@spfn/auth 0.3.0-beta.25 → 0.3.0-beta.27

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, z as OAuthProvider, N as NewUserPublicKey, x as VerificationPurpose, B as NewPasskey, E as Passkey, G as MfaVerification, H as MfaVerificationMethod, J as NewMfaChallenge, Q as MfaChallenge, u as PermissionCategory, W as UserPublicKey, X as AuthContext } from './machine-principals-CdEgxOB1.js';
-export { Y as ApproveDeviceAuthParams, Z as AssertStepUpParams, _ as AuthDeletionCancelledPayload, $ as AuthDeletionCompletedPayload, a0 as AuthDeletionRequestedPayload, a1 as AuthDeviceRegisteredPayload, a2 as AuthLoginPayload, a3 as AuthPasswordResetPayload, a4 as AuthProfileOutcome, a5 as AuthProfileVerifier, a6 as AuthProviderSchema, a7 as AuthRegisterPayload, a8 as BearerOutcome, a9 as BearerRefusal, aa as ChangePasswordParams, ab as CompletePasswordResetParams, ac as CompleteSignupParams, ad as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ae as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, af as ConfirmTotpParams, g as ConfirmTotpResult, ag as DeferredLoginEvent, ah as DenyDeviceAuthParams, ai as DeviceAuthApprovedResult, aj as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ak as DeviceAuthPendingResult, al as DeviceAuthPollResponseSchema, am as DeviceNameSchema, an as DeviceRegistrationChannel, ao as DisableSessionBindingParams, ap as EmailSchema, aq as FingerprintSchema, ar as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, as as FinishPasskeyLoginParams, at as FinishSessionRenewParams, au as InvitationAcceptedPayload, av as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aw as KEY_FINGERPRINT_PREFIX_LENGTH, ax as KeyIdSchema, K as KeySummary, ay as LoginParams, L as LoginResult, az as LogoutParams, aA as MFA_CHALLENGE_ATTEMPT_LIMIT, aB as MFA_CHALLENGE_CHANNELS, aC as MFA_VERIFICATION_METHODS, aD as MachinePrincipal, aE as MachineVerifierRegistration, aF as MarkPasskeyParams, aG as MfaChallengeChannel, aH as MfaChallengeHandle, M as MfaStatus, aI as NativeVerifyOptions, aJ as NewMfaVerification, aK as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aL as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aM as OAuth2ScopeDescription, aN as OAuthCallbackParams, aO as OAuthCallbackResult, aP as OAuthCodeExchangeOptions, aQ as OAuthNativeParams, n as OAuthNativeResult, aR as OAuthStartParams, O as OAuthStartResult, aS as OAuthTokens, aT as OAuthUnlinkedPayload, aU as OpenStepUpChallengeParams, aV as PASSKEY_DEVICE_TYPES, aW as PASSKEY_LABEL_MAX_LENGTH, aX as PasskeyDeviceType, f as PasskeySummary, aY as PasswordSchema, aZ as PhoneSchema, a_ as PlatformSchema, a$ as PollDeviceAuthParams, b0 as PollDeviceAuthResult, b1 as PublicKeySchema, b2 as RecentAuthenticationParams, b3 as RegisterParams, b4 as RegisterPublicKeyParams, b5 as RegisterPublicKeyResult, a as RegisterResult, b6 as RenamePasskeyParams, b7 as RequestPasswordResetParams, c as RequestPasswordResetResult, b8 as RequestSignupLinkParams, b as RequestSignupLinkResult, b9 as RevokeAllKeysParams, i as RevokeAllKeysResult, ba as RevokeKeyParams, bb as RevokePasskeyParams, bc as RotateKeyParams, h as RotateKeyResult, bd as SendVerificationCodeParams, S as SendVerificationCodeResult, be as SessionBindingParams, j as SessionBindingResult, bf as StartDeviceAuthParams, e as StartDeviceAuthResult, bg as StartPasskeyEnrollmentParams, bh as StartSessionRenewParams, bi as StepUpParams, bj as TargetTypeSchema, T as TotpEnrolmentResult, bk as UnlinkNotification, bl as UnlinkNotifyRejection, bm as UnlinkNotifyRequest, bn as UnlinkNotifyResult, bo as UserCodeSchema, v as VERIFICATION_PURPOSES, w as VERIFICATION_TARGET_TYPES, bp as VerificationPurposeSchema, y as VerificationTargetType, bq as VerifyCodeParams, br as VerifyCodeResult, bs as VerifyMfaChallengeParams, V as VerifyMfaChallengeResult, bt as admitBearerKey, bu as approveDeviceAuthService, bv as approveOAuth2AuthorizeService, bw as assertNotLastRecoveryCredential, bx as assertRecentAuthentication, by as assertStepUp, bz as attemptSecondFactor, bA as authDeletionCancelledEvent, bB as authDeletionCompletedEvent, bC as authDeletionRequestedEvent, bD as authDeviceRegisteredEvent, bE as authLoginEvent, bF as authPasswordResetEvent, bG as authRegisterEvent, m as authRouter, bH as authenticate, bI as bearerAuthContext, bJ as buildOAuthErrorUrl, bK as carryStepUpVerification, bL as changePasswordService, bM as completePasswordResetService, bN as completeSignupService, bO as confirmPasswordResetService, bP as confirmSignupLinkService, bQ as confirmTotpEnrolmentService, bR as denyDeviceAuthService, bS as denyOAuth2AuthorizeService, bT as describeOAuth2AuthorizeRequestService, bU as disableMfaService, bV as disableSessionBindingService, bW as enableSessionBindingService, bX as finishPasskeyEnrollmentService, bY as finishPasskeyLoginService, bZ as finishSessionRenewService, b_ as getDeviceAuthInfoService, b$ as getEnabledOAuthProviders, c0 as getGoogleAccessToken, c1 as getMachinePrincipal, c2 as getOAuthProvider, c3 as getRegisteredProviders, c4 as getSessionBindingService, c5 as invitationAcceptedEvent, c6 as invitationCreatedEvent, c7 as isOAuthProviderEnabled, c8 as issueOneTimeTokenService, c9 as keySessionBindingService, ca as listKeysService, cb as listOAuth2GrantsService, cc as listPasskeysService, cd as loginService, ce as logoutService, cf as machineAuth, cg as markPasskeySecondFactorService, ch as mfaChallenges, ci as mfaEnrolledForUser, cj as mfaStatusService, ck as mfaVerifications, cl as oauthCallbackService, cm as oauthNativeService, cn as oauthStartService, co as oauthUnlinkNotifyService, cp as oauthUnlinkedEvent, cq as openStepUpChallengeService, cr as optionalAuth, cs as passkeys, ct as pollDeviceAuthService, cu as regenerateRecoveryCodesService, cv as registerAuthProfile, cw as registerMachineVerifier, cx as registerOAuthProvider, cy as registerPublicKeyService, cz as registerService, cA as registeredBinding, cB as renamePasskeyService, cC as requestPasswordResetService, cD as requestSignupLinkService, cE as requireEnabledProvider, cF as requireMachineScope, cG as resolveAuthenticatedUser, cH as resumeStepUpChallengeService, cI as revokeAllKeysService, cJ as revokeAllOAuth2GrantsForUser, cK as revokeKeyService, cL as revokeOAuth2GrantService, cM as revokePasskeyService, cN as rotateKeyService, cO as runAuthProfile, cP as selectAuthProfile, cQ as sendVerificationCodeService, cR as startDeviceAuthService, cS as startMfaChallengeAssertionService, cT as startPasskeyEnrollmentService, cU as startPasskeyLoginService, cV as startSessionBindingDisableService, cW as startSessionRenewService, cX as startStepUpService, cY as startTotpEnrolmentService, cZ as stepUpService, c_ as sweepMfaChallengesService, c$ as sweepUnconfirmedMfaService, d0 as userPublicKeys, d1 as verifyCodeService, d2 as verifyMfaChallengeService, d3 as verifyOneTimeTokenService, d4 as verifySecondFactor } from './machine-principals-CdEgxOB1.js';
+import { A as AuthInitOptions, z as OAuthProvider, N as NewUserPublicKey, x as VerificationPurpose, B as NewPasskey, E as Passkey, G as MfaVerification, H as MfaVerificationMethod, J as NewMfaChallenge, Q as MfaChallenge, u as PermissionCategory, W as UserPublicKey, X as AuthContext } from './machine-principals-BvRw8b8t.js';
+export { Y as ApproveDeviceAuthParams, Z as AssertStepUpParams, _ as AuthDeletionCancelledPayload, $ as AuthDeletionCompletedPayload, a0 as AuthDeletionRequestedPayload, a1 as AuthDeviceRegisteredPayload, a2 as AuthLoginPayload, a3 as AuthPasswordResetPayload, a4 as AuthProfileOutcome, a5 as AuthProfileVerifier, a6 as AuthProviderSchema, a7 as AuthRegisterPayload, a8 as BearerOutcome, a9 as BearerRefusal, aa as ChangePasswordParams, ab as CompletePasswordResetParams, ac as CompleteSignupParams, ad as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ae as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, af as ConfirmTotpParams, g as ConfirmTotpResult, ag as DeferredLoginEvent, ah as DenyDeviceAuthParams, ai as DeviceAuthApprovedResult, aj as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ak as DeviceAuthPendingResult, al as DeviceAuthPollResponseSchema, am as DeviceNameSchema, an as DeviceRegistrationChannel, ao as DisableSessionBindingParams, ap as EmailSchema, aq as FingerprintSchema, ar as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, as as FinishPasskeyLoginParams, at as FinishSessionRenewParams, au as InvitationAcceptedPayload, av as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aw as KEY_FINGERPRINT_PREFIX_LENGTH, ax as KeyIdSchema, K as KeySummary, ay as LoginParams, L as LoginResult, az as LogoutParams, aA as MFA_CHALLENGE_ATTEMPT_LIMIT, aB as MFA_CHALLENGE_CHANNELS, aC as MFA_VERIFICATION_METHODS, aD as MachinePrincipal, aE as MachineVerifierRegistration, aF as MarkPasskeyParams, aG as MfaChallengeChannel, aH as MfaChallengeHandle, M as MfaStatus, aI as NativeVerifyOptions, aJ as NewMfaVerification, aK as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aL as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aM as OAuth2ScopeDescription, aN as OAuthCallbackParams, aO as OAuthCallbackResult, aP as OAuthCodeExchangeOptions, aQ as OAuthNativeParams, n as OAuthNativeResult, aR as OAuthStartParams, O as OAuthStartResult, aS as OAuthTokens, aT as OAuthUnlinkedPayload, aU as OpenStepUpChallengeParams, aV as PASSKEY_DEVICE_TYPES, aW as PASSKEY_LABEL_MAX_LENGTH, aX as PasskeyDeviceType, f as PasskeySummary, aY as PasswordSchema, aZ as PhoneSchema, a_ as PlatformSchema, a$ as PollDeviceAuthParams, b0 as PollDeviceAuthResult, b1 as PublicKeySchema, b2 as RecentAuthenticationParams, b3 as RegisterParams, b4 as RegisterPublicKeyParams, b5 as RegisterPublicKeyResult, a as RegisterResult, b6 as RenamePasskeyParams, b7 as RequestPasswordResetParams, c as RequestPasswordResetResult, b8 as RequestSignupLinkParams, b as RequestSignupLinkResult, b9 as RevokeAllKeysParams, i as RevokeAllKeysResult, ba as RevokeKeyParams, bb as RevokePasskeyParams, bc as RotateKeyParams, h as RotateKeyResult, bd as SendVerificationCodeParams, S as SendVerificationCodeResult, be as SessionBindingParams, j as SessionBindingResult, bf as StartDeviceAuthParams, e as StartDeviceAuthResult, bg as StartPasskeyEnrollmentParams, bh as StartSessionRenewParams, bi as StepUpParams, bj as TargetTypeSchema, T as TotpEnrolmentResult, bk as UnlinkNotification, bl as UnlinkNotifyRejection, bm as UnlinkNotifyRequest, bn as UnlinkNotifyResult, bo as UserCodeSchema, v as VERIFICATION_PURPOSES, w as VERIFICATION_TARGET_TYPES, bp as VerificationPurposeSchema, y as VerificationTargetType, bq as VerifyCodeParams, br as VerifyCodeResult, bs as VerifyMfaChallengeParams, V as VerifyMfaChallengeResult, bt as admitBearerKey, bu as approveDeviceAuthService, bv as approveOAuth2AuthorizeService, bw as assertNotLastRecoveryCredential, bx as assertRecentAuthentication, by as assertStepUp, bz as attemptSecondFactor, bA as authDeletionCancelledEvent, bB as authDeletionCompletedEvent, bC as authDeletionRequestedEvent, bD as authDeviceRegisteredEvent, bE as authLoginEvent, bF as authPasswordResetEvent, bG as authRegisterEvent, m as authRouter, bH as authenticate, bI as bearerAuthContext, bJ as buildOAuthErrorUrl, bK as carryStepUpVerification, bL as changePasswordService, bM as completePasswordResetService, bN as completeSignupService, bO as confirmPasswordResetService, bP as confirmSignupLinkService, bQ as confirmTotpEnrolmentService, bR as denyDeviceAuthService, bS as denyOAuth2AuthorizeService, bT as describeOAuth2AuthorizeRequestService, bU as disableMfaService, bV as disableSessionBindingService, bW as enableSessionBindingService, bX as finishPasskeyEnrollmentService, bY as finishPasskeyLoginService, bZ as finishSessionRenewService, b_ as getDeviceAuthInfoService, b$ as getEnabledOAuthProviders, c0 as getGoogleAccessToken, c1 as getMachinePrincipal, c2 as getOAuthProvider, c3 as getRegisteredProviders, c4 as getSessionBindingService, c5 as invitationAcceptedEvent, c6 as invitationCreatedEvent, c7 as isOAuthProviderEnabled, c8 as issueOneTimeTokenService, c9 as keySessionBindingService, ca as listKeysService, cb as listOAuth2GrantsService, cc as listPasskeysService, cd as loginService, ce as logoutService, cf as machineAuth, cg as markPasskeySecondFactorService, ch as mfaChallenges, ci as mfaEnrolledForUser, cj as mfaStatusService, ck as mfaVerifications, cl as oauthCallbackService, cm as oauthNativeService, cn as oauthStartService, co as oauthUnlinkNotifyService, cp as oauthUnlinkedEvent, cq as openStepUpChallengeService, cr as optionalAuth, cs as passkeys, ct as pollDeviceAuthService, cu as regenerateRecoveryCodesService, cv as registerAuthProfile, cw as registerMachineVerifier, cx as registerOAuthProvider, cy as registerPublicKeyService, cz as registerService, cA as registeredBinding, cB as renamePasskeyService, cC as requestPasswordResetService, cD as requestSignupLinkService, cE as requireEnabledProvider, cF as requireMachineScope, cG as resolveAuthenticatedUser, cH as resumeStepUpChallengeService, cI as revokeAllKeysService, cJ as revokeAllOAuth2GrantsForUser, cK as revokeKeyService, cL as revokeOAuth2GrantService, cM as revokePasskeyService, cN as rotateKeyService, cO as runAuthProfile, cP as selectAuthProfile, cQ as sendVerificationCodeService, cR as startDeviceAuthService, cS as startMfaChallengeAssertionService, cT as startPasskeyEnrollmentService, cU as startPasskeyLoginService, cV as startSessionBindingDisableService, cW as startSessionRenewService, cX as startStepUpService, cY as startTotpEnrolmentService, cZ as stepUpService, c_ as sweepMfaChallengesService, c$ as sweepUnconfirmedMfaService, d0 as userPublicKeys, d1 as verifyCodeService, d2 as verifyMfaChallengeService, d3 as verifyOneTimeTokenService, d4 as verifySecondFactor } from './machine-principals-BvRw8b8t.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { l as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-CTdoTOxM.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, S as SessionBindingType, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
@@ -7896,6 +7896,12 @@ declare const mfaEnrolmentRepository: MfaEnrolmentRepository;
  * most of all, since the poll that spends it is the one call that registers a
  * key. Judging the clock only in the read would let that key be registered after
  * the code was dead.
+ *
+ * The three transitions that answer a record — approve, deny, and the global
+ * revocation's sweep — also wake any long poll parked on it, after commit. That
+ * is done here rather than in each caller because the sweep has four callers
+ * across the revocation paths, and a caller that forgot would leave a waiting
+ * device on its slower recheck instead of telling it no.
  */
 
 declare class DeviceAuthorizationsRepository extends BaseRepository {
@@ -7930,6 +7936,16 @@ declare class DeviceAuthorizationsRepository extends BaseRepository {
      * Read replica.
      */
     findByDeviceCodeHash(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
+    /**
+     * `findByDeviceCodeHash`, read from the primary even outside a transaction.
+     *
+     * For the long poll's wait, which runs before any transaction opens: it is
+     * woken right after an answer commits, and a replica that has not caught up
+     * yet would show it the record still pending and send it back to sleep.
+     *
+     * Write primary.
+     */
+    findByDeviceCodeHashOnPrimary(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
     /**
      * Bind the approving user and move the record to `approved`, but only from
      * `pending`.
@@ -7986,6 +8002,8 @@ declare class DeviceAuthorizationsRepository extends BaseRepository {
      * @returns the spent row, or null if it was not approved (any more), or expired
      */
     consumeApproved(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
+    /** Wake the polls parked on a record this call moved, and hand the row back. */
+    private answered;
 }
 declare const deviceAuthorizationsRepository: DeviceAuthorizationsRepository;
 
@@ -10590,6 +10608,8 @@ interface AuthDeviceAuthConfig {
     ttlMs: number;
     /** How long the waiting device should wait between polls, in milliseconds. */
     intervalMs: number;
+    /** The longest a poll that asks to wait (`waitMillis`) is held open, in milliseconds. */
+    maxWaitMs: number;
 }
 /**
  * Ten minutes. Long enough to walk to the other device and type the code, short
@@ -10598,12 +10618,19 @@ interface AuthDeviceAuthConfig {
 declare const DEFAULT_DEVICE_AUTH_TTL_MS: number;
 /** Five seconds. The interval the server asks for; the rate limit is what enforces it. */
 declare const DEFAULT_DEVICE_AUTH_INTERVAL_MS: number;
+/**
+ * Twenty seconds. Load balancers commonly close a request that has sent nothing
+ * for 30 seconds (Google Cloud's backend service default among them), and a long
+ * poll cut off there reaches the device as a network error rather than as a
+ * pending answer. Twenty leaves room under that for the request's own work.
+ */
+declare const DEFAULT_DEVICE_AUTH_MAX_WAIT_MS: number;
 /**
  * Set the resolved device-auth config. Called synchronously from
  * `createAuthLifecycle()` for the same reason `configureDeletion` is: it must
  * take effect before any handler that reads `getDeviceAuthConfig()` can run.
  *
- * Both knobs are whole millisecond counts, and one that is not is refused here
+ * Every knob is a whole millisecond count, and one that is not is refused here
  * rather than served. `intervalMs` is the reason the check exists: it leaves as
  * `intervalMillis` in the start and poll answers, which `DeviceAuthPollResponseSchema`
  * declares an integer and the mobile contract exports as one, so a fractional
@@ -10911,6 +10938,12 @@ interface AuthLifecycleOptions extends AuthInitOptions {
          * @default 5000
          */
         intervalMs?: number;
+        /**
+         * The longest a poll that sends `waitMillis` is held open, in milliseconds.
+         * Keep it under the idle timeout of every proxy in front of the server.
+         * @default 20000
+         */
+        maxWaitMs?: number;
     };
     /**
      * OAuth 2.1 authorization server for MCP clients
@@ -11094,4 +11127,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, MfaChallenge, MfaChallengesRepository, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, NewMfaChallenge, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaChallengesRepository, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_MAX_WAIT_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, MfaChallenge, MfaChallengesRepository, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, NewMfaChallenge, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaChallengesRepository, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };

package/dist/server.js

@@ -8505,6 +8505,77 @@ var init_mfa_enrolment_repository = __esm({
   }
 });
 
+// src/server/lib/device-auth-waiters.ts
+import { onAfterCommit } from "@spfn/core/db";
+function announceDeviceAuthAnswered(ids) {
+  if (ids.length === 0) {
+    return;
+  }
+  onAfterCommit(() => {
+    for (const id26 of ids) {
+      wake(id26);
+    }
+  });
+}
+function wake(id26) {
+  const parked = waiters.get(id26);
+  if (!parked) {
+    return;
+  }
+  waiters.delete(id26);
+  for (const resolve of parked) {
+    resolve();
+  }
+}
+function waitForDeviceAuthAnswer(id26, timeoutMs, signal) {
+  if (signal?.aborted) {
+    return Promise.resolve();
+  }
+  return new Promise((resolve) => {
+    const parked = waiters.get(id26) ?? /* @__PURE__ */ new Set();
+    const done = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      unpark(id26, parked, done);
+      resolve();
+    };
+    const timer = setTimeout(done, timeoutMs);
+    signal?.addEventListener("abort", done, { once: true });
+    parked.add(done);
+    waiters.set(id26, parked);
+  });
+}
+function unpark(id26, parked, resolver) {
+  parked.delete(resolver);
+  if (parked.size === 0 && waiters.get(id26) === parked) {
+    waiters.delete(id26);
+  }
+}
+function waitingOnDeviceAuth(id26) {
+  return waiting.get(id26) ?? 0;
+}
+async function holdDeviceAuthWait(id26, wait) {
+  waiting.set(id26, waitingOnDeviceAuth(id26) + 1);
+  try {
+    return await wait();
+  } finally {
+    const left = waitingOnDeviceAuth(id26) - 1;
+    if (left > 0) {
+      waiting.set(id26, left);
+    } else {
+      waiting.delete(id26);
+    }
+  }
+}
+var waiters, waiting;
+var init_device_auth_waiters = __esm({
+  "src/server/lib/device-auth-waiters.ts"() {
+    "use strict";
+    waiters = /* @__PURE__ */ new Map();
+    waiting = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/server/repositories/device-authorizations.repository.ts
 import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
 import { eq as eq14, and as and14, gt as gt7, inArray as inArray2, sql as sql9 } from "drizzle-orm";
@@ -8513,6 +8584,7 @@ var init_device_authorizations_repository = __esm({
   "src/server/repositories/device-authorizations.repository.ts"() {
     "use strict";
     init_device_authorizations();
+    init_device_auth_waiters();
     notExpired = () => gt7(deviceAuthorizations.expiresAt, sql9`now()`);
     DeviceAuthorizationsRepository = class extends BaseRepository14 {
       /**
@@ -8555,6 +8627,19 @@ var init_device_authorizations_repository = __esm({
         const result = await this.readDb.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
         return result[0] ?? null;
       }
+      /**
+       * `findByDeviceCodeHash`, read from the primary even outside a transaction.
+       *
+       * For the long poll's wait, which runs before any transaction opens: it is
+       * woken right after an answer commits, and a replica that has not caught up
+       * yet would show it the record still pending and send it back to sleep.
+       *
+       * Write primary.
+       */
+      async findByDeviceCodeHashOnPrimary(deviceCodeHash) {
+        const result = await this.db.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
+        return result[0] ?? null;
+      }
       /**
        * Bind the approving user and move the record to `approved`, but only from
        * `pending`.
@@ -8572,7 +8657,7 @@ var init_device_authorizations_repository = __esm({
             notExpired()
           )
         ).returning();
-        return result[0] ?? null;
+        return this.answered(result[0] ?? null);
       }
       /**
        * Move the record to `denied`, but only from `pending`.
@@ -8589,7 +8674,7 @@ var init_device_authorizations_repository = __esm({
             notExpired()
           )
         ).returning();
-        return result[0] ?? null;
+        return this.answered(result[0] ?? null);
       }
       /**
        * Refuse every authorization a user still has in flight.
@@ -8617,12 +8702,14 @@ var init_device_authorizations_repository = __esm({
        * @returns the rows this call refused
        */
       async denyAllActiveByUserId(userId) {
-        return await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
+        const denied = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
           and14(
             eq14(deviceAuthorizations.userId, userId),
             inArray2(deviceAuthorizations.status, ["pending", "approved"])
           )
         ).returning();
+        announceDeviceAuthAnswered(denied.map((record) => record.id));
+        return denied;
       }
       /**
        * Spend an approved record, but only from `approved`, and address it by the
@@ -8645,6 +8732,13 @@ var init_device_authorizations_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /** Wake the polls parked on a record this call moved, and hand the row back. */
+      answered(record) {
+        if (record) {
+          announceDeviceAuthAnswered([record.id]);
+        }
+        return record;
+      }
     };
     deviceAuthorizationsRepository = new DeviceAuthorizationsRepository();
   }
@@ -11587,7 +11681,7 @@ import { InvalidKeyFingerprintError, KeyIdAlreadyRegisteredError } from "@spfn/a
 import { ValidationError as ValidationError3 } from "@spfn/core/errors";
 
 // src/server/services/device-registration.service.ts
-import { onAfterCommit } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
 
 // src/server/events/index.ts
 init_esm();
@@ -11739,7 +11833,7 @@ init_repositories();
 var DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH = 12;
 async function emitDeviceRegistered(row, channel) {
   const mfaEnrolled = await mfaEnrolmentRepository.isEnrolled(row.userId);
-  onAfterCommit(() => authDeviceRegisteredEvent.emit({
+  onAfterCommit2(() => authDeviceRegisteredEvent.emit({
     userId: String(row.userId),
     keyId: row.keyId,
     algorithm: row.algorithm,
@@ -11757,7 +11851,7 @@ async function emitDeviceRegistered(row, channel) {
 // src/server/services/mfa.service.ts
 init_logger();
 init_config();
-import { onAfterCommit as onAfterCommit2, runInTransaction as runInTransaction2 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit3, runInTransaction as runInTransaction2 } from "@spfn/core/db";
 import { ValidationError as ValidationError2 } from "@spfn/core/errors";
 import {
   MfaAlreadyEnrolledError,
@@ -12230,7 +12324,7 @@ async function releaseDeferredAnnouncements(row, key) {
     return;
   }
   const mfaEnrolled = await mfaEnrolledForUser(row.userId);
-  onAfterCommit2(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
+  onAfterCommit3(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
 }
 async function verifyMfaChallengeService(params) {
   const challengeHash = hashCredential(params.challenge);
@@ -12324,7 +12418,7 @@ async function countConfirmFailure(userId) {
 function readSecret(secretEnc, userId) {
   const { value, needsRotation } = decryptMfaSecret(secretEnc, userId);
   if (needsRotation) {
-    onAfterCommit2(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
+    onAfterCommit3(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
   }
   return value;
 }
@@ -12633,7 +12727,7 @@ init_key_policy();
 // src/server/services/account-deletion.service.ts
 init_repositories();
 import { ValidationError as ValidationError4, NotFoundError as NotFoundError2 } from "@spfn/core/errors";
-import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit3 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
 import { sendEmail as sendEmail3 } from "@spfn/notification/server";
 import {
   InvalidCredentialsError,
@@ -12790,13 +12884,13 @@ async function requestAccountDeletionService(userId, params) {
   await keysRepository.revokeAllActiveByUserId(user.id, "Account deletion requested");
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
   await revokeAllOAuth2GrantsForUser(user.id);
-  onAfterCommit3(() => authDeletionRequestedEvent.emit({
+  onAfterCommit4(() => authDeletionRequestedEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId,
     purgeScheduledAt: purgeScheduledAt.toISOString(),
     requestedBy
   }));
-  onAfterCommit3(() => notifyDeletionRequested(user, purgeScheduledAt));
+  onAfterCommit4(() => notifyDeletionRequested(user, purgeScheduledAt));
   if (gracePeriodDays === 0) {
     await purgePendingRequest(request);
   }
@@ -12828,11 +12922,11 @@ async function cancelAccountDeletionService(params) {
     throw new DeletionNotRequestedError();
   }
   await usersRepository.reactivateFromPendingDeletion(user.id);
-  onAfterCommit3(() => authDeletionCancelledEvent.emit({
+  onAfterCommit4(() => authDeletionCancelledEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId
   }));
-  onAfterCommit3(() => notifyDeletionCancelled(user));
+  onAfterCommit4(() => notifyDeletionCancelled(user));
   return { userId: String(user.id) };
 }
 async function anonymizeUser(user) {
@@ -12919,9 +13013,9 @@ async function purgePendingRequest(request) {
   }
   const { email, publicId } = purgedUser;
   if (email) {
-    onAfterCommit3(() => notifyPurgeFinal(email));
+    onAfterCommit4(() => notifyPurgeFinal(email));
   }
-  onAfterCommit3(() => authDeletionCompletedEvent.emit({
+  onAfterCommit4(() => authDeletionCompletedEvent.emit({
     userPublicId: publicId,
     purgeStrategy
   }));
@@ -13275,7 +13369,7 @@ init_repositories();
 import { env as env11 } from "@spfn/auth/config";
 import { PasswordResetLinkError, PasswordResetSessionError } from "@spfn/auth/errors";
 import { ValidationError as ValidationError6 } from "@spfn/core/errors";
-import { onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
 init_key_policy();
 async function activeUserOf(userId) {
   const user = await usersRepository.findByIdOnPrimary(userId);
@@ -13376,7 +13470,7 @@ async function completePasswordResetService(params) {
     throw new PasswordResetSessionError();
   }
   const registered = await replaceCredentials(row, user, params);
-  onAfterCommit4(() => authPasswordResetEvent.emit({
+  onAfterCommit5(() => authPasswordResetEvent.emit({
     userId: String(user.id),
     email: row.email
   }));
@@ -13468,21 +13562,26 @@ import {
   DeviceAuthDeniedError,
   InvalidKeyFingerprintError as InvalidKeyFingerprintError2
 } from "@spfn/auth/errors";
-import { onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit6 } from "@spfn/core/db";
+import { getShutdownManager } from "@spfn/core/server";
 
 // src/server/lib/device-auth-config.ts
 var DEFAULT_DEVICE_AUTH_TTL_MS = 10 * 60 * 1e3;
 var DEFAULT_DEVICE_AUTH_INTERVAL_MS = 5 * 1e3;
+var DEFAULT_DEVICE_AUTH_MAX_WAIT_MS = 20 * 1e3;
 var config2 = {
   ttlMs: DEFAULT_DEVICE_AUTH_TTL_MS,
-  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS
+  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  maxWaitMs: DEFAULT_DEVICE_AUTH_MAX_WAIT_MS
 };
 function configureDeviceAuth(options) {
   const ttlMs = options?.ttlMs ?? DEFAULT_DEVICE_AUTH_TTL_MS;
   const intervalMs = options?.intervalMs ?? DEFAULT_DEVICE_AUTH_INTERVAL_MS;
+  const maxWaitMs = options?.maxWaitMs ?? DEFAULT_DEVICE_AUTH_MAX_WAIT_MS;
   assertWholeMillis("ttlMs", ttlMs);
   assertWholeMillis("intervalMs", intervalMs);
-  config2 = { ttlMs, intervalMs };
+  assertWholeMillis("maxWaitMs", maxWaitMs);
+  config2 = { ttlMs, intervalMs, maxWaitMs };
 }
 function assertWholeMillis(name, value) {
   if (!Number.isInteger(value) || value <= 0) {
@@ -13495,6 +13594,9 @@ function getDeviceAuthConfig() {
   return config2;
 }
 
+// src/server/services/device-auth.service.ts
+init_device_auth_waiters();
+
 // src/server/lib/device-code.ts
 import { createHash, randomBytes, randomInt } from "crypto";
 var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
@@ -13524,6 +13626,8 @@ function hashDeviceCode(deviceCode) {
 // src/server/services/device-auth.service.ts
 init_key_policy();
 var USER_CODE_ATTEMPTS = 3;
+var WAIT_RECHECK_MS = 1e3;
+var MAX_WAITERS_PER_RECORD = 3;
 function assertActionable(record) {
   if (!record || record.status === "consumed") {
     throw new DeviceAuthNotFoundError();
@@ -13623,6 +13727,37 @@ async function denyDeviceAuthService(params) {
     );
   }
 }
+async function waitForDeviceAuthAnswerService(params) {
+  const requested = Math.min(params.waitMillis, getDeviceAuthConfig().maxWaitMs);
+  const deviceCodeHash = hashDeviceCode(params.deviceCode);
+  const record = requested > 0 ? await readWaitable(deviceCodeHash) : null;
+  if (!record || waitingOnDeviceAuth(record.id) >= MAX_WAITERS_PER_RECORD) {
+    return 0;
+  }
+  const startedAt = Date.now();
+  const deadline = Math.min(startedAt + requested, record.expiresAt.getTime());
+  await holdDeviceAuthWait(record.id, () => waitUntil(record.id, deviceCodeHash, deadline, params.signal));
+  return Date.now() - startedAt;
+}
+async function waitUntil(id26, deviceCodeHash, deadline, signal) {
+  while (!signal?.aborted && !getShutdownManager().isShuttingDown()) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      return;
+    }
+    await waitForDeviceAuthAnswer(id26, Math.min(remaining, WAIT_RECHECK_MS), signal);
+    if (!await readWaitable(deviceCodeHash)) {
+      return;
+    }
+  }
+}
+async function readWaitable(deviceCodeHash) {
+  const record = await deviceAuthorizationsRepository.findByDeviceCodeHashOnPrimary(deviceCodeHash).catch(() => null);
+  return isWaitable(record) ? record : null;
+}
+function isWaitable(record) {
+  return record?.status === "pending" && record.expiresAt.getTime() > Date.now();
+}
 async function pollDeviceAuthService(params) {
   const deviceCodeHash = hashDeviceCode(params.deviceCode);
   const record = assertActionable(
@@ -13632,7 +13767,10 @@ async function pollDeviceAuthService(params) {
     throw new DeviceAuthDeniedError();
   }
   if (record.status === "pending") {
-    return { status: "pending", intervalMillis: getDeviceAuthConfig().intervalMs };
+    return {
+      status: "pending",
+      intervalMillis: Math.max(0, getDeviceAuthConfig().intervalMs - (params.waitedMillis ?? 0))
+    };
   }
   const consumed = await deviceAuthorizationsRepository.consumeApproved(deviceCodeHash);
   if (!consumed) {
@@ -13688,7 +13826,7 @@ async function completeDeviceLogin(record, provenance) {
     ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
-  onAfterCommit5(() => authLoginEvent.emit({
+  onAfterCommit6(() => authLoginEvent.emit({
     userId: String(user.id),
     provider: "device",
     email: result.email,
@@ -13701,7 +13839,7 @@ async function completeDeviceLogin(record, provenance) {
 // src/server/services/passkey.service.ts
 init_logger();
 init_config();
-import { onAfterCommit as onAfterCommit6, runInTransaction as runInTransaction4 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit7, runInTransaction as runInTransaction4 } from "@spfn/core/db";
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 import {
   AccountDisabledError as AccountDisabledError3,
@@ -13819,7 +13957,7 @@ async function finishPasskeyEnrollmentService(params) {
     aaguid: verified.aaguid,
     label: params.label ?? null
   });
-  onAfterCommit6(() => passkeyEnrolledEvent.emit({
+  onAfterCommit7(() => passkeyEnrolledEvent.emit({
     userId: String(params.userId),
     passkeyId: String(row.id),
     label: row.label ?? void 0
@@ -13919,7 +14057,7 @@ async function startSession(user, params) {
     ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
-  onAfterCommit6(() => authLoginEvent.emit({
+  onAfterCommit7(() => authLoginEvent.emit({
     userId: String(user.id),
     provider: "passkey",
     email: result.email,
@@ -14002,7 +14140,7 @@ async function revokePasskeyService(params) {
   if (!revoked) {
     throw new PasskeyNotFoundError2();
   }
-  onAfterCommit6(() => passkeyRevokedEvent.emit({
+  onAfterCommit7(() => passkeyRevokedEvent.emit({
     userId: String(params.userId),
     passkeyId: String(revoked.id),
     reason: "user"
@@ -15830,7 +15968,7 @@ async function oauthUnlinkNotifyService(provider, notification) {
 }
 
 // src/server/services/oauth-native.service.ts
-import { runInTransaction as runInTransaction5, onAfterCommit as onAfterCommit7 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction5, onAfterCommit as onAfterCommit8 } from "@spfn/core/db";
 import {
   InvalidKeyFingerprintError as InvalidKeyFingerprintError3,
   NativeSignInUnsupportedError as NativeSignInUnsupportedError5,
@@ -15903,7 +16041,7 @@ async function persistNativeLogin(identity, params) {
     }
     await updateLastLoginService(userId);
     const mfaEnrolled = isNewUser ? false : await mfaEnrolledForUser(userId);
-    onAfterCommit7(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
+    onAfterCommit8(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
     return { mfaRequired: false, userId: String(userId), keyId: params.keyId, isNewUser };
   }, { context: "auth:oauth-native" });
 }
@@ -16937,6 +17075,31 @@ function attestedClientIp(c) {
   return provenance.webProxy ? provenance.ip ?? null : null;
 }
 
+// src/server/middleware/device-auth-long-poll.ts
+var DEVICE_AUTH_WAITED_MILLIS = "deviceAuthWaitedMillis";
+function deviceAuthLongPoll() {
+  return async (c, next) => {
+    const target = waitTarget(await c.req.json().catch(() => null));
+    if (!target) {
+      return next();
+    }
+    const signal = c.req.raw.signal;
+    const waitedMillis = await waitForDeviceAuthAnswerService({ ...target, signal });
+    if (signal.aborted) {
+      return c.body(null, 204);
+    }
+    c.set(DEVICE_AUTH_WAITED_MILLIS, waitedMillis);
+    return next();
+  };
+}
+function waitTarget(body) {
+  const { deviceCode, waitMillis } = body ?? {};
+  if (typeof deviceCode !== "string" || !Number.isInteger(waitMillis) || waitMillis <= 0) {
+    return null;
+  }
+  return { deviceCode, waitMillis };
+}
+
 // src/server/routes/auth/index.ts
 var sendVerificationCode = route.post("/_auth/codes").input({
   body: Type.Object({
@@ -17095,11 +17258,23 @@ var startDeviceAuth = route.post("/_auth/device/start").input({
 });
 var pollDeviceAuth = route.post("/_auth/device/poll").input({
   body: Type.Object({
-    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" })
+    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" }),
+    waitMillis: Type.Optional(Type.Integer({
+      minimum: 0,
+      description: "Longest to hold the request while nobody has answered; capped by the server"
+    }))
   })
-}).use([rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([
+  rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }),
+  deviceAuthLongPoll(),
+  Transactional()
+]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  return await pollDeviceAuthService({ ...body, ...deviceProvenance(c.raw) });
+  return await pollDeviceAuthService({
+    deviceCode: body.deviceCode,
+    ...deviceProvenance(c.raw),
+    waitedMillis: Number(c.raw.get(DEVICE_AUTH_WAITED_MILLIS) ?? 0)
+  });
 });
 var getDeviceAuthInfo = route.post("/_auth/device/info").input({
   body: Type.Object({
@@ -18176,7 +18351,7 @@ var CORE_PREREQUISITE_OPERATIONS = [
 
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.13.0";
+var CONTRACT_VERSION = "0.13.1";
 var CONTRACT_SUPPORTED_RANGE = ">=0.13.0 <0.14.0";
 function required(name, type) {
   return { name, type, optional: false };
@@ -18510,7 +18685,8 @@ var CONTRACT_TYPES = [
   {
     name: "PollDeviceAuthRequest",
     fields: [
-      required("deviceCode", "string")
+      required("deviceCode", "string"),
+      optional("waitMillis", "integer")
     ]
   },
   /**
@@ -21479,6 +21655,7 @@ export {
   DEFAULT_DELETION_PURGE_STRATEGY,
   DEFAULT_DELETION_SEND_NOTIFICATIONS,
   DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  DEFAULT_DEVICE_AUTH_MAX_WAIT_MS,
   DEFAULT_DEVICE_AUTH_TTL_MS,
   DEFAULT_REFRESH_TOKEN_TTL_MS,
   DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON,