@spfn/auth 0.3.0-beta.17 → 0.3.0-beta.19

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, r as OAuthProvider, p as VerificationPurpose, N as NewPasskey, s as Passkey, n as PermissionCategory, t as AuthContext } from './machine-principals-nrpFSvvB.js';
-export { u as ApproveDeviceAuthParams, v as AuthProfileOutcome, w as AuthProfileVerifier, x as ChangePasswordParams, y as CompletePasswordResetParams, z as CompleteSignupParams, B as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, E as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, G as DenyDeviceAuthParams, H as DeviceAuthApprovedResult, J as DeviceAuthInfoParams, D as DeviceAuthInfoResult, M as DeviceAuthPendingResult, Q as DeviceAuthPollResponseSchema, T as DeviceNameSchema, W as EmailSchema, X as FingerprintSchema, Y as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, Z as FinishPasskeyLoginParams, I as IssueOneTimeTokenResult, _ as KEY_FINGERPRINT_PREFIX_LENGTH, $ as KeyIdSchema, K as KeySummary, a0 as LoginParams, L as LoginResult, a1 as LogoutParams, a2 as MachinePrincipal, a3 as MachineVerifierRegistration, a4 as NativeVerifyOptions, a5 as NormalizedIdentity, a6 as OAuthCallbackParams, a7 as OAuthCallbackResult, a8 as OAuthCodeExchangeOptions, a9 as OAuthNativeParams, i as OAuthNativeResult, aa as OAuthStartParams, O as OAuthStartResult, ab as OAuthTokens, ac as PASSKEY_DEVICE_TYPES, ad as PASSKEY_LABEL_MAX_LENGTH, ae as PasskeyDeviceType, f as PasskeySummary, af as PasswordSchema, ag as PhoneSchema, ah as PlatformSchema, ai as PollDeviceAuthParams, aj as PollDeviceAuthResult, ak as PublicKeySchema, al as RecentAuthenticationParams, am as RegisterParams, an as RegisterPublicKeyParams, a as RegisterResult, ao as RenamePasskeyParams, ap as RequestPasswordResetParams, c as RequestPasswordResetResult, aq as RequestSignupLinkParams, b as RequestSignupLinkResult, ar as RevokeAllKeysParams, h as RevokeAllKeysResult, as as RevokeKeyParams, at as RevokePasskeyParams, au as RotateKeyParams, g as RotateKeyResult, av as SendVerificationCodeParams, S as SendVerificationCodeResult, aw as StartDeviceAuthParams, e as StartDeviceAuthResult, ax as StartPasskeyEnrollmentParams, ay as TargetTypeSchema, az as UnlinkNotification, aA as UnlinkNotifyRejection, aB as UnlinkNotifyRequest, aC as UnlinkNotifyResult, aD as UserCodeSchema, V as VERIFICATION_PURPOSES, o as VERIFICATION_TARGET_TYPES, aE as VerificationPurposeSchema, q as VerificationTargetType, aF as VerifyCodeParams, aG as VerifyCodeResult, aH as approveDeviceAuthService, aI as assertNotLastRecoveryCredential, aJ as assertRecentAuthentication, m as authRouter, aK as authenticate, aL as buildOAuthErrorUrl, aM as changePasswordService, aN as completePasswordResetService, aO as completeSignupService, aP as confirmPasswordResetService, aQ as confirmSignupLinkService, aR as denyDeviceAuthService, aS as finishPasskeyEnrollmentService, aT as finishPasskeyLoginService, aU as getDeviceAuthInfoService, aV as getEnabledOAuthProviders, aW as getGoogleAccessToken, aX as getMachinePrincipal, aY as getOAuthProvider, aZ as getRegisteredProviders, a_ as isOAuthProviderEnabled, a$ as issueOneTimeTokenService, b0 as listKeysService, b1 as listPasskeysService, b2 as loginService, b3 as logoutService, b4 as machineAuth, b5 as oauthCallbackService, b6 as oauthNativeService, b7 as oauthStartService, b8 as oauthUnlinkNotifyService, b9 as optionalAuth, ba as passkeys, bb as pollDeviceAuthService, bc as registerAuthProfile, bd as registerMachineVerifier, be as registerOAuthProvider, bf as registerPublicKeyService, bg as registerService, bh as renamePasskeyService, bi as requestPasswordResetService, bj as requestSignupLinkService, bk as requireEnabledProvider, bl as requireMachineScope, bm as resolveAuthenticatedUser, bn as revokeAllKeysService, bo as revokeKeyService, bp as revokePasskeyService, bq as rotateKeyService, br as runAuthProfile, bs as selectAuthProfile, bt as sendVerificationCodeService, bu as startDeviceAuthService, bv as startPasskeyEnrollmentService, bw as startPasskeyLoginService, bx as verifyCodeService, by as verifyOneTimeTokenService } from './machine-principals-nrpFSvvB.js';
+import { A as AuthInitOptions, u as OAuthProvider, s as VerificationPurpose, N as NewPasskey, v as Passkey, q as PermissionCategory, w as AuthContext } from './machine-principals-BD4tnASp.js';
+export { x as ApproveDeviceAuthParams, y as AuthProfileOutcome, z as AuthProfileVerifier, B as ChangePasswordParams, E as CompletePasswordResetParams, G as CompleteSignupParams, H as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, J as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, M as DenyDeviceAuthParams, Q as DeviceAuthApprovedResult, T as DeviceAuthInfoParams, D as DeviceAuthInfoResult, W as DeviceAuthPendingResult, X as DeviceAuthPollResponseSchema, Y as DeviceNameSchema, Z as EmailSchema, _ as FingerprintSchema, $ as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, a0 as FinishPasskeyLoginParams, I as IssueOneTimeTokenResult, a1 as KEY_FINGERPRINT_PREFIX_LENGTH, a2 as KeyIdSchema, K as KeySummary, a3 as LoginParams, L as LoginResult, a4 as LogoutParams, a5 as MachinePrincipal, a6 as MachineVerifierRegistration, a7 as NativeVerifyOptions, a8 as NormalizedIdentity, l as OAuth2AuthorizationCodeIssued, a9 as OAuth2AuthorizeParams, k as OAuth2ConsentView, n as OAuth2GrantSummary, aa as OAuth2ScopeDescription, ab as OAuthCallbackParams, ac as OAuthCallbackResult, ad as OAuthCodeExchangeOptions, ae as OAuthNativeParams, i as OAuthNativeResult, af as OAuthStartParams, O as OAuthStartResult, ag as OAuthTokens, ah as PASSKEY_DEVICE_TYPES, ai as PASSKEY_LABEL_MAX_LENGTH, aj as PasskeyDeviceType, f as PasskeySummary, ak as PasswordSchema, al as PhoneSchema, am as PlatformSchema, an as PollDeviceAuthParams, ao as PollDeviceAuthResult, ap as PublicKeySchema, aq as RecentAuthenticationParams, ar as RegisterParams, as as RegisterPublicKeyParams, a as RegisterResult, at as RenamePasskeyParams, au as RequestPasswordResetParams, c as RequestPasswordResetResult, av as RequestSignupLinkParams, b as RequestSignupLinkResult, aw as RevokeAllKeysParams, h as RevokeAllKeysResult, ax as RevokeKeyParams, ay as RevokePasskeyParams, az as RotateKeyParams, g as RotateKeyResult, aA as SendVerificationCodeParams, S as SendVerificationCodeResult, aB as StartDeviceAuthParams, e as StartDeviceAuthResult, aC as StartPasskeyEnrollmentParams, aD as TargetTypeSchema, aE as UnlinkNotification, aF as UnlinkNotifyRejection, aG as UnlinkNotifyRequest, aH as UnlinkNotifyResult, aI as UserCodeSchema, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, aJ as VerificationPurposeSchema, t as VerificationTargetType, aK as VerifyCodeParams, aL as VerifyCodeResult, aM as approveDeviceAuthService, aN as approveOAuth2AuthorizeService, aO as assertNotLastRecoveryCredential, aP as assertRecentAuthentication, m as authRouter, aQ as authenticate, aR as buildOAuthErrorUrl, aS as changePasswordService, aT as completePasswordResetService, aU as completeSignupService, aV as confirmPasswordResetService, aW as confirmSignupLinkService, aX as denyDeviceAuthService, aY as denyOAuth2AuthorizeService, aZ as describeOAuth2AuthorizeRequestService, a_ as finishPasskeyEnrollmentService, a$ as finishPasskeyLoginService, b0 as getDeviceAuthInfoService, b1 as getEnabledOAuthProviders, b2 as getGoogleAccessToken, b3 as getMachinePrincipal, b4 as getOAuthProvider, b5 as getRegisteredProviders, b6 as isOAuthProviderEnabled, b7 as issueOneTimeTokenService, b8 as listKeysService, b9 as listOAuth2GrantsService, ba as listPasskeysService, bb as loginService, bc as logoutService, bd as machineAuth, be as oauthCallbackService, bf as oauthNativeService, bg as oauthStartService, bh as oauthUnlinkNotifyService, bi as optionalAuth, bj as passkeys, bk as pollDeviceAuthService, bl as registerAuthProfile, bm as registerMachineVerifier, bn as registerOAuthProvider, bo as registerPublicKeyService, bp as registerService, bq as renamePasskeyService, br as requestPasswordResetService, bs as requestSignupLinkService, bt as requireEnabledProvider, bu as requireMachineScope, bv as resolveAuthenticatedUser, bw as revokeAllKeysService, bx as revokeAllOAuth2GrantsForUser, by as revokeKeyService, bz as revokeOAuth2GrantService, bA as revokePasskeyService, bB as rotateKeyService, bC as runAuthProfile, bD as selectAuthProfile, bE as sendVerificationCodeService, bF as startDeviceAuthService, bG as startPasskeyEnrollmentService, bH as startPasskeyLoginService, bI as verifyCodeService, bJ as verifyOneTimeTokenService } from './machine-principals-BD4tnASp.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -2478,6 +2478,227 @@ declare function verifyOpsTokenService(token: string): Promise<VerifiedOpsToken
 declare function revokeOpsTokenService(id: number): Promise<OpsToken | null>;
 declare function listOpsTokensService(): Promise<OpsToken[]>;
 
+/**
+ * OAuth 2.1 Client Service
+ *
+ * RFC 7591 dynamic client registration, for public clients and nothing else.
+ * `claude mcp add` and `codex mcp add` both begin here: the CLI discovers the
+ * authorization server, registers itself unauthenticated, and gets back a
+ * `client_id` it keeps on the user's disk.
+ *
+ * Unauthenticated registration means the table is a place anyone can write, so
+ * two things bound it. The route rate-limits by IP, and this service caps how
+ * many clients one IP may have standing that nobody has approved — a rate limit
+ * alone would let an IP accumulate rows forever at a slow enough pace, because a
+ * row costs nothing to make and lives until a job sweeps it. The cap looks back
+ * an hour rather than over all time: it is a bound on how much junk one address
+ * may have standing at once, not a lifetime quota on how many CLIs somebody may
+ * ever connect.
+ *
+ * Every refusal here is RFC 7591 §3.2.2 shaped (`invalid_redirect_uri`,
+ * `invalid_client_metadata`) rather than thrown, because the client reading it
+ * is an OAuth client library that knows those two words and not this
+ * application's error envelope. The route renders the shape; this decides it.
+ */
+/**
+ * How many unapproved clients one IP may have standing.
+ *
+ * Generous against real use — a developer registering the same CLI on four
+ * projects in an afternoon, each abandoned at the consent screen, is nowhere
+ * near it — and small enough that the table cannot be filled from one address
+ * between two sweeps of the purge job.
+ */
+declare const MAX_UNGRANTED_CLIENTS_PER_IP = 20;
+/** How long a client nobody approved is kept before the purge job deletes it. */
+declare const STALE_CLIENT_MAX_AGE_MS: number;
+/** The only grant types this authorization server issues. */
+declare const SUPPORTED_GRANT_TYPES: string[];
+/** The only response type. There is no implicit flow here. */
+declare const SUPPORTED_RESPONSE_TYPES: string[];
+/** Registration metadata as RFC 7591 names it, before anything is trusted. */
+interface OAuth2RegisterRequest {
+    redirect_uris?: unknown;
+    client_name?: unknown;
+    token_endpoint_auth_method?: unknown;
+    grant_types?: unknown;
+    response_types?: unknown;
+}
+/** RFC 7591 §3.2.1 registration response. */
+interface OAuth2RegisteredClient {
+    client_id: string;
+    client_id_issued_at: number;
+    client_name: string;
+    redirect_uris: string[];
+    token_endpoint_auth_method: string;
+    grant_types: string[];
+    response_types: string[];
+}
+/** A refusal in the shape the client's own OAuth library will read. */
+interface OAuth2RegisterRefusal {
+    ok: false;
+    status: 400 | 429;
+    error: string;
+    description: string;
+}
+type OAuth2RegisterResult = {
+    ok: true;
+    client: OAuth2RegisteredClient;
+} | OAuth2RegisterRefusal;
+/**
+ * Register a public client.
+ *
+ * @param request - Metadata exactly as it arrived; nothing here is trusted
+ * @param clientIp - Client IP for the standing cap, or null when unknowable
+ */
+declare function registerOAuth2ClientService(request: OAuth2RegisterRequest, clientIp: string | null): Promise<OAuth2RegisterResult>;
+/**
+ * Delete clients nobody approved within a day — the `auth.oauth2.client-purge`
+ * sweep.
+ *
+ * @returns how many rows the sweep removed
+ */
+declare function purgeStaleOAuth2ClientsService(): Promise<{
+    deleted: number;
+}>;
+
+/**
+ * OAuth 2.1 Token Service
+ *
+ * The token endpoint's two grant types, and RFC 7009 revocation.
+ *
+ * Every failure on this endpoint answers `invalid_grant` — an unknown code, a
+ * spent one, an expired one, a mismatched verifier, a code minted for another
+ * client, a refresh token that never existed, one that was rotated away. That is
+ * not laziness with error messages: the endpoint is public and unauthenticated,
+ * and an error that distinguished "this code does not exist" from "this code
+ * exists but is not yours" would answer the question an attacker holding a
+ * stolen value is actually asking. `invalid_target` and `invalid_scope` are the
+ * two exceptions, and both are decided from values the caller already knows.
+ *
+ * Nothing is spent or revoked before the presenter has shown it is the client the
+ * credential belongs to. On the code path that means `client_id`, `redirect_uri`
+ * and the PKCE verifier are all checked against the row before the code is
+ * consumed — a caller that cannot satisfy them leaves the code unspent for the
+ * real client and the grant untouched, because it has proved nothing about
+ * itself and must therefore cost nobody anything.
+ *
+ * Two replays are detected rather than merely refused, and both revoke the whole
+ * grant:
+ *
+ * - A code presented twice. The first exchange already produced tokens; if the
+ *   second presentation is the real client, somebody else holds those tokens.
+ * - A rotated refresh token presented again. Same reasoning, and it is why a
+ *   rotated row is marked rather than deleted — a deleted row is
+ *   indistinguishable from one that never existed.
+ *
+ * Revoking the grant kills the replacement tokens too, which is the point: the
+ * thief's pair and the client's pair both hang off the grant, and there is no
+ * way to tell which is which.
+ */
+/** A token request as RFC 6749 names its fields, before anything is trusted. */
+interface OAuth2TokenRequest {
+    grant_type?: string;
+    code?: string;
+    code_verifier?: string;
+    client_id?: string;
+    redirect_uri?: string;
+    refresh_token?: string;
+    resource?: string;
+    scope?: string;
+}
+/** RFC 6749 §5.1, with `scope` always stated so a narrowed request is legible. */
+interface OAuth2TokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+}
+/** RFC 6749 §5.2: the code, and a sentence for whoever is reading the logs. */
+interface OAuth2TokenRefusal {
+    ok: false;
+    error: string;
+    description: string;
+}
+type OAuth2TokenResult = {
+    ok: true;
+    tokens: OAuth2TokenResponse;
+} | OAuth2TokenRefusal;
+/**
+ * Exchange a code or refresh a token.
+ *
+ * @param request - The form or JSON body, exactly as it arrived
+ */
+declare function oauth2TokenService(request: OAuth2TokenRequest): Promise<OAuth2TokenResult>;
+/**
+ * Revoke a presented token.
+ *
+ * Answers nothing, ever. RFC 7009 §2.2 requires 200 for a token that was never
+ * issued as well as for one that was, so a caller cannot use this endpoint to
+ * ask whether a value it found somewhere is real.
+ *
+ * A refresh token takes the grant with it: a client presenting its refresh token
+ * here is saying it is finished, and leaving that grant's access tokens alive
+ * for eight more hours would be honouring half the request. An access token is
+ * revoked alone — a client may be discarding one it no longer needs while still
+ * holding the connection.
+ *
+ * A `client_id` that is not the token's is the same 200 and revokes nothing
+ * (RFC 7009 §2.1). The endpoint has no client authentication to lean on, so this
+ * does not stop anybody who holds the token from revoking it — what it stops is
+ * one client tearing down another's connection by presenting a value it came
+ * across, which is the only thing a public client's id can be asked to mean.
+ * Which is also why it is required and not optional: RFC 7009 §2.1 has the
+ * client authenticate per RFC 6749 §2.3, and §2.3.1 says a public client with no
+ * credentials identifies itself with `client_id`. The route refuses a request
+ * that carries none before this is called.
+ *
+ * @param token - The value to revoke, access or refresh
+ * @param clientId - Checked against the token's client
+ */
+declare function revokeOAuth2TokenService(token: string, clientId: string): Promise<void>;
+
+/**
+ * OAuth 2.1 Access Token Verification
+ *
+ * `verifyAccessToken` is what `@spfn/mcp` calls on every request to `/mcp`. It
+ * is the one function in this feature an application wires up by hand:
+ *
+ * ```typescript
+ * createMcpRoute({ validateToken: verifyAccessToken })
+ * ```
+ *
+ * Null for every refusal, and the same null for all of them — unknown, revoked,
+ * expired, refresh-kind, grant revoked, wrong resource. The non-disclosure rule
+ * `verifyOpsTokenService` keeps, for the same reason: this is a public endpoint
+ * and the refusal must not tell a caller whether the value it presented was ever
+ * real.
+ *
+ * The resource check is not a formality. An access token minted for one API is
+ * refused by another (RFC 8707), so a token a user approved for their MCP server
+ * cannot be replayed against a neighbouring deployment that happens to share this
+ * authorization server.
+ */
+/** What a verified access token authorizes. */
+interface VerifiedOAuth2AccessToken {
+    /** The public `client_id` of the CLI holding the token. */
+    clientId: string;
+    /** Scope names, as granted or as the refresh that minted it narrowed them to. */
+    scopes: string[];
+    /** Expiry as seconds since the epoch — the unit every OAuth field uses. */
+    expiresAt: number;
+    /** The account the CLI is acting for. */
+    userId: string;
+}
+/**
+ * Verify a bearer token presented to a protected resource.
+ *
+ * @param token - The raw bearer value
+ * @param resource - The resource being accessed, e.g. `https://api.example.com/mcp`
+ * @returns the principal, or null for any reason at all
+ */
+declare function verifyAccessToken(token: string, resource: string): Promise<VerifiedOAuth2AccessToken | null>;
+
 /**
  * @spfn/auth - Database Schema Definition
  *
@@ -4514,13 +4735,614 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        permissionId: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        permissionId: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "role_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type RolePermission = typeof rolePermissions.$inferSelect;
+type NewRolePermission = typeof rolePermissions.$inferInsert;
+
+/**
+ * @spfn/auth - User-Permissions Override Entity
+ *
+ * Per-user permission grants/revocations
+ *
+ * Features:
+ * - Grant additional permissions to specific users
+ * - Revoke role-inherited permissions from specific users
+ * - Temporary permissions with expiration
+ * - Audit trail with reason field
+ *
+ * Priority:
+ * User permissions override role permissions
+ */
+declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_permissions";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        permissionId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        granted: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        reason: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type UserPermission = typeof userPermissions.$inferSelect;
+type NewUserPermission = typeof userPermissions.$inferInsert;
+
+/**
+ * @spfn/auth - OAuth 2.1 Clients Entity
+ *
+ * One row per public client that registered itself through RFC 7591 dynamic
+ * client registration — a `claude mcp add` on somebody's laptop, a `codex`
+ * install, a second copy of either on the same machine. There is no secret
+ * column because there is no secret: these clients run on the user's own
+ * device, cannot keep one, and authenticate with `token_endpoint_auth_method:
+ * "none"` plus PKCE.
+ *
+ * `oauth2_` and not `oauth_`: the `oauth` prefix in this package belongs to the
+ * social-login client we are on the other side of (Google, Kakao). Everything
+ * named `oauth2` here is the authorization server we run.
+ *
+ * Registration is unauthenticated by definition, so a row here is nothing but a
+ * claim until a user approves it. `auth.oauth2.client-purge` deletes the rows
+ * that never were: a client older than a day with no grant against it.
+ */
+declare const oauth2Clients: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_clients";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        clientId: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        clientName: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        redirectUris: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        createdIp: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OAuth2Client = typeof oauth2Clients.$inferSelect;
+type NewOAuth2Client = typeof oauth2Clients.$inferInsert;
+
+/**
+ * @spfn/auth - OAuth 2.1 Grants Entity
+ *
+ * What a user actually consented to: this client, for this resource, with these
+ * scopes. Codes and tokens all hang off a grant, so it is the one row that has
+ * to be revoked to cut a CLI off — `GET /_auth/oauth2/grants` lists them and
+ * `DELETE /_auth/oauth2/grants/:id` is the button.
+ *
+ * One row per (client, user, resource). Re-consenting updates `scopes` rather
+ * than adding a second row, so a user who widens a CLI's access sees one entry
+ * for it and not a pile of them, and revoking that entry revokes everything the
+ * client holds.
+ *
+ * A global revocation — revoke-all, a password change, a password reset, a
+ * deletion request — revokes every grant the user has, for the reason device
+ * codes are refused in the same breath: a live grant still has a refresh token
+ * against it, and "sign me out everywhere" that leaves one alive has not.
+ */
+declare const oauth2Grants: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_grants";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        client: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        resource: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OAuth2Grant = typeof oauth2Grants.$inferSelect;
+type NewOAuth2Grant = typeof oauth2Grants.$inferInsert;
+
+/**
+ * @spfn/auth - OAuth 2.1 Authorization Codes Entity
+ *
+ * The 60-second, single-use ticket the consent screen hands back through the
+ * client's own loopback listener, exchanged at the token endpoint for tokens.
+ *
+ * Only the SHA-256 hash is stored, as with device codes, ops tokens and signup
+ * links: a dump of this table must not let its reader finish somebody's
+ * authorization. The unique constraint on the hash doubles as the lookup index.
+ *
+ * `usedAt` is written by the same statement that reads the row, so of two token
+ * requests arriving together exactly one gets tokens. A code presented twice is
+ * the signature of a stolen code, and the second presentation revokes the whole
+ * grant rather than merely refusing — by then the thief may already hold what
+ * the first exchange produced.
+ */
+declare const oauth2AuthorizationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_authorization_codes";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        codeHash: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        grant: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        redirectUri: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        codeChallenge: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        usedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "role_permissions";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4532,30 +5354,44 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type RolePermission = typeof rolePermissions.$inferSelect;
-type NewRolePermission = typeof rolePermissions.$inferInsert;
+type OAuth2AuthorizationCode = typeof oauth2AuthorizationCodes.$inferSelect;
+type NewOAuth2AuthorizationCode = typeof oauth2AuthorizationCodes.$inferInsert;
 
 /**
- * @spfn/auth - User-Permissions Override Entity
+ * @spfn/auth - OAuth 2.1 Tokens Entity
  *
- * Per-user permission grants/revocations
+ * Access and refresh tokens alike, one row each, distinguished by `kind`. Both
+ * are opaque — `spfn_at_<64 hex>` and `spfn_rt_<64 hex>` — because whatever
+ * verifies them is in the same process as this table, which is the same reason
+ * ops tokens, device codes and signup links are opaque. A JWT would buy
+ * stateless verification and pay for it by making revocation take effect only
+ * at expiry, and revocation here is a button the user presses.
  *
- * Features:
- * - Grant additional permissions to specific users
- * - Revoke role-inherited permissions from specific users
- * - Temporary permissions with expiration
- * - Audit trail with reason field
+ * Only the SHA-256 hash is stored. The value exists in the clear exactly once,
+ * in the token response.
  *
- * Priority:
- * User permissions override role permissions
+ * `replacedAt` is what makes refresh rotation detectable: a rotated refresh is
+ * not deleted, it is marked, so presenting it again is distinguishable from
+ * presenting one that never existed. That presentation means the token leaked —
+ * either the client or the thief is replaying — and the answer is to revoke the
+ * grant, which kills the replacement as well.
  */
-declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_permissions";
+/**
+ * Which half of the pair a row is.
+ *
+ * One table rather than two: every rule that matters — revoked, expired, whose
+ * grant, which scopes — is the same for both, and a single `kind` column keeps
+ * "revoke everything under this grant" one statement.
+ */
+declare const OAUTH2_TOKEN_KINDS: readonly ["access", "refresh"];
+type OAuth2TokenKind = typeof OAUTH2_TOKEN_KINDS[number];
+declare const oauth2Tokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_tokens";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "user_permissions";
+            tableName: "oauth2_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4568,9 +5404,9 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "user_permissions";
+            tableName: "oauth2_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4583,9 +5419,9 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "user_permissions";
+            tableName: "oauth2_tokens";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -4598,12 +5434,12 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
+            tableName: "oauth2_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -4613,9 +5449,24 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        permissionId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        kind: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["access", "refresh"] & [string, ...string[]]>>, {
             name: string;
-            tableName: "user_permissions";
+            tableName: "oauth2_tokens";
+            dataType: "string enum";
+            data: "access" | "refresh";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["access", "refresh"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        grant: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_tokens";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
@@ -4628,14 +5479,14 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        granted: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        scopes: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
+            tableName: "oauth2_tokens";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -4643,11 +5494,26 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        reason: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "string";
-            data: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -4658,9 +5524,24 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTimestampBuilder, {
+        replacedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_permissions";
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4676,8 +5557,8 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type UserPermission = typeof userPermissions.$inferSelect;
-type NewUserPermission = typeof userPermissions.$inferInsert;
+type OAuth2Token = typeof oauth2Tokens.$inferSelect;
+type NewOAuth2Token = typeof oauth2Tokens.$inferInsert;
 
 /**
  * @spfn/auth - Auth Metadata Entity
@@ -7369,6 +8250,242 @@ declare class OpsTokensRepository extends BaseRepository {
 }
 declare const opsTokensRepository: OpsTokensRepository;
 
+/**
+ * OAuth 2.1 Clients Repository
+ *
+ * Data access for dynamically registered public clients. Extends BaseRepository
+ * for transaction context and read/write splitting like every other auth
+ * repository.
+ */
+
+declare class OAuth2ClientsRepository extends BaseRepository {
+    create(data: NewOAuth2Client): Promise<OAuth2Client>;
+    /**
+     * Lookup by the public `client_id` — the authorize and token paths.
+     *
+     * Reads the primary, not the replica, for the reason the ops-token lookup
+     * does: a client registered a moment ago is immediately used, and a replica
+     * read would answer "unknown client" for the length of the replication lag,
+     * at the one moment a CLI is being connected.
+     */
+    findByClientId(clientId: string): Promise<OAuth2Client | null>;
+    /** Fire-and-forget from the token-issuing path. */
+    updateLastUsedById(id: number): Promise<void>;
+    /**
+     * Register a client unless this address is already at its standing cap.
+     *
+     * The count and the insert are one transaction whose first statement takes
+     * an advisory lock on the address, and all three parts are load-bearing.
+     * Counting on the replica lets replication lag hand out slots that are
+     * already taken. Counting and inserting in two statements lets a second
+     * registration read the same total between them. And a transaction alone
+     * does not close that: under READ COMMITTED each concurrent transaction
+     * counts the rows the others have not committed yet, so twenty requests
+     * arriving together all see zero. The lock is the only part that makes the
+     * cap a number rather than an average, and it is per address, so it costs
+     * nobody else anything.
+     *
+     * @param data - The row to write when there is room for it
+     * @param limit - The address, its cap, and how far back the cap looks
+     * @returns the registered client, or null when the address is at its cap
+     */
+    createWithinStandingCap(data: NewOAuth2Client, limit: {
+        ip: string;
+        max: number;
+        windowMs: number;
+    }): Promise<OAuth2Client | null>;
+    /**
+     * How many clients this IP registered within the window that nobody has
+     * approved yet.
+     *
+     * The window is what makes this a standing-population cap rather than a
+     * permanent quota. Rows are only freed by the purge job, which sweeps once
+     * a day against a 24-hour threshold — so without a window a row registered
+     * a minute after one sweep holds its slot for nearly two days, and twenty
+     * developers behind one NAT lock their whole office out of registering.
+     * A grant against the client takes it out of the count at any age: a client
+     * somebody approved is not junk.
+     *
+     * Reads the primary, inside the caller's transaction, for the reason
+     * `findByClientId` does — a row written a moment ago is exactly the row this
+     * count exists to see.
+     */
+    private countRecentUngrantedByIp;
+    /**
+     * Delete clients older than `before` that no user ever approved.
+     *
+     * A registration is an unauthenticated write, so the table fills with rows
+     * from installs that were abandoned at the consent screen. A row with a
+     * grant against it is never touched, whatever its age — that is somebody's
+     * connected CLI.
+     *
+     * @returns how many rows this sweep removed
+     */
+    deleteStaleUngranted(before: Date): Promise<number>;
+}
+declare const oauth2ClientsRepository: OAuth2ClientsRepository;
+
+/**
+ * OAuth 2.1 Grants Repository
+ *
+ * Data access for the consent records every code and token hangs off.
+ *
+ * Revocation is the operation that matters here, and it is always one statement
+ * per table rather than a read-then-write: a grant being revoked at the same
+ * moment as a refresh rotation must not let the rotation's successor survive,
+ * and `where revoked_at is null` in the UPDATE is what makes the two orderings
+ * produce the same end state.
+ */
+
+/** A grant with the client it belongs to — what every list and lookup needs. */
+interface OAuth2GrantWithClient {
+    grant: OAuth2Grant;
+    client: OAuth2Client;
+}
+declare class OAuth2GrantsRepository extends BaseRepository {
+    /**
+     * Record a consent, or refresh the scopes of the one already there.
+     *
+     * Re-consenting is an upsert and not an insert: the unique index on
+     * (client, user, resource) says one consent per triple, and a user who
+     * approves a wider scope set is amending the consent they already gave, not
+     * giving a second one. Revoking the entry they can see must revoke
+     * everything the client holds, which a second row would break.
+     *
+     * `revokedAt: null` in the update is deliberate — approving again after
+     * revoking is how a user reconnects a CLI they cut off.
+     */
+    upsert(data: NewOAuth2Grant): Promise<OAuth2Grant>;
+    /**
+     * A grant and its client in one read — the shape the token and verification
+     * paths need, since both have to check the client the caller claims and the
+     * grant's revocation at once.
+     *
+     * Read primary: revocation is documented as taking effect immediately.
+     */
+    findWithClientById(id: number): Promise<OAuth2GrantWithClient | null>;
+    /** What the user's "connected apps" screen lists. Read replica. */
+    listActiveByUserId(userId: number): Promise<OAuth2GrantWithClient[]>;
+    /**
+     * Revoke one live grant belonging to one user.
+     *
+     * The user id is part of the condition rather than checked beforehand: the
+     * id in the URL comes from a caller, and a grant that is not theirs must not
+     * be revocable by guessing a number. A miss is indistinguishable from an id
+     * that does not exist, which is the answer the route gives.
+     *
+     * @returns the revoked row, or null if there was no live grant of that id
+     *          for that user
+     */
+    revokeByIdForUser(id: number, userId: number): Promise<OAuth2Grant | null>;
+    /** Revoke one grant by id, whoever it belongs to — the replay detections. */
+    revokeById(id: number): Promise<OAuth2Grant | null>;
+    /**
+     * Revoke every live grant a user has — the authorization-server half of a
+     * global revocation, beside `denyAllActiveByUserId`.
+     *
+     * @returns the grant ids this call revoked
+     */
+    revokeAllActiveByUserId(userId: number): Promise<number[]>;
+    /**
+     * Revoke every live token under the given grants.
+     *
+     * Verification already refuses a token whose grant is revoked, so this is
+     * belt and braces — but the belt is what a `SELECT` against this table shows
+     * an operator, and a live-looking row under a dead grant reads as a hole.
+     *
+     * @returns how many tokens this call revoked
+     */
+    revokeTokensOfGrants(grantIds: number[]): Promise<number>;
+}
+declare const oauth2GrantsRepository: OAuth2GrantsRepository;
+
+/**
+ * OAuth 2.1 Authorization Codes Repository
+ *
+ * Two operations and one of them is the whole point. `consume` is a conditional
+ * UPDATE that names unspent and not-expired and writes `used_at` in the same
+ * statement that reads the row, so of two token requests racing on one code
+ * exactly one comes back with a row. Read-then-write would hand both of them
+ * tokens.
+ *
+ * The TTL travels in that statement as `now()` evaluated by the database, for
+ * the reason the device-code transitions carry theirs: the row is judged by the
+ * same clock that stores it, so an app server whose clock drifted cannot extend
+ * a code's life.
+ *
+ * `findByCodeHash` exists only to explain a miss. A code that is simply unknown
+ * and one that was already spent get the same answer at the endpoint —
+ * `invalid_grant` either way — but the spent one also revokes the grant, and
+ * that decision needs the row.
+ */
+
+declare class OAuth2AuthorizationCodesRepository extends BaseRepository {
+    create(data: NewOAuth2AuthorizationCode): Promise<OAuth2AuthorizationCode>;
+    /**
+     * Spend a code, addressed by the hash the caller actually presented.
+     *
+     * @returns the row this call spent, or null when it was unknown, already
+     *          spent, or past its 60 seconds
+     */
+    consume(codeHash: string): Promise<OAuth2AuthorizationCode | null>;
+    /**
+     * The row behind a miss, in any state. Deliberately unfiltered — which
+     * refusal is owed is the service's decision, and a row filtered out here
+     * would be indistinguishable from a code that never existed.
+     */
+    findByCodeHash(codeHash: string): Promise<OAuth2AuthorizationCode | null>;
+}
+declare const oauth2AuthorizationCodesRepository: OAuth2AuthorizationCodesRepository;
+
+/**
+ * OAuth 2.1 Tokens Repository
+ *
+ * Access and refresh rows, and the rotation that turns one refresh into the
+ * next.
+ *
+ * `rotate` is the code-consuming statement again, in the other table: mark the
+ * presented refresh `replaced_at` only if it is live, and return it only when
+ * THIS call was the one that marked it. Two clients refreshing the same token at
+ * once therefore produce one rotation and one refusal, instead of two token
+ * pairs off one refresh.
+ *
+ * Nothing is deleted. A rotated refresh keeps its row so that presenting it
+ * again is distinguishable from presenting a token that never existed, which is
+ * the entire reuse detection.
+ */
+
+declare class OAuth2TokensRepository extends BaseRepository {
+    create(data: NewOAuth2Token): Promise<OAuth2Token>;
+    /**
+     * Lookup by the token's hash — the verification and refresh paths.
+     *
+     * Primary, not replica: revocation is a button the user presses and is
+     * documented as taking effect immediately, so a replica read would keep
+     * authenticating a revoked token for the length of the replication lag.
+     * Unfiltered, so the service can tell revoked from expired from unknown.
+     */
+    findByTokenHash(tokenHash: string): Promise<OAuth2Token | null>;
+    /**
+     * Mark a live refresh token as replaced, addressed by its hash.
+     *
+     * @returns the row this call replaced, or null when it was unknown, already
+     *          rotated, revoked, or expired
+     */
+    rotate(tokenHash: string): Promise<OAuth2Token | null>;
+    /**
+     * Revoke a live token by hash — RFC 7009.
+     *
+     * @returns the revoked row, or null when there was nothing live to revoke.
+     *          The endpoint answers 200 either way; the caller learns nothing
+     *          about whether the value it presented ever existed.
+     */
+    revokeByTokenHash(tokenHash: string): Promise<OAuth2Token | null>;
+    /** Fire-and-forget from the verification path, as ops tokens do. */
+    updateLastUsedById(id: number): Promise<void>;
+}
+declare const oauth2TokensRepository: OAuth2TokensRepository;
+
 /**
  * @spfn/auth - Email address normalization
  *
@@ -8080,6 +9197,273 @@ declare function deriveCsrfToken(keyId: string): Promise<string>;
  */
 declare function matchesCsrfToken(expected: string, presented: string | null | undefined): boolean;
 
+/**
+ * OAuth 2.1 Authorization Server Configuration
+ *
+ * Singleton config, mirroring `lib/device-auth-config.ts`: a mutable
+ * module-level value, set once from `createAuthLifecycle()` and read at request
+ * time.
+ *
+ * Unlike the device-auth block this one has no defaults to fall back on, and
+ * that is the feature: an application that does not pass `authorizationServer`
+ * is not running an authorization server, and every route under
+ * `/_auth/oauth2/*` answers 404 for it. Nothing here can be derived — the scope
+ * names are the application's vocabulary, and inventing a set would publish
+ * scopes in the metadata document that nothing honours.
+ */
+/**
+ * Everything the authorization server needs, resolved.
+ *
+ * `issuer` and `authorizeUrl` are absolute; the defaults are derived here, once,
+ * rather than at each use — the metadata document publishes them and a client
+ * that read one value must not meet another on the next request.
+ */
+interface AuthorizationServerConfig {
+    /** Origin the tokens are issued by, no path. `SPFN_API_URL` by default. */
+    issuer: string;
+    /**
+     * Where `issuer` came from — the option name or the variable name — so the
+     * boot refusal can tell an operator which one to edit.
+     */
+    issuerSource: string;
+    /** Consent screen, on the web app: `${appUrl}/oauth/authorize` by default. */
+    authorizeUrl: string;
+    /** Scope name to the one-line description the consent screen shows. */
+    scopes: Record<string, string>;
+    /** What an authorize request with no `scope` asks for. All of them by default. */
+    defaultScopes: string[];
+    /** `https://` origins a client may register a redirect URI on. Loopback needs no entry. */
+    allowedRedirectOrigins: string[];
+    accessTokenTtlMs: number;
+    refreshTokenTtlMs: number;
+    codeTtlMs: number;
+}
+/** Options as an application writes them. Everything but `scopes` has a default. */
+interface AuthorizationServerOptions {
+    issuer?: string;
+    authorizeUrl?: string;
+    scopes: Record<string, string>;
+    defaultScopes?: string[];
+    allowedRedirectOrigins?: string[];
+    accessTokenTtlMs?: number;
+    refreshTokenTtlMs?: number;
+    codeTtlMs?: number;
+}
+/** Eight hours. Long enough for a working session, short enough to matter. */
+declare const DEFAULT_ACCESS_TOKEN_TTL_MS: number;
+/** Thirty days. The CLI is expected to be reconnected about that often. */
+declare const DEFAULT_REFRESH_TOKEN_TTL_MS: number;
+/** Sixty seconds — the code travels from a browser redirect to a local listener. */
+declare const DEFAULT_CODE_TTL_MS: number;
+/** Path the consent screen is served at on the web app. */
+declare const AUTHORIZE_PATH = "/oauth/authorize";
+/** The API origin every default is derived from, and the boot check's subject. */
+declare function resolveIssuerSource(env?: Record<string, string | undefined>): {
+    value: string | undefined;
+    variable: string;
+};
+/**
+ * Resolve the authorization server config, or clear it when the application
+ * passed none. Called synchronously from `createAuthLifecycle()` for the reason
+ * `configureDeviceAuth` is: nothing may serve a request under half a config.
+ *
+ * The issuer is reduced to the form this server publishes here, where every
+ * other default is resolved, so the config is publishable in exactly one state
+ * whether or not a lifecycle hook has run. It is not *validated* here: a value
+ * this cannot reduce is stored as the operator wrote it and refused by
+ * `assertAuthorizationServerIssuer` from `afterInfrastructure`, where a throw
+ * exits the process instead of leaving a server listening without routes. See
+ * `lifecycle.ts`.
+ */
+declare function configureAuthorizationServer(options?: AuthorizationServerOptions, env?: Record<string, string | undefined>): void;
+/**
+ * The resolved config, or null when this application runs no authorization
+ * server. Every route under `/_auth/oauth2/*` reads it and answers 404 on null.
+ */
+declare function getAuthorizationServerConfig(): AuthorizationServerConfig | null;
+/**
+ * `localhost`, `127.0.0.1` and `[::1]` — the hosts a browser treats as a secure
+ * context over plain http, which is why the issuer may be `http://` on them and
+ * nowhere else. `URL.hostname` normalises every IPv6 spelling to `[::1]`.
+ */
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Refuse boot on an issuer no client could use.
+ *
+ * `.well-known/*` lives at an origin's root, so an issuer carrying a path has no
+ * place to publish its metadata and every discovery request 404s. An issuer that
+ * is neither https nor loopback http means tokens crossing the network in the
+ * clear. Both are configuration drift between environments, so the deploy that
+ * introduces them is where they have to surface — the posture, the place and the
+ * voice of `assertOAuthRedirectUris`, one door down.
+ *
+ * This only asserts. `configureAuthorizationServer` reduced the value it reads
+ * if it could, so anything reaching here that is not an origin is one the
+ * reduction deliberately left alone.
+ *
+ * Silent when no authorization server is configured: an application that does
+ * not run one must boot exactly as it did before this feature existed.
+ *
+ * @throws When the resolved issuer cannot be honoured. The message names the
+ *         variable or the option the value came from.
+ */
+declare function assertAuthorizationServerIssuer(): void;
+
+/**
+ * OAuth 2.1 redirect URI rules
+ *
+ * Two jobs, and they are not the same job. Registration decides whether a URI
+ * may be written down at all; matching decides whether the URI on an authorize
+ * request is one that was. Registration is where policy lives (no plain http off
+ * loopback, https only on origins the application allows, no fragment ever), and
+ * matching is deliberately dumb: exact, on everything except a loopback port.
+ *
+ * The loopback exception is the whole reason a CLI can use this flow. `claude`
+ * opens a listener on whatever port the OS hands it and cannot know that port
+ * when it registers, so RFC 8252 §7.3 lets the port vary — and nothing else.
+ * `localhost`, `127.0.0.1` and `[::1]` are three different registrations that do
+ * not stand in for one another: they resolve differently on a machine with a
+ * split-horizon resolver, and a client that registered one and is answered on
+ * another is a client something redirected.
+ *
+ * IPv6 arrives in as many spellings as there are ways to write zeroes, so both
+ * sides are read through `new URL(...).hostname`, which answers `[::1]` for
+ * every one of them. The registered value is stored verbatim — the registration
+ * response echoes it back and must not answer a client with a URI it did not
+ * write — so the normalisation happens here, on both sides, at every comparison.
+ */
+/** Why a redirect URI cannot be registered, in RFC 7591 §3.2.2 terms. */
+type RedirectUriRefusal = 'invalid_redirect_uri';
+/**
+ * Whether a URI may be registered, given the https origins this application
+ * allows.
+ *
+ * @param uri - The value exactly as the client wrote it
+ * @param allowedRedirectOrigins - `https://` origins from the lifecycle config
+ * @returns null when it may; the refusal detail when it may not
+ */
+declare function refuseRedirectUriRegistration(uri: string, allowedRedirectOrigins: string[]): string | null;
+/**
+ * Whether a presented redirect URI is one of the registered ones.
+ *
+ * Host, path and query must be identical; the port may differ only when both
+ * sides are loopback http. A presented URI carrying a fragment or a dot segment
+ * matches nothing — registration already refuses both, so this is the request
+ * side of the same two rules.
+ */
+declare function matchesRegisteredRedirectUri(presented: string, registered: string[]): boolean;
+/**
+ * The host shown on the consent screen, so the person approving can see where
+ * the code is about to be sent.
+ */
+declare function redirectHostOf(uri: string): string;
+
+/**
+ * OAuth 2.1 resource indicator (RFC 8707)
+ *
+ * The one string that says which API an access token is good against. It is
+ * required at authorize, defaulted from the grant at token, and compared again
+ * at verification — and the three comparisons have to agree, or a token minted
+ * for one spelling of a URL is refused by another.
+ *
+ * So there is one rule and it is applied at every entry point: parse and
+ * re-serialise with `new URL(...).toString()`, store that, and compare the
+ * normalised strings exactly. That folds away the differences a URL parser is
+ * allowed to fold — a default port written out, a percent-encoding case, an
+ * empty path becoming `/` — and folds away nothing else. A trailing slash is
+ * not noise: `https://api.example.com/mcp` and `https://api.example.com/mcp/`
+ * are different paths and stay different resources.
+ *
+ * A fragment is refused rather than stripped. RFC 8707 §2 forbids one, and
+ * stripping would quietly hand back a token for a target the client did not ask
+ * for.
+ */
+/**
+ * The canonical form of a resource indicator, or null when the value is not one.
+ *
+ * @param value - The `resource` parameter as it arrived
+ */
+declare function normalizeResource(value: string): string | null;
+/**
+ * Whether a presented resource names the same target as a grant's.
+ *
+ * Both sides go through `normalizeResource`: the grant's value was normalised
+ * when it was stored, and normalising it again costs one parse and removes the
+ * chance that a row written by an older rule is compared raw.
+ */
+declare function sameResource(presented: string, granted: string): boolean;
+
+/**
+ * OAuth 2.1 token, code and clock helpers
+ *
+ * Every secret this server issues is generated, hashed and compared here, so
+ * there is one answer to "how long is it, what does it start with, and how is it
+ * checked" rather than one per call site.
+ *
+ * Lookup is by the hash and the hash column is unique, so the database finds at
+ * most one row — but the equality that actually authorizes is done here, in
+ * constant time, over the hex digests. It costs a string comparison of 64
+ * characters and it means the decision never depends on how an index compared.
+ *
+ * The clock helpers are the other half. Three places express a moment and they
+ * disagree about the unit — the row stores a timestamp, `verifyAccessToken`
+ * answers seconds since the epoch, and a token response carries the seconds
+ * remaining — so all three go through one function each rather than three
+ * divisions by 1000 that can each be wrong on their own.
+ */
+/** Shape of an access token. Paired with `isAccessTokenShaped` below. */
+declare const OAUTH2_ACCESS_TOKEN_PREFIX = "spfn_at_";
+/** Shape of a refresh token. */
+declare const OAUTH2_REFRESH_TOKEN_PREFIX = "spfn_rt_";
+/** SHA-256 hex of a token or code. The only form either is ever stored in. */
+declare function hashOAuth2Secret(secret: string): string;
+/** Constant-time equality for two hex digests. */
+declare function sameOAuth2Hash(a: string, b: string): boolean;
+declare function generateAccessToken(): string;
+declare function generateRefreshToken(): string;
+/** 43 url-safe characters, which is 32 bytes of base64url with no padding. */
+declare function generateAuthorizationCode(): string;
+/**
+ * Whether a presented bearer credential has the access-token shape.
+ *
+ * Shape only — the token may still be unknown, revoked or expired, which
+ * `verifyAccessToken` decides. Callers read a raw header, so a missing or
+ * non-string argument answers false rather than throwing, exactly as
+ * `isOpsToken` does.
+ */
+declare function isAccessTokenShaped(bearer: string): boolean;
+/** The PKCE S256 transform: base64url of SHA-256 over the verifier's ASCII. */
+declare function pkceChallengeFor(codeVerifier: string): string;
+/**
+ * Whether a presented verifier is one RFC 7636 describes.
+ *
+ * Conformance rather than defence — the S256 comparison is what authorizes, and
+ * a verifier of any length still has to hash to the stored challenge. What this
+ * catches is a client that built its verifier wrong: 22 characters of entropy
+ * carries less than the transform promises, and an oversized one is a client
+ * that will be refused by the next server it talks to for a reason this one
+ * never told it.
+ */
+declare function isPkceVerifierShaped(codeVerifier: string): boolean;
+/**
+ * Whether a presented challenge could have come out of the S256 transform.
+ *
+ * A challenge of any other shape is a client that sent something else in the
+ * field — its verifier, most often, which is `plain` PKCE wearing the S256
+ * label and is exactly what the method check exists to refuse.
+ */
+declare function isPkceS256ChallengeShaped(codeChallenge: string): boolean;
+/** A moment as seconds since the epoch — what `verifyAccessToken` answers with. */
+declare function toEpochSeconds(at: Date): number;
+/**
+ * Whole seconds from now until a moment — what `expires_in` carries.
+ *
+ * Floored at zero: a token that expired while the response was being built is
+ * answered as zero rather than as a negative number a client would read as an
+ * enormous unsigned one.
+ */
+declare function secondsUntil(at: Date, from?: Date): number;
+
 /**
  * One-Time Token Manager
  *
@@ -8520,6 +9904,33 @@ interface AuthLifecycleOptions extends AuthInitOptions {
          */
         intervalMs?: number;
     };
+    /**
+     * OAuth 2.1 authorization server for MCP clients
+     *
+     * Opt-in, and the opt-in is this block. Without it `/_auth/oauth2/*` and
+     * `/.well-known/oauth-authorization-server` answer 404, the boot check does
+     * not run, and the application boots exactly as it did before this feature
+     * existed. With it, Claude Code and Codex can register themselves, send the
+     * account owner to a consent screen, and hold a token against `/mcp`.
+     *
+     * `scopes` is the one thing with no default: the names are the
+     * application's own vocabulary, they are published in the metadata document
+     * and shown on the consent screen, and there is nothing to derive them from.
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     authorizationServer: {
+     *         scopes: {
+     *             'mcp:read': 'Read your projects and tasks',
+     *             'mcp:write': 'Create and edit your tasks',
+     *         },
+     *         defaultScopes: ['mcp:read'],
+     *     },
+     * })
+     * ```
+     */
+    authorizationServer?: AuthorizationServerOptions;
 }
 declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecycleConfig;
 
@@ -8582,8 +9993,8 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
 }, void>;
 
 /**
- * Build the auth job router: the account-deletion purge sweep and the link-mail
- * sender.
+ * Build the auth job router: the account-deletion purge sweep, the OAuth 2.1
+ * stale-client sweep, and the link-mail sender.
  *
  * The cron is a parameter because `job(...).cron(expression)` bakes the string in
  * at module-import time, which always happens before `createAuthLifecycle()` runs
@@ -8592,11 +10003,14 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
  * after that call, when the schedule is not the default.
  *
  * @param options.purgeCron - Deletion purge schedule; defaults to daily at 04:00
+ * @param options.oauth2ClientPurgeCron - Stale OAuth client sweep; defaults to daily at 05:00
  */
 declare function createAuthJobRouter(options?: {
     purgeCron?: string;
+    oauth2ClientPurgeCron?: string;
 }): _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
+    oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -8615,6 +10029,7 @@ declare function createAuthJobRouter(options?: {
  */
 declare const authJobRouter: _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
+    oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -8846,4 +10261,4 @@ type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
 type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
-export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, type AuthPasswordResetPayload, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CsrfMode, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authPasswordResetEvent, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateDeviceCode, generateOAuthNonce, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, isOpsToken, issueOpsTokenService, kakaoProvider, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeStoredEmails, normalizeUserCode, oauthUnlinkedEvent, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, type AuthPasswordResetPayload, AuthProviderSchema, type AuthRegisterPayload, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, MAX_UNGRANTED_CLIENTS_PER_IP, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authPasswordResetEvent, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oauthUnlinkedEvent, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };