auth/keys/revoke").input({
+  body: Type.Object({
+    keyId: Type.String({ description: "Key to revoke \u2014 must belong to the caller" })
+  })
+}).use([Transactional()]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId, keyId: currentKeyId } = getAuth(c);
+  const revoked = await revokeKeyService({
+    userId: Number(userId),
+    keyId: body.keyId,
+    reason: "Revoked by user"
+  });
+  if (!revoked) {
+    throw new KeyNotFoundError();
+  }
+  return { keyId: body.keyId, selfRevoked: body.keyId === currentKeyId };
+});
+var revokeAllKeys = route.post("/_auth/keys/revoke-all").input({
+  body: Type.Object({
+    includeCurrent: Type.Optional(Type.Boolean({
+      description: "Also revoke the key this request is signed with. Default false."
+    }))
+  })
+}).use([Transactional()]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId, keyId } = getAuth(c);
+  return await revokeAllKeysService({
+    userId: Number(userId),
+    currentKeyId: keyId,
+    includeCurrent: body.includeCurrent,
+    reason: "Revoked by user"
   });
 });
 var changePassword = route.put("/_auth/password").input({
@@ -10689,6 +11073,9 @@ var authRouter = defineRouter({
   login,
   logout,
   rotateKey,
+  listKeys,
+  revokeKey,
+  revokeAllKeys,
   changePassword,
   getAuthSession,
   issueOneTimeToken
@@ -11070,7 +11457,7 @@ function encodeString(value) {
 }
 
 // src/server/client-proof/proof.ts
-import { createHash as createHash4, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
+import { createHash as createHash5, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
 var CLIENT_PROOF_PROFILE = "clientProofV1";
 var ABSENT_BODY_SHA256 = "0".repeat(64);
 var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
@@ -11140,7 +11527,7 @@ function verifyClientProof(input, presentedProof, publicKey) {
   );
 }
 function sha256Hex(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash5("sha256").update(bytes).digest("hex");
 }
 
 // src/server/client-proof/refusal.ts
@@ -11206,6 +11593,18 @@ var ClientProofRefusal = class _ClientProofRefusal {
   static unprocessable() {
     return contractViolation("the request could not be processed");
   }
+  /**
+   * A client that ships separately from the server said nothing about which
+   * contract it was built against. Without it the server cannot tell whether
+   * the two ends agree, and answering as though they do is what produces the
+   * undecodable body this check exists to replace.
+   */
+  static contractVersionMissing() {
+    return contractViolation("a client of this kind must state the contract version it was generated from");
+  }
+  static contractVersionUnsupported() {
+    return contractViolation("the stated contract version is outside the range this server serves");
+  }
   // ---- the profile allowlist ----------------------------------------------
   static profileRejected() {
     return new _ClientProofRefusal("PROFILE_REJECTED", "the named auth profile is not on this contract's allowlist");
@@ -12275,8 +12674,9 @@ var deleteCookie = (c, name, opt) => {
 
 // src/server/routes/oauth/index.ts
 init_types();
+init_schema3();
 import { Transactional as Transactional3 } from "@spfn/core/db";
-import { ValidationError as ValidationError11 } from "@spfn/core/errors";
+import { ValidationError as ValidationError9 } from "@spfn/core/errors";
 import { rateLimitPolicy as rateLimitPolicy4 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
@@ -12396,10 +12796,10 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
 }).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
-    throw new ValidationError11({ message: "Google OAuth is not configured" });
+    throw new ValidationError9({ message: "Google OAuth is not configured" });
   }
   if (!body.state) {
-    throw new ValidationError11({
+    throw new ValidationError9({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -12494,7 +12894,7 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
-    throw new ValidationError11({
+    throw new ValidationError9({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -12504,13 +12904,20 @@ var oauthNative = route4.post("/_auth/oauth/:provider/native").input({
   params: providerParams,
   body: Type.Object({
     idToken: Type.String({ description: "id_token from native/web social SDK" }),
-    nonce: Type.String({ description: "Raw nonce used when requesting the id_token" }),
+    nonce: Type.String({
+      description: "Raw nonce used when requesting the id_token. Must equal `fingerprint` \u2014 the nonce is what binds the id_token to this public key, so a stolen id_token cannot be paired with a different key."
+    }),
+    accessToken: Type.Optional(Type.String({
+      description: "Provider access token from the same sign-in. Optional \u2014 sent only when the provider needs it to resolve claims the id_token omits (Kakao email verification)."
+    })),
     publicKey: Type.String({ description: "Client public key (Base64 DER)" }),
     keyId: Type.String({ description: "Key identifier (UUID)" }),
     fingerprint: Type.String({ description: "Key fingerprint (SHA-256 hex)" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((a) => Type.Literal(a)), {
       description: "Key algorithm (ES256 or RS256)"
     }),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema),
     profile: Type.Optional(Type.Object({
       name: Type.Optional(Type.String())
     }, {
@@ -12520,7 +12927,11 @@ var oauthNative = route4.post("/_auth/oauth/:provider/native").input({
       description: "Custom metadata passed to auth events (e.g. referral code, UTM params)"
     }))
   })
-}).use([rateLimitPolicy4("oauth-native", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-native", {
+  limit: 5,
+  windowMs: 6e4,
+  by: byIpAndIdToken({ ipLimit: 20 })
+})]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
   return await oauthNativeService({ provider: params.provider, ...body });
 });
@@ -12729,6 +13140,9 @@ var mainAuthRouter = defineRouter6({
   login,
   logout,
   rotateKey,
+  listKeys,
+  revokeKey,
+  revokeAllKeys,
   changePassword,
   getAuthSession,
   // One-Time Token routes
@@ -13134,16 +13548,21 @@ export {
   DEFAULT_DELETION_PURGE_CRON,
   DEFAULT_DELETION_PURGE_STRATEGY,
   DEFAULT_DELETION_SEND_NOTIFICATIONS,
+  DeviceNameSchema,
   EmailSchema,
   EnvironmentKeyringTokenCipher,
   INVITATION_STATUSES,
   InvitationsRepository,
   KEY_ALGORITHM,
+  KEY_DEVICE_NAME_MAX_LENGTH,
+  KEY_FINGERPRINT_PREFIX_LENGTH,
+  KEY_PLATFORM,
   KeysRepository,
   PURGE_STRATEGIES,
   PasswordSchema,
   PermissionsRepository,
   PhoneSchema,
+  PlatformSchema,
   RolePermissionsRepository,
   RolesRepository,
   SOCIAL_PROVIDERS,
@@ -13257,6 +13676,7 @@ export {
   kakaoProvider,
   keysRepository,
   listInvitations,
+  listKeysService,
   loginService,
   logoutService,
   matchOAuthCsrfCookies,
@@ -13284,6 +13704,7 @@ export {
   requireRole,
   resendInvitation,
   resolveAuthenticatedUser,
+  revokeAllKeysService,
   revokeKeyService,
   roleGuard,
   rolePermissions,