@spfn/auth 0.3.0-beta.18 → 0.3.0-beta.19

package/dist/server.js

@@ -897,8 +897,8 @@ var init_array2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs
-function Argument(index16) {
-  return CreateType({ [Kind]: "Argument", index: index16 });
+function Argument(index18) {
+  return CreateType({ [Kind]: "Argument", index: index18 });
 }
 var init_argument = __esm({
   "../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs"() {
@@ -1136,28 +1136,28 @@ var init_union2 = __esm({
 function Unescape(pattern) {
   return pattern.replace(/\\\$/g, "$").replace(/\\\*/g, "*").replace(/\\\^/g, "^").replace(/\\\|/g, "|").replace(/\\\(/g, "(").replace(/\\\)/g, ")");
 }
-function IsNonEscaped(pattern, index16, char) {
-  return pattern[index16] === char && pattern.charCodeAt(index16 - 1) !== 92;
+function IsNonEscaped(pattern, index18, char) {
+  return pattern[index18] === char && pattern.charCodeAt(index18 - 1) !== 92;
 }
-function IsOpenParen(pattern, index16) {
-  return IsNonEscaped(pattern, index16, "(");
+function IsOpenParen(pattern, index18) {
+  return IsNonEscaped(pattern, index18, "(");
 }
-function IsCloseParen(pattern, index16) {
-  return IsNonEscaped(pattern, index16, ")");
+function IsCloseParen(pattern, index18) {
+  return IsNonEscaped(pattern, index18, ")");
 }
-function IsSeparator(pattern, index16) {
-  return IsNonEscaped(pattern, index16, "|");
+function IsSeparator(pattern, index18) {
+  return IsNonEscaped(pattern, index18, "|");
 }
 function IsGroup(pattern) {
   if (!(IsOpenParen(pattern, 0) && IsCloseParen(pattern, pattern.length - 1)))
     return false;
   let count = 0;
-  for (let index16 = 0; index16 < pattern.length; index16++) {
-    if (IsOpenParen(pattern, index16))
+  for (let index18 = 0; index18 < pattern.length; index18++) {
+    if (IsOpenParen(pattern, index18))
       count += 1;
-    if (IsCloseParen(pattern, index16))
+    if (IsCloseParen(pattern, index18))
       count -= 1;
-    if (count === 0 && index16 !== pattern.length - 1)
+    if (count === 0 && index18 !== pattern.length - 1)
       return false;
   }
   return true;
@@ -1167,19 +1167,19 @@ function InGroup(pattern) {
 }
 function IsPrecedenceOr(pattern) {
   let count = 0;
-  for (let index16 = 0; index16 < pattern.length; index16++) {
-    if (IsOpenParen(pattern, index16))
+  for (let index18 = 0; index18 < pattern.length; index18++) {
+    if (IsOpenParen(pattern, index18))
       count += 1;
-    if (IsCloseParen(pattern, index16))
+    if (IsCloseParen(pattern, index18))
       count -= 1;
-    if (IsSeparator(pattern, index16) && count === 0)
+    if (IsSeparator(pattern, index18) && count === 0)
       return true;
   }
   return false;
 }
 function IsPrecedenceAnd(pattern) {
-  for (let index16 = 0; index16 < pattern.length; index16++) {
-    if (IsOpenParen(pattern, index16))
+  for (let index18 = 0; index18 < pattern.length; index18++) {
+    if (IsOpenParen(pattern, index18))
       return true;
   }
   return false;
@@ -1187,16 +1187,16 @@ function IsPrecedenceAnd(pattern) {
 function Or(pattern) {
   let [count, start] = [0, 0];
   const expressions = [];
-  for (let index16 = 0; index16 < pattern.length; index16++) {
-    if (IsOpenParen(pattern, index16))
+  for (let index18 = 0; index18 < pattern.length; index18++) {
+    if (IsOpenParen(pattern, index18))
       count += 1;
-    if (IsCloseParen(pattern, index16))
+    if (IsCloseParen(pattern, index18))
       count -= 1;
-    if (IsSeparator(pattern, index16) && count === 0) {
-      const range2 = pattern.slice(start, index16);
+    if (IsSeparator(pattern, index18) && count === 0) {
+      const range2 = pattern.slice(start, index18);
       if (range2.length > 0)
         expressions.push(TemplateLiteralParse(range2));
-      start = index16 + 1;
+      start = index18 + 1;
     }
   }
   const range = pattern.slice(start);
@@ -1209,40 +1209,40 @@ function Or(pattern) {
   return { type: "or", expr: expressions };
 }
 function And(pattern) {
-  function Group(value, index16) {
-    if (!IsOpenParen(value, index16))
+  function Group(value, index18) {
+    if (!IsOpenParen(value, index18))
       throw new TemplateLiteralParserError(`TemplateLiteralParser: Index must point to open parens`);
     let count = 0;
-    for (let scan = index16; scan < value.length; scan++) {
+    for (let scan = index18; scan < value.length; scan++) {
       if (IsOpenParen(value, scan))
         count += 1;
       if (IsCloseParen(value, scan))
         count -= 1;
       if (count === 0)
-        return [index16, scan];
+        return [index18, scan];
     }
     throw new TemplateLiteralParserError(`TemplateLiteralParser: Unclosed group parens in expression`);
   }
-  function Range(pattern2, index16) {
-    for (let scan = index16; scan < pattern2.length; scan++) {
+  function Range(pattern2, index18) {
+    for (let scan = index18; scan < pattern2.length; scan++) {
       if (IsOpenParen(pattern2, scan))
-        return [index16, scan];
+        return [index18, scan];
     }
-    return [index16, pattern2.length];
+    return [index18, pattern2.length];
   }
   const expressions = [];
-  for (let index16 = 0; index16 < pattern.length; index16++) {
-    if (IsOpenParen(pattern, index16)) {
-      const [start, end] = Group(pattern, index16);
+  for (let index18 = 0; index18 < pattern.length; index18++) {
+    if (IsOpenParen(pattern, index18)) {
+      const [start, end] = Group(pattern, index18);
       const range = pattern.slice(start, end + 1);
       expressions.push(TemplateLiteralParse(range));
-      index16 = end;
+      index18 = end;
     } else {
-      const [start, end] = Range(pattern, index16);
+      const [start, end] = Range(pattern, index18);
       const range = pattern.slice(start, end);
       if (range.length > 0)
         expressions.push(TemplateLiteralParse(range));
-      index16 = end - 1;
+      index18 = end - 1;
     }
   }
   return expressions.length === 0 ? { type: "const", const: "" } : expressions.length === 1 ? expressions[0] : { type: "and", expr: expressions };
@@ -2577,13 +2577,13 @@ function FromBoolean(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsBoolean(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromConstructor(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index16) => IntoBooleanResult(Visit3(right.parameters[index16], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index18) => IntoBooleanResult(Visit3(right.parameters[index18], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromDate(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsDate(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromFunction(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index16) => IntoBooleanResult(Visit3(right.parameters[index16], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index18) => IntoBooleanResult(Visit3(right.parameters[index18], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromIntegerRight(left, right) {
   return type_exports.IsLiteral(left) && value_exports.IsNumber(left.const) ? ExtendsResult.True : type_exports.IsNumber(left) || type_exports.IsInteger(left) ? ExtendsResult.True : ExtendsResult.False;
@@ -2743,7 +2743,7 @@ function FromTupleRight(left, right) {
   return type_exports.IsNever(left) ? ExtendsResult.True : type_exports.IsUnknown(left) ? ExtendsResult.False : type_exports.IsAny(left) ? ExtendsResult.Union : ExtendsResult.False;
 }
 function FromTuple3(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index16) => Visit3(schema, right.items[index16]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index18) => Visit3(schema, right.items[index18]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromUint8Array(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsUint8Array(right) ? ExtendsResult.True : ExtendsResult.False;
@@ -5740,9 +5740,167 @@ var init_user_permissions = __esm({
   }
 });
 
+// src/server/entities/oauth2-clients.ts
+import { text as text16 } from "drizzle-orm/pg-core";
+import { id as id17, timestamps as timestamps15, utcTimestamp as utcTimestamp13 } from "@spfn/core/db";
+var oauth2Clients;
+var init_oauth2_clients = __esm({
+  "src/server/entities/oauth2-clients.ts"() {
+    "use strict";
+    init_schema4();
+    oauth2Clients = authSchema.table(
+      "oauth2_clients",
+      {
+        id: id17(),
+        // The `client_id` the client sends on every later request. Random, opaque,
+        // and the unique constraint doubles as the lookup index.
+        clientId: text16("client_id").notNull().unique(),
+        // Self-declared label, shown on the consent screen and nowhere else.
+        // A client that lies about it gains one wrong line on that screen.
+        clientName: text16("client_name").notNull(),
+        // Registered redirect URIs, stored exactly as the client wrote them.
+        // The registration answer echoes them back verbatim, so normalising here
+        // would answer a client with a URI it did not register. Matching
+        // normalises both sides instead — see lib/oauth2/redirect-uri.ts.
+        redirectUris: text16("redirect_uris").array().notNull(),
+        // Client IP the registration arrived from, so the per-IP cap on clients
+        // nobody has approved yet can be counted. Nullable: an IP is not always
+        // knowable behind a proxy that forwards none, and a registration is not
+        // worth refusing over that.
+        createdIp: text16("created_ip"),
+        // Last token issuance or refresh under this client, updated
+        // fire-and-forget. Operator-facing only; nothing is authorized by it.
+        lastUsedAt: utcTimestamp13("last_used_at"),
+        ...timestamps15()
+      }
+    );
+  }
+});
+
+// src/server/entities/oauth2-grants.ts
+import { uniqueIndex as uniqueIndex7, index as index16, text as text17 } from "drizzle-orm/pg-core";
+import { id as id18, timestamps as timestamps16, utcTimestamp as utcTimestamp14, foreignKey as foreignKey10 } from "@spfn/core/db";
+var oauth2Grants;
+var init_oauth2_grants = __esm({
+  "src/server/entities/oauth2-grants.ts"() {
+    "use strict";
+    init_users();
+    init_oauth2_clients();
+    init_schema4();
+    oauth2Grants = authSchema.table(
+      "oauth2_grants",
+      {
+        id: id18(),
+        // `oauth2_client_id` and not `client_id`: the opaque string a client
+        // sends is called `client_id` everywhere in the protocol, and a bigint
+        // foreign key under that name in this schema would read as that value.
+        client: foreignKey10("oauth2_client", () => oauth2Clients.id, { onDelete: "cascade" }),
+        // Whose consent this is. Read from the approving session at authorize
+        // time, never from a request body — that is the whole authorization.
+        user: foreignKey10("user", () => users.id, { onDelete: "cascade" }),
+        // The RFC 8707 target this consent is for, normalised (see lib/oauth2).
+        // An access token is only good against the resource its grant names.
+        resource: text17("resource").notNull(),
+        // Scope names the user approved. A refresh may ask for a subset of these
+        // and never for more.
+        scopes: text17("scopes").array().notNull(),
+        // null = live; a timestamp cuts off every code and token beneath it
+        revokedAt: utcTimestamp14("revoked_at"),
+        ...timestamps16()
+      },
+      (table) => [
+        // One consent per (client, user, resource) — the re-consent path updates
+        // this row rather than inserting beside it.
+        uniqueIndex7("oauth2_grant_client_user_resource_idx").on(table.client, table.user, table.resource),
+        // The global-revocation path and the user's own grant list both address
+        // rows by user alone.
+        index16("oauth2_grant_user_idx").on(table.user)
+      ]
+    );
+  }
+});
+
+// src/server/entities/oauth2-authorization-codes.ts
+import { text as text18 } from "drizzle-orm/pg-core";
+import { id as id19, timestamps as timestamps17, utcTimestamp as utcTimestamp15, foreignKey as foreignKey11 } from "@spfn/core/db";
+var oauth2AuthorizationCodes;
+var init_oauth2_authorization_codes = __esm({
+  "src/server/entities/oauth2-authorization-codes.ts"() {
+    "use strict";
+    init_oauth2_grants();
+    init_schema4();
+    oauth2AuthorizationCodes = authSchema.table(
+      "oauth2_authorization_codes",
+      {
+        id: id19(),
+        // SHA-256 hex of the code. The code itself (32 random bytes, base64url)
+        // is in the redirect and nowhere else.
+        codeHash: text18("code_hash").notNull().unique(),
+        grant: foreignKey11("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
+        // The exact redirect_uri string the authorize request carried. The token
+        // request must repeat it character for character (RFC 6749 §4.1.3).
+        redirectUri: text18("redirect_uri").notNull(),
+        // The PKCE S256 challenge. `code_verifier` at the token endpoint is
+        // hashed and compared against this; `plain` is not accepted anywhere,
+        // so no method column is needed.
+        codeChallenge: text18("code_challenge").notNull(),
+        // 60 seconds from issuance. Judged by the database in the statement that
+        // spends the row, not only in a read before it.
+        expiresAt: utcTimestamp15("expires_at").notNull(),
+        // null = unspent. Non-null means spent, and a second presentation of the
+        // same code revokes the grant.
+        usedAt: utcTimestamp15("used_at"),
+        ...timestamps17()
+      }
+    );
+  }
+});
+
+// src/server/entities/oauth2-tokens.ts
+import { index as index17, text as text19 } from "drizzle-orm/pg-core";
+import { id as id20, timestamps as timestamps18, enumText as enumText11, utcTimestamp as utcTimestamp16, foreignKey as foreignKey12 } from "@spfn/core/db";
+var OAUTH2_TOKEN_KINDS, oauth2Tokens;
+var init_oauth2_tokens = __esm({
+  "src/server/entities/oauth2-tokens.ts"() {
+    "use strict";
+    init_oauth2_grants();
+    init_schema4();
+    OAUTH2_TOKEN_KINDS = ["access", "refresh"];
+    oauth2Tokens = authSchema.table(
+      "oauth2_tokens",
+      {
+        id: id20(),
+        // SHA-256 hex of the token value. Lookup key; the unique constraint
+        // doubles as the index.
+        tokenHash: text19("token_hash").notNull().unique(),
+        kind: enumText11("kind", OAUTH2_TOKEN_KINDS).notNull(),
+        grant: foreignKey12("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
+        // What this particular token carries, which may be narrower than its
+        // grant's scopes: a refresh request is allowed to ask for a subset.
+        // Never wider — that is `invalid_scope`.
+        scopes: text19("scopes").array().notNull(),
+        expiresAt: utcTimestamp16("expires_at").notNull(),
+        // null = live. Set by revoke, by a grant revocation, and by the two
+        // replay detections (code reuse, refresh reuse).
+        revokedAt: utcTimestamp16("revoked_at"),
+        // Refresh only: set when a rotation issued the successor. A row with
+        // this set is spent, and presenting it revokes the grant.
+        replacedAt: utcTimestamp16("replaced_at"),
+        // Last successful verification, updated fire-and-forget like ops tokens
+        lastUsedAt: utcTimestamp16("last_used_at"),
+        ...timestamps18()
+      },
+      (table) => [
+        // Revocation addresses every token under one grant.
+        index17("oauth2_token_grant_idx").on(table.grant)
+      ]
+    );
+  }
+});
+
 // src/server/entities/auth-metadata.ts
 import { sql as sql3 } from "drizzle-orm";
-import { text as text16, timestamp } from "drizzle-orm/pg-core";
+import { text as text20, timestamp } from "drizzle-orm/pg-core";
 var authMetadata;
 var init_auth_metadata = __esm({
   "src/server/entities/auth-metadata.ts"() {
@@ -5752,9 +5910,9 @@ var init_auth_metadata = __esm({
       "auth_metadata",
       {
         // Metadata key (primary key)
-        key: text16("key").primaryKey(),
+        key: text20("key").primaryKey(),
         // Metadata value
-        value: text16("value").notNull(),
+        value: text20("value").notNull(),
         // Last updated timestamp — stamped by the database on insert and on update
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow().$onUpdate(() => sql3`now()`)
       }
@@ -5763,8 +5921,8 @@ var init_auth_metadata = __esm({
 });
 
 // src/server/entities/ops-tokens.ts
-import { text as text17 } from "drizzle-orm/pg-core";
-import { id as id17, timestamps as timestamps15, utcTimestamp as utcTimestamp13 } from "@spfn/core/db";
+import { text as text21 } from "drizzle-orm/pg-core";
+import { id as id21, timestamps as timestamps19, utcTimestamp as utcTimestamp17 } from "@spfn/core/db";
 var opsTokens;
 var init_ops_tokens = __esm({
   "src/server/entities/ops-tokens.ts"() {
@@ -5773,22 +5931,22 @@ var init_ops_tokens = __esm({
     opsTokens = authSchema.table(
       "ops_tokens",
       {
-        id: id17(),
+        id: id21(),
         // Operator-facing label ("ci-deploy", "rayim-laptop")
-        name: text17("name").notNull(),
+        name: text21("name").notNull(),
         // SHA-256 hex of the token secret. Lookup key — the secret never lands
         // here, and the unique constraint doubles as the lookup index.
-        tokenHash: text17("token_hash").notNull().unique(),
+        tokenHash: text21("token_hash").notNull().unique(),
         // Granted scopes as permission strings ('waitlist:read', ...).
         // '*' grants every scope.
-        scopes: text17("scopes").array().notNull(),
+        scopes: text21("scopes").array().notNull(),
         // null = the token does not expire
-        expiresAt: utcTimestamp13("expires_at"),
+        expiresAt: utcTimestamp17("expires_at"),
         // null = active; a timestamp revokes the token permanently
-        revokedAt: utcTimestamp13("revoked_at"),
+        revokedAt: utcTimestamp17("revoked_at"),
         // Last successful verification, updated fire-and-forget
-        lastUsedAt: utcTimestamp13("last_used_at"),
-        ...timestamps15()
+        lastUsedAt: utcTimestamp17("last_used_at"),
+        ...timestamps19()
       }
     );
   }
@@ -5815,6 +5973,10 @@ var init_entities = __esm({
     init_permissions();
     init_role_permissions();
     init_user_permissions();
+    init_oauth2_clients();
+    init_oauth2_grants();
+    init_oauth2_authorization_codes();
+    init_oauth2_tokens();
     init_auth_metadata();
     init_ops_tokens();
   }
@@ -5835,8 +5997,8 @@ var init_users_repository = __esm({
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5846,8 +6008,8 @@ var init_users_repository = __esm({
        * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
        * 계속 사용할 것.
        */
-      async findByIdOnPrimary(id18) {
-        const result = await this.db.select().from(users).where(eq(users.id, id18)).limit(1);
+      async findByIdOnPrimary(id22) {
+        const result = await this.db.select().from(users).where(eq(users.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5863,8 +6025,8 @@ var init_users_repository = __esm({
        * Only meaningful inside a transaction — the lock is released at commit.
        * Write primary.
        */
-      async lockById(id18) {
-        await this.db.select({ id: users.id }).from(users).where(eq(users.id, id18)).for("update");
+      async lockById(id22) {
+        await this.db.select({ id: users.id }).from(users).where(eq(users.id, id22)).for("update");
       }
       /**
        * 이메일로 사용자 조회
@@ -5934,13 +6096,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id18) {
+      async findByIdWithRole(id22) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id18)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id22)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -6015,9 +6177,9 @@ var init_users_repository = __esm({
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id18, data) {
+      async updateById(id22, data) {
         const patch = "email" in data ? { ...data, email: normalizeOptionalEmail(data.email) } : data;
-        const result = await this.db.update(users).set(patch).where(eq(users.id, id18)).returning();
+        const result = await this.db.update(users).set(patch).where(eq(users.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6029,10 +6191,10 @@ var init_users_repository = __esm({
        * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
        * Write primary 사용
        */
-      async reactivateFromPendingDeletion(id18) {
+      async reactivateFromPendingDeletion(id22) {
         const result = await this.db.update(users).set({ status: "active" }).where(
           and(
-            eq(users.id, id18),
+            eq(users.id, id22),
             eq(users.status, "pending_deletion")
           )
         ).returning();
@@ -6042,32 +6204,32 @@ var init_users_repository = __esm({
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id18, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id22, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash
         };
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id18)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id18) {
+      async updateLastLogin(id22) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id18)).returning();
+        }).where(eq(users.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id18) {
-        const result = await this.db.delete(users).where(eq(users.id, id18)).returning();
+      async deleteById(id22) {
+        const result = await this.db.delete(users).where(eq(users.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6415,14 +6577,14 @@ var init_keys_repository = __esm({
        * stored, so it answers "since when has this device been on this release"
        * rather than "when was it last seen", which lastUsedAt already answers.
        */
-      async updateLastUsedById(id18, identity) {
+      async updateLastUsedById(id22, identity) {
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
         const lastUsedIsStale = or(
           isNull(userPublicKeys.lastUsedAt),
           lt(userPublicKeys.lastUsedAt, staleBefore)
         );
         if (!identity) {
-          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id18), lastUsedIsStale));
+          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id22), lastUsedIsStale));
           return;
         }
         const identityChanged = sql5`(
@@ -6439,7 +6601,7 @@ var init_keys_repository = __esm({
           clientContractVersion: identity.contractVersion,
           clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
         }).where(and2(
-          eq2(userPublicKeys.id, id18),
+          eq2(userPublicKeys.id, id22),
           or(lastUsedIsStale, identityChanged)
         ));
       }
@@ -6478,8 +6640,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6493,22 +6655,22 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id18) {
+      async markAsUsed(id22) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id18)).returning();
+        }).where(eq3(verificationCodes.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id18) {
-        const code = await this.findById(id18);
+      async incrementAttempts(id22) {
+        const code = await this.findById(id22);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1
-        }).where(eq3(verificationCodes.id, id18)).returning();
+        }).where(eq3(verificationCodes.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6592,10 +6754,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the issued row, or null if the row is no longer deliverable
        */
-      async issue(id18, tokenHash) {
+      async issue(id22, tokenHash) {
         const result = await this.db.update(signupLinkTokens).set({ tokenHash }).where(
           and4(
-            eq4(signupLinkTokens.id, id18),
+            eq4(signupLinkTokens.id, id22),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt),
             isNull3(signupLinkTokens.completedAt),
@@ -6631,14 +6793,14 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async claimLink(id18, setupSecretHash, setupExpiresAt) {
+      async claimLink(id22, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(signupLinkTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and4(
-            eq4(signupLinkTokens.id, id18),
+            eq4(signupLinkTokens.id, id22),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -6651,10 +6813,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async claimSetupSession(id18) {
+      async claimSetupSession(id22) {
         const result = await this.db.update(signupLinkTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and4(
-            eq4(signupLinkTokens.id, id18),
+            eq4(signupLinkTokens.id, id22),
             isNull3(signupLinkTokens.completedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -6736,10 +6898,10 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the issued row, or null if the row is no longer deliverable
        */
-      async issue(id18, tokenHash) {
+      async issue(id22, tokenHash) {
         const result = await this.db.update(passwordResetTokens).set({ tokenHash }).where(
           and5(
-            eq5(passwordResetTokens.id, id18),
+            eq5(passwordResetTokens.id, id22),
             isNull4(passwordResetTokens.consumedAt),
             isNull4(passwordResetTokens.supersededAt),
             isNull4(passwordResetTokens.completedAt),
@@ -6787,14 +6949,14 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async consume(id18, setupSecretHash, setupExpiresAt) {
+      async consume(id22, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(passwordResetTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and5(
-            eq5(passwordResetTokens.id, id18),
+            eq5(passwordResetTokens.id, id22),
             isNull4(passwordResetTokens.consumedAt),
             isNull4(passwordResetTokens.supersededAt)
           )
@@ -6807,10 +6969,10 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async complete(id18) {
+      async complete(id22) {
         const result = await this.db.update(passwordResetTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and5(
-            eq5(passwordResetTokens.id, id18),
+            eq5(passwordResetTokens.id, id22),
             isNull4(passwordResetTokens.completedAt),
             isNull4(passwordResetTokens.supersededAt)
           )
@@ -6891,9 +7053,9 @@ var init_passkeys_repository = __esm({
        * Owner-scoped, so an id belonging to someone else answers null rather than
        * a row — a management route can only ever say "not yours".
        */
-      async findLiveByIdAndUserId(id18, userId) {
+      async findLiveByIdAndUserId(id22, userId) {
         const result = await this.db.select().from(passkeys).where(and6(
-          eq6(passkeys.id, id18),
+          eq6(passkeys.id, id22),
           eq6(passkeys.userId, userId),
           isNull5(passkeys.revokedAt)
         )).limit(1);
@@ -6903,17 +7065,17 @@ var init_passkeys_repository = __esm({
        * Record a successful assertion.
        * Write primary.
        */
-      async recordUse(id18, counter) {
-        await this.db.update(passkeys).set({ counter, lastUsedAt: /* @__PURE__ */ new Date() }).where(eq6(passkeys.id, id18));
+      async recordUse(id22, counter) {
+        await this.db.update(passkeys).set({ counter, lastUsedAt: /* @__PURE__ */ new Date() }).where(eq6(passkeys.id, id22));
       }
       /**
        * Rename, but only a credential this user still owns and has not revoked.
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async renameByIdAndUserId(id18, userId, label) {
+      async renameByIdAndUserId(id22, userId, label) {
         const result = await this.db.update(passkeys).set({ label }).where(and6(
-          eq6(passkeys.id, id18),
+          eq6(passkeys.id, id22),
           eq6(passkeys.userId, userId),
           isNull5(passkeys.revokedAt)
         )).returning();
@@ -6928,9 +7090,9 @@ var init_passkeys_repository = __esm({
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async revokeByIdAndUserId(id18, userId, reason) {
+      async revokeByIdAndUserId(id22, userId, reason) {
         const result = await this.db.update(passkeys).set({ revokedAt: /* @__PURE__ */ new Date(), revokedReason: reason }).where(and6(
-          eq6(passkeys.id, id18),
+          eq6(passkeys.id, id22),
           eq6(passkeys.userId, userId),
           isNull5(passkeys.revokedAt)
         )).returning();
@@ -7063,10 +7225,10 @@ var init_device_authorizations_repository = __esm({
        *
        * @returns the updated row, or null if it was no longer pending, or expired
        */
-      async approve(id18, userId) {
+      async approve(id22, userId) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "approved", userId, approvedAt: /* @__PURE__ */ new Date() }).where(
           and8(
-            eq8(deviceAuthorizations.id, id18),
+            eq8(deviceAuthorizations.id, id22),
             eq8(deviceAuthorizations.status, "pending"),
             notExpired()
           )
@@ -7080,10 +7242,10 @@ var init_device_authorizations_repository = __esm({
        *
        * @returns the updated row, or null if it was no longer pending, or expired
        */
-      async deny(id18) {
+      async deny(id22) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
           and8(
-            eq8(deviceAuthorizations.id, id18),
+            eq8(deviceAuthorizations.id, id22),
             eq8(deviceAuthorizations.status, "pending"),
             notExpired()
           )
@@ -7161,8 +7323,8 @@ var init_roles_repository = __esm({
       /**
        * ID로 역할 조회
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(roles).where(eq9(roles.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(roles).where(eq9(roles.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7193,15 +7355,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id18, data) {
-        const result = await this.db.update(roles).set(data).where(eq9(roles.id, id18)).returning();
+      async updateById(id22, data) {
+        const result = await this.db.update(roles).set(data).where(eq9(roles.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id18) {
-        const result = await this.db.delete(roles).where(eq9(roles.id, id18)).returning();
+      async deleteById(id22) {
+        const result = await this.db.delete(roles).where(eq9(roles.id, id22)).returning();
         return result[0] ?? null;
       }
     };
@@ -7221,8 +7383,8 @@ var init_permissions_repository = __esm({
       /**
        * ID로 권한 조회
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(permissions).where(eq10(permissions.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(permissions).where(eq10(permissions.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7273,15 +7435,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id18, data) {
-        const result = await this.db.update(permissions).set(data).where(eq10(permissions.id, id18)).returning();
+      async updateById(id22, data) {
+        const result = await this.db.update(permissions).set(data).where(eq10(permissions.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id18) {
-        const result = await this.db.delete(permissions).where(eq10(permissions.id, id18)).returning();
+      async deleteById(id22) {
+        const result = await this.db.delete(permissions).where(eq10(permissions.id, id22)).returning();
         return result[0] ?? null;
       }
     };
@@ -7411,8 +7573,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id18, data) {
-        const result = await this.db.update(userPermissions).set(data).where(eq12(userPermissions.id, id18)).returning();
+      async updateById(id22, data) {
+        const result = await this.db.update(userPermissions).set(data).where(eq12(userPermissions.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7464,8 +7626,8 @@ var init_user_profiles_repository = __esm({
       /**
        * ID로 프로필 조회
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(userProfiles).where(eq13(userProfiles.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(userProfiles).where(eq13(userProfiles.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7491,8 +7653,8 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id18, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq13(userProfiles.id, id18)).returning();
+      async updateById(id22, data) {
+        const result = await this.db.update(userProfiles).set(data).where(eq13(userProfiles.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7505,8 +7667,8 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id18) {
-        const result = await this.db.delete(userProfiles).where(eq13(userProfiles.id, id18)).returning();
+      async deleteById(id22) {
+        const result = await this.db.delete(userProfiles).where(eq13(userProfiles.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7597,8 +7759,8 @@ var init_invitations_repository = __esm({
       /**
        * ID로 초대 조회
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(userInvitations).where(eq14(userInvitations.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(userInvitations).where(eq14(userInvitations.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7641,7 +7803,7 @@ var init_invitations_repository = __esm({
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id18, status, timestamp2) {
+      async updateStatus(id22, status, timestamp2) {
         const updates = {
           status
         };
@@ -7652,14 +7814,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq14(userInvitations.id, id18)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq14(userInvitations.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id18) {
-        const result = await this.db.delete(userInvitations).where(eq14(userInvitations.id, id18)).returning();
+      async deleteById(id22) {
+        const result = await this.db.delete(userInvitations).where(eq14(userInvitations.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7754,31 +7916,31 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id18, data) {
+      async updateById(id22, data) {
         const patch = "email" in data && typeof data.email === "string" ? { ...data, email: normalizeEmail(data.email) } : data;
-        const result = await this.db.update(userInvitations).set(patch).where(eq14(userInvitations.id, id18)).returning();
+        const result = await this.db.update(userInvitations).set(patch).where(eq14(userInvitations.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id18, newExpiresAt) {
+      async resend(id22, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt
-        }).where(eq14(userInvitations.id, id18)).returning();
+        }).where(eq14(userInvitations.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id18, cancelledBy, reason, currentMetadata) {
+      async cancel(id22, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata
-        }).where(eq14(userInvitations.id, id18)).returning();
+        }).where(eq14(userInvitations.id, id22)).returning();
         return result[0] ?? null;
       }
     };
@@ -8633,11 +8795,11 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id18, data) {
+      async updateTokens(id22, data) {
         const accounts = await this.db.select({
           provider: userSocialAccounts.provider,
           providerUserId: userSocialAccounts.providerUserId
-        }).from(userSocialAccounts).where(eq15(userSocialAccounts.id, id18)).limit(1);
+        }).from(userSocialAccounts).where(eq15(userSocialAccounts.id, id22)).limit(1);
         const account = accounts[0];
         if (!account) {
           return null;
@@ -8651,15 +8813,15 @@ var init_social_accounts_repository = __esm({
           ...data,
           accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
           refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken
-        }).where(eq15(userSocialAccounts.id, id18)).returning();
+        }).where(eq15(userSocialAccounts.id, id22)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id18) {
-        const result = await this.db.delete(userSocialAccounts).where(eq15(userSocialAccounts.id, id18)).returning();
+      async deleteById(id22) {
+        const result = await this.db.delete(userSocialAccounts).where(eq15(userSocialAccounts.id, id22)).returning();
         return result[0] ?? null;
       }
       /**
@@ -8739,8 +8901,8 @@ var init_account_deletion_requests_repository = __esm({
        * ID로 요청 조회
        * Read replica 사용
        */
-      async findById(id18) {
-        const result = await this.readDb.select().from(accountDeletionRequests).where(eq17(accountDeletionRequests.id, id18)).limit(1);
+      async findById(id22) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq17(accountDeletionRequests.id, id22)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8799,13 +8961,13 @@ var init_account_deletion_requests_repository = __esm({
        * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCancelled(id18) {
+      async markCancelled(id22) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date()
         }).where(
           and13(
-            eq17(accountDeletionRequests.id, id18),
+            eq17(accountDeletionRequests.id, id22),
             eq17(accountDeletionRequests.status, "pending")
           )
         ).returning();
@@ -8821,14 +8983,14 @@ var init_account_deletion_requests_repository = __esm({
        * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCompleted(id18, purgeStrategy) {
+      async markCompleted(id22, purgeStrategy) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "completed",
           completedAt: /* @__PURE__ */ new Date(),
           purgeStrategy
         }).where(
           and13(
-            eq17(accountDeletionRequests.id, id18),
+            eq17(accountDeletionRequests.id, id22),
             eq17(accountDeletionRequests.status, "pending")
           )
         ).returning();
@@ -8872,19 +9034,332 @@ var init_ops_tokens_repository = __esm({
        * token is already revoked — the first revocation's timestamp is never
        * overwritten.
        */
-      async revokeById(id18) {
-        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and14(eq18(opsTokens.id, id18), isNull8(opsTokens.revokedAt))).returning();
+      async revokeById(id22) {
+        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and14(eq18(opsTokens.id, id22), isNull8(opsTokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path. */
-      async updateLastUsedById(id18) {
-        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq18(opsTokens.id, id18));
+      async updateLastUsedById(id22) {
+        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq18(opsTokens.id, id22));
       }
     };
     opsTokensRepository = new OpsTokensRepository();
   }
 });
 
+// src/server/repositories/oauth2-clients.repository.ts
+import { and as and15, eq as eq19, gt as gt7, lt as lt6, sql as sql8 } from "drizzle-orm";
+import { BaseRepository as BaseRepository19, runInTransaction } from "@spfn/core/db";
+var OAuth2ClientsRepository, oauth2ClientsRepository;
+var init_oauth2_clients_repository = __esm({
+  "src/server/repositories/oauth2-clients.repository.ts"() {
+    "use strict";
+    init_oauth2_clients();
+    init_oauth2_grants();
+    OAuth2ClientsRepository = class extends BaseRepository19 {
+      async create(data) {
+        const result = await this.db.insert(oauth2Clients).values(data).returning();
+        return result[0];
+      }
+      /**
+       * Lookup by the public `client_id` — the authorize and token paths.
+       *
+       * Reads the primary, not the replica, for the reason the ops-token lookup
+       * does: a client registered a moment ago is immediately used, and a replica
+       * read would answer "unknown client" for the length of the replication lag,
+       * at the one moment a CLI is being connected.
+       */
+      async findByClientId(clientId) {
+        const result = await this.db.select().from(oauth2Clients).where(eq19(oauth2Clients.clientId, clientId)).limit(1);
+        return result[0] ?? null;
+      }
+      /** Fire-and-forget from the token-issuing path. */
+      async updateLastUsedById(id22) {
+        await this.db.update(oauth2Clients).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq19(oauth2Clients.id, id22));
+      }
+      /**
+       * Register a client unless this address is already at its standing cap.
+       *
+       * The count and the insert are one transaction whose first statement takes
+       * an advisory lock on the address, and all three parts are load-bearing.
+       * Counting on the replica lets replication lag hand out slots that are
+       * already taken. Counting and inserting in two statements lets a second
+       * registration read the same total between them. And a transaction alone
+       * does not close that: under READ COMMITTED each concurrent transaction
+       * counts the rows the others have not committed yet, so twenty requests
+       * arriving together all see zero. The lock is the only part that makes the
+       * cap a number rather than an average, and it is per address, so it costs
+       * nobody else anything.
+       *
+       * @param data - The row to write when there is room for it
+       * @param limit - The address, its cap, and how far back the cap looks
+       * @returns the registered client, or null when the address is at its cap
+       */
+      async createWithinStandingCap(data, limit) {
+        return await runInTransaction(async () => {
+          await this.db.execute(sql8`select pg_advisory_xact_lock(hashtext(${limit.ip}))`);
+          const standing = await this.countRecentUngrantedByIp(limit.ip, limit.windowMs);
+          return standing < limit.max ? await this.create(data) : null;
+        });
+      }
+      /**
+       * How many clients this IP registered within the window that nobody has
+       * approved yet.
+       *
+       * The window is what makes this a standing-population cap rather than a
+       * permanent quota. Rows are only freed by the purge job, which sweeps once
+       * a day against a 24-hour threshold — so without a window a row registered
+       * a minute after one sweep holds its slot for nearly two days, and twenty
+       * developers behind one NAT lock their whole office out of registering.
+       * A grant against the client takes it out of the count at any age: a client
+       * somebody approved is not junk.
+       *
+       * Reads the primary, inside the caller's transaction, for the reason
+       * `findByClientId` does — a row written a moment ago is exactly the row this
+       * count exists to see.
+       */
+      async countRecentUngrantedByIp(ip, windowMs) {
+        const result = await this.db.select({ count: sql8`count(*)::int` }).from(oauth2Clients).where(
+          and15(
+            eq19(oauth2Clients.createdIp, ip),
+            gt7(oauth2Clients.createdAt, new Date(Date.now() - windowMs)),
+            sql8`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
+          )
+        );
+        return result[0]?.count ?? 0;
+      }
+      /**
+       * Delete clients older than `before` that no user ever approved.
+       *
+       * A registration is an unauthenticated write, so the table fills with rows
+       * from installs that were abandoned at the consent screen. A row with a
+       * grant against it is never touched, whatever its age — that is somebody's
+       * connected CLI.
+       *
+       * @returns how many rows this sweep removed
+       */
+      async deleteStaleUngranted(before) {
+        const deleted = await this.db.delete(oauth2Clients).where(
+          and15(
+            lt6(oauth2Clients.createdAt, before),
+            sql8`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
+          )
+        ).returning({ id: oauth2Clients.id });
+        return deleted.length;
+      }
+    };
+    oauth2ClientsRepository = new OAuth2ClientsRepository();
+  }
+});
+
+// src/server/repositories/oauth2-grants.repository.ts
+import { and as and16, desc as desc5, eq as eq20, inArray as inArray3, isNull as isNull9, sql as sql9 } from "drizzle-orm";
+import { BaseRepository as BaseRepository20 } from "@spfn/core/db";
+var OAuth2GrantsRepository, oauth2GrantsRepository;
+var init_oauth2_grants_repository = __esm({
+  "src/server/repositories/oauth2-grants.repository.ts"() {
+    "use strict";
+    init_oauth2_grants();
+    init_oauth2_clients();
+    init_oauth2_tokens();
+    OAuth2GrantsRepository = class extends BaseRepository20 {
+      /**
+       * Record a consent, or refresh the scopes of the one already there.
+       *
+       * Re-consenting is an upsert and not an insert: the unique index on
+       * (client, user, resource) says one consent per triple, and a user who
+       * approves a wider scope set is amending the consent they already gave, not
+       * giving a second one. Revoking the entry they can see must revoke
+       * everything the client holds, which a second row would break.
+       *
+       * `revokedAt: null` in the update is deliberate — approving again after
+       * revoking is how a user reconnects a CLI they cut off.
+       */
+      async upsert(data) {
+        const result = await this.db.insert(oauth2Grants).values(data).onConflictDoUpdate({
+          target: [oauth2Grants.client, oauth2Grants.user, oauth2Grants.resource],
+          set: { scopes: data.scopes, revokedAt: null, updatedAt: /* @__PURE__ */ new Date() }
+        }).returning();
+        return result[0];
+      }
+      /**
+       * A grant and its client in one read — the shape the token and verification
+       * paths need, since both have to check the client the caller claims and the
+       * grant's revocation at once.
+       *
+       * Read primary: revocation is documented as taking effect immediately.
+       */
+      async findWithClientById(id22) {
+        const result = await this.db.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq20(oauth2Grants.client, oauth2Clients.id)).where(eq20(oauth2Grants.id, id22)).limit(1);
+        return result[0] ?? null;
+      }
+      /** What the user's "connected apps" screen lists. Read replica. */
+      async listActiveByUserId(userId) {
+        return await this.readDb.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq20(oauth2Grants.client, oauth2Clients.id)).where(and16(eq20(oauth2Grants.user, userId), isNull9(oauth2Grants.revokedAt))).orderBy(desc5(oauth2Grants.createdAt));
+      }
+      /**
+       * Revoke one live grant belonging to one user.
+       *
+       * The user id is part of the condition rather than checked beforehand: the
+       * id in the URL comes from a caller, and a grant that is not theirs must not
+       * be revocable by guessing a number. A miss is indistinguishable from an id
+       * that does not exist, which is the answer the route gives.
+       *
+       * @returns the revoked row, or null if there was no live grant of that id
+       *          for that user
+       */
+      async revokeByIdForUser(id22, userId) {
+        const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(
+          and16(
+            eq20(oauth2Grants.id, id22),
+            eq20(oauth2Grants.user, userId),
+            isNull9(oauth2Grants.revokedAt)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /** Revoke one grant by id, whoever it belongs to — the replay detections. */
+      async revokeById(id22) {
+        const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and16(eq20(oauth2Grants.id, id22), isNull9(oauth2Grants.revokedAt))).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Revoke every live grant a user has — the authorization-server half of a
+       * global revocation, beside `denyAllActiveByUserId`.
+       *
+       * @returns the grant ids this call revoked
+       */
+      async revokeAllActiveByUserId(userId) {
+        const revoked = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and16(eq20(oauth2Grants.user, userId), isNull9(oauth2Grants.revokedAt))).returning({ id: oauth2Grants.id });
+        return revoked.map((row) => row.id);
+      }
+      /**
+       * Revoke every live token under the given grants.
+       *
+       * Verification already refuses a token whose grant is revoked, so this is
+       * belt and braces — but the belt is what a `SELECT` against this table shows
+       * an operator, and a live-looking row under a dead grant reads as a hole.
+       *
+       * @returns how many tokens this call revoked
+       */
+      async revokeTokensOfGrants(grantIds) {
+        if (grantIds.length === 0) {
+          return 0;
+        }
+        const revoked = await this.db.update(oauth2Tokens).set({ revokedAt: sql9`now()` }).where(and16(inArray3(oauth2Tokens.grant, grantIds), isNull9(oauth2Tokens.revokedAt))).returning({ id: oauth2Tokens.id });
+        return revoked.length;
+      }
+    };
+    oauth2GrantsRepository = new OAuth2GrantsRepository();
+  }
+});
+
+// src/server/repositories/oauth2-authorization-codes.repository.ts
+import { and as and17, eq as eq21, gt as gt8, isNull as isNull10, sql as sql10 } from "drizzle-orm";
+import { BaseRepository as BaseRepository21 } from "@spfn/core/db";
+var OAuth2AuthorizationCodesRepository, oauth2AuthorizationCodesRepository;
+var init_oauth2_authorization_codes_repository = __esm({
+  "src/server/repositories/oauth2-authorization-codes.repository.ts"() {
+    "use strict";
+    init_oauth2_authorization_codes();
+    OAuth2AuthorizationCodesRepository = class extends BaseRepository21 {
+      async create(data) {
+        const result = await this.db.insert(oauth2AuthorizationCodes).values(data).returning();
+        return result[0];
+      }
+      /**
+       * Spend a code, addressed by the hash the caller actually presented.
+       *
+       * @returns the row this call spent, or null when it was unknown, already
+       *          spent, or past its 60 seconds
+       */
+      async consume(codeHash) {
+        const result = await this.db.update(oauth2AuthorizationCodes).set({ usedAt: sql10`now()` }).where(
+          and17(
+            eq21(oauth2AuthorizationCodes.codeHash, codeHash),
+            isNull10(oauth2AuthorizationCodes.usedAt),
+            gt8(oauth2AuthorizationCodes.expiresAt, sql10`now()`)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * The row behind a miss, in any state. Deliberately unfiltered — which
+       * refusal is owed is the service's decision, and a row filtered out here
+       * would be indistinguishable from a code that never existed.
+       */
+      async findByCodeHash(codeHash) {
+        const result = await this.db.select().from(oauth2AuthorizationCodes).where(eq21(oauth2AuthorizationCodes.codeHash, codeHash)).limit(1);
+        return result[0] ?? null;
+      }
+    };
+    oauth2AuthorizationCodesRepository = new OAuth2AuthorizationCodesRepository();
+  }
+});
+
+// src/server/repositories/oauth2-tokens.repository.ts
+import { and as and18, eq as eq22, gt as gt9, isNull as isNull11, sql as sql11 } from "drizzle-orm";
+import { BaseRepository as BaseRepository22 } from "@spfn/core/db";
+var OAuth2TokensRepository, oauth2TokensRepository;
+var init_oauth2_tokens_repository = __esm({
+  "src/server/repositories/oauth2-tokens.repository.ts"() {
+    "use strict";
+    init_oauth2_tokens();
+    OAuth2TokensRepository = class extends BaseRepository22 {
+      async create(data) {
+        const result = await this.db.insert(oauth2Tokens).values(data).returning();
+        return result[0];
+      }
+      /**
+       * Lookup by the token's hash — the verification and refresh paths.
+       *
+       * Primary, not replica: revocation is a button the user presses and is
+       * documented as taking effect immediately, so a replica read would keep
+       * authenticating a revoked token for the length of the replication lag.
+       * Unfiltered, so the service can tell revoked from expired from unknown.
+       */
+      async findByTokenHash(tokenHash) {
+        const result = await this.db.select().from(oauth2Tokens).where(eq22(oauth2Tokens.tokenHash, tokenHash)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Mark a live refresh token as replaced, addressed by its hash.
+       *
+       * @returns the row this call replaced, or null when it was unknown, already
+       *          rotated, revoked, or expired
+       */
+      async rotate(tokenHash) {
+        const result = await this.db.update(oauth2Tokens).set({ replacedAt: sql11`now()` }).where(
+          and18(
+            eq22(oauth2Tokens.tokenHash, tokenHash),
+            eq22(oauth2Tokens.kind, "refresh"),
+            isNull11(oauth2Tokens.replacedAt),
+            isNull11(oauth2Tokens.revokedAt),
+            gt9(oauth2Tokens.expiresAt, sql11`now()`)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Revoke a live token by hash — RFC 7009.
+       *
+       * @returns the revoked row, or null when there was nothing live to revoke.
+       *          The endpoint answers 200 either way; the caller learns nothing
+       *          about whether the value it presented ever existed.
+       */
+      async revokeByTokenHash(tokenHash) {
+        const result = await this.db.update(oauth2Tokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and18(eq22(oauth2Tokens.tokenHash, tokenHash), isNull11(oauth2Tokens.revokedAt))).returning();
+        return result[0] ?? null;
+      }
+      /** Fire-and-forget from the verification path, as ops tokens do. */
+      async updateLastUsedById(id22) {
+        await this.db.update(oauth2Tokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq22(oauth2Tokens.id, id22));
+      }
+    };
+    oauth2TokensRepository = new OAuth2TokensRepository();
+  }
+});
+
 // src/server/repositories/index.ts
 var init_repositories = __esm({
   "src/server/repositories/index.ts"() {
@@ -8907,6 +9382,10 @@ var init_repositories = __esm({
     init_auth_metadata_repository();
     init_account_deletion_requests_repository();
     init_ops_tokens_repository();
+    init_oauth2_clients_repository();
+    init_oauth2_grants_repository();
+    init_oauth2_authorization_codes_repository();
+    init_oauth2_tokens_repository();
   }
 });
 
@@ -8998,7 +9477,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id18) => Number(id18));
+  const permissionIdNums = permissionIds.map((id22) => Number(id22));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -9018,7 +9497,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id18) => permissionsRepository.findById(id18))
+    permissionIds.map((id22) => permissionsRepository.findById(id22))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -9266,10 +9745,9 @@ import {
   VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError2
 } from "@spfn/auth/errors";
 
-// src/server/lib/config.ts
-init_email();
-import { env as env4 } from "@spfn/auth/config";
-import { PasskeyConfigError } from "@spfn/auth/errors";
+// src/server/services/oauth2-grant.service.ts
+init_oauth2_grants_repository();
+import { OAuth2GrantNotFoundError } from "@spfn/auth/errors";
 
 // src/server/logger.ts
 import { logger as rootLogger } from "@spfn/core/logger";
@@ -9290,7 +9768,43 @@ var authLogger = {
   sms: rootLogger.child("@spfn/auth:sms")
 };
 
+// src/server/services/oauth2-grant.service.ts
+async function listOAuth2GrantsService(userId) {
+  const rows = await oauth2GrantsRepository.listActiveByUserId(userId);
+  return rows.map(({ grant, client }) => ({
+    id: Number(grant.id),
+    clientId: client.clientId,
+    clientName: client.clientName,
+    resource: grant.resource,
+    scopes: grant.scopes,
+    createdAtMillis: grant.createdAt.getTime(),
+    lastUsedAtMillis: client.lastUsedAt?.getTime()
+  }));
+}
+async function revokeOAuth2GrantService(id22, userId) {
+  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id22, userId);
+  if (!revoked) {
+    throw new OAuth2GrantNotFoundError();
+  }
+  await oauth2GrantsRepository.revokeTokensOfGrants([revoked.id]);
+}
+async function revokeAllOAuth2GrantsForUser(userId) {
+  const grantIds = await oauth2GrantsRepository.revokeAllActiveByUserId(userId);
+  if (grantIds.length === 0) {
+    return;
+  }
+  const tokens = await oauth2GrantsRepository.revokeTokensOfGrants(grantIds);
+  authLogger.service.info("OAuth2 grants revoked for a user", {
+    userId,
+    grants: grantIds.length,
+    tokens
+  });
+}
+
 // src/server/lib/config.ts
+init_email();
+import { env as env4 } from "@spfn/auth/config";
+import { PasskeyConfigError } from "@spfn/auth/errors";
 function getCookieSuffix() {
   const port = process.env.SPFN_PORT;
   return port ? `_${port}` : "";
@@ -9355,10 +9869,10 @@ var globalConfig = {
   sessionTtl: "7d"
   // Default: 7 days
 };
-function configureAuth(config3) {
+function configureAuth(config4) {
   globalConfig = {
     ...globalConfig,
-    ...config3
+    ...config4
   };
 }
 function getAuthConfig() {
@@ -9402,8 +9916,13 @@ function getCsrfMode() {
   }
   return normalized;
 }
+var PACKAGE_CSRF_EXEMPT_PATHS = [
+  "/_auth/oauth2/register",
+  "/_auth/oauth2/token",
+  "/_auth/oauth2/revoke"
+];
 function getCsrfExemptPaths() {
-  return globalConfig.csrf?.exemptPaths ?? [];
+  return [...PACKAGE_CSRF_EXEMPT_PATHS, ...globalConfig.csrf?.exemptPaths ?? []];
 }
 var PASSKEY_USER_VERIFICATIONS = ["preferred", "required"];
 var DEFAULT_CHALLENGE_TTL_SECONDS = 300;
@@ -9963,6 +10482,7 @@ async function revokeAllKeysService(params) {
   const { userId, currentKeyId, includeCurrent = false, reason } = params;
   const revoked = includeCurrent ? await keysRepository.revokeAllActiveByUserId(userId, reason) : await keysRepository.revokeAllActiveByUserIdExcept(userId, currentKeyId, reason);
   await deviceAuthorizationsRepository.denyAllActiveByUserId(userId);
+  await revokeAllOAuth2GrantsForUser(userId);
   return { revokedCount: revoked.length, currentKeyRevoked: includeCurrent };
 }
 
@@ -10040,7 +10560,7 @@ async function updateUsernameService(userId, username) {
 // src/server/services/account-deletion.service.ts
 init_repositories();
 import { ValidationError as ValidationError2, NotFoundError as NotFoundError2 } from "@spfn/core/errors";
-import { runInTransaction, onAfterCommit } from "@spfn/core/db";
+import { runInTransaction as runInTransaction2, onAfterCommit } from "@spfn/core/db";
 import { sendEmail as sendEmail3 } from "@spfn/notification/server";
 import {
   InvalidCredentialsError,
@@ -10230,8 +10750,8 @@ async function verifyReauthCredential(user, params) {
     throw new VerificationTokenTargetMismatchError();
   }
 }
-async function sendDeletionEmail(to, subject, text18) {
-  const result = await sendEmail3({ to, subject, text: text18 });
+async function sendDeletionEmail(to, subject, text22) {
+  const result = await sendEmail3({ to, subject, text: text22 });
   if (!result.success) {
     authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
   }
@@ -10283,12 +10803,12 @@ async function requestAccountDeletionService(userId, params) {
   if (requestedBy === "self") {
     await verifyReauthCredential(user, { password, verificationToken });
   }
-  const config3 = getDeletionConfig();
+  const config4 = getDeletionConfig();
   const wantsImmediate = immediate === true;
-  if (wantsImmediate && requestedBy === "self" && !config3.allowSelfImmediate) {
+  if (wantsImmediate && requestedBy === "self" && !config4.allowSelfImmediate) {
     throw new ImmediateDeletionNotAllowedError();
   }
-  const gracePeriodDays = wantsImmediate ? 0 : config3.gracePeriodDays;
+  const gracePeriodDays = wantsImmediate ? 0 : config4.gracePeriodDays;
   const requestedAt = /* @__PURE__ */ new Date();
   const purgeScheduledAt = addDays(requestedAt, gracePeriodDays);
   await usersRepository.updateById(user.id, { status: "pending_deletion" });
@@ -10311,6 +10831,7 @@ async function requestAccountDeletionService(userId, params) {
   }
   await keysRepository.revokeAllActiveByUserId(user.id, "Account deletion requested");
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
+  await revokeAllOAuth2GrantsForUser(user.id);
   onAfterCommit(() => authDeletionRequestedEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId,
@@ -10394,10 +10915,10 @@ async function purgePendingRequest(request) {
   if (!precheckUser || precheckUser.status !== "pending_deletion") {
     return { outcome: "skipped" };
   }
-  const config3 = getDeletionConfig();
-  if (config3.onBeforePurge) {
+  const config4 = getDeletionConfig();
+  if (config4.onBeforePurge) {
     try {
-      await config3.onBeforePurge({
+      await config4.onBeforePurge({
         id: precheckUser.id,
         publicId: precheckUser.publicId,
         email: precheckUser.email,
@@ -10411,9 +10932,9 @@ async function purgePendingRequest(request) {
       return { outcome: "skipped" };
     }
   }
-  const purgeStrategy = config3.purgeStrategy;
+  const purgeStrategy = config4.purgeStrategy;
   let purgedUser = null;
-  await runInTransaction(async () => {
+  await runInTransaction2(async () => {
     const user = await usersRepository.findById(userId);
     if (!user || user.status !== "pending_deletion") {
       return;
@@ -10634,6 +11155,7 @@ async function changePasswordService(params) {
   const newPasswordHash = await hashPassword(newPassword);
   await usersRepository.updatePassword(userId, newPasswordHash, true);
   await deviceAuthorizationsRepository.denyAllActiveByUserId(userId);
+  await revokeAllOAuth2GrantsForUser(userId);
   await keysRepository.revokeAllActiveByUserId(userId, "Revoked by password change");
 }
 
@@ -10829,6 +11351,7 @@ async function replaceCredentials(row, user, params) {
     ...user.emailVerifiedAt ? {} : { emailVerifiedAt: /* @__PURE__ */ new Date() }
   });
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
+  await revokeAllOAuth2GrantsForUser(user.id);
   await keysRepository.revokeAllActiveByUserId(user.id, "Revoked by password reset");
   await registerPublicKeyService({
     userId: user.id,
@@ -11106,7 +11629,7 @@ async function completeDeviceLogin(record) {
 
 // src/server/services/passkey.service.ts
 import crypto6 from "crypto";
-import { onAfterCommit as onAfterCommit4, runInTransaction as runInTransaction2 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit4, runInTransaction as runInTransaction3 } from "@spfn/core/db";
 import { ValidationError as ValidationError5 } from "@spfn/core/errors";
 import {
   AccountDisabledError as AccountDisabledError3,
@@ -11258,9 +11781,9 @@ function presentedChallenge(clientDataJSON) {
   const decoded = parseJson(Buffer.from(clientDataJSON, "base64url").toString("utf8"));
   return typeof decoded?.challenge === "string" ? decoded.challenge : "";
 }
-function parseJson(text18) {
+function parseJson(text22) {
   try {
-    return JSON.parse(text18);
+    return JSON.parse(text22);
   } catch {
     return null;
   }
@@ -11364,7 +11887,7 @@ async function startPasskeyLoginService() {
 }
 async function finishPasskeyLoginService(params) {
   assertDeviceKeyPresent(params);
-  return runInTransaction2(async () => {
+  return runInTransaction3(async () => {
     const challenge = presentedChallenge(params.response.response.clientDataJSON);
     await consumeChallenge(challenge, "authentication", null);
     const passkey = await passkeysRepository.findLiveByCredentialId(params.response.id);
@@ -11563,51 +12086,51 @@ async function initializeAuth(options = {}) {
   authLogger.service.info("\u{1F512} Built-in roles: user, admin, superadmin");
 }
 async function syncRoles(configs, existingByName) {
-  for (const config3 of configs) {
-    const existing = existingByName.get(config3.name);
+  for (const config4 of configs) {
+    const existing = existingByName.get(config4.name);
     if (!existing) {
       await rolesRepository.create({
-        name: config3.name,
-        displayName: config3.displayName,
-        description: config3.description || null,
-        priority: config3.priority ?? 10,
-        isSystem: config3.isSystem ?? false,
-        isBuiltin: config3.isBuiltin ?? false,
+        name: config4.name,
+        displayName: config4.displayName,
+        description: config4.description || null,
+        priority: config4.priority ?? 10,
+        isSystem: config4.isSystem ?? false,
+        isBuiltin: config4.isBuiltin ?? false,
         isActive: true
       });
-      authLogger.service.info(`  \u2705 Created role: ${config3.name}`);
+      authLogger.service.info(`  \u2705 Created role: ${config4.name}`);
     } else {
       const updateData = {
-        displayName: config3.displayName,
-        description: config3.description || null
+        displayName: config4.displayName,
+        description: config4.description || null
       };
       if (!existing.isBuiltin) {
-        updateData.priority = config3.priority ?? existing.priority;
+        updateData.priority = config4.priority ?? existing.priority;
       }
       await rolesRepository.updateById(existing.id, updateData);
     }
   }
 }
 async function syncPermissions(configs, existingByName) {
-  for (const config3 of configs) {
-    const existing = existingByName.get(config3.name);
+  for (const config4 of configs) {
+    const existing = existingByName.get(config4.name);
     if (!existing) {
       await permissionsRepository.create({
-        name: config3.name,
-        displayName: config3.displayName,
-        description: config3.description || null,
-        category: config3.category || null,
-        isSystem: config3.isSystem ?? false,
-        isBuiltin: config3.isBuiltin ?? false,
+        name: config4.name,
+        displayName: config4.displayName,
+        description: config4.description || null,
+        category: config4.category || null,
+        isSystem: config4.isSystem ?? false,
+        isBuiltin: config4.isBuiltin ?? false,
         isActive: true,
         metadata: null
       });
-      authLogger.service.info(`  \u2705 Created permission: ${config3.name}`);
+      authLogger.service.info(`  \u2705 Created permission: ${config4.name}`);
     } else {
       await permissionsRepository.updateById(existing.id, {
-        displayName: config3.displayName,
-        description: config3.description || null,
-        category: config3.category || null
+        displayName: config4.displayName,
+        description: config4.description || null,
+        category: config4.category || null
       });
     }
   }
@@ -11668,7 +12191,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id18) => permissionsRepository.findById(id18))
+      permIds.map((id22) => permissionsRepository.findById(id22))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -11882,20 +12405,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id18, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id18);
+async function cancelInvitation(id22, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id22);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id18, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id22, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id18) {
-  await invitationsRepository.deleteById(id18);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id18}`);
+async function deleteInvitation(id22) {
+  await invitationsRepository.deleteById(id22);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id22}`);
 }
 async function expireOldInvitations() {
   const count = await invitationsRepository.updateExpiredInvitations();
@@ -11904,8 +12427,8 @@ async function expireOldInvitations() {
   }
   return count;
 }
-async function resendInvitation(id18, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id18);
+async function resendInvitation(id22, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id22);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
@@ -11913,7 +12436,7 @@ async function resendInvitation(id18, expiresInDays = 7) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id18, newExpiresAt);
+  const updated = await invitationsRepository.resend(id22, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -11952,13 +12475,13 @@ async function getAuthSessionService(userId) {
 // src/server/lib/one-time-token.ts
 import { SSETokenManager } from "@spfn/core/event/sse";
 var manager = null;
-function initOneTimeTokenManager(config3) {
+function initOneTimeTokenManager(config4) {
   if (manager) {
     manager.destroy();
   }
   manager = new SSETokenManager({
-    ttl: config3?.ttl,
-    store: config3?.store
+    ttl: config4?.ttl,
+    store: config4?.store
   });
 }
 function getOneTimeTokenManager() {
@@ -12106,10 +12629,10 @@ function getDefaultScopes() {
 }
 function getGoogleAuthUrl(state, scopes) {
   const resolvedScopes = scopes ?? getDefaultScopes();
-  const config3 = getGoogleOAuthConfig();
+  const config4 = getGoogleOAuthConfig();
   const params = new URLSearchParams({
-    client_id: config3.clientId,
-    redirect_uri: config3.redirectUri,
+    client_id: config4.clientId,
+    redirect_uri: config4.redirectUri,
     response_type: "code",
     scope: resolvedScopes.join(" "),
     state,
@@ -12121,16 +12644,16 @@ function getGoogleAuthUrl(state, scopes) {
   return `${GOOGLE_AUTH_URL}?${params.toString()}`;
 }
 async function exchangeCodeForTokens(code) {
-  const config3 = getGoogleOAuthConfig();
+  const config4 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config3.clientId,
-      client_secret: config3.clientSecret,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      client_secret: config4.clientSecret,
+      redirect_uri: config4.redirectUri,
       grant_type: "authorization_code",
       code
     })
@@ -12154,15 +12677,15 @@ async function getGoogleUserInfo(accessToken) {
   return response.json();
 }
 async function refreshAccessToken(refreshToken) {
-  const config3 = getGoogleOAuthConfig();
+  const config4 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config3.clientId,
-      client_secret: config3.clientSecret,
+      client_id: config4.clientId,
+      client_secret: config4.clientSecret,
       refresh_token: refreshToken,
       grant_type: "refresh_token"
     })
@@ -12227,8 +12750,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id18) {
-  return registry2.get(id18);
+function getOAuthProvider(id22) {
+  return registry2.get(id22);
 }
 function getRegisteredProviders() {
   return [...registry2.values()];
@@ -12482,21 +13005,21 @@ var githubProvider = {
     return !!(env3.SPFN_AUTH_GITHUB_CLIENT_ID && env3.SPFN_AUTH_GITHUB_CLIENT_SECRET);
   },
   getAuthUrl(state, scopes) {
-    const config3 = getGithubConfig();
+    const config4 = getGithubConfig();
     const params = new URLSearchParams({
-      client_id: config3.clientId,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      redirect_uri: config4.redirectUri,
       state,
       scope: (scopes ?? getGithubScopes()).join(" ")
     });
     return `${GITHUB_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code) {
-    const config3 = getGithubConfig();
+    const config4 = getGithubConfig();
     return requestGithubTokens(new URLSearchParams({
-      client_id: config3.clientId,
-      client_secret: config3.clientSecret,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      client_secret: config4.clientSecret,
+      redirect_uri: config4.redirectUri,
       code
     }));
   },
@@ -12526,11 +13049,11 @@ var githubProvider = {
     };
   },
   async refreshTokens(refreshToken) {
-    const config3 = getGithubConfig();
+    const config4 = getGithubConfig();
     return requestGithubTokens(new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config3.clientId,
-      client_secret: config3.clientSecret,
+      client_id: config4.clientId,
+      client_secret: config4.clientSecret,
       refresh_token: refreshToken
     }));
   }
@@ -12653,26 +13176,26 @@ var kakaoProvider = {
     return !!env3.SPFN_AUTH_KAKAO_CLIENT_ID;
   },
   getAuthUrl(state, scopes) {
-    const config3 = getKakaoConfig();
+    const config4 = getKakaoConfig();
     const params = new URLSearchParams({
       response_type: "code",
-      client_id: config3.clientId,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      redirect_uri: config4.redirectUri,
       state,
       scope: (scopes ?? getKakaoScopes()).join(",")
     });
     return `${KAKAO_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code) {
-    const config3 = getKakaoConfig();
+    const config4 = getKakaoConfig();
     const params = new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: config3.clientId,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      redirect_uri: config4.redirectUri,
       code
     });
-    if (config3.clientSecret) {
-      params.set("client_secret", config3.clientSecret);
+    if (config4.clientSecret) {
+      params.set("client_secret", config4.clientSecret);
     }
     return requestKakaoTokens(params);
   },
@@ -12714,14 +13237,14 @@ var kakaoProvider = {
     return options.accessToken ? withKakaoVerifiedEmail(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
-    const config3 = getKakaoConfig();
+    const config4 = getKakaoConfig();
     const params = new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config3.clientId,
+      client_id: config4.clientId,
       refresh_token: refreshToken
     });
-    if (config3.clientSecret) {
-      params.set("client_secret", config3.clientSecret);
+    if (config4.clientSecret) {
+      params.set("client_secret", config4.clientSecret);
     }
     return requestKakaoTokens(params);
   },
@@ -12879,22 +13402,22 @@ var naverProvider = {
     return !!(env3.SPFN_AUTH_NAVER_CLIENT_ID && env3.SPFN_AUTH_NAVER_CLIENT_SECRET);
   },
   getAuthUrl(state) {
-    const config3 = getNaverConfig();
+    const config4 = getNaverConfig();
     const params = new URLSearchParams({
       response_type: "code",
-      client_id: config3.clientId,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      redirect_uri: config4.redirectUri,
       state
     });
     return `${NAVER_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code, options) {
-    const config3 = getNaverConfig();
+    const config4 = getNaverConfig();
     return requestNaverTokens(new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: config3.clientId,
-      client_secret: config3.clientSecret,
-      redirect_uri: config3.redirectUri,
+      client_id: config4.clientId,
+      client_secret: config4.clientSecret,
+      redirect_uri: config4.redirectUri,
       code,
       state: options.state
     }));
@@ -12935,11 +13458,11 @@ var naverProvider = {
     return options.accessToken ? withNaverProfile(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
-    const config3 = getNaverConfig();
+    const config4 = getNaverConfig();
     return requestNaverTokens(new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config3.clientId,
-      client_secret: config3.clientSecret,
+      client_id: config4.clientId,
+      client_secret: config4.clientSecret,
       refresh_token: refreshToken
     }));
   },
@@ -13257,7 +13780,7 @@ async function oauthUnlinkNotifyService(provider, notification) {
 }
 
 // src/server/services/oauth-native.service.ts
-import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction4, onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
 import {
   InvalidKeyFingerprintError as InvalidKeyFingerprintError3,
   NativeSignInUnsupportedError as NativeSignInUnsupportedError5,
@@ -13290,7 +13813,7 @@ function assertNonceBindsPublicKey(params) {
   }
 }
 async function persistNativeLogin(identity, params) {
-  return runInTransaction3(async () => {
+  return runInTransaction4(async () => {
     const existing = await socialAccountsRepository.findByProviderAndProviderId(
       params.provider,
       identity.providerUserId
@@ -13371,89 +13894,818 @@ async function verifyOpsTokenService(token) {
     scopes: record.scopes
   };
 }
-async function revokeOpsTokenService(id18) {
-  return await opsTokensRepository.revokeById(id18);
+async function revokeOpsTokenService(id22) {
+  return await opsTokensRepository.revokeById(id22);
 }
 async function listOpsTokensService() {
   return await opsTokensRepository.list();
 }
 
-// src/server/routes/auth/index.ts
-init_esm();
-import { Transactional } from "@spfn/core/db";
-import { rateLimitPolicy } from "@spfn/core/middleware";
+// src/server/services/oauth2-client.service.ts
+init_oauth2_clients_repository();
+import { randomBytes as randomBytes4 } from "crypto";
 
-// src/server/lib/rate-limit-keys.ts
-init_email();
-import { createHash as createHash6 } from "crypto";
-import { getClientIp } from "@spfn/core/middleware";
-async function readJsonBody(c) {
-  try {
-    return await c.req.json();
-  } catch {
-    return {};
-  }
+// src/server/lib/oauth2/config.ts
+var DEFAULT_ACCESS_TOKEN_TTL_MS = 8 * 60 * 60 * 1e3;
+var DEFAULT_REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_CODE_TTL_MS = 60 * 1e3;
+var AUTHORIZE_PATH = "/oauth/authorize";
+var config3 = null;
+function resolveIssuerSource(env19 = process.env) {
+  return { value: env19.SPFN_API_URL, variable: "SPFN_API_URL" };
 }
-function accountKey(body) {
-  if (typeof body.email === "string" && body.email.trim()) {
-    return `email:${normalizeEmail(body.email)}`;
+function resolveAuthorizeUrl(env19) {
+  const appUrl = env19.NEXT_PUBLIC_SPFN_APP_URL || env19.SPFN_APP_URL || "http://localhost:3000";
+  return new URL(AUTHORIZE_PATH, appUrl).toString();
+}
+function configureAuthorizationServer(options, env19 = process.env) {
+  if (!options) {
+    config3 = null;
+    return;
   }
-  if (typeof body.phone === "string" && body.phone.trim()) {
-    return `phone:${body.phone.trim()}`;
+  const scopeNames = Object.keys(options.scopes ?? {});
+  if (scopeNames.length === 0) {
+    throw new Error(
+      "authorizationServer.scopes must name at least one scope. The names are published in /.well-known/oauth-authorization-server and shown on the consent screen, so there is nothing to derive them from."
+    );
   }
-  return void 0;
+  config3 = {
+    issuer: canonicalIssuer(options.issuer ?? resolveIssuerSource(env19).value ?? ""),
+    issuerSource: options.issuer ? "authorizationServer.issuer" : resolveIssuerSource(env19).variable,
+    authorizeUrl: options.authorizeUrl ?? resolveAuthorizeUrl(env19),
+    scopes: { ...options.scopes },
+    defaultScopes: options.defaultScopes ?? scopeNames,
+    allowedRedirectOrigins: options.allowedRedirectOrigins ?? [],
+    accessTokenTtlMs: options.accessTokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS,
+    refreshTokenTtlMs: options.refreshTokenTtlMs ?? DEFAULT_REFRESH_TOKEN_TTL_MS,
+    codeTtlMs: options.codeTtlMs ?? DEFAULT_CODE_TTL_MS
+  };
+  assertKnownDefaultScopes(config3);
 }
-function targetKey(body) {
-  if (typeof body.target !== "string" || !body.target.trim()) {
-    return void 0;
+function assertKnownDefaultScopes(resolved) {
+  const unknown = resolved.defaultScopes.filter((scope) => !(scope in resolved.scopes));
+  if (unknown.length > 0) {
+    throw new Error(
+      `authorizationServer.defaultScopes names ${unknown.join(", ")}, which authorizationServer.scopes does not describe. An authorize request with no scope would ask for something no consent screen can explain.`
+    );
   }
-  const type = typeof body.targetType === "string" ? body.targetType : "target";
-  const value = type === "email" ? normalizeEmail(body.target) : body.target.trim();
-  return `${type}:${value}`;
 }
-function byIpAndAccount(options = {}) {
-  return async (c) => {
-    const body = await readJsonBody(c);
-    const account = accountKey(body);
-    return [
-      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
-      account ? `acct:${account}` : void 0
-    ];
-  };
+function getAuthorizationServerConfig() {
+  return config3;
 }
-function byIpAndCaller(options = {}) {
-  return async (c) => {
-    const auth = getOptionalAuth(c);
-    return [
-      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
-      auth ? `caller:${auth.userId}` : void 0
-    ];
-  };
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
-function idTokenKey(body) {
-  if (typeof body.idToken !== "string" || !body.idToken) {
-    return void 0;
+function assertAuthorizationServerIssuer() {
+  const resolved = getAuthorizationServerConfig();
+  if (!resolved) {
+    return;
   }
-  return `tok:${createHash6("sha256").update(body.idToken).digest("hex")}`;
+  assertPublishableIssuer(resolved.issuer, resolved.issuerSource);
+  authLogger.service.info(
+    `OAuth 2.1 authorization server enabled. issuer=${resolved.issuer}, authorization_endpoint=${resolved.authorizeUrl}, scopes=${Object.keys(resolved.scopes).join(" ")}.`
+  );
 }
-function byIpAndIdToken(options = {}) {
-  return async (c) => {
-    const body = await readJsonBody(c);
-    return [
-      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
-      idTokenKey(body)
-    ];
-  };
+function canonicalIssuer(raw) {
+  const url = parseUrl(raw);
+  return url && isOriginOnly(raw, url) ? url.origin : raw;
 }
-function byIpAndTarget(options = {}) {
-  return async (c) => {
-    const body = await readJsonBody(c);
-    const target = targetKey(body);
-    return [
-      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
-      target ? `tgt:${target}` : void 0
-    ];
-  };
+function isOriginOnly(raw, url) {
+  return raw === url.origin || raw === `${url.origin}/`;
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function assertPublishableIssuer(issuer, source) {
+  const url = parseUrl(issuer);
+  if (!url) {
+    throw new Error(
+      `${source} must be an absolute URL for the OAuth 2.1 authorization server to issue tokens under; it is "${issuer}".`
+    );
+  }
+  assertIssuerIdentifiesOneOrigin(url, issuer, source);
+  assertIssuerTransportIsSafe(url, issuer, source);
+}
+function assertIssuerIdentifiesOneOrigin(url, issuer, source) {
+  if (url.username !== "" || url.password !== "") {
+    throw new Error(
+      `${source} must not carry a username or a password for the OAuth 2.1 authorization server. Credentials in an issuer are dropped by every client that compares one, so the identifier published in the metadata would not be the value configured here.`
+    );
+  }
+  if (!isOriginOnly(issuer, url)) {
+    throw new Error(
+      `${source} must be an origin with no path for the OAuth 2.1 authorization server; it is "${issuer}". /.well-known/oauth-authorization-server is served at an origin's root, so an issuer carrying a path publishes its metadata nowhere a client will look.`
+    );
+  }
+}
+function assertIssuerTransportIsSafe(url, issuer, source) {
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHostname(url.hostname))) {
+    throw new Error(
+      `${source} must be https, or http on localhost / 127.0.0.1 / [::1] for development; it is "${issuer}". Anything else carries access tokens over the network in the clear.`
+    );
+  }
+}
+
+// src/server/lib/oauth2/redirect-uri.ts
+function refuseRedirectUriRegistration(uri, allowedRedirectOrigins) {
+  let url;
+  try {
+    url = new URL(uri);
+  } catch {
+    return `"${uri}" is not an absolute URI.`;
+  }
+  if (url.hash !== "") {
+    return `"${uri}" carries a fragment. A fragment never survives the redirect, so a client that registered one would be waiting for something it can never be sent.`;
+  }
+  if (hasDotSegment(uri)) {
+    return `"${uri}" has a "." or ".." path segment. Those resolve away before a path is compared, so the URI does not name one destination; register the path it resolves to.`;
+  }
+  return refuseRedirectOrigin(url, uri, allowedRedirectOrigins);
+}
+function refuseRedirectOrigin(url, uri, allowedRedirectOrigins) {
+  if (url.protocol === "http:") {
+    return isLoopbackHostname(url.hostname) ? null : `"${uri}" is plain http off loopback. The authorization code would cross the network in the clear; register an https URI, or a loopback one for a client on this machine.`;
+  }
+  if (url.protocol !== "https:") {
+    return `"${uri}" is neither https nor loopback http. Custom-protocol redirects are not registered here.`;
+  }
+  return allowedRedirectOrigins.includes(url.origin) ? null : `"${uri}" is on an origin this application does not allow. Add ${url.origin} to authorizationServer.allowedRedirectOrigins, or register a loopback URI.`;
+}
+function hasDotSegment(uri) {
+  const path = uri.replace(/^[^:]*:[/\\]{0,2}[^/\\?#]*/, "").split(/[?#]/)[0] ?? "";
+  return path.split(/[/\\]/).some(isDotSegment);
+}
+function isDotSegment(segment) {
+  const decoded = segment.replace(/%2e/gi, ".");
+  return decoded === "." || decoded === "..";
+}
+function matchesRegisteredRedirectUri(presented, registered) {
+  let request;
+  try {
+    request = new URL(presented);
+  } catch {
+    return false;
+  }
+  if (request.hash !== "" || hasDotSegment(presented)) {
+    return false;
+  }
+  return registered.some((candidate) => sameRedirectTarget(request, candidate));
+}
+function sameRedirectTarget(request, registered) {
+  let known;
+  try {
+    known = new URL(registered);
+  } catch {
+    return false;
+  }
+  if (request.protocol !== known.protocol || request.hostname !== known.hostname || request.pathname !== known.pathname || request.search !== known.search) {
+    return false;
+  }
+  return portMayVary(known) || request.port === known.port;
+}
+function portMayVary(registered) {
+  return registered.protocol === "http:" && isLoopbackHostname(registered.hostname);
+}
+function redirectHostOf(uri) {
+  return new URL(uri).host;
+}
+
+// src/server/lib/oauth2/tokens.ts
+import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
+
+// src/server/lib/csrf.ts
+import { env as env16 } from "@spfn/auth/config";
+var CSRF_HEADER = "x-spfn-csrf";
+var CSRF_SUBKEY_LABEL = "spfn-auth-csrf-token-v1";
+var MAX_CANDIDATES = 32;
+function sessionSecret() {
+  const secret = env16.SPFN_AUTH_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "SPFN_AUTH_SESSION_SECRET is required for CSRF protection. Set it (sessions need it anyway), or set SPFN_AUTH_CSRF=off."
+    );
+  }
+  return secret;
+}
+async function hmacSha256(key, message) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key.buffer,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return new Uint8Array(signature);
+}
+function toHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function deriveCsrfToken(keyId) {
+  const subkey = await hmacSha256(new TextEncoder().encode(sessionSecret()), CSRF_SUBKEY_LABEL);
+  return toHex(await hmacSha256(subkey, keyId));
+}
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function matchesCsrfToken(expected, presented) {
+  if (!presented) {
+    return false;
+  }
+  return presented.split(",", MAX_CANDIDATES).some((candidate) => timingSafeEqualString(expected, candidate.trim()));
+}
+
+// src/server/lib/oauth2/tokens.ts
+var OAUTH2_ACCESS_TOKEN_PREFIX = "spfn_at_";
+var OAUTH2_REFRESH_TOKEN_PREFIX = "spfn_rt_";
+var SECRET_BYTES = 32;
+function hashOAuth2Secret(secret) {
+  return createHash6("sha256").update(secret).digest("hex");
+}
+function sameOAuth2Hash(a, b) {
+  return timingSafeEqualString(a, b);
+}
+function generateAccessToken() {
+  return OAUTH2_ACCESS_TOKEN_PREFIX + randomBytes3(SECRET_BYTES).toString("hex");
+}
+function generateRefreshToken() {
+  return OAUTH2_REFRESH_TOKEN_PREFIX + randomBytes3(SECRET_BYTES).toString("hex");
+}
+function generateAuthorizationCode() {
+  return randomBytes3(SECRET_BYTES).toString("base64url");
+}
+function isAccessTokenShaped(bearer) {
+  return typeof bearer === "string" && bearer.startsWith(OAUTH2_ACCESS_TOKEN_PREFIX);
+}
+function pkceChallengeFor(codeVerifier) {
+  return createHash6("sha256").update(codeVerifier).digest("base64url");
+}
+var PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
+var PKCE_S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+function isPkceVerifierShaped(codeVerifier) {
+  return PKCE_VERIFIER.test(codeVerifier);
+}
+function isPkceS256ChallengeShaped(codeChallenge) {
+  return PKCE_S256_CHALLENGE.test(codeChallenge);
+}
+function toEpochSeconds(at) {
+  return Math.floor(at.getTime() / 1e3);
+}
+function secondsUntil(at, from = /* @__PURE__ */ new Date()) {
+  return Math.max(0, Math.floor((at.getTime() - from.getTime()) / 1e3));
+}
+
+// src/server/services/oauth2-client.service.ts
+var MAX_UNGRANTED_CLIENTS_PER_IP = 20;
+var UNGRANTED_CLIENT_WINDOW_MS = 60 * 60 * 1e3;
+var STALE_CLIENT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var SUPPORTED_AUTH_METHOD = "none";
+var SUPPORTED_GRANT_TYPES = ["authorization_code", "refresh_token"];
+var SUPPORTED_RESPONSE_TYPES = ["code"];
+function refuse(status, error, description) {
+  return { ok: false, status, error, description };
+}
+function requireConfig() {
+  const config4 = getAuthorizationServerConfig();
+  if (!config4) {
+    throw new Error("OAuth2 client service called with no authorization server configured.");
+  }
+  return config4;
+}
+function asStringArray(value) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    return null;
+  }
+  return value;
+}
+function refuseDeclaredMetadata(request) {
+  const { token_endpoint_auth_method: authMethod } = request;
+  if (authMethod !== void 0 && authMethod !== SUPPORTED_AUTH_METHOD) {
+    return refuse(
+      400,
+      "invalid_client_metadata",
+      `token_endpoint_auth_method must be "${SUPPORTED_AUTH_METHOD}". This authorization server registers public clients only \u2014 a client on a user's own machine cannot keep a secret.`
+    );
+  }
+  return refuseListedMetadata("grant_types", request.grant_types, SUPPORTED_GRANT_TYPES) ?? refuseListedMetadata("response_types", request.response_types, SUPPORTED_RESPONSE_TYPES);
+}
+function refuseListedMetadata(field, value, supported) {
+  if (value === void 0) {
+    return null;
+  }
+  const declared = asStringArray(value);
+  if (!declared || declared.length === 0 || declared.some((entry) => !supported.includes(entry))) {
+    return refuse(
+      400,
+      "invalid_client_metadata",
+      `${field} must be a non-empty subset of ${supported.join(", ")}.`
+    );
+  }
+  return null;
+}
+function refuseRedirectUris(uris, allowedRedirectOrigins) {
+  const declared = asStringArray(uris);
+  if (!declared || declared.length === 0) {
+    return refuse(
+      400,
+      "invalid_client_metadata",
+      "redirect_uris must list at least one absolute URI. There is nowhere to send an authorization code without one."
+    );
+  }
+  for (const uri of declared) {
+    const detail = refuseRedirectUriRegistration(uri, allowedRedirectOrigins);
+    if (detail) {
+      return refuse(400, "invalid_redirect_uri", detail);
+    }
+  }
+  return null;
+}
+async function registerOAuth2ClientService(request, clientIp) {
+  const config4 = requireConfig();
+  const refusal = refuseRedirectUris(request.redirect_uris, config4.allowedRedirectOrigins) ?? refuseDeclaredMetadata(request);
+  if (refusal) {
+    return refusal;
+  }
+  const record = await createUnderStandingCap(newClientRow(request, clientIp), clientIp);
+  if (!record) {
+    return refuse(429, "invalid_client_metadata", OVER_STANDING_CAP_MESSAGE);
+  }
+  authLogger.service.info("OAuth2 client registered", { clientName: record.clientName });
+  return { ok: true, client: describeClient(record) };
+}
+var OVER_STANDING_CAP_MESSAGE = `This address has registered ${MAX_UNGRANTED_CLIENTS_PER_IP} clients in the last hour that nobody has approved. Complete or abandon one of those, or try again later.`;
+function newClientRow(request, clientIp) {
+  const redirectUris = asStringArray(request.redirect_uris);
+  return {
+    clientId: `spfn_client_${randomBytes4(16).toString("hex")}`,
+    clientName: clientNameOf(request.client_name, redirectUris[0]),
+    redirectUris,
+    createdIp: clientIp
+  };
+}
+async function createUnderStandingCap(data, clientIp) {
+  if (!clientIp) {
+    return await oauth2ClientsRepository.create(data);
+  }
+  return await oauth2ClientsRepository.createWithinStandingCap(data, {
+    ip: clientIp,
+    max: MAX_UNGRANTED_CLIENTS_PER_IP,
+    windowMs: UNGRANTED_CLIENT_WINDOW_MS
+  });
+}
+function clientNameOf(declared, firstRedirectUri) {
+  if (typeof declared === "string" && declared.trim()) {
+    return declared.trim();
+  }
+  return new URL(firstRedirectUri).host;
+}
+function describeClient(record) {
+  return {
+    client_id: record.clientId,
+    client_id_issued_at: toEpochSeconds(record.createdAt),
+    client_name: record.clientName,
+    redirect_uris: record.redirectUris,
+    token_endpoint_auth_method: SUPPORTED_AUTH_METHOD,
+    grant_types: SUPPORTED_GRANT_TYPES,
+    response_types: SUPPORTED_RESPONSE_TYPES
+  };
+}
+async function purgeStaleOAuth2ClientsService() {
+  const deleted = await oauth2ClientsRepository.deleteStaleUngranted(
+    new Date(Date.now() - STALE_CLIENT_MAX_AGE_MS)
+  );
+  return { deleted };
+}
+
+// src/server/services/oauth2-authorize.service.ts
+init_oauth2_clients_repository();
+init_oauth2_grants_repository();
+init_oauth2_authorization_codes_repository();
+import {
+  OAuth2AuthorizeRedirectError,
+  OAuth2RedirectUriMismatchError,
+  OAuth2UnknownClientError
+} from "@spfn/auth/errors";
+
+// src/server/lib/oauth2/resource.ts
+function normalizeResource(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.hash !== "") {
+    return null;
+  }
+  return url.toString();
+}
+function sameResource(presented, granted) {
+  const left = normalizeResource(presented);
+  return left !== null && left === normalizeResource(granted);
+}
+
+// src/server/services/oauth2-authorize.service.ts
+function requireConfig2() {
+  const config4 = getAuthorizationServerConfig();
+  if (!config4) {
+    throw new Error("OAuth2 authorize service called with no authorization server configured.");
+  }
+  return config4;
+}
+async function resolveRedirectTarget(params) {
+  const client = await oauth2ClientsRepository.findByClientId(params.clientId);
+  if (!client) {
+    throw new OAuth2UnknownClientError();
+  }
+  if (!matchesRegisteredRedirectUri(params.redirectUri, client.redirectUris)) {
+    throw new OAuth2RedirectUriMismatchError();
+  }
+  return { client, redirectUri: params.redirectUri };
+}
+function resolveScopes(params, config4) {
+  const requested = params.scope?.trim();
+  if (!requested) {
+    return config4.defaultScopes;
+  }
+  return requested.split(/\s+/);
+}
+var PKCE_REQUIRED_MESSAGE = "code_challenge with code_challenge_method=S256 is required, and the challenge must be the 43 base64url characters that transform produces. Neither plain PKCE nor a request without PKCE is accepted, because a code intercepted on the loopback listener would otherwise be exchangeable by whoever intercepted it.";
+var RESOURCE_REQUIRED_MESSAGE = "resource is required and must be an absolute URI with no fragment (RFC 8707). A token issued without a stated target is a token good against everything.";
+function refuseRedirectable(params, redirectUri, error, message) {
+  throw new OAuth2AuthorizeRedirectError({ error, redirectUri, state: params.state, message });
+}
+function hasUsableS256Challenge(params) {
+  return params.codeChallengeMethod === "S256" && !!params.codeChallenge && isPkceS256ChallengeShaped(params.codeChallenge);
+}
+function assertRedirectableRules(params, redirectUri, config4) {
+  if (!hasUsableS256Challenge(params)) {
+    refuseRedirectable(params, redirectUri, "invalid_request", PKCE_REQUIRED_MESSAGE);
+  }
+  const resource = params.resource ? normalizeResource(params.resource) : null;
+  if (!resource) {
+    refuseRedirectable(params, redirectUri, "invalid_target", RESOURCE_REQUIRED_MESSAGE);
+  }
+  const scopes = resolveScopes(params, config4);
+  const unknown = scopes.filter((scope) => !(scope in config4.scopes));
+  if (unknown.length > 0) {
+    refuseRedirectable(params, redirectUri, "invalid_scope", `Unknown scope: ${unknown.join(", ")}.`);
+  }
+  return { resource, scopes, codeChallenge: params.codeChallenge };
+}
+async function validate(params) {
+  const config4 = requireConfig2();
+  const { client, redirectUri } = await resolveRedirectTarget(params);
+  const { resource, scopes, codeChallenge } = assertRedirectableRules(params, redirectUri, config4);
+  return { client, redirectUri, resource, scopes, codeChallenge, state: params.state };
+}
+async function describeOAuth2AuthorizeRequestService(params) {
+  const config4 = requireConfig2();
+  const validated = await validate(params);
+  return {
+    clientName: validated.client.clientName,
+    redirectHost: redirectHostOf(validated.redirectUri),
+    scopes: validated.scopes.map((name) => ({ name, description: config4.scopes[name] })),
+    resource: validated.resource
+  };
+}
+async function approveOAuth2AuthorizeService(params, userId) {
+  const config4 = requireConfig2();
+  const validated = await validate(params);
+  const grant = await oauth2GrantsRepository.upsert({
+    client: validated.client.id,
+    user: userId,
+    resource: validated.resource,
+    scopes: validated.scopes
+  });
+  const code = generateAuthorizationCode();
+  await oauth2AuthorizationCodesRepository.create({
+    codeHash: hashOAuth2Secret(code),
+    grant: grant.id,
+    redirectUri: validated.redirectUri,
+    codeChallenge: validated.codeChallenge,
+    expiresAt: new Date(Date.now() + config4.codeTtlMs)
+  });
+  return { code, redirectUri: validated.redirectUri, state: validated.state };
+}
+async function denyOAuth2AuthorizeService(params) {
+  const validated = await validate(params);
+  throw new OAuth2AuthorizeRedirectError({
+    error: "access_denied",
+    redirectUri: validated.redirectUri,
+    state: validated.state,
+    message: "The account owner refused this authorization request."
+  });
+}
+
+// src/server/services/oauth2-token.service.ts
+init_oauth2_clients_repository();
+init_oauth2_grants_repository();
+init_oauth2_authorization_codes_repository();
+init_oauth2_tokens_repository();
+import { runInTransaction as runInTransaction5 } from "@spfn/core/db";
+function invalidGrant() {
+  return {
+    ok: false,
+    error: "invalid_grant",
+    description: "The authorization code or refresh token is invalid, expired, already used, or was issued to another client."
+  };
+}
+function refuse2(error, description) {
+  return { ok: false, error, description };
+}
+function requireConfig3() {
+  const config4 = getAuthorizationServerConfig();
+  if (!config4) {
+    throw new Error("OAuth2 token service called with no authorization server configured.");
+  }
+  return config4;
+}
+async function oauth2TokenService(request) {
+  if (request.grant_type === "authorization_code") {
+    return await exchangeAuthorizationCode(request);
+  }
+  if (request.grant_type === "refresh_token") {
+    return await refreshTokens(request);
+  }
+  return refuse2(
+    "unsupported_grant_type",
+    "grant_type must be authorization_code or refresh_token."
+  );
+}
+async function exchangeAuthorizationCode(request) {
+  if (!request.code || !request.code_verifier || !request.client_id || !request.redirect_uri) {
+    return refuse2(
+      "invalid_request",
+      "authorization_code requires code, code_verifier, client_id and redirect_uri."
+    );
+  }
+  const codeHash = hashOAuth2Secret(request.code);
+  const record = await oauth2AuthorizationCodesRepository.findByCodeHash(codeHash);
+  if (!record || !sameOAuth2Hash(record.codeHash, codeHash)) {
+    return invalidGrant();
+  }
+  const pair = await oauth2GrantsRepository.findWithClientById(record.grant);
+  if (!pair || pair.grant.revokedAt !== null || !boundToRequest(request, record, pair.client)) {
+    return invalidGrant();
+  }
+  return await spendBoundCode(request, record, pair);
+}
+function boundToRequest(request, record, client) {
+  if (request.client_id !== client.clientId || request.redirect_uri !== record.redirectUri) {
+    return false;
+  }
+  if (!isPkceVerifierShaped(request.code_verifier)) {
+    return false;
+  }
+  return sameOAuth2Hash(pkceChallengeFor(request.code_verifier), record.codeChallenge);
+}
+async function spendBoundCode(request, record, pair) {
+  if (record.usedAt !== null) {
+    await revokeGrantAndTokens(record.grant, "authorization code presented twice");
+    return invalidGrant();
+  }
+  if (!await oauth2AuthorizationCodesRepository.consume(record.codeHash)) {
+    return invalidGrant();
+  }
+  if (resolveResource(request.resource, pair.grant) === null) {
+    return refuse2("invalid_target", "resource does not match the resource this grant was issued for.");
+  }
+  return { ok: true, tokens: await issueTokenPair(pair.grant, pair.grant.scopes) };
+}
+async function refreshTokens(request) {
+  if (!request.refresh_token || !request.client_id) {
+    return refuse2("invalid_request", "refresh_token requires refresh_token and client_id.");
+  }
+  const tokenHash = hashOAuth2Secret(request.refresh_token);
+  const presented = await oauth2TokensRepository.findByTokenHash(tokenHash);
+  if (!presented || !sameOAuth2Hash(presented.tokenHash, tokenHash) || presented.kind !== "refresh") {
+    return invalidGrant();
+  }
+  if (presented.replacedAt !== null) {
+    await revokeGrantAndTokens(presented.grant, "rotated refresh token presented again");
+    return invalidGrant();
+  }
+  if (presented.revokedAt !== null || presented.expiresAt.getTime() <= Date.now()) {
+    return invalidGrant();
+  }
+  return await rotateRefresh(request, tokenHash, presented.grant, presented.scopes);
+}
+async function rotateRefresh(request, tokenHash, grantId, presentedScopes) {
+  const pair = await oauth2GrantsRepository.findWithClientById(grantId);
+  if (!pair || pair.grant.revokedAt !== null || request.client_id !== pair.client.clientId) {
+    return invalidGrant();
+  }
+  if (resolveResource(request.resource, pair.grant) === null) {
+    return refuse2("invalid_target", "resource does not match the resource this grant was issued for.");
+  }
+  const scopes = resolveRefreshScopes(request.scope, pair.grant, presentedScopes);
+  if (!scopes) {
+    return refuse2("invalid_scope", "A refresh may ask for a subset of the granted scopes, never more.");
+  }
+  if (!await oauth2TokensRepository.rotate(tokenHash)) {
+    return await refuseLostRotation(tokenHash, grantId);
+  }
+  return { ok: true, tokens: await issueTokenPair(pair.grant, scopes) };
+}
+async function refuseLostRotation(tokenHash, grantId) {
+  const current = await oauth2TokensRepository.findByTokenHash(tokenHash);
+  if (current && current.replacedAt !== null) {
+    await revokeGrantAndTokens(grantId, "refresh token rotated twice concurrently");
+  }
+  return invalidGrant();
+}
+function resolveRefreshScopes(requested, grant, presentedScopes) {
+  const asked = requested?.trim();
+  if (!asked) {
+    return presentedScopes;
+  }
+  const scopes = asked.split(/\s+/);
+  return scopes.every((scope) => grant.scopes.includes(scope)) ? scopes : null;
+}
+function resolveResource(requested, grant) {
+  if (!requested) {
+    return grant.resource;
+  }
+  return sameResource(requested, grant.resource) ? grant.resource : null;
+}
+async function issueTokenPair(grant, scopes) {
+  const config4 = requireConfig3();
+  const accessToken = generateAccessToken();
+  const refreshToken = generateRefreshToken();
+  const expiresAt = new Date(Date.now() + config4.accessTokenTtlMs);
+  await runInTransaction5(async () => {
+    await storeToken(accessToken, "access", grant.id, scopes, expiresAt);
+    await storeToken(
+      refreshToken,
+      "refresh",
+      grant.id,
+      scopes,
+      new Date(Date.now() + config4.refreshTokenTtlMs)
+    );
+  });
+  oauth2ClientsRepository.updateLastUsedById(grant.client).catch((err) => authLogger.service.error("Failed to update OAuth2 client lastUsedAt", err));
+  return {
+    access_token: accessToken,
+    token_type: "Bearer",
+    expires_in: secondsUntil(expiresAt),
+    refresh_token: refreshToken,
+    scope: scopes.join(" ")
+  };
+}
+async function storeToken(token, kind, grantId, scopes, expiresAt) {
+  await oauth2TokensRepository.create({
+    tokenHash: hashOAuth2Secret(token),
+    kind,
+    grant: grantId,
+    scopes,
+    expiresAt
+  });
+}
+async function revokeGrantAndTokens(grantId, reason) {
+  await oauth2GrantsRepository.revokeById(grantId);
+  await oauth2GrantsRepository.revokeTokensOfGrants([grantId]);
+  authLogger.service.warn("OAuth2 grant revoked after a replay", { grantId, reason });
+}
+async function revokeOAuth2TokenService(token, clientId) {
+  if (!token) {
+    return;
+  }
+  const tokenHash = hashOAuth2Secret(token);
+  const record = await oauth2TokensRepository.findByTokenHash(tokenHash);
+  if (!record || !sameOAuth2Hash(record.tokenHash, tokenHash)) {
+    return;
+  }
+  if (!await issuedToClient(record.grant, clientId)) {
+    return;
+  }
+  if (record.kind === "access") {
+    await oauth2TokensRepository.revokeByTokenHash(tokenHash);
+    return;
+  }
+  await oauth2GrantsRepository.revokeById(record.grant);
+  await oauth2GrantsRepository.revokeTokensOfGrants([record.grant]);
+}
+async function issuedToClient(grantId, clientId) {
+  const pair = await oauth2GrantsRepository.findWithClientById(grantId);
+  return pair?.client.clientId === clientId;
+}
+
+// src/server/services/oauth2-access-token.service.ts
+init_oauth2_grants_repository();
+init_oauth2_tokens_repository();
+async function verifyAccessToken(token, resource) {
+  if (!isAccessTokenShaped(token)) {
+    return null;
+  }
+  const tokenHash = hashOAuth2Secret(token);
+  const record = await oauth2TokensRepository.findByTokenHash(tokenHash);
+  if (!record || !sameOAuth2Hash(record.tokenHash, tokenHash) || !isUsable(record)) {
+    return null;
+  }
+  const pair = await oauth2GrantsRepository.findWithClientById(record.grant);
+  if (!pair || pair.grant.revokedAt !== null || !sameResource(resource, pair.grant.resource)) {
+    return null;
+  }
+  oauth2TokensRepository.updateLastUsedById(record.id).catch((err) => authLogger.service.error("Failed to update OAuth2 token lastUsedAt", err));
+  return {
+    clientId: pair.client.clientId,
+    scopes: record.scopes,
+    expiresAt: toEpochSeconds(record.expiresAt),
+    userId: String(pair.grant.user)
+  };
+}
+function isUsable(record) {
+  return record.kind === "access" && record.revokedAt === null && record.expiresAt.getTime() > Date.now();
+}
+
+// src/server/routes/auth/index.ts
+init_esm();
+import { Transactional } from "@spfn/core/db";
+import { rateLimitPolicy } from "@spfn/core/middleware";
+
+// src/server/lib/rate-limit-keys.ts
+init_email();
+import { createHash as createHash7 } from "crypto";
+import { getClientIp } from "@spfn/core/middleware";
+async function readJsonBody(c) {
+  try {
+    return await c.req.json();
+  } catch {
+    return {};
+  }
+}
+function accountKey(body) {
+  if (typeof body.email === "string" && body.email.trim()) {
+    return `email:${normalizeEmail(body.email)}`;
+  }
+  if (typeof body.phone === "string" && body.phone.trim()) {
+    return `phone:${body.phone.trim()}`;
+  }
+  return void 0;
+}
+function targetKey(body) {
+  if (typeof body.target !== "string" || !body.target.trim()) {
+    return void 0;
+  }
+  const type = typeof body.targetType === "string" ? body.targetType : "target";
+  const value = type === "email" ? normalizeEmail(body.target) : body.target.trim();
+  return `${type}:${value}`;
+}
+function byIpAndAccount(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    const account = accountKey(body);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      account ? `acct:${account}` : void 0
+    ];
+  };
+}
+function byIpAndCaller(options = {}) {
+  return async (c) => {
+    const auth = getOptionalAuth(c);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      auth ? `caller:${auth.userId}` : void 0
+    ];
+  };
+}
+function idTokenKey(body) {
+  if (typeof body.idToken !== "string" || !body.idToken) {
+    return void 0;
+  }
+  return `tok:${createHash7("sha256").update(body.idToken).digest("hex")}`;
+}
+function byIpAndIdToken(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      idTokenKey(body)
+    ];
+  };
+}
+function byIpAndTarget(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    const target = targetKey(body);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      target ? `tgt:${target}` : void 0
+    ];
+  };
 }
 
 // src/server/routes/auth/index.ts
@@ -13967,7 +15219,7 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/client-proof/refusal.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 
 // src/server/client-proof/canonical-json.ts
 var CanonicalJsonError = class extends Error {
@@ -13980,13 +15232,13 @@ var CanonicalJsonError = class extends Error {
 var INT64_MIN = -(2n ** 63n);
 var INT64_MAX = 2n ** 63n - 1n;
 function parseCanonicalJson(bytes) {
-  let text18;
+  let text22;
   try {
-    text18 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text22 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new CanonicalJsonError("INVALID_UTF8");
   }
-  const parser = new Parser(text18);
+  const parser = new Parser(text22);
   const value = parser.parseValue();
   parser.skipWhitespace();
   if (!parser.atEnd()) {
@@ -14007,8 +15259,8 @@ function isCanonicalBytes(bytes, value) {
   return true;
 }
 var Parser = class {
-  constructor(text18) {
-    this.text = text18;
+  constructor(text22) {
+    this.text = text22;
   }
   pos = 0;
   atEnd() {
@@ -14325,7 +15577,7 @@ var HTTP_STATUS = {
   CONTRACT_UNSUPPORTED: 409
 };
 function newHexId() {
-  return randomBytes3(16).toString("hex");
+  return randomBytes5(16).toString("hex");
 }
 var ClientProofRefusal = class _ClientProofRefusal {
   constructor(code, message) {
@@ -14427,7 +15679,7 @@ function contractViolation(message) {
 }
 
 // src/server/client-proof/contract-bundle.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import {
   CORE_TIME_OPERATION_ID as CORE_TIME_OPERATION_ID2,
   ServerTimeResponseSchema
@@ -14435,7 +15687,7 @@ import {
 init_types();
 
 // src/server/client-proof/proof.ts
-import { createHash as createHash7, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
+import { createHash as createHash8, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
 var CLIENT_PROOF_PROFILE = "clientProofV1";
 var ABSENT_BODY_SHA256 = "0".repeat(64);
 var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
@@ -14505,7 +15757,7 @@ function verifyClientProof(input, presentedProof, publicKey) {
   );
 }
 function sha256Hex(bytes) {
-  return createHash7("sha256").update(bytes).digest("hex");
+  return createHash8("sha256").update(bytes).digest("hex");
 }
 
 // src/server/client-proof/admission.ts
@@ -15735,16 +16987,16 @@ function extractBearer2(header) {
 }
 
 // src/server/middleware/ops-or-user.ts
-function opsOrUser(config3) {
-  const roles2 = config3.roles ?? [];
-  const permissions2 = config3.permissions ?? [];
-  if (!config3.opsScopes || config3.opsScopes.length === 0) {
+function opsOrUser(config4) {
+  const roles2 = config4.roles ?? [];
+  const permissions2 = config4.permissions ?? [];
+  if (!config4.opsScopes || config4.opsScopes.length === 0) {
     throw new Error("opsOrUser: opsScopes must name at least one scope \u2014 an ops token would otherwise be admitted unchecked.");
   }
   if (roles2.length === 0 && permissions2.length === 0) {
     throw new Error("opsOrUser: give roles, permissions, or both \u2014 a user session would otherwise be admitted unchecked.");
   }
-  const ops = chain([opsTokenAuth.handler, requireOpsScope(...config3.opsScopes)]);
+  const ops = chain([opsTokenAuth.handler, requireOpsScope(...config4.opsScopes)]);
   const user = chain([
     authenticate.handler,
     ...roles2.length > 0 ? [requireRole(...roles2)] : [],
@@ -15759,8 +17011,8 @@ function bearerOf(header) {
 function chain(handlers) {
   return async (c, next) => {
     let answer;
-    const runFrom = async (index16) => {
-      const produced = index16 < handlers.length ? await handlers[index16](c, () => runFrom(index16 + 1)) : await next();
+    const runFrom = async (index18) => {
+      const produced = index18 < handlers.length ? await handlers[index18](c, () => runFrom(index18 + 1)) : await next();
       if (produced instanceof Response) {
         answer = produced;
       }
@@ -16751,6 +18003,186 @@ var revokeOpsToken = route9.delete("/_auth/ops-tokens/:id").input({
   return { opsToken: toSummary2(record) };
 });
 
+// src/server/routes/oauth2/index.ts
+init_esm();
+import { route as route10 } from "@spfn/core/route";
+import { getClientIp as getClientIp2, rateLimitPolicy as rateLimitPolicy8 } from "@spfn/core/middleware";
+
+// src/server/routes/oauth2/http.ts
+import { NotFoundError as NotFoundError5 } from "@spfn/core/errors";
+var NO_STORE_HEADERS = {
+  "Content-Type": "application/json",
+  "Cache-Control": "no-store",
+  Pragma: "no-cache"
+};
+function requireAuthorizationServer() {
+  const config4 = getAuthorizationServerConfig();
+  if (!config4) {
+    throw new NotFoundError5({
+      message: "This application does not run an OAuth 2.1 authorization server. Pass `authorizationServer` to createAuthLifecycle() to enable one."
+    });
+  }
+  return config4;
+}
+function oauth2ErrorResponse(c, status, error, description) {
+  return c.json({ error, error_description: description }, status, NO_STORE_HEADERS);
+}
+function oauth2JsonResponse(c, status, body) {
+  return c.json(body, status, NO_STORE_HEADERS);
+}
+async function readOAuth2Body(c) {
+  const contentType = c.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    return await readJsonBody2(c);
+  }
+  return await readFormBody(c);
+}
+async function readJsonBody2(c) {
+  try {
+    return flatten(await c.req.json());
+  } catch {
+    return {};
+  }
+}
+async function readFormBody(c) {
+  try {
+    return flatten(await c.req.parseBody());
+  } catch {
+    return {};
+  }
+}
+function flatten(parsed) {
+  if (!parsed || typeof parsed !== "object") {
+    return {};
+  }
+  const flat = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value === "string") {
+      flat[key] = value;
+    }
+  }
+  return flat;
+}
+
+// src/server/routes/oauth2/index.ts
+var registerOAuth2Client = route10.post("/_auth/oauth2/register").use([rateLimitPolicy8("auth-oauth2-register", { limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  requireAuthorizationServer();
+  const body = await readRegistrationBody(c.raw);
+  const result = await registerOAuth2ClientService(body, getClientIp2(c.raw) || null);
+  if (!result.ok) {
+    return oauth2ErrorResponse(c.raw, result.status, result.error, result.description);
+  }
+  return oauth2JsonResponse(c.raw, 201, result.client);
+});
+async function readRegistrationBody(c) {
+  try {
+    const parsed = await c.req.json();
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var listOAuth2Grants = route10.get("/_auth/oauth2/grants").use([authenticate]).handler(async (c) => {
+  requireAuthorizationServer();
+  return { grants: await listOAuth2GrantsService(Number(getAuth(c).userId)) };
+});
+var revokeOAuth2Grant = route10.delete("/_auth/oauth2/grants/:id").input({ params: Type.Object({ id: Type.Number({ description: "Grant id from the list" }) }) }).use([authenticate]).handler(async (c) => {
+  requireAuthorizationServer();
+  const { params } = await c.data();
+  await revokeOAuth2GrantService(params.id, Number(getAuth(c).userId));
+  return { revoked: true };
+});
+var oauth2AuthorizationServerMetadata = route10.get("/.well-known/oauth-authorization-server").skip(["auth"]).handler(async (c) => {
+  const config4 = requireAuthorizationServer();
+  return c.json({
+    issuer: config4.issuer,
+    authorization_endpoint: config4.authorizeUrl,
+    token_endpoint: new URL("/_auth/oauth2/token", config4.issuer).toString(),
+    registration_endpoint: new URL("/_auth/oauth2/register", config4.issuer).toString(),
+    revocation_endpoint: new URL("/_auth/oauth2/revoke", config4.issuer).toString(),
+    response_types_supported: SUPPORTED_RESPONSE_TYPES,
+    grant_types_supported: SUPPORTED_GRANT_TYPES,
+    token_endpoint_auth_methods_supported: ["none"],
+    code_challenge_methods_supported: ["S256"],
+    scopes_supported: Object.keys(config4.scopes)
+  });
+});
+
+// src/server/routes/oauth2/authorize.ts
+init_esm();
+import { route as route11 } from "@spfn/core/route";
+import { rateLimitPolicy as rateLimitPolicy9 } from "@spfn/core/middleware";
+var AUTHORIZE_FIELDS = {
+  client_id: Type.String({ minLength: 1, description: "client_id from dynamic registration" }),
+  redirect_uri: Type.String({ minLength: 1, description: "Where the code is sent; must be registered" }),
+  code_challenge: Type.Optional(Type.String({ description: "PKCE S256 challenge" })),
+  code_challenge_method: Type.Optional(Type.String({ description: "Must be S256" })),
+  resource: Type.Optional(Type.String({ description: "RFC 8707 target the token will be good against" })),
+  scope: Type.Optional(Type.String({ description: "Space-delimited scope names; absent asks for the default set" })),
+  state: Type.Optional(Type.String({ description: "Client's opaque value, echoed back verbatim" }))
+};
+function toParams(input) {
+  return {
+    clientId: input.client_id,
+    redirectUri: input.redirect_uri,
+    codeChallenge: input.code_challenge,
+    codeChallengeMethod: input.code_challenge_method,
+    resource: input.resource,
+    scope: input.scope,
+    state: input.state
+  };
+}
+var authorizeRateLimit = rateLimitPolicy9("auth-oauth2-authorize", {
+  limit: 30,
+  windowMs: 6e4,
+  by: byIpAndCaller({ ipLimit: 120 })
+});
+var getOAuth2Authorize = route11.get("/_auth/oauth2/authorize").input({ query: Type.Object(AUTHORIZE_FIELDS) }).use([authenticate, authorizeRateLimit]).handler(async (c) => {
+  requireAuthorizationServer();
+  const { query } = await c.data();
+  return await describeOAuth2AuthorizeRequestService(toParams(query));
+});
+var createOAuth2AuthorizationCode = route11.post("/_auth/oauth2/authorize").input({
+  body: Type.Object({
+    ...AUTHORIZE_FIELDS,
+    approve: Type.Boolean({ description: "What the account owner decided" })
+  })
+}).use([authenticate, authorizeRateLimit]).handler(async (c) => {
+  requireAuthorizationServer();
+  const { body } = await c.data();
+  const params = toParams(body);
+  if (!body.approve) {
+    return await denyOAuth2AuthorizeService(params);
+  }
+  return await approveOAuth2AuthorizeService(params, Number(getAuth(c).userId));
+});
+
+// src/server/routes/oauth2/token.ts
+import { route as route12 } from "@spfn/core/route";
+import { rateLimitPolicy as rateLimitPolicy10 } from "@spfn/core/middleware";
+var oauth2Token = route12.post("/_auth/oauth2/token").use([rateLimitPolicy10("auth-oauth2-token", { limit: 60, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  requireAuthorizationServer();
+  const result = await oauth2TokenService(await readOAuth2Body(c.raw));
+  if (!result.ok) {
+    return oauth2ErrorResponse(c.raw, 400, result.error, result.description);
+  }
+  return oauth2JsonResponse(c.raw, 200, result.tokens);
+});
+var oauth2Revoke = route12.post("/_auth/oauth2/revoke").use([rateLimitPolicy10("auth-oauth2-revoke", { limit: 60, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  requireAuthorizationServer();
+  const body = await readOAuth2Body(c.raw);
+  if (!body.client_id) {
+    return oauth2ErrorResponse(
+      c.raw,
+      400,
+      "invalid_request",
+      "client_id is required. A public client identifies itself with it (RFC 6749 \xA72.3.1)."
+    );
+  }
+  await revokeOAuth2TokenService(body.token ?? "", body.client_id);
+  return oauth2JsonResponse(c.raw, 200, {});
+});
+
 // src/server/routes/index.ts
 var mainAuthRouter = defineRouter6({
   // Auth routes
@@ -16828,7 +18260,17 @@ var mainAuthRouter = defineRouter6({
   // Ops token routes (admin only)
   issueOpsToken,
   listOpsTokens,
-  revokeOpsToken
+  revokeOpsToken,
+  // OAuth 2.1 authorization server routes (MCP clients).
+  // Answer 404 unless the app passed `authorizationServer` to createAuthLifecycle().
+  registerOAuth2Client,
+  getOAuth2Authorize,
+  createOAuth2AuthorizationCode,
+  oauth2Token,
+  oauth2Revoke,
+  listOAuth2Grants,
+  revokeOAuth2Grant,
+  oauth2AuthorizationServerMetadata
 });
 
 // src/server.ts
@@ -16939,10 +18381,10 @@ function shouldRotateKey(createdAt, rotationDays = 90) {
 
 // src/server/lib/session.ts
 import * as jose2 from "jose";
-import { env as env16 } from "@spfn/auth/config";
+import { env as env17 } from "@spfn/auth/config";
 import { env as coreEnv } from "@spfn/core/config";
 async function getSessionSecretKey() {
-  const secret = env16.SPFN_AUTH_SESSION_SECRET;
+  const secret = env17.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(secret);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -17023,55 +18465,6 @@ async function shouldRefreshSession(jwt4, thresholdHours = 24) {
   return hoursRemaining < thresholdHours;
 }
 
-// src/server/lib/csrf.ts
-import { env as env17 } from "@spfn/auth/config";
-var CSRF_HEADER = "x-spfn-csrf";
-var CSRF_SUBKEY_LABEL = "spfn-auth-csrf-token-v1";
-var MAX_CANDIDATES = 32;
-function sessionSecret() {
-  const secret = env17.SPFN_AUTH_SESSION_SECRET;
-  if (!secret) {
-    throw new Error(
-      "SPFN_AUTH_SESSION_SECRET is required for CSRF protection. Set it (sessions need it anyway), or set SPFN_AUTH_CSRF=off."
-    );
-  }
-  return secret;
-}
-async function hmacSha256(key, message) {
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    key.buffer,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
-  return new Uint8Array(signature);
-}
-function toHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function deriveCsrfToken(keyId) {
-  const subkey = await hmacSha256(new TextEncoder().encode(sessionSecret()), CSRF_SUBKEY_LABEL);
-  return toHex(await hmacSha256(subkey, keyId));
-}
-function timingSafeEqualString(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  let difference = 0;
-  for (let i = 0; i < a.length; i++) {
-    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return difference === 0;
-}
-function matchesCsrfToken(expected, presented) {
-  if (!presented) {
-    return false;
-  }
-  return presented.split(",", MAX_CANDIDATES).some((candidate) => timingSafeEqualString(expected, candidate.trim()));
-}
-
 // src/server/setup.ts
 import { env as env18 } from "@spfn/auth/config";
 import { getRoleByName as getRoleByName2 } from "@spfn/auth/server";
@@ -17265,18 +18658,21 @@ function assertOAuthRedirectUris(env19 = process.env) {
 function createAuthLifecycle(options = {}) {
   configureDeletion(options.deletion);
   configureDeviceAuth(options.deviceAuth);
+  configureAuthorizationServer(options.authorizationServer);
   return {
     /**
      * Initialize auth system after database is ready
      *
      * Performs:
-     * 0. Refuses boot on an OAuth redirect URI override off the web app origin
+     * 0. Refuses boot on an OAuth redirect URI override off the web app origin,
+     *    or on an authorization server issuer no client could use
      * 1. Ensures admin account exists (creates if missing)
      * 2. Initializes RBAC system with built-in + custom roles/permissions
      * 3. Initializes one-time token manager
      */
     afterInfrastructure: async () => {
       assertOAuthRedirectUris();
+      assertAuthorizationServerIssuer();
       await initializeAuth(options);
       try {
         await normalizeStoredEmails();
@@ -17306,10 +18702,23 @@ function createAuthDeletionPurgeJob(cronExpression = DEFAULT_DELETION_PURGE_CRON
   });
 }
 
+// src/server/jobs/oauth2-client-purge.ts
+import { job as job3 } from "@spfn/core/job";
+var DEFAULT_OAUTH2_CLIENT_PURGE_CRON = "0 5 * * *";
+function createOAuth2ClientPurgeJob(cronExpression = DEFAULT_OAUTH2_CLIENT_PURGE_CRON) {
+  return job3("auth.oauth2.client-purge").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
+    const { deleted } = await purgeStaleOAuth2ClientsService();
+    if (deleted > 0) {
+      authLogger.service.info("[auth.oauth2.client-purge] sweep complete", { deleted });
+    }
+  });
+}
+
 // src/server/jobs/index.ts
 function createAuthJobRouter(options) {
   return defineJobRouter({
     deletionPurge: createAuthDeletionPurgeJob(options?.purgeCron),
+    oauth2ClientPurge: createOAuth2ClientPurgeJob(options?.oauth2ClientPurgeCron),
     linkMail: linkMailJob
   });
 }
@@ -17318,11 +18727,14 @@ var createAuthDeletionJobRouter = createAuthJobRouter;
 export {
   ACCOUNT_DELETION_REQUESTED_BY,
   ACCOUNT_DELETION_REQUEST_STATUSES,
+  AUTHORIZE_PATH,
   AccountDeletionRequestsRepository,
   AuthMetadataRepository,
   AuthProviderSchema,
   COOKIE_NAMES,
   CSRF_HEADER,
+  DEFAULT_ACCESS_TOKEN_TTL_MS,
+  DEFAULT_CODE_TTL_MS,
   DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE,
   DEFAULT_DELETION_GRACE_PERIOD_DAYS,
   DEFAULT_DELETION_PURGE_CRON,
@@ -17330,6 +18742,7 @@ export {
   DEFAULT_DELETION_SEND_NOTIFICATIONS,
   DEFAULT_DEVICE_AUTH_INTERVAL_MS,
   DEFAULT_DEVICE_AUTH_TTL_MS,
+  DEFAULT_REFRESH_TOKEN_TTL_MS,
   DEVICE_AUTH_STATUSES,
   DeviceAuthPollResponseSchema,
   DeviceAuthorizationsRepository,
@@ -17345,6 +18758,14 @@ export {
   KEY_PLATFORM,
   KeyIdSchema,
   KeysRepository,
+  MAX_UNGRANTED_CLIENTS_PER_IP,
+  OAUTH2_ACCESS_TOKEN_PREFIX,
+  OAUTH2_REFRESH_TOKEN_PREFIX,
+  OAUTH2_TOKEN_KINDS,
+  OAuth2AuthorizationCodesRepository,
+  OAuth2ClientsRepository,
+  OAuth2GrantsRepository,
+  OAuth2TokensRepository,
   OPS_TOKEN_PREFIX,
   OpsTokensRepository,
   PASSKEY_DEVICE_TYPES,
@@ -17360,6 +18781,9 @@ export {
   RolePermissionsRepository,
   RolesRepository,
   SOCIAL_PROVIDERS,
+  STALE_CLIENT_MAX_AGE_MS,
+  SUPPORTED_GRANT_TYPES,
+  SUPPORTED_RESPONSE_TYPES,
   SignupLinkTokensRepository,
   SocialAccountsRepository,
   TargetTypeSchema,
@@ -17383,6 +18807,8 @@ export {
   addPermissionToRole,
   appleProvider,
   approveDeviceAuthService,
+  approveOAuth2AuthorizeService,
+  assertAuthorizationServerIssuer,
   assertCanAssignRole,
   assertKeyMatchesAlgorithm,
   assertNotLastRecoveryCredential,
@@ -17409,6 +18835,7 @@ export {
   completePasswordResetService,
   completeSignupService,
   configureAuth,
+  configureAuthorizationServer,
   configureDeletion,
   configureDeviceAuth,
   configureOAuthTokenCipher,
@@ -17426,7 +18853,9 @@ export {
   deleteInvitation,
   deleteRole,
   denyDeviceAuthService,
+  denyOAuth2AuthorizeService,
   deriveCsrfToken,
+  describeOAuth2AuthorizeRequestService,
   deviceAuthorizations,
   deviceAuthorizationsRepository,
   encryptToken,
@@ -17435,18 +18864,22 @@ export {
   finishPasskeyEnrollmentService,
   finishPasskeyLoginService,
   formatUserCode,
+  generateAccessToken,
+  generateAuthorizationCode,
   generateClientToken,
   generateDeviceCode,
   generateKeyPair,
   generateKeyPairES256,
   generateKeyPairRS256,
   generateOAuthNonce,
+  generateRefreshToken,
   generateToken,
   generateUserCode,
   getAllRoles,
   getAuth,
   getAuthConfig,
   getAuthSessionService,
+  getAuthorizationServerConfig,
   getCsrfExemptPaths,
   getCsrfMode,
   getDeletionConfig,
@@ -17492,16 +18925,21 @@ export {
   hasPermission,
   hasRole,
   hashDeviceCode,
+  hashOAuth2Secret,
   hashPassword,
   initOneTimeTokenManager,
   initializeAuth,
   invitationAcceptedEvent,
   invitationCreatedEvent,
   invitationsRepository,
+  isAccessTokenShaped,
   isEncrypted,
   isGoogleOAuthEnabled,
+  isLoopbackHostname,
   isOAuthProviderEnabled,
   isOpsToken,
+  isPkceS256ChallengeShaped,
+  isPkceVerifierShaped,
   isSafeReturnPath,
   issueOneTimeTokenService,
   issueOpsTokenService,
@@ -17510,6 +18948,7 @@ export {
   linkMailJob,
   listInvitations,
   listKeysService,
+  listOAuth2GrantsService,
   listOpsTokensService,
   listPasskeysService,
   loginService,
@@ -17517,11 +18956,22 @@ export {
   machineAuth,
   matchOAuthCsrfCookies,
   matchesCsrfToken,
+  matchesRegisteredRedirectUri,
   naverProvider,
   normalizeEmail,
   normalizeOptionalEmail,
+  normalizeResource,
   normalizeStoredEmails,
   normalizeUserCode,
+  oauth2AuthorizationCodes,
+  oauth2AuthorizationCodesRepository,
+  oauth2Clients,
+  oauth2ClientsRepository,
+  oauth2Grants,
+  oauth2GrantsRepository,
+  oauth2TokenService,
+  oauth2Tokens,
+  oauth2TokensRepository,
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,
@@ -17540,11 +18990,16 @@ export {
   passwordResetTokensRepository,
   permissions,
   permissionsRepository,
+  pkceChallengeFor,
   pollDeviceAuthService,
+  purgeStaleOAuth2ClientsService,
   purgeUserService,
+  redirectHostOf,
   refreshAccessToken,
+  refuseRedirectUriRegistration,
   registerAuthProfile,
   registerMachineVerifier,
+  registerOAuth2ClientService,
   registerOAuthProvider,
   registerPublicKeyService,
   registerService,
@@ -17561,8 +19016,12 @@ export {
   requireRole,
   resendInvitation,
   resolveAuthenticatedUser,
+  resolveIssuerSource,
   revokeAllKeysService,
+  revokeAllOAuth2GrantsForUser,
   revokeKeyService,
+  revokeOAuth2GrantService,
+  revokeOAuth2TokenService,
   revokeOpsTokenService,
   revokePasskeyService,
   roleGuard,
@@ -17573,7 +19032,10 @@ export {
   rotateKeyService,
   runAuthProfile,
   runBeforeRegister,
+  sameOAuth2Hash,
+  sameResource,
   sealSession,
+  secondsUntil,
   selectAuthProfile,
   sendVerificationCodeService,
   setRolePermissions,
@@ -17586,6 +19048,7 @@ export {
   startPasskeyEnrollmentService,
   startPasskeyLoginService,
   sweepDuePurges,
+  toEpochSeconds,
   unsealSession,
   updateLastLoginService,
   updateLocaleService,
@@ -17606,6 +19069,7 @@ export {
   validatePasswordStrength,
   verificationCodes,
   verificationCodesRepository,
+  verifyAccessToken,
   verifyClientToken,
   verifyCodeService,
   verifyIdToken,