@spfn/auth 0.3.0-beta.1 → 0.3.0-beta.3

package/dist/server.js

@@ -5432,6 +5432,38 @@ var init_auth_metadata = __esm({
   }
 });
 
+// src/server/entities/ops-tokens.ts
+import { text as text12 } from "drizzle-orm/pg-core";
+import { id as id12, timestamps as timestamps11, utcTimestamp as utcTimestamp8 } from "@spfn/core/db";
+var opsTokens;
+var init_ops_tokens = __esm({
+  "src/server/entities/ops-tokens.ts"() {
+    "use strict";
+    init_schema4();
+    opsTokens = authSchema.table(
+      "ops_tokens",
+      {
+        id: id12(),
+        // Operator-facing label ("ci-deploy", "rayim-laptop")
+        name: text12("name").notNull(),
+        // SHA-256 hex of the token secret. Lookup key — the secret never lands
+        // here, and the unique constraint doubles as the lookup index.
+        tokenHash: text12("token_hash").notNull().unique(),
+        // Granted scopes as permission strings ('waitlist:read', ...).
+        // '*' grants every scope.
+        scopes: text12("scopes").array().notNull(),
+        // null = the token does not expire
+        expiresAt: utcTimestamp8("expires_at"),
+        // null = active; a timestamp revokes the token permanently
+        revokedAt: utcTimestamp8("revoked_at"),
+        // Last successful verification, updated fire-and-forget
+        lastUsedAt: utcTimestamp8("last_used_at"),
+        ...timestamps11()
+      }
+    );
+  }
+});
+
 // src/server/entities/index.ts
 var init_entities = __esm({
   "src/server/entities/index.ts"() {
@@ -5449,6 +5481,7 @@ var init_entities = __esm({
     init_role_permissions();
     init_user_permissions();
     init_auth_metadata();
+    init_ops_tokens();
   }
 });
 
@@ -5466,8 +5499,8 @@ var init_users_repository = __esm({
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5477,8 +5510,8 @@ var init_users_repository = __esm({
        * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
        * 계속 사용할 것.
        */
-      async findByIdOnPrimary(id12) {
-        const result = await this.db.select().from(users).where(eq(users.id, id12)).limit(1);
+      async findByIdOnPrimary(id13) {
+        const result = await this.db.select().from(users).where(eq(users.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5531,13 +5564,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id12) {
+      async findByIdWithRole(id13) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id12)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id13)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -5558,8 +5591,8 @@ var init_users_repository = __esm({
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id12, data) {
-        const result = await this.db.update(users).set(data).where(eq(users.id, id12)).returning();
+      async updateById(id13, data) {
+        const result = await this.db.update(users).set(data).where(eq(users.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5571,10 +5604,10 @@ var init_users_repository = __esm({
        * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
        * Write primary 사용
        */
-      async reactivateFromPendingDeletion(id12) {
+      async reactivateFromPendingDeletion(id13) {
         const result = await this.db.update(users).set({ status: "active" }).where(
           and(
-            eq(users.id, id12),
+            eq(users.id, id13),
             eq(users.status, "pending_deletion")
           )
         ).returning();
@@ -5584,32 +5617,32 @@ var init_users_repository = __esm({
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id12, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id13, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash
         };
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id12)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id12) {
+      async updateLastLogin(id13) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id12)).returning();
+        }).where(eq(users.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id12) {
-        const result = await this.db.delete(users).where(eq(users.id, id12)).returning();
+      async deleteById(id13) {
+        const result = await this.db.delete(users).where(eq(users.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5957,14 +5990,14 @@ var init_keys_repository = __esm({
        * stored, so it answers "since when has this device been on this release"
        * rather than "when was it last seen", which lastUsedAt already answers.
        */
-      async updateLastUsedById(id12, identity) {
+      async updateLastUsedById(id13, identity) {
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
         const lastUsedIsStale = or(
           isNull(userPublicKeys.lastUsedAt),
           lt(userPublicKeys.lastUsedAt, staleBefore)
         );
         if (!identity) {
-          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id12), lastUsedIsStale));
+          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id13), lastUsedIsStale));
           return;
         }
         const identityChanged = sql4`(
@@ -5981,7 +6014,7 @@ var init_keys_repository = __esm({
           clientContractVersion: identity.contractVersion,
           clientSeenAt: sql4`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
         }).where(and2(
-          eq2(userPublicKeys.id, id12),
+          eq2(userPublicKeys.id, id13),
           or(lastUsedIsStale, identityChanged)
         ));
       }
@@ -6020,8 +6053,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6035,22 +6068,22 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id12) {
+      async markAsUsed(id13) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id12)).returning();
+        }).where(eq3(verificationCodes.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id12) {
-        const code = await this.findById(id12);
+      async incrementAttempts(id13) {
+        const code = await this.findById(id13);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1
-        }).where(eq3(verificationCodes.id, id12)).returning();
+        }).where(eq3(verificationCodes.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6106,8 +6139,8 @@ var init_roles_repository = __esm({
       /**
        * ID로 역할 조회
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(roles).where(eq4(roles.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(roles).where(eq4(roles.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6138,15 +6171,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id12, data) {
-        const result = await this.db.update(roles).set(data).where(eq4(roles.id, id12)).returning();
+      async updateById(id13, data) {
+        const result = await this.db.update(roles).set(data).where(eq4(roles.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id12) {
-        const result = await this.db.delete(roles).where(eq4(roles.id, id12)).returning();
+      async deleteById(id13) {
+        const result = await this.db.delete(roles).where(eq4(roles.id, id13)).returning();
         return result[0] ?? null;
       }
     };
@@ -6166,8 +6199,8 @@ var init_permissions_repository = __esm({
       /**
        * ID로 권한 조회
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(permissions).where(eq5(permissions.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(permissions).where(eq5(permissions.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6218,15 +6251,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id12, data) {
-        const result = await this.db.update(permissions).set(data).where(eq5(permissions.id, id12)).returning();
+      async updateById(id13, data) {
+        const result = await this.db.update(permissions).set(data).where(eq5(permissions.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id12) {
-        const result = await this.db.delete(permissions).where(eq5(permissions.id, id12)).returning();
+      async deleteById(id13) {
+        const result = await this.db.delete(permissions).where(eq5(permissions.id, id13)).returning();
         return result[0] ?? null;
       }
     };
@@ -6356,8 +6389,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id12, data) {
-        const result = await this.db.update(userPermissions).set(data).where(eq7(userPermissions.id, id12)).returning();
+      async updateById(id13, data) {
+        const result = await this.db.update(userPermissions).set(data).where(eq7(userPermissions.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6409,8 +6442,8 @@ var init_user_profiles_repository = __esm({
       /**
        * ID로 프로필 조회
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(userProfiles).where(eq8(userProfiles.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(userProfiles).where(eq8(userProfiles.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6436,8 +6469,8 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id12, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq8(userProfiles.id, id12)).returning();
+      async updateById(id13, data) {
+        const result = await this.db.update(userProfiles).set(data).where(eq8(userProfiles.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6450,8 +6483,8 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id12) {
-        const result = await this.db.delete(userProfiles).where(eq8(userProfiles.id, id12)).returning();
+      async deleteById(id13) {
+        const result = await this.db.delete(userProfiles).where(eq8(userProfiles.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6541,8 +6574,8 @@ var init_invitations_repository = __esm({
       /**
        * ID로 초대 조회
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(userInvitations).where(eq9(userInvitations.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(userInvitations).where(eq9(userInvitations.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6585,7 +6618,7 @@ var init_invitations_repository = __esm({
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id12, status, timestamp2) {
+      async updateStatus(id13, status, timestamp2) {
         const updates = {
           status
         };
@@ -6596,14 +6629,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq9(userInvitations.id, id12)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq9(userInvitations.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id12) {
-        const result = await this.db.delete(userInvitations).where(eq9(userInvitations.id, id12)).returning();
+      async deleteById(id13) {
+        const result = await this.db.delete(userInvitations).where(eq9(userInvitations.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6698,30 +6731,30 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id12, data) {
-        const result = await this.db.update(userInvitations).set(data).where(eq9(userInvitations.id, id12)).returning();
+      async updateById(id13, data) {
+        const result = await this.db.update(userInvitations).set(data).where(eq9(userInvitations.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id12, newExpiresAt) {
+      async resend(id13, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt
-        }).where(eq9(userInvitations.id, id12)).returning();
+        }).where(eq9(userInvitations.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id12, cancelledBy, reason, currentMetadata) {
+      async cancel(id13, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata
-        }).where(eq9(userInvitations.id, id12)).returning();
+        }).where(eq9(userInvitations.id, id13)).returning();
         return result[0] ?? null;
       }
     };
@@ -7446,11 +7479,11 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id12, data) {
+      async updateTokens(id13, data) {
         const accounts = await this.db.select({
           provider: userSocialAccounts.provider,
           providerUserId: userSocialAccounts.providerUserId
-        }).from(userSocialAccounts).where(eq10(userSocialAccounts.id, id12)).limit(1);
+        }).from(userSocialAccounts).where(eq10(userSocialAccounts.id, id13)).limit(1);
         const account = accounts[0];
         if (!account) {
           return null;
@@ -7464,15 +7497,15 @@ var init_social_accounts_repository = __esm({
           ...data,
           accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
           refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken
-        }).where(eq10(userSocialAccounts.id, id12)).returning();
+        }).where(eq10(userSocialAccounts.id, id13)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id12) {
-        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.id, id12)).returning();
+      async deleteById(id13) {
+        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7552,8 +7585,8 @@ var init_account_deletion_requests_repository = __esm({
        * ID로 요청 조회
        * Read replica 사용
        */
-      async findById(id12) {
-        const result = await this.readDb.select().from(accountDeletionRequests).where(eq12(accountDeletionRequests.id, id12)).limit(1);
+      async findById(id13) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq12(accountDeletionRequests.id, id13)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7612,13 +7645,13 @@ var init_account_deletion_requests_repository = __esm({
        * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCancelled(id12) {
+      async markCancelled(id13) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date()
         }).where(
           and8(
-            eq12(accountDeletionRequests.id, id12),
+            eq12(accountDeletionRequests.id, id13),
             eq12(accountDeletionRequests.status, "pending")
           )
         ).returning();
@@ -7634,14 +7667,14 @@ var init_account_deletion_requests_repository = __esm({
        * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCompleted(id12, purgeStrategy) {
+      async markCompleted(id13, purgeStrategy) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "completed",
           completedAt: /* @__PURE__ */ new Date(),
           purgeStrategy
         }).where(
           and8(
-            eq12(accountDeletionRequests.id, id12),
+            eq12(accountDeletionRequests.id, id13),
             eq12(accountDeletionRequests.status, "pending")
           )
         ).returning();
@@ -7652,6 +7685,52 @@ var init_account_deletion_requests_repository = __esm({
   }
 });
 
+// src/server/repositories/ops-tokens.repository.ts
+import { and as and9, desc as desc3, eq as eq13, isNull as isNull4 } from "drizzle-orm";
+import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
+var OpsTokensRepository, opsTokensRepository;
+var init_ops_tokens_repository = __esm({
+  "src/server/repositories/ops-tokens.repository.ts"() {
+    "use strict";
+    init_ops_tokens();
+    OpsTokensRepository = class extends BaseRepository13 {
+      /**
+       * Lookup by the secret's hash — the verification path.
+       *
+       * Reads the primary, not the replica, unlike every other SELECT here.
+       * Revocation writes to the primary, so a replica read would keep
+       * authenticating a revoked token for the length of the replication lag —
+       * and revocation is documented as taking effect immediately.
+       */
+      async findByTokenHash(tokenHash) {
+        const result = await this.db.select().from(opsTokens).where(eq13(opsTokens.tokenHash, tokenHash)).limit(1);
+        return result[0] ?? null;
+      }
+      async create(data) {
+        const result = await this.db.insert(opsTokens).values(data).returning();
+        return result[0];
+      }
+      async list() {
+        return await this.readDb.select().from(opsTokens).orderBy(desc3(opsTokens.createdAt));
+      }
+      /**
+       * Revoke an active token. Returns null when the id does not exist or the
+       * token is already revoked — the first revocation's timestamp is never
+       * overwritten.
+       */
+      async revokeById(id13) {
+        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and9(eq13(opsTokens.id, id13), isNull4(opsTokens.revokedAt))).returning();
+        return result[0] ?? null;
+      }
+      /** Fire-and-forget from the verification path. */
+      async updateLastUsedById(id13) {
+        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq13(opsTokens.id, id13));
+      }
+    };
+    opsTokensRepository = new OpsTokensRepository();
+  }
+});
+
 // src/server/repositories/index.ts
 var init_repositories = __esm({
   "src/server/repositories/index.ts"() {
@@ -7668,6 +7747,7 @@ var init_repositories = __esm({
     init_social_accounts_repository();
     init_auth_metadata_repository();
     init_account_deletion_requests_repository();
+    init_ops_tokens_repository();
   }
 });
 
@@ -7759,7 +7839,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id12) => Number(id12));
+  const permissionIdNums = permissionIds.map((id13) => Number(id13));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -7779,7 +7859,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id12) => permissionsRepository.findById(id12))
+    permissionIds.map((id13) => permissionsRepository.findById(id13))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -7992,7 +8072,7 @@ import {
 // src/server/lib/config.ts
 import { env as env4 } from "@spfn/auth/config";
 function getCookieSuffix() {
-  const port = process.env.PORT;
+  const port = process.env.SPFN_PORT;
   return port ? `_${port}` : "";
 }
 var COOKIE_NAMES = {
@@ -8595,8 +8675,8 @@ async function verifyReauthCredential(user, params) {
     throw new VerificationTokenTargetMismatchError();
   }
 }
-async function sendDeletionEmail(to, subject, text12) {
-  const result = await sendEmail2({ to, subject, text: text12 });
+async function sendDeletionEmail(to, subject, text13) {
+  const result = await sendEmail2({ to, subject, text: text13 });
   if (!result.success) {
     authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
   }
@@ -9144,7 +9224,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id12) => permissionsRepository.findById(id12))
+      permIds.map((id13) => permissionsRepository.findById(id13))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -9357,20 +9437,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id12, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id12);
+async function cancelInvitation(id13, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id13);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id12, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id13, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id12) {
-  await invitationsRepository.deleteById(id12);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id12}`);
+async function deleteInvitation(id13) {
+  await invitationsRepository.deleteById(id13);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id13}`);
 }
 async function expireOldInvitations() {
   const count = await invitationsRepository.updateExpiredInvitations();
@@ -9379,8 +9459,8 @@ async function expireOldInvitations() {
   }
   return count;
 }
-async function resendInvitation(id12, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id12);
+async function resendInvitation(id13, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id13);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
@@ -9388,7 +9468,7 @@ async function resendInvitation(id12, expiresInDays = 7) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id12, newExpiresAt);
+  const updated = await invitationsRepository.resend(id13, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -9702,8 +9782,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id12) {
-  return registry2.get(id12);
+function getOAuthProvider(id13) {
+  return registry2.get(id13);
 }
 function getRegisteredProviders() {
   return [...registry2.values()];
@@ -10798,13 +10878,61 @@ async function persistNativeLogin(identity, params) {
   }, { context: "auth:oauth-native" });
 }
 
+// src/server/services/ops-token.service.ts
+init_ops_tokens_repository();
+import { createHash as createHash4, randomBytes } from "crypto";
+var OPS_TOKEN_PREFIX = "spfn_ops_";
+function hashOpsToken(token) {
+  return createHash4("sha256").update(token).digest("hex");
+}
+async function issueOpsTokenService(name, scopes, expiresAt) {
+  if (scopes.length === 0) {
+    throw new Error("An ops token needs at least one scope ('*' grants all).");
+  }
+  const token = OPS_TOKEN_PREFIX + randomBytes(32).toString("hex");
+  const record = await opsTokensRepository.create({
+    name,
+    tokenHash: hashOpsToken(token),
+    scopes,
+    expiresAt
+  });
+  return { token, record };
+}
+async function verifyOpsTokenService(token) {
+  if (!token.startsWith(OPS_TOKEN_PREFIX)) {
+    return null;
+  }
+  const record = await opsTokensRepository.findByTokenHash(hashOpsToken(token));
+  if (!record) {
+    return null;
+  }
+  if (record.revokedAt !== null) {
+    return null;
+  }
+  if (record.expiresAt !== null && /* @__PURE__ */ new Date() > record.expiresAt) {
+    return null;
+  }
+  opsTokensRepository.updateLastUsedById(record.id).catch((err) => authLogger.service.error("Failed to update ops token lastUsedAt", err));
+  return {
+    tokenId: record.id,
+    name: record.name,
+    scopes: record.scopes
+  };
+}
+async function revokeOpsTokenService(id13) {
+  return await opsTokensRepository.revokeById(id13);
+}
+async function listOpsTokensService() {
+  return await opsTokensRepository.list();
+}
+
 // src/server/routes/auth/index.ts
 init_esm();
 import { Transactional } from "@spfn/core/db";
 import { rateLimitPolicy } from "@spfn/core/middleware";
 
 // src/server/lib/rate-limit-keys.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { getClientIp } from "@spfn/core/middleware";
 async function readJsonBody(c) {
   try {
@@ -10844,7 +10972,7 @@ function idTokenKey(body) {
   if (typeof body.idToken !== "string" || !body.idToken) {
     return void 0;
   }
-  return `tok:${createHash4("sha256").update(body.idToken).digest("hex")}`;
+  return `tok:${createHash5("sha256").update(body.idToken).digest("hex")}`;
 }
 function byIpAndIdToken(options = {}) {
   return async (c) => {
@@ -11086,7 +11214,7 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/client-proof/refusal.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 
 // src/server/client-proof/canonical-json.ts
 var CanonicalJsonError = class extends Error {
@@ -11099,13 +11227,13 @@ var CanonicalJsonError = class extends Error {
 var INT64_MIN = -(2n ** 63n);
 var INT64_MAX = 2n ** 63n - 1n;
 function parseCanonicalJson(bytes) {
-  let text12;
+  let text13;
   try {
-    text12 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text13 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new CanonicalJsonError("INVALID_UTF8");
   }
-  const parser = new Parser(text12);
+  const parser = new Parser(text13);
   const value = parser.parseValue();
   parser.skipWhitespace();
   if (!parser.atEnd()) {
@@ -11126,8 +11254,8 @@ function isCanonicalBytes(bytes, value) {
   return true;
 }
 var Parser = class {
-  constructor(text12) {
-    this.text = text12;
+  constructor(text13) {
+    this.text = text13;
   }
   pos = 0;
   atEnd() {
@@ -11444,7 +11572,7 @@ var HTTP_STATUS = {
   CONTRACT_UNSUPPORTED: 409
 };
 function newHexId() {
-  return randomBytes(16).toString("hex");
+  return randomBytes2(16).toString("hex");
 }
 var ClientProofRefusal = class _ClientProofRefusal {
   constructor(code, message) {
@@ -11546,11 +11674,11 @@ function contractViolation(message) {
 }
 
 // src/server/client-proof/contract-bundle.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 init_types();
 
 // src/server/client-proof/proof.ts
-import { createHash as createHash5, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
+import { createHash as createHash6, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
 var CLIENT_PROOF_PROFILE = "clientProofV1";
 var ABSENT_BODY_SHA256 = "0".repeat(64);
 var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
@@ -11620,7 +11748,7 @@ function verifyClientProof(input, presentedProof, publicKey) {
   );
 }
 function sha256Hex(bytes) {
-  return createHash5("sha256").update(bytes).digest("hex");
+  return createHash6("sha256").update(bytes).digest("hex");
 }
 
 // src/server/client-proof/admission.ts
@@ -12483,6 +12611,46 @@ function extractOTTHeader(header) {
   return header.substring(4);
 }
 
+// src/server/middleware/ops-token-auth.ts
+import { defineMiddleware as defineMiddleware6 } from "@spfn/core/route";
+import { ForbiddenError as ForbiddenError5, UnauthorizedError as UnauthorizedError4 } from "@spfn/core/errors";
+function getOpsToken(c) {
+  return c.get("opsToken") ?? null;
+}
+var opsTokenAuth = defineMiddleware6("opsTokenAuth", async (c, next) => {
+  const token = extractBearer(c.req.header("Authorization"));
+  if (!token) {
+    throw new UnauthorizedError4({ message: "Ops token required: Authorization: Bearer <token>" });
+  }
+  const verified = await verifyOpsTokenService(token);
+  if (!verified) {
+    throw new UnauthorizedError4({ message: "Invalid ops token" });
+  }
+  c.set("opsToken", verified);
+  await next();
+}, { skips: ["auth"] });
+var requireOpsScope = defineMiddleware6(
+  "opsScope",
+  (...scopes) => async (c, next) => {
+    const token = getOpsToken(c);
+    if (!token) {
+      throw new UnauthorizedError4({ message: "Ops token required: Authorization: Bearer <token>" });
+    }
+    const granted = new Set(token.scopes);
+    const missing = scopes.filter((scope) => !granted.has(scope) && !granted.has("*"));
+    if (missing.length > 0) {
+      throw new ForbiddenError5({ message: `Ops token lacks scope: ${missing.join(", ")}` });
+    }
+    await next();
+  }
+);
+function extractBearer(header) {
+  if (!header || !header.startsWith("Bearer ")) {
+    return null;
+  }
+  return header.substring(7);
+}
+
 // src/server/routes/invitations/index.ts
 init_types();
 init_esm();
@@ -13271,7 +13439,7 @@ var oauthRouter = defineRouter4({
 
 // src/server/routes/admin/index.ts
 init_esm();
-import { ForbiddenError as ForbiddenError5 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError6 } from "@spfn/core/errors";
 import { route as route5 } from "@spfn/core/route";
 var listRoles = route5.get("/_auth/admin/roles").input({
   query: Type.Object({
@@ -13341,11 +13509,11 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
   const { params, body } = await c.data();
   const auth = getAuth(c);
   if (params.userId === Number(auth.userId)) {
-    throw new ForbiddenError5({ message: "Cannot change your own role" });
+    throw new ForbiddenError6({ message: "Cannot change your own role" });
   }
   const targetRole = await getUserRole(params.userId);
   if (targetRole === "superadmin") {
-    throw new ForbiddenError5({ message: "Cannot modify superadmin role" });
+    throw new ForbiddenError6({ message: "Cannot modify superadmin role" });
   }
   await assertCanAssignRole(auth.userId, body.roleId);
   await updateUserService(params.userId, { roleId: body.roleId });
@@ -13400,6 +13568,64 @@ var deletionRouter = defineRouter5({
   cancelAccountDeletion
 });
 
+// src/server/routes/ops-tokens/index.ts
+init_esm();
+import { route as route7 } from "@spfn/core/route";
+import { BadRequestError as BadRequestError2, NotFoundError as NotFoundError4 } from "@spfn/core/errors";
+var MAX_EXPIRY_DAYS = 36500;
+function toSummary(record) {
+  return {
+    id: Number(record.id),
+    name: record.name,
+    scopes: record.scopes,
+    expiresAt: record.expiresAt ? record.expiresAt.toISOString() : null,
+    revokedAt: record.revokedAt ? record.revokedAt.toISOString() : null,
+    lastUsedAt: record.lastUsedAt ? record.lastUsedAt.toISOString() : null,
+    createdAt: record.createdAt ? record.createdAt.toISOString() : null
+  };
+}
+var issueOpsToken = route7.post("/_auth/ops-tokens").input({
+  body: Type.Object({
+    name: Type.String({ minLength: 1, description: "Operator-facing label" }),
+    scopes: Type.Array(Type.String({ minLength: 1 }), {
+      minItems: 1,
+      description: "Scopes the token grants ('*' grants all)"
+    }),
+    expiresInDays: Type.Optional(Type.Union([
+      Type.Number({ exclusiveMinimum: 0, maximum: MAX_EXPIRY_DAYS }),
+      Type.Null()
+    ], {
+      description: `Days until expiry, up to ${MAX_EXPIRY_DAYS}; null issues a non-expiring token`
+    }))
+  })
+}).use([authenticate, requireRole("admin", "superadmin")]).handler(async (c) => {
+  const { body } = await c.data();
+  const expiresInDays = body.expiresInDays ?? null;
+  const expiresAt = expiresInDays === null ? null : new Date(Date.now() + expiresInDays * 24 * 60 * 60 * 1e3);
+  if (expiresAt && Number.isNaN(expiresAt.getTime())) {
+    throw new BadRequestError2({
+      message: `expiresInDays takes 1 to ${MAX_EXPIRY_DAYS} days, or null for no expiry.`
+    });
+  }
+  const { token, record } = await issueOpsTokenService(body.name, body.scopes, expiresAt);
+  return { token, opsToken: toSummary(record) };
+});
+var listOpsTokens = route7.get("/_auth/ops-tokens").use([authenticate, requireRole("admin", "superadmin")]).handler(async () => {
+  return { opsTokens: (await listOpsTokensService()).map(toSummary) };
+});
+var revokeOpsToken = route7.delete("/_auth/ops-tokens/:id").input({
+  params: Type.Object({
+    id: Type.Number({ description: "Ops token id" })
+  })
+}).use([authenticate, requireRole("admin", "superadmin")]).handler(async (c) => {
+  const { params } = await c.data();
+  const record = await revokeOpsTokenService(params.id);
+  if (!record) {
+    throw new NotFoundError4({ message: `No ops token with id ${params.id} to revoke.` });
+  }
+  return { opsToken: toSummary(record) };
+});
+
 // src/server/routes/index.ts
 var mainAuthRouter = defineRouter6({
   // Auth routes
@@ -13451,7 +13677,11 @@ var mainAuthRouter = defineRouter6({
   createAdminRole,
   updateAdminRole,
   deleteAdminRole,
-  updateUserRole
+  updateUserRole,
+  // Ops token routes (admin only)
+  issueOpsToken,
+  listOpsTokens,
+  revokeOpsToken
 });
 
 // src/server.ts
@@ -13827,6 +14057,7 @@ export {
   KEY_FINGERPRINT_PREFIX_LENGTH,
   KEY_PLATFORM,
   KeysRepository,
+  OpsTokensRepository,
   PURGE_STRATEGIES,
   PasswordSchema,
   PermissionsRepository,
@@ -13909,6 +14140,7 @@ export {
   getLocale,
   getOAuthProvider,
   getOneTimeTokenManager,
+  getOpsToken,
   getOptionalAuth,
   getPendingDeletionInfo,
   getRegisteredProviders,
@@ -13942,10 +14174,12 @@ export {
   isGoogleOAuthEnabled,
   isOAuthProviderEnabled,
   issueOneTimeTokenService,
+  issueOpsTokenService,
   kakaoProvider,
   keysRepository,
   listInvitations,
   listKeysService,
+  listOpsTokensService,
   loginService,
   logoutService,
   matchOAuthCsrfCookies,
@@ -13956,6 +14190,9 @@ export {
   oauthUnlinkNotifyService,
   oauthUnlinkedEvent,
   oneTimeTokenAuth,
+  opsTokenAuth,
+  opsTokens,
+  opsTokensRepository,
   optionalAuth,
   parseDuration,
   permissions,
@@ -13969,12 +14206,14 @@ export {
   requestAccountDeletionService,
   requireAnyPermission,
   requireEnabledProvider,
+  requireOpsScope,
   requirePermissions,
   requireRole,
   resendInvitation,
   resolveAuthenticatedUser,
   revokeAllKeysService,
   revokeKeyService,
+  revokeOpsTokenService,
   roleGuard,
   rolePermissions,
   rolePermissionsRepository,
@@ -14017,6 +14256,7 @@ export {
   verifyKeyFingerprint,
   verifyOAuthState,
   verifyOneTimeTokenService,
+  verifyOpsTokenService,
   verifyPassword,
   verifyToken
 };