@spfn/auth 0.3.0-beta.26 → 0.3.0-beta.28

package/dist/server.js

@@ -897,8 +897,8 @@ var init_array2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs
-function Argument(index21) {
-  return CreateType({ [Kind]: "Argument", index: index21 });
+function Argument(index22) {
+  return CreateType({ [Kind]: "Argument", index: index22 });
 }
 var init_argument = __esm({
   "../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs"() {
@@ -1136,28 +1136,28 @@ var init_union2 = __esm({
 function Unescape(pattern) {
   return pattern.replace(/\\\$/g, "$").replace(/\\\*/g, "*").replace(/\\\^/g, "^").replace(/\\\|/g, "|").replace(/\\\(/g, "(").replace(/\\\)/g, ")");
 }
-function IsNonEscaped(pattern, index21, char) {
-  return pattern[index21] === char && pattern.charCodeAt(index21 - 1) !== 92;
+function IsNonEscaped(pattern, index22, char) {
+  return pattern[index22] === char && pattern.charCodeAt(index22 - 1) !== 92;
 }
-function IsOpenParen(pattern, index21) {
-  return IsNonEscaped(pattern, index21, "(");
+function IsOpenParen(pattern, index22) {
+  return IsNonEscaped(pattern, index22, "(");
 }
-function IsCloseParen(pattern, index21) {
-  return IsNonEscaped(pattern, index21, ")");
+function IsCloseParen(pattern, index22) {
+  return IsNonEscaped(pattern, index22, ")");
 }
-function IsSeparator(pattern, index21) {
-  return IsNonEscaped(pattern, index21, "|");
+function IsSeparator(pattern, index22) {
+  return IsNonEscaped(pattern, index22, "|");
 }
 function IsGroup(pattern) {
   if (!(IsOpenParen(pattern, 0) && IsCloseParen(pattern, pattern.length - 1)))
     return false;
   let count2 = 0;
-  for (let index21 = 0; index21 < pattern.length; index21++) {
-    if (IsOpenParen(pattern, index21))
+  for (let index22 = 0; index22 < pattern.length; index22++) {
+    if (IsOpenParen(pattern, index22))
       count2 += 1;
-    if (IsCloseParen(pattern, index21))
+    if (IsCloseParen(pattern, index22))
       count2 -= 1;
-    if (count2 === 0 && index21 !== pattern.length - 1)
+    if (count2 === 0 && index22 !== pattern.length - 1)
       return false;
   }
   return true;
@@ -1167,19 +1167,19 @@ function InGroup(pattern) {
 }
 function IsPrecedenceOr(pattern) {
   let count2 = 0;
-  for (let index21 = 0; index21 < pattern.length; index21++) {
-    if (IsOpenParen(pattern, index21))
+  for (let index22 = 0; index22 < pattern.length; index22++) {
+    if (IsOpenParen(pattern, index22))
       count2 += 1;
-    if (IsCloseParen(pattern, index21))
+    if (IsCloseParen(pattern, index22))
       count2 -= 1;
-    if (IsSeparator(pattern, index21) && count2 === 0)
+    if (IsSeparator(pattern, index22) && count2 === 0)
       return true;
   }
   return false;
 }
 function IsPrecedenceAnd(pattern) {
-  for (let index21 = 0; index21 < pattern.length; index21++) {
-    if (IsOpenParen(pattern, index21))
+  for (let index22 = 0; index22 < pattern.length; index22++) {
+    if (IsOpenParen(pattern, index22))
       return true;
   }
   return false;
@@ -1187,16 +1187,16 @@ function IsPrecedenceAnd(pattern) {
 function Or(pattern) {
   let [count2, start] = [0, 0];
   const expressions = [];
-  for (let index21 = 0; index21 < pattern.length; index21++) {
-    if (IsOpenParen(pattern, index21))
+  for (let index22 = 0; index22 < pattern.length; index22++) {
+    if (IsOpenParen(pattern, index22))
       count2 += 1;
-    if (IsCloseParen(pattern, index21))
+    if (IsCloseParen(pattern, index22))
       count2 -= 1;
-    if (IsSeparator(pattern, index21) && count2 === 0) {
-      const range2 = pattern.slice(start, index21);
+    if (IsSeparator(pattern, index22) && count2 === 0) {
+      const range2 = pattern.slice(start, index22);
       if (range2.length > 0)
         expressions.push(TemplateLiteralParse(range2));
-      start = index21 + 1;
+      start = index22 + 1;
     }
   }
   const range = pattern.slice(start);
@@ -1209,40 +1209,40 @@ function Or(pattern) {
   return { type: "or", expr: expressions };
 }
 function And(pattern) {
-  function Group(value, index21) {
-    if (!IsOpenParen(value, index21))
+  function Group(value, index22) {
+    if (!IsOpenParen(value, index22))
       throw new TemplateLiteralParserError(`TemplateLiteralParser: Index must point to open parens`);
     let count2 = 0;
-    for (let scan = index21; scan < value.length; scan++) {
+    for (let scan = index22; scan < value.length; scan++) {
       if (IsOpenParen(value, scan))
         count2 += 1;
       if (IsCloseParen(value, scan))
         count2 -= 1;
       if (count2 === 0)
-        return [index21, scan];
+        return [index22, scan];
     }
     throw new TemplateLiteralParserError(`TemplateLiteralParser: Unclosed group parens in expression`);
   }
-  function Range(pattern2, index21) {
-    for (let scan = index21; scan < pattern2.length; scan++) {
+  function Range(pattern2, index22) {
+    for (let scan = index22; scan < pattern2.length; scan++) {
       if (IsOpenParen(pattern2, scan))
-        return [index21, scan];
+        return [index22, scan];
     }
-    return [index21, pattern2.length];
+    return [index22, pattern2.length];
   }
   const expressions = [];
-  for (let index21 = 0; index21 < pattern.length; index21++) {
-    if (IsOpenParen(pattern, index21)) {
-      const [start, end] = Group(pattern, index21);
+  for (let index22 = 0; index22 < pattern.length; index22++) {
+    if (IsOpenParen(pattern, index22)) {
+      const [start, end] = Group(pattern, index22);
       const range = pattern.slice(start, end + 1);
       expressions.push(TemplateLiteralParse(range));
-      index21 = end;
+      index22 = end;
     } else {
-      const [start, end] = Range(pattern, index21);
+      const [start, end] = Range(pattern, index22);
       const range = pattern.slice(start, end);
       if (range.length > 0)
         expressions.push(TemplateLiteralParse(range));
-      index21 = end - 1;
+      index22 = end - 1;
     }
   }
   return expressions.length === 0 ? { type: "const", const: "" } : expressions.length === 1 ? expressions[0] : { type: "and", expr: expressions };
@@ -2577,13 +2577,13 @@ function FromBoolean(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsBoolean(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromConstructor(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index21) => IntoBooleanResult(Visit3(right.parameters[index21], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index22) => IntoBooleanResult(Visit3(right.parameters[index22], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromDate(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsDate(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromFunction(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index21) => IntoBooleanResult(Visit3(right.parameters[index21], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index22) => IntoBooleanResult(Visit3(right.parameters[index22], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromIntegerRight(left, right) {
   return type_exports.IsLiteral(left) && value_exports.IsNumber(left.const) ? ExtendsResult.True : type_exports.IsNumber(left) || type_exports.IsInteger(left) ? ExtendsResult.True : ExtendsResult.False;
@@ -2743,7 +2743,7 @@ function FromTupleRight(left, right) {
   return type_exports.IsNever(left) ? ExtendsResult.True : type_exports.IsUnknown(left) ? ExtendsResult.False : type_exports.IsAny(left) ? ExtendsResult.Union : ExtendsResult.False;
 }
 function FromTuple3(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index21) => Visit3(schema, right.items[index21]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index22) => Visit3(schema, right.items[index22]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromUint8Array(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsUint8Array(right) ? ExtendsResult.True : ExtendsResult.False;
@@ -4474,7 +4474,7 @@ var init_types = __esm({
 
 // src/server/routes/schema.ts
 import { EMAIL_PATTERN, PHONE_PATTERN } from "@spfn/auth";
-var EmailSchema, PhoneSchema, DeviceNameSchema, PlatformSchema, PublicKeySchema, KeyIdSchema, FingerprintSchema, UserCodeSchema, DeviceAuthPollResponseSchema, PasswordSchema, TargetTypeSchema, VERIFICATION_TARGET_TYPES, VerificationPurposeSchema, VERIFICATION_PURPOSES;
+var EmailSchema, PhoneSchema, DeviceNameSchema, PlatformSchema, PublicKeySchema, KeyIdSchema, FingerprintSchema, UserCodeSchema, LinkIdSchema, MatchChoiceSchema, DeviceAuthPollResponseSchema, PasswordSchema, TargetTypeSchema, VERIFICATION_TARGET_TYPES, VerificationPurposeSchema, VERIFICATION_PURPOSES;
 var init_schema3 = __esm({
   "src/server/routes/schema.ts"() {
     "use strict";
@@ -4513,6 +4513,16 @@ var init_schema3 = __esm({
       maxLength: 16,
       description: "Device user code as displayed, e.g. WXYZ-2345. Dashes, spaces and case are ignored."
     });
+    LinkIdSchema = Type.String({
+      minLength: 1,
+      maxLength: 64,
+      description: "Device link handle returned by /_auth/device/link/issue"
+    });
+    MatchChoiceSchema = Type.Integer({
+      minimum: 10,
+      maximum: 99,
+      description: "The number the issuer picked \u2014 the one the new device shows"
+    });
     DeviceAuthPollResponseSchema = Type.Union([
       Type.Object({
         status: Type.Literal("pending"),
@@ -5615,9 +5625,86 @@ var init_device_authorizations = __esm({
   }
 });
 
+// src/server/entities/device-links.ts
+import { integer as integer9, text as text17, uniqueIndex as uniqueIndex9, index as index14 } from "drizzle-orm/pg-core";
+import { id as id16, timestamps as timestamps14, enumText as enumText10, utcTimestamp as utcTimestamp15, foreignKey as foreignKey12 } from "@spfn/core/db";
+var DEVICE_LINK_STATUSES, deviceLinks;
+var init_device_links = __esm({
+  "src/server/entities/device-links.ts"() {
+    "use strict";
+    init_types();
+    init_users();
+    init_schema4();
+    DEVICE_LINK_STATUSES = ["issued", "redeemed", "approved", "denied", "consumed", "expired"];
+    deviceLinks = authSchema.table(
+      "device_links",
+      {
+        id: id16(),
+        // The issuer's handle on the record, returned by issue and named by
+        // status, confirm, deny and cancel
+        // Random rather than the row id so a handle says nothing about how many
+        // links exist; it authorizes nothing without the issuing key beside it
+        linkId: text17("link_id").notNull().unique(),
+        // The code the issuer shows and the new device sends back
+        // Stored normalized — uppercase, no dash — as device_authorizations does
+        // Plaintext on purpose: redeeming it registers nothing until the issuer
+        // picks the match number the redeeming device shows
+        userCode: text17("user_code").notNull(),
+        // The account the new device joins, written at issue time from the
+        // issuer's session. Never taken from a request body
+        issuerUserId: foreignKey12("issuer_user", () => users.id, { onDelete: "cascade" }),
+        // The key that signed the issue request
+        // Only requests signed by this key can see or answer the link, and the
+        // link is judged expired once this key is revoked or runs out
+        issuerKeyId: text17("issuer_key_id").notNull(),
+        // SHA-256 of the device code, hex — set at redeem, null before
+        // The code itself is returned to the redeeming device once and never stored
+        deviceCodeHash: text17("device_code_hash").unique(),
+        // Key material the redeeming device generated, same shapes as user_public_keys
+        // null until redeem; parked, not registered, until a poll moves it over
+        publicKey: text17("public_key"),
+        keyId: text17("key_id"),
+        fingerprint: text17("fingerprint"),
+        algorithm: enumText10("algorithm", KEY_ALGORITHM),
+        // Labels the redeeming device supplied, shown to the issuer
+        // Display only — the match number is what the decision rests on
+        deviceName: text17("device_name"),
+        platform: enumText10("platform", KEY_PLATFORM),
+        // The number the redeeming device shows, 10–99, drawn at redeem
+        // Never sent to the issuer on its own: it is one of `choices`
+        matchNumber: integer9("match_number"),
+        // The three numbers the issuer picks from — the match and two distinct
+        // decoys, shuffled once at redeem so every status answer shows the same
+        // order
+        choices: integer9("choices").array(),
+        status: enumText10("status", DEVICE_LINK_STATUSES).notNull().default("issued"),
+        // Expiry — 5 minutes from issue by default
+        // Judged on read and in every transition; no job clears the row
+        expiresAt: utcTimestamp15("expires_at").notNull(),
+        // Set when a device redeemed the code
+        redeemedAt: utcTimestamp15("redeemed_at"),
+        // Set when the issuer picked the right number
+        approvedAt: utcTimestamp15("approved_at"),
+        // Set when the poll that registered the key won the race
+        consumedAt: utcTimestamp15("consumed_at"),
+        ...timestamps14()
+      },
+      (table) => [
+        // Lookup path for redeem
+        // Unique so a typed code can never address two records
+        uniqueIndex9("device_link_user_code_idx").on(table.userCode),
+        // Issue expires the issuing key's live link before it creates the next one
+        index14("device_link_issuer_key_idx").on(table.issuerKeyId),
+        // A global revocation expires every live link of the account
+        index14("device_link_issuer_user_idx").on(table.issuerUserId)
+      ]
+    );
+  }
+});
+
 // src/server/entities/user-invitations.ts
-import { text as text17, index as index14 } from "drizzle-orm/pg-core";
-import { id as id16, timestamps as timestamps14, enumText as enumText10, utcTimestamp as utcTimestamp15, typedJsonb as typedJsonb2, foreignKey as foreignKey12 } from "@spfn/core/db";
+import { text as text18, index as index15 } from "drizzle-orm/pg-core";
+import { id as id17, timestamps as timestamps15, enumText as enumText11, utcTimestamp as utcTimestamp16, typedJsonb as typedJsonb2, foreignKey as foreignKey13 } from "@spfn/core/db";
 var userInvitations;
 var init_user_invitations = __esm({
   "src/server/entities/user-invitations.ts"() {
@@ -5630,39 +5717,39 @@ var init_user_invitations = __esm({
       "user_invitations",
       {
         // Primary key
-        id: id16(),
+        id: id17(),
         // Target email address for the invitation
         // Will become the user's email upon acceptance
-        email: text17("email").notNull(),
+        email: text18("email").notNull(),
         // Unique invitation token (UUID v4)
         // Used in invitation URL: /auth/invite/{token}
         // Single-use token that expires after acceptance
-        token: text17("token").notNull().unique(),
+        token: text18("token").notNull().unique(),
         // Role to be assigned when invitation is accepted
         // Foreign key to roles table
-        roleId: foreignKey12("role", () => roles.id),
+        roleId: foreignKey13("role", () => roles.id),
         // User who created this invitation
         // Foreign key to users table
         // Used for: audit trail, permission checks
-        invitedBy: foreignKey12("invited_by", () => users.id, { onDelete: "cascade" }),
+        invitedBy: foreignKey13("invited_by", () => users.id, { onDelete: "cascade" }),
         // Invitation status
         // - pending: Invitation sent, awaiting acceptance
         // - accepted: User accepted and account created
         // - expired: Invitation expired (automatic)
         // - cancelled: Invitation cancelled by admin
-        status: enumText10("status", INVITATION_STATUSES).default("pending").notNull(),
+        status: enumText11("status", INVITATION_STATUSES).default("pending").notNull(),
         // Expiration timestamp (default: 7 days from creation)
         // Invitation cannot be accepted after this time
         // Background job should update status to 'expired'
-        expiresAt: utcTimestamp15("expires_at").notNull(),
+        expiresAt: utcTimestamp16("expires_at").notNull(),
         // Timestamp when invitation was accepted
         // null = not yet accepted
         // Used for: audit trail, analytics
-        acceptedAt: utcTimestamp15("accepted_at"),
+        acceptedAt: utcTimestamp16("accepted_at"),
         // Timestamp when invitation was cancelled
         // null = not cancelled
         // Used for: audit trail
-        cancelledAt: utcTimestamp15("cancelled_at"),
+        cancelledAt: utcTimestamp16("cancelled_at"),
         // Additional metadata (JSONB)
         // Use cases:
         // - Custom welcome message
@@ -5671,26 +5758,26 @@ var init_user_invitations = __esm({
         // - Custom fields for app-specific data
         // Example: { message: "Welcome!", department: "Engineering" }
         metadata: typedJsonb2("metadata"),
-        ...timestamps14()
+        ...timestamps15()
       },
       (table) => [
         // Indexes for query optimization
-        index14("invitations_token_idx").on(table.token),
-        index14("invitations_email_idx").on(table.email),
-        index14("invitations_status_idx").on(table.status),
-        index14("invitations_invited_by_idx").on(table.invitedBy),
-        index14("invitations_expires_at_idx").on(table.expiresAt),
+        index15("invitations_token_idx").on(table.token),
+        index15("invitations_email_idx").on(table.email),
+        index15("invitations_status_idx").on(table.status),
+        index15("invitations_invited_by_idx").on(table.invitedBy),
+        index15("invitations_expires_at_idx").on(table.expiresAt),
         // For cleanup jobs
-        index14("invitations_role_id_idx").on(table.roleId)
+        index15("invitations_role_id_idx").on(table.roleId)
       ]
     );
   }
 });
 
 // src/server/entities/account-deletion-requests.ts
-import { text as text18, index as index15, uniqueIndex as uniqueIndex9 } from "drizzle-orm/pg-core";
+import { text as text19, index as index16, uniqueIndex as uniqueIndex10 } from "drizzle-orm/pg-core";
 import { sql as sql2 } from "drizzle-orm";
-import { id as id17, timestamps as timestamps15, enumText as enumText11, utcTimestamp as utcTimestamp16, optionalForeignKey as optionalForeignKey2 } from "@spfn/core/db";
+import { id as id18, timestamps as timestamps16, enumText as enumText12, utcTimestamp as utcTimestamp17, optionalForeignKey as optionalForeignKey2 } from "@spfn/core/db";
 var accountDeletionRequests;
 var init_account_deletion_requests = __esm({
   "src/server/entities/account-deletion-requests.ts"() {
@@ -5701,40 +5788,40 @@ var init_account_deletion_requests = __esm({
     accountDeletionRequests = authSchema.table(
       "account_deletion_requests",
       {
-        id: id17(),
+        id: id18(),
         // Foreign key to users table. `set null` (optionalForeignKey default) so this
         // row survives a hard-delete purge of the user it refers to.
         userId: optionalForeignKey2("user", () => users.id),
         // Snapshot of the user's public UUID at request time — stays readable even
         // after userId is nulled out or the account is anonymized.
-        userPublicId: text18("user_public_id").notNull(),
+        userPublicId: text19("user_public_id").notNull(),
         // When the deletion was requested
-        requestedAt: utcTimestamp16("requested_at").notNull().defaultNow(),
+        requestedAt: utcTimestamp17("requested_at").notNull().defaultNow(),
         // When the purge job is allowed to run (requestedAt + grace period; equals
         // requestedAt itself for immediate/zero-grace deletions)
-        purgeScheduledAt: utcTimestamp16("purge_scheduled_at").notNull(),
+        purgeScheduledAt: utcTimestamp17("purge_scheduled_at").notNull(),
         // Request lifecycle status
         // - pending: awaiting purgeScheduledAt (or immediate purge)
         // - cancelled: recovered before purge
         // - completed: purge ran
-        status: enumText11("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
+        status: enumText12("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
         // Who initiated the request
-        requestedBy: enumText11("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
+        requestedBy: enumText12("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
         // Optional free-text reason (self-service UI, admin note, DSR reference, ...)
-        reason: text18("reason"),
-        cancelledAt: utcTimestamp16("cancelled_at"),
-        completedAt: utcTimestamp16("completed_at"),
+        reason: text19("reason"),
+        cancelledAt: utcTimestamp17("cancelled_at"),
+        completedAt: utcTimestamp17("completed_at"),
         // Purge strategy actually executed (set on completion; null while pending)
-        purgeStrategy: enumText11("purge_strategy", PURGE_STRATEGIES),
-        ...timestamps15()
+        purgeStrategy: enumText12("purge_strategy", PURGE_STRATEGIES),
+        ...timestamps16()
       },
       (table) => [
-        index15("account_deletion_requests_user_id_idx").on(table.userId),
-        index15("account_deletion_requests_status_idx").on(table.status),
-        index15("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
-        index15("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
+        index16("account_deletion_requests_user_id_idx").on(table.userId),
+        index16("account_deletion_requests_status_idx").on(table.status),
+        index16("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
+        index16("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
         // Partial unique index: at most one pending request per user at a time.
-        uniqueIndex9("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
+        uniqueIndex10("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
       ]
     );
   }
@@ -5886,8 +5973,8 @@ var init_rbac = __esm({
 });
 
 // src/server/entities/permissions.ts
-import { text as text19, boolean as boolean5, index as index16 } from "drizzle-orm/pg-core";
-import { id as id18, timestamps as timestamps16, enumText as enumText12, typedJsonb as typedJsonb3 } from "@spfn/core/db";
+import { text as text20, boolean as boolean5, index as index17 } from "drizzle-orm/pg-core";
+import { id as id19, timestamps as timestamps17, enumText as enumText13, typedJsonb as typedJsonb3 } from "@spfn/core/db";
 var permissions;
 var init_permissions = __esm({
   "src/server/entities/permissions.ts"() {
@@ -5898,7 +5985,7 @@ var init_permissions = __esm({
       "permissions",
       {
         // Primary key
-        id: id18(),
+        id: id19(),
         // Permission identifier
         // Format: resource:action or namespace:resource:action
         // Examples:
@@ -5906,20 +5993,20 @@ var init_permissions = __esm({
         // - Namespaced: 'auth:user:delete', 'cms:post:publish'
         // Must be unique across all permissions
         // Used in: permission checks, role assignments, API guards
-        name: text19("name").notNull().unique(),
+        name: text20("name").notNull().unique(),
         // Display name for UI
         // Human-readable name shown in admin panels
         // Example: "Delete Users", "Publish Posts"
-        displayName: text19("display_name").notNull(),
+        displayName: text20("display_name").notNull(),
         // Permission description
         // Detailed explanation of what this permission allows
         // Example: "Allows deletion of user accounts from the system"
-        description: text19("description"),
+        description: text20("description"),
         // Category for grouping
         // Used for: organizing permissions in UI, filtering
         // Built-in categories: auth, user, rbac, system
         // Custom categories: any app-specific category
-        category: enumText12("category", PERMISSION_CATEGORIES),
+        category: enumText13("category", PERMISSION_CATEGORIES),
         // Built-in permission flag
         // true: Core package permissions (auth:*, user:*, rbac:*)
         //       - Cannot be deleted or modified
@@ -5950,22 +6037,22 @@ var init_permissions = __esm({
         // - Audit: { createdBy: 123, source: 'migration', version: '1.0.0' }
         // Example: { icon: 'trash', color: 'red', requiresMfa: true }
         metadata: typedJsonb3("metadata"),
-        ...timestamps16()
+        ...timestamps17()
       },
       (table) => [
-        index16("permissions_name_idx").on(table.name),
-        index16("permissions_category_idx").on(table.category),
-        index16("permissions_is_system_idx").on(table.isSystem),
-        index16("permissions_is_active_idx").on(table.isActive),
-        index16("permissions_is_builtin_idx").on(table.isBuiltin)
+        index17("permissions_name_idx").on(table.name),
+        index17("permissions_category_idx").on(table.category),
+        index17("permissions_is_system_idx").on(table.isSystem),
+        index17("permissions_is_active_idx").on(table.isActive),
+        index17("permissions_is_builtin_idx").on(table.isBuiltin)
       ]
     );
   }
 });
 
 // src/server/entities/role-permissions.ts
-import { index as index17, unique } from "drizzle-orm/pg-core";
-import { id as id19, timestamps as timestamps17, foreignKey as foreignKey13 } from "@spfn/core/db";
+import { index as index18, unique } from "drizzle-orm/pg-core";
+import { id as id20, timestamps as timestamps18, foreignKey as foreignKey14 } from "@spfn/core/db";
 var rolePermissions;
 var init_role_permissions = __esm({
   "src/server/entities/role-permissions.ts"() {
@@ -5977,25 +6064,25 @@ var init_role_permissions = __esm({
       "role_permissions",
       {
         // Primary key
-        id: id19(),
+        id: id20(),
         // Role reference
         // Foreign key to roles table
         // Cascade delete: when role is deleted, all role-permission mappings are removed
         // Used for: defining which permissions each role has
         // Example: Admin role → [user:create, user:delete, user:update]
-        roleId: foreignKey13("role", () => roles.id, { onDelete: "cascade" }),
+        roleId: foreignKey14("role", () => roles.id, { onDelete: "cascade" }),
         // Permission reference
         // Foreign key to permissions table
         // Cascade delete: when permission is deleted, all role-permission mappings are removed
         // Used for: granting permissions to roles
         // Example: user:delete permission → [Admin, Superadmin]
-        permissionId: foreignKey13("permission", () => permissions.id, { onDelete: "cascade" }),
-        ...timestamps17()
+        permissionId: foreignKey14("permission", () => permissions.id, { onDelete: "cascade" }),
+        ...timestamps18()
       },
       (table) => [
         // Indexes for query performance
-        index17("role_permissions_role_id_idx").on(table.roleId),
-        index17("role_permissions_permission_id_idx").on(table.permissionId),
+        index18("role_permissions_role_id_idx").on(table.roleId),
+        index18("role_permissions_permission_id_idx").on(table.permissionId),
         // Unique constraint: one role-permission pair only
         unique("role_permissions_unique").on(table.roleId, table.permissionId)
       ]
@@ -6004,8 +6091,8 @@ var init_role_permissions = __esm({
 });
 
 // src/server/entities/user-permissions.ts
-import { boolean as boolean6, text as text20, index as index18, unique as unique2 } from "drizzle-orm/pg-core";
-import { id as id20, timestamps as timestamps18, utcTimestamp as utcTimestamp17, foreignKey as foreignKey14 } from "@spfn/core/db";
+import { boolean as boolean6, text as text21, index as index19, unique as unique2 } from "drizzle-orm/pg-core";
+import { id as id21, timestamps as timestamps19, utcTimestamp as utcTimestamp18, foreignKey as foreignKey15 } from "@spfn/core/db";
 var userPermissions;
 var init_user_permissions = __esm({
   "src/server/entities/user-permissions.ts"() {
@@ -6017,15 +6104,15 @@ var init_user_permissions = __esm({
       "user_permissions",
       {
         // Primary key
-        id: id20(),
+        id: id21(),
         // User reference
         // Foreign key to users table
         // Cascade delete: when user is deleted, all overrides are removed
-        userId: foreignKey14("user", () => users.id, { onDelete: "cascade" }),
+        userId: foreignKey15("user", () => users.id, { onDelete: "cascade" }),
         // Permission reference
         // Foreign key to permissions table
         // Cascade delete: when permission is deleted, all overrides are removed
-        permissionId: foreignKey14("permission", () => permissions.id, { onDelete: "cascade" }),
+        permissionId: foreignKey15("permission", () => permissions.id, { onDelete: "cascade" }),
         // Grant or revoke flag
         // true: GRANT this permission to the user (additive override)
         //       - Grants permission even if role doesn't have it
@@ -6040,19 +6127,19 @@ var init_user_permissions = __esm({
         // Reason for grant/revocation
         // Used for: audit trail, compliance documentation
         // Example: "Temporary access for project X", "Security incident - restricted"
-        reason: text20("reason"),
+        reason: text21("reason"),
         // Expiration timestamp (optional)
         // null: Permanent override (remains until manually removed)
         // timestamp: Permission expires at this time (auto-revoked by background job)
         // Use case: Time-limited elevated access, temporary restrictions
-        expiresAt: utcTimestamp17("expires_at"),
-        ...timestamps18()
+        expiresAt: utcTimestamp18("expires_at"),
+        ...timestamps19()
       },
       (table) => [
         // Indexes for query performance
-        index18("user_permissions_user_id_idx").on(table.userId),
-        index18("user_permissions_permission_id_idx").on(table.permissionId),
-        index18("user_permissions_expires_at_idx").on(table.expiresAt),
+        index19("user_permissions_user_id_idx").on(table.userId),
+        index19("user_permissions_permission_id_idx").on(table.permissionId),
+        index19("user_permissions_expires_at_idx").on(table.expiresAt),
         // Unique constraint: one user-permission pair only
         unique2("user_permissions_unique").on(table.userId, table.permissionId)
       ]
@@ -6061,8 +6148,8 @@ var init_user_permissions = __esm({
 });
 
 // src/server/entities/oauth2-clients.ts
-import { text as text21 } from "drizzle-orm/pg-core";
-import { id as id21, timestamps as timestamps19, utcTimestamp as utcTimestamp18 } from "@spfn/core/db";
+import { text as text22 } from "drizzle-orm/pg-core";
+import { id as id22, timestamps as timestamps20, utcTimestamp as utcTimestamp19 } from "@spfn/core/db";
 var oauth2Clients;
 var init_oauth2_clients = __esm({
   "src/server/entities/oauth2-clients.ts"() {
@@ -6071,35 +6158,35 @@ var init_oauth2_clients = __esm({
     oauth2Clients = authSchema.table(
       "oauth2_clients",
       {
-        id: id21(),
+        id: id22(),
         // The `client_id` the client sends on every later request. Random, opaque,
         // and the unique constraint doubles as the lookup index.
-        clientId: text21("client_id").notNull().unique(),
+        clientId: text22("client_id").notNull().unique(),
         // Self-declared label, shown on the consent screen and nowhere else.
         // A client that lies about it gains one wrong line on that screen.
-        clientName: text21("client_name").notNull(),
+        clientName: text22("client_name").notNull(),
         // Registered redirect URIs, stored exactly as the client wrote them.
         // The registration answer echoes them back verbatim, so normalising here
         // would answer a client with a URI it did not register. Matching
         // normalises both sides instead — see lib/oauth2/redirect-uri.ts.
-        redirectUris: text21("redirect_uris").array().notNull(),
+        redirectUris: text22("redirect_uris").array().notNull(),
         // Client IP the registration arrived from, so the per-IP cap on clients
         // nobody has approved yet can be counted. Nullable: an IP is not always
         // knowable behind a proxy that forwards none, and a registration is not
         // worth refusing over that.
-        createdIp: text21("created_ip"),
+        createdIp: text22("created_ip"),
         // Last token issuance or refresh under this client, updated
         // fire-and-forget. Operator-facing only; nothing is authorized by it.
-        lastUsedAt: utcTimestamp18("last_used_at"),
-        ...timestamps19()
+        lastUsedAt: utcTimestamp19("last_used_at"),
+        ...timestamps20()
       }
     );
   }
 });
 
 // src/server/entities/oauth2-grants.ts
-import { uniqueIndex as uniqueIndex10, index as index19, text as text22 } from "drizzle-orm/pg-core";
-import { id as id22, timestamps as timestamps20, utcTimestamp as utcTimestamp19, foreignKey as foreignKey15 } from "@spfn/core/db";
+import { uniqueIndex as uniqueIndex11, index as index20, text as text23 } from "drizzle-orm/pg-core";
+import { id as id23, timestamps as timestamps21, utcTimestamp as utcTimestamp20, foreignKey as foreignKey16 } from "@spfn/core/db";
 var oauth2Grants;
 var init_oauth2_grants = __esm({
   "src/server/entities/oauth2-grants.ts"() {
@@ -6110,39 +6197,39 @@ var init_oauth2_grants = __esm({
     oauth2Grants = authSchema.table(
       "oauth2_grants",
       {
-        id: id22(),
+        id: id23(),
         // `oauth2_client_id` and not `client_id`: the opaque string a client
         // sends is called `client_id` everywhere in the protocol, and a bigint
         // foreign key under that name in this schema would read as that value.
-        client: foreignKey15("oauth2_client", () => oauth2Clients.id, { onDelete: "cascade" }),
+        client: foreignKey16("oauth2_client", () => oauth2Clients.id, { onDelete: "cascade" }),
         // Whose consent this is. Read from the approving session at authorize
         // time, never from a request body — that is the whole authorization.
-        user: foreignKey15("user", () => users.id, { onDelete: "cascade" }),
+        user: foreignKey16("user", () => users.id, { onDelete: "cascade" }),
         // The RFC 8707 target this consent is for, normalised (see lib/oauth2).
         // An access token is only good against the resource its grant names.
-        resource: text22("resource").notNull(),
+        resource: text23("resource").notNull(),
         // Scope names the user approved. A refresh may ask for a subset of these
         // and never for more.
-        scopes: text22("scopes").array().notNull(),
+        scopes: text23("scopes").array().notNull(),
         // null = live; a timestamp cuts off every code and token beneath it
-        revokedAt: utcTimestamp19("revoked_at"),
-        ...timestamps20()
+        revokedAt: utcTimestamp20("revoked_at"),
+        ...timestamps21()
       },
       (table) => [
         // One consent per (client, user, resource) — the re-consent path updates
         // this row rather than inserting beside it.
-        uniqueIndex10("oauth2_grant_client_user_resource_idx").on(table.client, table.user, table.resource),
+        uniqueIndex11("oauth2_grant_client_user_resource_idx").on(table.client, table.user, table.resource),
         // The global-revocation path and the user's own grant list both address
         // rows by user alone.
-        index19("oauth2_grant_user_idx").on(table.user)
+        index20("oauth2_grant_user_idx").on(table.user)
       ]
     );
   }
 });
 
 // src/server/entities/oauth2-authorization-codes.ts
-import { text as text23 } from "drizzle-orm/pg-core";
-import { id as id23, timestamps as timestamps21, utcTimestamp as utcTimestamp20, foreignKey as foreignKey16 } from "@spfn/core/db";
+import { text as text24 } from "drizzle-orm/pg-core";
+import { id as id24, timestamps as timestamps22, utcTimestamp as utcTimestamp21, foreignKey as foreignKey17 } from "@spfn/core/db";
 var oauth2AuthorizationCodes;
 var init_oauth2_authorization_codes = __esm({
   "src/server/entities/oauth2-authorization-codes.ts"() {
@@ -6152,33 +6239,33 @@ var init_oauth2_authorization_codes = __esm({
     oauth2AuthorizationCodes = authSchema.table(
       "oauth2_authorization_codes",
       {
-        id: id23(),
+        id: id24(),
         // SHA-256 hex of the code. The code itself (32 random bytes, base64url)
         // is in the redirect and nowhere else.
-        codeHash: text23("code_hash").notNull().unique(),
-        grant: foreignKey16("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
+        codeHash: text24("code_hash").notNull().unique(),
+        grant: foreignKey17("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
         // The exact redirect_uri string the authorize request carried. The token
         // request must repeat it character for character (RFC 6749 §4.1.3).
-        redirectUri: text23("redirect_uri").notNull(),
+        redirectUri: text24("redirect_uri").notNull(),
         // The PKCE S256 challenge. `code_verifier` at the token endpoint is
         // hashed and compared against this; `plain` is not accepted anywhere,
         // so no method column is needed.
-        codeChallenge: text23("code_challenge").notNull(),
+        codeChallenge: text24("code_challenge").notNull(),
         // 60 seconds from issuance. Judged by the database in the statement that
         // spends the row, not only in a read before it.
-        expiresAt: utcTimestamp20("expires_at").notNull(),
+        expiresAt: utcTimestamp21("expires_at").notNull(),
         // null = unspent. Non-null means spent, and a second presentation of the
         // same code revokes the grant.
-        usedAt: utcTimestamp20("used_at"),
-        ...timestamps21()
+        usedAt: utcTimestamp21("used_at"),
+        ...timestamps22()
       }
     );
   }
 });
 
 // src/server/entities/oauth2-tokens.ts
-import { index as index20, text as text24 } from "drizzle-orm/pg-core";
-import { id as id24, timestamps as timestamps22, enumText as enumText13, utcTimestamp as utcTimestamp21, foreignKey as foreignKey17 } from "@spfn/core/db";
+import { index as index21, text as text25 } from "drizzle-orm/pg-core";
+import { id as id25, timestamps as timestamps23, enumText as enumText14, utcTimestamp as utcTimestamp22, foreignKey as foreignKey18 } from "@spfn/core/db";
 var OAUTH2_TOKEN_KINDS, oauth2Tokens;
 var init_oauth2_tokens = __esm({
   "src/server/entities/oauth2-tokens.ts"() {
@@ -6189,30 +6276,30 @@ var init_oauth2_tokens = __esm({
     oauth2Tokens = authSchema.table(
       "oauth2_tokens",
       {
-        id: id24(),
+        id: id25(),
         // SHA-256 hex of the token value. Lookup key; the unique constraint
         // doubles as the index.
-        tokenHash: text24("token_hash").notNull().unique(),
-        kind: enumText13("kind", OAUTH2_TOKEN_KINDS).notNull(),
-        grant: foreignKey17("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
+        tokenHash: text25("token_hash").notNull().unique(),
+        kind: enumText14("kind", OAUTH2_TOKEN_KINDS).notNull(),
+        grant: foreignKey18("oauth2_grant", () => oauth2Grants.id, { onDelete: "cascade" }),
         // What this particular token carries, which may be narrower than its
         // grant's scopes: a refresh request is allowed to ask for a subset.
         // Never wider — that is `invalid_scope`.
-        scopes: text24("scopes").array().notNull(),
-        expiresAt: utcTimestamp21("expires_at").notNull(),
+        scopes: text25("scopes").array().notNull(),
+        expiresAt: utcTimestamp22("expires_at").notNull(),
         // null = live. Set by revoke, by a grant revocation, and by the two
         // replay detections (code reuse, refresh reuse).
-        revokedAt: utcTimestamp21("revoked_at"),
+        revokedAt: utcTimestamp22("revoked_at"),
         // Refresh only: set when a rotation issued the successor. A row with
         // this set is spent, and presenting it revokes the grant.
-        replacedAt: utcTimestamp21("replaced_at"),
+        replacedAt: utcTimestamp22("replaced_at"),
         // Last successful verification, updated fire-and-forget like ops tokens
-        lastUsedAt: utcTimestamp21("last_used_at"),
-        ...timestamps22()
+        lastUsedAt: utcTimestamp22("last_used_at"),
+        ...timestamps23()
       },
       (table) => [
         // Revocation addresses every token under one grant.
-        index20("oauth2_token_grant_idx").on(table.grant)
+        index21("oauth2_token_grant_idx").on(table.grant)
       ]
     );
   }
@@ -6220,7 +6307,7 @@ var init_oauth2_tokens = __esm({
 
 // src/server/entities/auth-metadata.ts
 import { sql as sql3 } from "drizzle-orm";
-import { text as text25, timestamp } from "drizzle-orm/pg-core";
+import { text as text26, timestamp } from "drizzle-orm/pg-core";
 var authMetadata;
 var init_auth_metadata = __esm({
   "src/server/entities/auth-metadata.ts"() {
@@ -6230,9 +6317,9 @@ var init_auth_metadata = __esm({
       "auth_metadata",
       {
         // Metadata key (primary key)
-        key: text25("key").primaryKey(),
+        key: text26("key").primaryKey(),
         // Metadata value
-        value: text25("value").notNull(),
+        value: text26("value").notNull(),
         // Last updated timestamp — stamped by the database on insert and on update
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow().$onUpdate(() => sql3`now()`)
       }
@@ -6241,8 +6328,8 @@ var init_auth_metadata = __esm({
 });
 
 // src/server/entities/ops-tokens.ts
-import { text as text26 } from "drizzle-orm/pg-core";
-import { id as id25, timestamps as timestamps23, utcTimestamp as utcTimestamp22 } from "@spfn/core/db";
+import { text as text27 } from "drizzle-orm/pg-core";
+import { id as id26, timestamps as timestamps24, utcTimestamp as utcTimestamp23 } from "@spfn/core/db";
 var opsTokens;
 var init_ops_tokens = __esm({
   "src/server/entities/ops-tokens.ts"() {
@@ -6251,22 +6338,22 @@ var init_ops_tokens = __esm({
     opsTokens = authSchema.table(
       "ops_tokens",
       {
-        id: id25(),
+        id: id26(),
         // Operator-facing label ("ci-deploy", "rayim-laptop")
-        name: text26("name").notNull(),
+        name: text27("name").notNull(),
         // SHA-256 hex of the token secret. Lookup key — the secret never lands
         // here, and the unique constraint doubles as the lookup index.
-        tokenHash: text26("token_hash").notNull().unique(),
+        tokenHash: text27("token_hash").notNull().unique(),
         // Granted scopes as permission strings ('waitlist:read', ...).
         // '*' grants every scope.
-        scopes: text26("scopes").array().notNull(),
+        scopes: text27("scopes").array().notNull(),
         // null = the token does not expire
-        expiresAt: utcTimestamp22("expires_at"),
+        expiresAt: utcTimestamp23("expires_at"),
         // null = active; a timestamp revokes the token permanently
-        revokedAt: utcTimestamp22("revoked_at"),
+        revokedAt: utcTimestamp23("revoked_at"),
         // Last successful verification, updated fire-and-forget
-        lastUsedAt: utcTimestamp22("last_used_at"),
-        ...timestamps23()
+        lastUsedAt: utcTimestamp23("last_used_at"),
+        ...timestamps24()
       }
     );
   }
@@ -6292,6 +6379,7 @@ var init_entities = __esm({
     init_mfa_verifications();
     init_mfa_challenges();
     init_device_authorizations();
+    init_device_links();
     init_user_invitations();
     init_account_deletion_requests();
     init_roles();
@@ -6328,16 +6416,16 @@ var init_users_repository = __esm({
        *
        * Write primary 사용
        */
-      async currentKeyEpoch(id26) {
-        const result = await this.db.select({ keyEpoch: users.keyEpoch }).from(users).where(eq(users.id, id26)).limit(1);
+      async currentKeyEpoch(id27) {
+        const result = await this.db.select({ keyEpoch: users.keyEpoch }).from(users).where(eq(users.id, id27)).limit(1);
         return result[0]?.keyEpoch ?? 0;
       }
       /**
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6347,8 +6435,8 @@ var init_users_repository = __esm({
        * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
        * 계속 사용할 것.
        */
-      async findByIdOnPrimary(id26) {
-        const result = await this.db.select().from(users).where(eq(users.id, id26)).limit(1);
+      async findByIdOnPrimary(id27) {
+        const result = await this.db.select().from(users).where(eq(users.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6364,8 +6452,8 @@ var init_users_repository = __esm({
        * Only meaningful inside a transaction — the lock is released at commit.
        * Write primary.
        */
-      async lockById(id26) {
-        await this.db.select({ id: users.id }).from(users).where(eq(users.id, id26)).for("update");
+      async lockById(id27) {
+        await this.db.select({ id: users.id }).from(users).where(eq(users.id, id27)).for("update");
       }
       /**
        * 이메일로 사용자 조회
@@ -6435,13 +6523,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id26) {
+      async findByIdWithRole(id27) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id26)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id27)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -6516,9 +6604,9 @@ var init_users_repository = __esm({
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id26, data) {
+      async updateById(id27, data) {
         const patch = "email" in data ? { ...data, email: normalizeOptionalEmail(data.email) } : data;
-        const result = await this.db.update(users).set(patch).where(eq(users.id, id26)).returning();
+        const result = await this.db.update(users).set(patch).where(eq(users.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6530,10 +6618,10 @@ var init_users_repository = __esm({
        * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
        * Write primary 사용
        */
-      async reactivateFromPendingDeletion(id26) {
+      async reactivateFromPendingDeletion(id27) {
         const result = await this.db.update(users).set({ status: "active" }).where(
           and(
-            eq(users.id, id26),
+            eq(users.id, id27),
             eq(users.status, "pending_deletion")
           )
         ).returning();
@@ -6543,32 +6631,32 @@ var init_users_repository = __esm({
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id26, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id27, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash
         };
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id26)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id26) {
+      async updateLastLogin(id27) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id26)).returning();
+        }).where(eq(users.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id26) {
-        const result = await this.db.delete(users).where(eq(users.id, id26)).returning();
+      async deleteById(id27) {
+        const result = await this.db.delete(users).where(eq(users.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6756,10 +6844,10 @@ function parseDuration(duration) {
       throw new Error(`Unknown duration unit: ${unit}`);
   }
 }
-function configureAuth(config4) {
+function configureAuth(config5) {
   globalConfig = {
     ...globalConfig,
-    ...config4
+    ...config5
   };
 }
 function getAuthConfig() {
@@ -7170,6 +7258,18 @@ var init_keys_repository = __esm({
       async revokeAllActiveByUserIdExcept(userId, keepKeyId, reason) {
         return await this.revokeActive(userId, reason, keepKeyId);
       }
+      /**
+       * Lock the user's active key rows until the transaction ends, for a revocation
+       * that has to touch other rows before it revokes the keys.
+       *
+       * Device-link statements lock the issuing key row before the link row. A
+       * transaction that expires links and then revokes keys takes them the other
+       * way round, and deadlocks against an issue, redeem, approve or consume in
+       * flight on the same key. Calling this first restores the key-before-link order.
+       */
+      async lockActiveByUserId(userId) {
+        await this.db.select({ id: userPublicKeys.id }).from(userPublicKeys).where(and2(eq2(userPublicKeys.userId, userId), eq2(userPublicKeys.isActive, true))).for("no key update");
+      }
       /**
        * The one statement behind both global revocations.
        *
@@ -7366,7 +7466,7 @@ var init_keys_repository = __esm({
        * replica-lagged address compared in application code both misses real
        * switches and invents ones that did not happen.
        */
-      async updateLastUsedById(id26, identity, ip) {
+      async updateLastUsedById(id27, identity, ip) {
         const now = /* @__PURE__ */ new Date();
         const nowParam = sql5`${now.toISOString()}::timestamptz`;
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
@@ -7407,7 +7507,7 @@ var init_keys_repository = __esm({
             clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
           } : {}
         }).where(and2(
-          eq2(userPublicKeys.id, id26),
+          eq2(userPublicKeys.id, id27),
           or(lastUsedIsStale, identityChanged, sql5`(${ipChanged} AND ${notStampedThisWindow})`)
         ));
       }
@@ -7458,8 +7558,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7473,22 +7573,22 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id26) {
+      async markAsUsed(id27) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id26)).returning();
+        }).where(eq3(verificationCodes.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id26) {
-        const code = await this.findById(id26);
+      async incrementAttempts(id27) {
+        const code = await this.findById(id27);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1
-        }).where(eq3(verificationCodes.id, id26)).returning();
+        }).where(eq3(verificationCodes.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7572,10 +7672,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the issued row, or null if the row is no longer deliverable
        */
-      async issue(id26, tokenHash) {
+      async issue(id27, tokenHash) {
         const result = await this.db.update(signupLinkTokens).set({ tokenHash }).where(
           and4(
-            eq4(signupLinkTokens.id, id26),
+            eq4(signupLinkTokens.id, id27),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt),
             isNull3(signupLinkTokens.completedAt),
@@ -7611,14 +7711,14 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async claimLink(id26, setupSecretHash, setupExpiresAt) {
+      async claimLink(id27, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(signupLinkTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and4(
-            eq4(signupLinkTokens.id, id26),
+            eq4(signupLinkTokens.id, id27),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -7631,10 +7731,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async claimSetupSession(id26) {
+      async claimSetupSession(id27) {
         const result = await this.db.update(signupLinkTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and4(
-            eq4(signupLinkTokens.id, id26),
+            eq4(signupLinkTokens.id, id27),
             isNull3(signupLinkTokens.completedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -7716,10 +7816,10 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the issued row, or null if the row is no longer deliverable
        */
-      async issue(id26, tokenHash) {
+      async issue(id27, tokenHash) {
         const result = await this.db.update(passwordResetTokens).set({ tokenHash }).where(
           and5(
-            eq5(passwordResetTokens.id, id26),
+            eq5(passwordResetTokens.id, id27),
             isNull4(passwordResetTokens.consumedAt),
             isNull4(passwordResetTokens.supersededAt),
             isNull4(passwordResetTokens.completedAt),
@@ -7767,14 +7867,14 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async consume(id26, setupSecretHash, setupExpiresAt) {
+      async consume(id27, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(passwordResetTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and5(
-            eq5(passwordResetTokens.id, id26),
+            eq5(passwordResetTokens.id, id27),
             isNull4(passwordResetTokens.consumedAt),
             isNull4(passwordResetTokens.supersededAt)
           )
@@ -7787,10 +7887,10 @@ var init_password_reset_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async complete(id26) {
+      async complete(id27) {
         const result = await this.db.update(passwordResetTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and5(
-            eq5(passwordResetTokens.id, id26),
+            eq5(passwordResetTokens.id, id27),
             isNull4(passwordResetTokens.completedAt),
             isNull4(passwordResetTokens.supersededAt)
           )
@@ -7988,9 +8088,9 @@ var init_passkeys_repository = __esm({
        * Owner-scoped, so an id belonging to someone else answers null rather than
        * a row — a management route can only ever say "not yours".
        */
-      async findLiveByIdAndUserId(id26, userId) {
+      async findLiveByIdAndUserId(id27, userId) {
         const result = await this.db.select().from(passkeys).where(and7(
-          eq7(passkeys.id, id26),
+          eq7(passkeys.id, id27),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).limit(1);
@@ -8000,17 +8100,17 @@ var init_passkeys_repository = __esm({
        * Record a successful assertion.
        * Write primary.
        */
-      async recordUse(id26, counter) {
-        await this.db.update(passkeys).set({ counter, lastUsedAt: /* @__PURE__ */ new Date() }).where(eq7(passkeys.id, id26));
+      async recordUse(id27, counter) {
+        await this.db.update(passkeys).set({ counter, lastUsedAt: /* @__PURE__ */ new Date() }).where(eq7(passkeys.id, id27));
       }
       /**
        * Rename, but only a credential this user still owns and has not revoked.
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async renameByIdAndUserId(id26, userId, label) {
+      async renameByIdAndUserId(id27, userId, label) {
         const result = await this.db.update(passkeys).set({ label }).where(and7(
-          eq7(passkeys.id, id26),
+          eq7(passkeys.id, id27),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).returning();
@@ -8025,9 +8125,9 @@ var init_passkeys_repository = __esm({
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async revokeByIdAndUserId(id26, userId, reason) {
+      async revokeByIdAndUserId(id27, userId, reason) {
         const result = await this.db.update(passkeys).set({ revokedAt: /* @__PURE__ */ new Date(), revokedReason: reason }).where(and7(
-          eq7(passkeys.id, id26),
+          eq7(passkeys.id, id27),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).returning();
@@ -8042,9 +8142,9 @@ var init_passkeys_repository = __esm({
        *
        * @returns the updated row, or null if it is not theirs or already revoked
        */
-      async markSecondFactorByIdAndUserId(id26, userId, secondFactor) {
+      async markSecondFactorByIdAndUserId(id27, userId, secondFactor) {
         const result = await this.db.update(passkeys).set({ secondFactor }).where(and7(
-          eq7(passkeys.id, id26),
+          eq7(passkeys.id, id27),
           eq7(passkeys.userId, userId),
           isNull6(passkeys.revokedAt)
         )).returning();
@@ -8265,8 +8365,8 @@ var init_mfa_recovery_codes_repository = __esm({
        *
        * @returns true when this call spent the row
        */
-      async consume(id26) {
-        const result = await this.db.update(mfaRecoveryCodes).set({ usedAt: /* @__PURE__ */ new Date() }).where(and10(eq10(mfaRecoveryCodes.id, id26), isNull9(mfaRecoveryCodes.usedAt))).returning();
+      async consume(id27) {
+        const result = await this.db.update(mfaRecoveryCodes).set({ usedAt: /* @__PURE__ */ new Date() }).where(and10(eq10(mfaRecoveryCodes.id, id27), isNull9(mfaRecoveryCodes.usedAt))).returning();
         return result.length > 0;
       }
       /** Drop every generation the account has. Write primary. */
@@ -8368,9 +8468,9 @@ var init_mfa_challenges_repository = __esm({
        * Every condition the caller checked is restated here, so the row that is
        * marked is a row that was still spendable at the moment it was marked.
        */
-      async markVerified(id26, keyEpoch) {
+      async markVerified(id27, keyEpoch) {
         const result = await this.db.update(mfaChallenges).set({ verifiedAt: /* @__PURE__ */ new Date() }).where(and12(
-          eq12(mfaChallenges.id, id26),
+          eq12(mfaChallenges.id, id27),
           eq12(mfaChallenges.keyEpoch, keyEpoch),
           isNull10(mfaChallenges.verifiedAt),
           gt6(mfaChallenges.expiresAt, /* @__PURE__ */ new Date())
@@ -8384,8 +8484,8 @@ var init_mfa_challenges_repository = __esm({
        * is the whole reason lookup is by hash: there is no id for a caller to name,
        * so no counter but their own can be moved.
        */
-      async countFailure(id26) {
-        const result = await this.db.update(mfaChallenges).set({ attempts: sql8`${mfaChallenges.attempts} + 1` }).where(eq12(mfaChallenges.id, id26)).returning({ attempts: mfaChallenges.attempts });
+      async countFailure(id27) {
+        const result = await this.db.update(mfaChallenges).set({ attempts: sql8`${mfaChallenges.attempts} + 1` }).where(eq12(mfaChallenges.id, id27)).returning({ attempts: mfaChallenges.attempts });
         return (result[0]?.attempts ?? 0) >= MFA_CHALLENGE_ATTEMPT_LIMIT;
       }
       /**
@@ -8407,9 +8507,9 @@ var init_mfa_challenges_repository = __esm({
        * another ten minutes; only the secret is new, because the old one was never
        * stored and cannot be handed out twice.
        */
-      async resecret(id26, challengeHash) {
+      async resecret(id27, challengeHash) {
         const result = await this.db.update(mfaChallenges).set({ challengeHash }).where(and12(
-          eq12(mfaChallenges.id, id26),
+          eq12(mfaChallenges.id, id27),
           isNull10(mfaChallenges.verifiedAt),
           gt6(mfaChallenges.expiresAt, /* @__PURE__ */ new Date())
         )).returning({ id: mfaChallenges.id });
@@ -8505,6 +8605,107 @@ var init_mfa_enrolment_repository = __esm({
   }
 });
 
+// src/server/lib/answer-waiters.ts
+import { onAfterCommit } from "@spfn/core/db";
+function createAnswerWaiters() {
+  const parkedById = /* @__PURE__ */ new Map();
+  const waitingById = /* @__PURE__ */ new Map();
+  function wake(id27) {
+    const parked = parkedById.get(id27);
+    if (!parked) {
+      return;
+    }
+    parkedById.delete(id27);
+    for (const resolve of parked) {
+      resolve();
+    }
+  }
+  function unpark(id27, parked, resolver) {
+    parked.delete(resolver);
+    if (parked.size === 0 && parkedById.get(id27) === parked) {
+      parkedById.delete(id27);
+    }
+  }
+  function announce(ids) {
+    if (ids.length === 0) {
+      return;
+    }
+    onAfterCommit(() => {
+      for (const id27 of ids) {
+        wake(id27);
+      }
+    });
+  }
+  function wait(id27, timeoutMs, signal) {
+    if (signal?.aborted) {
+      return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+      const parked = parkedById.get(id27) ?? /* @__PURE__ */ new Set();
+      const done = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", done);
+        unpark(id27, parked, done);
+        resolve();
+      };
+      const timer = setTimeout(done, timeoutMs);
+      signal?.addEventListener("abort", done, { once: true });
+      parked.add(done);
+      parkedById.set(id27, parked);
+    });
+  }
+  function waiting(id27) {
+    return waitingById.get(id27) ?? 0;
+  }
+  async function hold(id27, run) {
+    waitingById.set(id27, waiting(id27) + 1);
+    try {
+      return await run();
+    } finally {
+      const left = waiting(id27) - 1;
+      if (left > 0) {
+        waitingById.set(id27, left);
+      } else {
+        waitingById.delete(id27);
+      }
+    }
+  }
+  return {
+    announce,
+    wait,
+    waiting,
+    hold,
+    parkedCount: () => parkedById.size + waitingById.size
+  };
+}
+var init_answer_waiters = __esm({
+  "src/server/lib/answer-waiters.ts"() {
+    "use strict";
+  }
+});
+
+// src/server/lib/device-auth-waiters.ts
+function announceDeviceAuthAnswered(ids) {
+  waiters.announce(ids);
+}
+function waitForDeviceAuthAnswer(id27, timeoutMs, signal) {
+  return waiters.wait(id27, timeoutMs, signal);
+}
+function waitingOnDeviceAuth(id27) {
+  return waiters.waiting(id27);
+}
+function holdDeviceAuthWait(id27, wait) {
+  return waiters.hold(id27, wait);
+}
+var waiters;
+var init_device_auth_waiters = __esm({
+  "src/server/lib/device-auth-waiters.ts"() {
+    "use strict";
+    init_answer_waiters();
+    waiters = createAnswerWaiters();
+  }
+});
+
 // src/server/repositories/device-authorizations.repository.ts
 import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
 import { eq as eq14, and as and14, gt as gt7, inArray as inArray2, sql as sql9 } from "drizzle-orm";
@@ -8513,6 +8714,7 @@ var init_device_authorizations_repository = __esm({
   "src/server/repositories/device-authorizations.repository.ts"() {
     "use strict";
     init_device_authorizations();
+    init_device_auth_waiters();
     notExpired = () => gt7(deviceAuthorizations.expiresAt, sql9`now()`);
     DeviceAuthorizationsRepository = class extends BaseRepository14 {
       /**
@@ -8555,6 +8757,19 @@ var init_device_authorizations_repository = __esm({
         const result = await this.readDb.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
         return result[0] ?? null;
       }
+      /**
+       * `findByDeviceCodeHash`, read from the primary even outside a transaction.
+       *
+       * For the long poll's wait, which runs before any transaction opens: it is
+       * woken right after an answer commits, and a replica that has not caught up
+       * yet would show it the record still pending and send it back to sleep.
+       *
+       * Write primary.
+       */
+      async findByDeviceCodeHashOnPrimary(deviceCodeHash) {
+        const result = await this.db.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
+        return result[0] ?? null;
+      }
       /**
        * Bind the approving user and move the record to `approved`, but only from
        * `pending`.
@@ -8564,15 +8779,15 @@ var init_device_authorizations_repository = __esm({
        *
        * @returns the updated row, or null if it was no longer pending, or expired
        */
-      async approve(id26, userId) {
+      async approve(id27, userId) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "approved", userId, approvedAt: /* @__PURE__ */ new Date() }).where(
           and14(
-            eq14(deviceAuthorizations.id, id26),
+            eq14(deviceAuthorizations.id, id27),
             eq14(deviceAuthorizations.status, "pending"),
             notExpired()
           )
         ).returning();
-        return result[0] ?? null;
+        return this.answered(result[0] ?? null);
       }
       /**
        * Move the record to `denied`, but only from `pending`.
@@ -8581,15 +8796,15 @@ var init_device_authorizations_repository = __esm({
        *
        * @returns the updated row, or null if it was no longer pending, or expired
        */
-      async deny(id26) {
+      async deny(id27) {
         const result = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
           and14(
-            eq14(deviceAuthorizations.id, id26),
+            eq14(deviceAuthorizations.id, id27),
             eq14(deviceAuthorizations.status, "pending"),
             notExpired()
           )
         ).returning();
-        return result[0] ?? null;
+        return this.answered(result[0] ?? null);
       }
       /**
        * Refuse every authorization a user still has in flight.
@@ -8617,12 +8832,14 @@ var init_device_authorizations_repository = __esm({
        * @returns the rows this call refused
        */
       async denyAllActiveByUserId(userId) {
-        return await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
+        const denied = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
           and14(
             eq14(deviceAuthorizations.userId, userId),
             inArray2(deviceAuthorizations.status, ["pending", "approved"])
           )
         ).returning();
+        announceDeviceAuthAnswered(denied.map((record) => record.id));
+        return denied;
       }
       /**
        * Spend an approved record, but only from `approved`, and address it by the
@@ -8645,32 +8862,255 @@ var init_device_authorizations_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /** Wake the polls parked on a record this call moved, and hand the row back. */
+      answered(record) {
+        if (record) {
+          announceDeviceAuthAnswered([record.id]);
+        }
+        return record;
+      }
     };
     deviceAuthorizationsRepository = new DeviceAuthorizationsRepository();
   }
 });
 
-// src/server/repositories/roles.repository.ts
+// src/server/lib/device-link-waiters.ts
+function announceDeviceLinkMoved(ids) {
+  waiters2.announce(ids);
+}
+function waitForDeviceLinkMove(id27, timeoutMs, signal) {
+  return waiters2.wait(id27, timeoutMs, signal);
+}
+function waitingOnDeviceLink(id27) {
+  return waiters2.waiting(id27);
+}
+function holdDeviceLinkWait(id27, wait) {
+  return waiters2.hold(id27, wait);
+}
+var waiters2;
+var init_device_link_waiters = __esm({
+  "src/server/lib/device-link-waiters.ts"() {
+    "use strict";
+    init_answer_waiters();
+    waiters2 = createAnswerWaiters();
+  }
+});
+
+// src/server/repositories/device-links.repository.ts
 import { BaseRepository as BaseRepository15 } from "@spfn/core/db";
-import { eq as eq15, asc } from "drizzle-orm";
+import { eq as eq15, and as and15, gt as gt8, or as or4, isNull as isNull12, inArray as inArray3, exists, getTableColumns, sql as sql10 } from "drizzle-orm";
+var LIVE_STATUSES, notExpired2, DeviceLinksRepository, deviceLinksRepository;
+var init_device_links_repository = __esm({
+  "src/server/repositories/device-links.repository.ts"() {
+    "use strict";
+    init_entities();
+    init_device_link_waiters();
+    LIVE_STATUSES = ["issued", "redeemed", "approved"];
+    notExpired2 = () => gt8(deviceLinks.expiresAt, sql10`now()`);
+    DeviceLinksRepository = class extends BaseRepository15 {
+      /**
+       * Insert an issued link, unless its user code is already taken.
+       *
+       * `onConflictDoNothing` for the reason `DeviceAuthorizationsRepository.create`
+       * gives: a raised unique violation would abort the issue route's transaction
+       * and leave no way to retry with a fresh code.
+       *
+       * @returns the inserted row, or null if the code collided
+       */
+      async create(data) {
+        const result = await this.db.insert(deviceLinks).values(data).onConflictDoNothing().returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Find a link by the issuer's handle, in any state.
+       *
+       * Unfiltered, as `DeviceAuthorizationsRepository.findByUserCode` is: which
+       * refusal a caller is owed is the service's decision.
+       */
+      async findByLinkId(linkId) {
+        return this.findOne(eq15(deviceLinks.linkId, linkId));
+      }
+      /** Find a link by its normalized user code, in any state. */
+      async findByUserCode(userCode) {
+        return this.findOne(eq15(deviceLinks.userCode, userCode));
+      }
+      /** Find a link by the hash of the device code its redeemer holds, in any state. */
+      async findByDeviceCodeHash(deviceCodeHash) {
+        return this.findOne(eq15(deviceLinks.deviceCodeHash, deviceCodeHash));
+      }
+      /**
+       * Park a device's key on an issued link and move it to `redeemed`.
+       *
+       * From `issued` only, so of two devices redeeming one code exactly one wins;
+       * the other matches nothing and is answered as if the code were unknown.
+       *
+       * @returns the updated row, or null if it was no longer issued, expired, or its issuer signed out
+       */
+      async redeem(id27, redemption) {
+        return this.transition(
+          { ...redemption, status: "redeemed", redeemedAt: /* @__PURE__ */ new Date() },
+          and15(eq15(deviceLinks.id, id27), eq15(deviceLinks.status, "issued"), notExpired2(), this.issuerKeyLive(true))
+        );
+      }
+      /**
+       * The issuer picked the right number: move the link to `approved`, from
+       * `redeemed` only.
+       *
+       * The key is not registered here, for the reason device-code approval gives:
+       * the redeeming device may never come back for it.
+       *
+       * @returns the updated row, or null if it was no longer redeemed, expired, or its issuer signed out
+       */
+      async approve(id27) {
+        return this.transition(
+          { status: "approved", approvedAt: /* @__PURE__ */ new Date() },
+          and15(eq15(deviceLinks.id, id27), eq15(deviceLinks.status, "redeemed"), notExpired2(), this.issuerKeyLive(true))
+        );
+      }
+      /**
+       * Refuse a redeemed link — the issuer said no, or picked the wrong number.
+       *
+       * No issuing-key condition: refusing is always safe, and a signed-out issuer's
+       * link is refused anyway.
+       *
+       * @returns the updated row, or null if it was no longer redeemed, or expired
+       */
+      async deny(id27) {
+        return this.transition(
+          { status: "denied" },
+          and15(eq15(deviceLinks.id, id27), eq15(deviceLinks.status, "redeemed"), notExpired2())
+        );
+      }
+      /**
+       * The issuer closed the link before anyone was let in: `issued` or `redeemed`
+       * to `expired`.
+       *
+       * @returns the updated row, or null if it had moved past redeemed, or expired
+       */
+      async cancel(id27) {
+        return this.transition(
+          { status: "expired" },
+          and15(eq15(deviceLinks.id, id27), inArray3(deviceLinks.status, ["issued", "redeemed"]), notExpired2())
+        );
+      }
+      /**
+       * Spend an approved link, addressed by the device code hash the caller
+       * presented — the one-shot `DeviceAuthorizationsRepository.consumeApproved`
+       * is, with the issuing key judged in the same statement.
+       *
+       * @returns the spent row, or null if it was not approved (any more), expired, or its issuer signed out
+       */
+      async consumeApproved(deviceCodeHash) {
+        return this.transition(
+          { status: "consumed", consumedAt: /* @__PURE__ */ new Date() },
+          and15(
+            eq15(deviceLinks.deviceCodeHash, deviceCodeHash),
+            eq15(deviceLinks.status, "approved"),
+            notExpired2(),
+            this.issuerKeyLive(true)
+          )
+        );
+      }
+      /**
+       * Lock the issuing key's row until the transaction ends, so two issues from
+       * one key run one after the other: each expires the other's link or waits for
+       * it to be inserted, and never both read "nothing live" and insert.
+       *
+       * `no key update` is the lock a plain UPDATE of the row takes: it conflicts
+       * with itself, with the share lock `issuerKeyLive(true)` takes and with a
+       * revocation's UPDATE, and it leaves foreign-key checks on the row alone.
+       * Taken first, before any link row, so every path that locks both — redeem,
+       * approve, consume and the revocations — locks the key row before the link.
+       */
+      async lockIssuerKey(issuerKeyId) {
+        await this.db.select({ one: sql10`1` }).from(userPublicKeys).where(eq15(userPublicKeys.keyId, issuerKeyId)).for("no key update");
+      }
+      /**
+       * Expire the live link a key issued, so a fresh issue leaves one link per key.
+       *
+       * Race-free only after `lockIssuerKey` in the same transaction.
+       *
+       * @returns the rows this call expired
+       */
+      async expireLiveByIssuerKey(issuerKeyId) {
+        return this.expireLive(eq15(deviceLinks.issuerKeyId, issuerKeyId));
+      }
+      /**
+       * Expire every link an account still has in play — the device-link half of a
+       * global revocation, beside `DeviceAuthorizationsRepository.denyAllActiveByUserId`.
+       *
+       * A revoke-all that spares the calling device spares its key too, so the
+       * issuing-key condition alone would leave that device's link able to let a
+       * new device in seconds after the owner signed everything else out.
+       *
+       * @returns the rows this call expired
+       */
+      async expireAllLiveByUserId(userId) {
+        return this.expireLive(eq15(deviceLinks.issuerUserId, userId));
+      }
+      async expireLive(owner) {
+        const expired = await this.db.update(deviceLinks).set({ status: "expired" }).where(and15(owner, inArray3(deviceLinks.status, LIVE_STATUSES))).returning();
+        announceDeviceLinkMoved(expired.map((link) => link.id));
+        return expired;
+      }
+      /** Apply one conditional UPDATE, wake the waiters of the row it moved, and hand the row back. */
+      async transition(values, where) {
+        const result = await this.db.update(deviceLinks).set(values).where(where).returning();
+        const moved = result[0] ?? null;
+        if (moved) {
+          announceDeviceLinkMoved([moved.id]);
+        }
+        return moved;
+      }
+      /** One link with its issuing key's standing. */
+      async findOne(where) {
+        const result = await this.db.select({ ...getTableColumns(deviceLinks), issuerKeyLive: this.issuerKeyLive(false) }).from(deviceLinks).where(where).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Whether the link's issuing key is still registered to its issuer, active
+       * and unexpired — the test `authenticate` applies to the same row.
+       *
+       * @param lock take a share lock on the key row, so a transition waits for a
+       *   revocation in flight instead of judging the version before it
+       */
+      issuerKeyLive(lock) {
+        const key = this.db.select({ one: sql10`1` }).from(userPublicKeys).where(
+          and15(
+            eq15(userPublicKeys.keyId, deviceLinks.issuerKeyId),
+            eq15(userPublicKeys.userId, deviceLinks.issuerUserId),
+            eq15(userPublicKeys.isActive, true),
+            or4(isNull12(userPublicKeys.expiresAt), gt8(userPublicKeys.expiresAt, sql10`now()`))
+          )
+        );
+        return sql10`${exists(lock ? key.for("share") : key)}`;
+      }
+    };
+    deviceLinksRepository = new DeviceLinksRepository();
+  }
+});
+
+// src/server/repositories/roles.repository.ts
+import { BaseRepository as BaseRepository16 } from "@spfn/core/db";
+import { eq as eq16, asc } from "drizzle-orm";
 var RolesRepository, rolesRepository;
 var init_roles_repository = __esm({
   "src/server/repositories/roles.repository.ts"() {
     "use strict";
     init_roles();
-    RolesRepository = class extends BaseRepository15 {
+    RolesRepository = class extends BaseRepository16 {
       /**
        * ID로 역할 조회
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(roles).where(eq15(roles.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(roles).where(eq16(roles.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 역할 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(roles).where(eq15(roles.name, name)).limit(1);
+        const result = await this.readDb.select().from(roles).where(eq16(roles.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8683,7 +9123,7 @@ var init_roles_repository = __esm({
        * 활성 역할만 조회
        */
       async findActive() {
-        return this.readDb.select().from(roles).where(eq15(roles.isActive, true)).orderBy(asc(roles.priority));
+        return this.readDb.select().from(roles).where(eq16(roles.isActive, true)).orderBy(asc(roles.priority));
       }
       /**
        * 역할 생성
@@ -8694,15 +9134,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id26, data) {
-        const result = await this.db.update(roles).set(data).where(eq15(roles.id, id26)).returning();
+      async updateById(id27, data) {
+        const result = await this.db.update(roles).set(data).where(eq16(roles.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id26) {
-        const result = await this.db.delete(roles).where(eq15(roles.id, id26)).returning();
+      async deleteById(id27) {
+        const result = await this.db.delete(roles).where(eq16(roles.id, id27)).returning();
         return result[0] ?? null;
       }
     };
@@ -8711,26 +9151,26 @@ var init_roles_repository = __esm({
 });
 
 // src/server/repositories/permissions.repository.ts
-import { BaseRepository as BaseRepository16 } from "@spfn/core/db";
-import { asc as asc2, eq as eq16, inArray as inArray3 } from "drizzle-orm";
+import { BaseRepository as BaseRepository17 } from "@spfn/core/db";
+import { asc as asc2, eq as eq17, inArray as inArray4 } from "drizzle-orm";
 var PermissionsRepository, permissionsRepository;
 var init_permissions_repository = __esm({
   "src/server/repositories/permissions.repository.ts"() {
     "use strict";
     init_permissions();
-    PermissionsRepository = class extends BaseRepository16 {
+    PermissionsRepository = class extends BaseRepository17 {
       /**
        * ID로 권한 조회
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(permissions).where(eq16(permissions.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(permissions).where(eq17(permissions.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 권한 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(permissions).where(eq16(permissions.name, name)).limit(1);
+        const result = await this.readDb.select().from(permissions).where(eq17(permissions.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8738,7 +9178,7 @@ var init_permissions_repository = __esm({
        */
       async findByNames(names) {
         if (names.length === 0) return [];
-        return this.readDb.select().from(permissions).where(inArray3(permissions.name, names));
+        return this.readDb.select().from(permissions).where(inArray4(permissions.name, names));
       }
       /**
        * 모든 권한 조회
@@ -8750,13 +9190,13 @@ var init_permissions_repository = __esm({
        * 활성 권한만 조회
        */
       async findActive() {
-        return this.readDb.select().from(permissions).where(eq16(permissions.isActive, true)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq17(permissions.isActive, true)).orderBy(asc2(permissions.name));
       }
       /**
        * 카테고리별 권한 조회
        */
       async findByCategory(category) {
-        return this.readDb.select().from(permissions).where(eq16(permissions.category, category)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq17(permissions.category, category)).orderBy(asc2(permissions.name));
       }
       /**
        * 권한 생성
@@ -8774,15 +9214,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id26, data) {
-        const result = await this.db.update(permissions).set(data).where(eq16(permissions.id, id26)).returning();
+      async updateById(id27, data) {
+        const result = await this.db.update(permissions).set(data).where(eq17(permissions.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id26) {
-        const result = await this.db.delete(permissions).where(eq16(permissions.id, id26)).returning();
+      async deleteById(id27) {
+        const result = await this.db.delete(permissions).where(eq17(permissions.id, id27)).returning();
         return result[0] ?? null;
       }
     };
@@ -8791,25 +9231,25 @@ var init_permissions_repository = __esm({
 });
 
 // src/server/repositories/role-permissions.repository.ts
-import { BaseRepository as BaseRepository17 } from "@spfn/core/db";
-import { and as and15, eq as eq17 } from "drizzle-orm";
+import { BaseRepository as BaseRepository18 } from "@spfn/core/db";
+import { and as and16, eq as eq18 } from "drizzle-orm";
 var RolePermissionsRepository, rolePermissionsRepository;
 var init_role_permissions_repository = __esm({
   "src/server/repositories/role-permissions.repository.ts"() {
     "use strict";
     init_role_permissions();
-    RolePermissionsRepository = class extends BaseRepository17 {
+    RolePermissionsRepository = class extends BaseRepository18 {
       /**
        * 역할 ID로 모든 권한 조회
        */
       async findByRoleId(roleId) {
-        return this.readDb.select().from(rolePermissions).where(eq17(rolePermissions.roleId, roleId));
+        return this.readDb.select().from(rolePermissions).where(eq18(rolePermissions.roleId, roleId));
       }
       /**
        * 권한 ID로 모든 역할 조회
        */
       async findByPermissionId(permissionId) {
-        return this.readDb.select().from(rolePermissions).where(eq17(rolePermissions.permissionId, permissionId));
+        return this.readDb.select().from(rolePermissions).where(eq18(rolePermissions.permissionId, permissionId));
       }
       /**
        * 역할-권한 매핑 생성
@@ -8829,9 +9269,9 @@ var init_role_permissions_repository = __esm({
        */
       async deleteByRoleIdAndPermissionId(roleId, permissionId) {
         const result = await this.db.delete(rolePermissions).where(
-          and15(
-            eq17(rolePermissions.roleId, roleId),
-            eq17(rolePermissions.permissionId, permissionId)
+          and16(
+            eq18(rolePermissions.roleId, roleId),
+            eq18(rolePermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -8840,7 +9280,7 @@ var init_role_permissions_repository = __esm({
        * 역할의 모든 권한 매핑 삭제
        */
       async deleteByRoleId(roleId) {
-        const result = await this.db.delete(rolePermissions).where(eq17(rolePermissions.roleId, roleId)).returning();
+        const result = await this.db.delete(rolePermissions).where(eq18(rolePermissions.roleId, roleId)).returning();
         return result.length;
       }
       /**
@@ -8861,19 +9301,19 @@ var init_role_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-permissions.repository.ts
-import { BaseRepository as BaseRepository18 } from "@spfn/core/db";
-import { eq as eq18, and as and16, or as or4, isNull as isNull12, isNotNull as isNotNull3, lt as lt6, gt as gt8 } from "drizzle-orm";
+import { BaseRepository as BaseRepository19 } from "@spfn/core/db";
+import { eq as eq19, and as and17, or as or5, isNull as isNull13, isNotNull as isNotNull3, lt as lt6, gt as gt9 } from "drizzle-orm";
 var UserPermissionsRepository, userPermissionsRepository;
 var init_user_permissions_repository = __esm({
   "src/server/repositories/user-permissions.repository.ts"() {
     "use strict";
     init_user_permissions();
-    UserPermissionsRepository = class extends BaseRepository18 {
+    UserPermissionsRepository = class extends BaseRepository19 {
       /**
        * 사용자 ID로 모든 권한 오버라이드 조회
        */
       async findByUserId(userId) {
-        return this.readDb.select().from(userPermissions).where(eq18(userPermissions.userId, userId));
+        return this.readDb.select().from(userPermissions).where(eq19(userPermissions.userId, userId));
       }
       /**
        * 사용자 ID로 유효한 권한 오버라이드만 조회
@@ -8882,11 +9322,11 @@ var init_user_permissions_repository = __esm({
       async findValidByUserId(userId) {
         const now = /* @__PURE__ */ new Date();
         return this.readDb.select().from(userPermissions).where(
-          and16(
-            eq18(userPermissions.userId, userId),
-            or4(
-              isNull12(userPermissions.expiresAt),
-              gt8(userPermissions.expiresAt, now)
+          and17(
+            eq19(userPermissions.userId, userId),
+            or5(
+              isNull13(userPermissions.expiresAt),
+              gt9(userPermissions.expiresAt, now)
             )
           )
         );
@@ -8896,9 +9336,9 @@ var init_user_permissions_repository = __esm({
        */
       async findByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.readDb.select().from(userPermissions).where(
-          and16(
-            eq18(userPermissions.userId, userId),
-            eq18(userPermissions.permissionId, permissionId)
+          and17(
+            eq19(userPermissions.userId, userId),
+            eq19(userPermissions.permissionId, permissionId)
           )
         ).limit(1);
         return result[0] ?? null;
@@ -8912,8 +9352,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id26, data) {
-        const result = await this.db.update(userPermissions).set(data).where(eq18(userPermissions.id, id26)).returning();
+      async updateById(id27, data) {
+        const result = await this.db.update(userPermissions).set(data).where(eq19(userPermissions.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
@@ -8921,9 +9361,9 @@ var init_user_permissions_repository = __esm({
        */
       async deleteByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.db.delete(userPermissions).where(
-          and16(
-            eq18(userPermissions.userId, userId),
-            eq18(userPermissions.permissionId, permissionId)
+          and17(
+            eq19(userPermissions.userId, userId),
+            eq19(userPermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -8932,7 +9372,7 @@ var init_user_permissions_repository = __esm({
        * 사용자의 모든 권한 오버라이드 삭제
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userPermissions).where(eq18(userPermissions.userId, userId)).returning();
+        const result = await this.db.delete(userPermissions).where(eq19(userPermissions.userId, userId)).returning();
         return result.length;
       }
       /**
@@ -8941,7 +9381,7 @@ var init_user_permissions_repository = __esm({
       async deleteExpired() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.delete(userPermissions).where(
-          and16(
+          and17(
             isNotNull3(userPermissions.expiresAt),
             lt6(userPermissions.expiresAt, now)
           )
@@ -8954,33 +9394,33 @@ var init_user_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-profiles.repository.ts
-import { BaseRepository as BaseRepository19 } from "@spfn/core/db";
-import { eq as eq19 } from "drizzle-orm";
+import { BaseRepository as BaseRepository20 } from "@spfn/core/db";
+import { eq as eq20 } from "drizzle-orm";
 var UserProfilesRepository, userProfilesRepository;
 var init_user_profiles_repository = __esm({
   "src/server/repositories/user-profiles.repository.ts"() {
     "use strict";
     init_user_profiles();
-    UserProfilesRepository = class extends BaseRepository19 {
+    UserProfilesRepository = class extends BaseRepository20 {
       /**
        * ID로 프로필 조회
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(userProfiles).where(eq19(userProfiles.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(userProfiles).where(eq20(userProfiles.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
        * User ID로 locale만 조회 (경량)
        */
       async findLocaleByUserId(userId) {
-        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq19(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq20(userProfiles.userId, userId)).limit(1);
         return result[0]?.locale || "en";
       }
       /**
        * User ID로 프로필 조회
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userProfiles).where(eq19(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select().from(userProfiles).where(eq20(userProfiles.userId, userId)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -8992,29 +9432,29 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id26, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq19(userProfiles.id, id26)).returning();
+      async updateById(id27, data) {
+        const result = await this.db.update(userProfiles).set(data).where(eq20(userProfiles.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 업데이트 (by User ID)
        */
       async updateByUserId(userId, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq19(userProfiles.userId, userId)).returning();
+        const result = await this.db.update(userProfiles).set(data).where(eq20(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id26) {
-        const result = await this.db.delete(userProfiles).where(eq19(userProfiles.id, id26)).returning();
+      async deleteById(id27) {
+        const result = await this.db.delete(userProfiles).where(eq20(userProfiles.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by User ID)
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userProfiles).where(eq19(userProfiles.userId, userId)).returning();
+        const result = await this.db.delete(userProfiles).where(eq20(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
@@ -9056,7 +9496,7 @@ var init_user_profiles_repository = __esm({
           metadata: userProfiles.metadata,
           createdAt: userProfiles.createdAt,
           updatedAt: userProfiles.updatedAt
-        }).from(userProfiles).where(eq19(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
+        }).from(userProfiles).where(eq20(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
         if (!profile) {
           return null;
         }
@@ -9084,8 +9524,8 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq20, and as and17, lt as lt7, desc as desc3, sql as sql10 } from "drizzle-orm";
-import { BaseRepository as BaseRepository20 } from "@spfn/core/db";
+import { eq as eq21, and as and18, lt as lt7, desc as desc3, sql as sql11 } from "drizzle-orm";
+import { BaseRepository as BaseRepository21 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
   "src/server/repositories/invitations.repository.ts"() {
@@ -9094,19 +9534,19 @@ var init_invitations_repository = __esm({
     init_roles();
     init_user_invitations();
     init_email();
-    InvitationsRepository = class extends BaseRepository20 {
+    InvitationsRepository = class extends BaseRepository21 {
       /**
        * ID로 초대 조회
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(userInvitations).where(eq20(userInvitations.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(userInvitations).where(eq21(userInvitations.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Token으로 초대 조회
        */
       async findByToken(token) {
-        const result = await this.readDb.select().from(userInvitations).where(eq20(userInvitations.token, token)).limit(1);
+        const result = await this.readDb.select().from(userInvitations).where(eq21(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -9114,9 +9554,9 @@ var init_invitations_repository = __esm({
        */
       async findPendingByEmail(email) {
         const result = await this.readDb.select().from(userInvitations).where(
-          and17(
-            eq20(userInvitations.email, normalizeEmail(email)),
-            eq20(userInvitations.status, "pending")
+          and18(
+            eq21(userInvitations.email, normalizeEmail(email)),
+            eq21(userInvitations.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -9125,13 +9565,13 @@ var init_invitations_repository = __esm({
        * 초대자 ID로 모든 초대 조회
        */
       async findByInvitedBy(invitedBy) {
-        return this.readDb.select().from(userInvitations).where(eq20(userInvitations.invitedBy, invitedBy));
+        return this.readDb.select().from(userInvitations).where(eq21(userInvitations.invitedBy, invitedBy));
       }
       /**
        * 상태별 초대 조회
        */
       async findByStatus(status) {
-        return this.readDb.select().from(userInvitations).where(eq20(userInvitations.status, status));
+        return this.readDb.select().from(userInvitations).where(eq21(userInvitations.status, status));
       }
       /**
        * 초대 생성
@@ -9142,7 +9582,7 @@ var init_invitations_repository = __esm({
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id26, status, timestamp2) {
+      async updateStatus(id27, status, timestamp2) {
         const updates = {
           status
         };
@@ -9153,14 +9593,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq20(userInvitations.id, id26)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq21(userInvitations.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id26) {
-        const result = await this.db.delete(userInvitations).where(eq20(userInvitations.id, id26)).returning();
+      async deleteById(id27) {
+        const result = await this.db.delete(userInvitations).where(eq21(userInvitations.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
@@ -9169,8 +9609,8 @@ var init_invitations_repository = __esm({
       async updateExpiredInvitations() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.update(userInvitations).set({ status: "expired" }).where(
-          and17(
-            eq20(userInvitations.status, "pending"),
+          and18(
+            eq21(userInvitations.status, "pending"),
             lt7(userInvitations.expiresAt, now)
           )
         ).returning();
@@ -9202,7 +9642,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq20(userInvitations.roleId, roles.id)).innerJoin(users, eq20(userInvitations.invitedBy, users.id)).where(eq20(userInvitations.token, token)).limit(1);
+        }).from(userInvitations).innerJoin(roles, eq21(userInvitations.roleId, roles.id)).innerJoin(users, eq21(userInvitations.invitedBy, users.id)).where(eq21(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -9213,13 +9653,13 @@ var init_invitations_repository = __esm({
         const offset = (page - 1) * limit;
         const conditions = [];
         if (status) {
-          conditions.push(eq20(userInvitations.status, status));
+          conditions.push(eq21(userInvitations.status, status));
         }
         if (invitedBy) {
-          conditions.push(eq20(userInvitations.invitedBy, invitedBy));
+          conditions.push(eq21(userInvitations.invitedBy, invitedBy));
         }
-        const whereClause = conditions.length > 0 ? and17(...conditions) : void 0;
-        const countResult = await this.readDb.select({ count: sql10`count(*)` }).from(userInvitations).where(whereClause);
+        const whereClause = conditions.length > 0 ? and18(...conditions) : void 0;
+        const countResult = await this.readDb.select({ count: sql11`count(*)` }).from(userInvitations).where(whereClause);
         const total = Number(countResult[0]?.count || 0);
         const results = await this.readDb.select({
           id: userInvitations.id,
@@ -9243,7 +9683,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq20(userInvitations.roleId, roles.id)).innerJoin(users, eq20(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc3(userInvitations.createdAt)).limit(limit).offset(offset);
+        }).from(userInvitations).innerJoin(roles, eq21(userInvitations.roleId, roles.id)).innerJoin(users, eq21(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc3(userInvitations.createdAt)).limit(limit).offset(offset);
         return {
           invitations: results,
           total,
@@ -9255,31 +9695,31 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id26, data) {
+      async updateById(id27, data) {
         const patch = "email" in data && typeof data.email === "string" ? { ...data, email: normalizeEmail(data.email) } : data;
-        const result = await this.db.update(userInvitations).set(patch).where(eq20(userInvitations.id, id26)).returning();
+        const result = await this.db.update(userInvitations).set(patch).where(eq21(userInvitations.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id26, newExpiresAt) {
+      async resend(id27, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt
-        }).where(eq20(userInvitations.id, id26)).returning();
+        }).where(eq21(userInvitations.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id26, cancelledBy, reason, currentMetadata) {
+      async cancel(id27, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata
-        }).where(eq20(userInvitations.id, id26)).returning();
+        }).where(eq21(userInvitations.id, id27)).returning();
         return result[0] ?? null;
       }
     };
@@ -10119,15 +10559,15 @@ var init_token_cipher = __esm({
 });
 
 // src/server/repositories/social-accounts.repository.ts
-import { eq as eq21, and as and18 } from "drizzle-orm";
-import { BaseRepository as BaseRepository21 } from "@spfn/core/db";
+import { eq as eq22, and as and19 } from "drizzle-orm";
+import { BaseRepository as BaseRepository22 } from "@spfn/core/db";
 var SocialAccountsRepository, socialAccountsRepository;
 var init_social_accounts_repository = __esm({
   "src/server/repositories/social-accounts.repository.ts"() {
     "use strict";
     init_entities();
     init_token_cipher();
-    SocialAccountsRepository = class extends BaseRepository21 {
+    SocialAccountsRepository = class extends BaseRepository22 {
       /**
        * 저장 row 의 토큰을 평문으로 복호화해 반환한다.
        *
@@ -10155,10 +10595,10 @@ var init_social_accounts_repository = __esm({
             if (refresh?.needsRotation) {
               heal.refreshToken = await encryptToken(refresh.value, context("refresh"));
             }
-            await this.db.update(userSocialAccounts).set(heal).where(and18(
-              eq21(userSocialAccounts.id, account.id),
-              access?.needsRotation && account.accessToken !== null ? eq21(userSocialAccounts.accessToken, account.accessToken) : void 0,
-              refresh?.needsRotation && account.refreshToken !== null ? eq21(userSocialAccounts.refreshToken, account.refreshToken) : void 0
+            await this.db.update(userSocialAccounts).set(heal).where(and19(
+              eq22(userSocialAccounts.id, account.id),
+              access?.needsRotation && account.accessToken !== null ? eq22(userSocialAccounts.accessToken, account.accessToken) : void 0,
+              refresh?.needsRotation && account.refreshToken !== null ? eq22(userSocialAccounts.refreshToken, account.refreshToken) : void 0
             ));
           } catch {
           }
@@ -10175,9 +10615,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByProviderAndProviderId(provider, providerUserId) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and18(
-            eq21(userSocialAccounts.provider, provider),
-            eq21(userSocialAccounts.providerUserId, providerUserId)
+          and19(
+            eq22(userSocialAccounts.provider, provider),
+            eq22(userSocialAccounts.providerUserId, providerUserId)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -10187,7 +10627,7 @@ var init_social_accounts_repository = __esm({
        * Read replica 사용
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userSocialAccounts).where(eq21(userSocialAccounts.userId, userId));
+        const result = await this.readDb.select().from(userSocialAccounts).where(eq22(userSocialAccounts.userId, userId));
         return Promise.all(result.map((account) => this.decryptAccount(account)));
       }
       /**
@@ -10196,9 +10636,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByUserIdAndProvider(userId, provider) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and18(
-            eq21(userSocialAccounts.userId, userId),
-            eq21(userSocialAccounts.provider, provider)
+          and19(
+            eq22(userSocialAccounts.userId, userId),
+            eq22(userSocialAccounts.provider, provider)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -10224,11 +10664,11 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id26, data) {
+      async updateTokens(id27, data) {
         const accounts = await this.db.select({
           provider: userSocialAccounts.provider,
           providerUserId: userSocialAccounts.providerUserId
-        }).from(userSocialAccounts).where(eq21(userSocialAccounts.id, id26)).limit(1);
+        }).from(userSocialAccounts).where(eq22(userSocialAccounts.id, id27)).limit(1);
         const account = accounts[0];
         if (!account) {
           return null;
@@ -10242,15 +10682,15 @@ var init_social_accounts_repository = __esm({
           ...data,
           accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
           refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken
-        }).where(eq21(userSocialAccounts.id, id26)).returning();
+        }).where(eq22(userSocialAccounts.id, id27)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id26) {
-        const result = await this.db.delete(userSocialAccounts).where(eq21(userSocialAccounts.id, id26)).returning();
+      async deleteById(id27) {
+        const result = await this.db.delete(userSocialAccounts).where(eq22(userSocialAccounts.id, id27)).returning();
         return result[0] ?? null;
       }
       /**
@@ -10259,9 +10699,9 @@ var init_social_accounts_repository = __esm({
        */
       async deleteByUserIdAndProvider(userId, provider) {
         const result = await this.db.delete(userSocialAccounts).where(
-          and18(
-            eq21(userSocialAccounts.userId, userId),
-            eq21(userSocialAccounts.provider, provider)
+          and19(
+            eq22(userSocialAccounts.userId, userId),
+            eq22(userSocialAccounts.provider, provider)
           )
         ).returning();
         return result[0] ?? null;
@@ -10274,7 +10714,7 @@ var init_social_accounts_repository = __esm({
        * Write primary 사용
        */
       async deleteAllByUserId(userId) {
-        const result = await this.db.delete(userSocialAccounts).where(eq21(userSocialAccounts.userId, userId)).returning();
+        const result = await this.db.delete(userSocialAccounts).where(eq22(userSocialAccounts.userId, userId)).returning();
         return result.length;
       }
     };
@@ -10283,19 +10723,19 @@ var init_social_accounts_repository = __esm({
 });
 
 // src/server/repositories/auth-metadata.repository.ts
-import { BaseRepository as BaseRepository22 } from "@spfn/core/db";
-import { eq as eq22 } from "drizzle-orm";
+import { BaseRepository as BaseRepository23 } from "@spfn/core/db";
+import { eq as eq23 } from "drizzle-orm";
 var AuthMetadataRepository, authMetadataRepository;
 var init_auth_metadata_repository = __esm({
   "src/server/repositories/auth-metadata.repository.ts"() {
     "use strict";
     init_auth_metadata();
-    AuthMetadataRepository = class extends BaseRepository22 {
+    AuthMetadataRepository = class extends BaseRepository23 {
       /**
        * 키로 값 조회
        */
       async get(key) {
-        const result = await this.readDb.select().from(authMetadata).where(eq22(authMetadata.key, key)).limit(1);
+        const result = await this.readDb.select().from(authMetadata).where(eq23(authMetadata.key, key)).limit(1);
         return result[0]?.value ?? null;
       }
       /**
@@ -10318,20 +10758,20 @@ var init_auth_metadata_repository = __esm({
 });
 
 // src/server/repositories/account-deletion-requests.repository.ts
-import { eq as eq23, and as and19, lte as lte2 } from "drizzle-orm";
-import { BaseRepository as BaseRepository23 } from "@spfn/core/db";
+import { eq as eq24, and as and20, lte as lte2 } from "drizzle-orm";
+import { BaseRepository as BaseRepository24 } from "@spfn/core/db";
 var AccountDeletionRequestsRepository, accountDeletionRequestsRepository;
 var init_account_deletion_requests_repository = __esm({
   "src/server/repositories/account-deletion-requests.repository.ts"() {
     "use strict";
     init_account_deletion_requests();
-    AccountDeletionRequestsRepository = class extends BaseRepository23 {
+    AccountDeletionRequestsRepository = class extends BaseRepository24 {
       /**
        * ID로 요청 조회
        * Read replica 사용
        */
-      async findById(id26) {
-        const result = await this.readDb.select().from(accountDeletionRequests).where(eq23(accountDeletionRequests.id, id26)).limit(1);
+      async findById(id27) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq24(accountDeletionRequests.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -10340,9 +10780,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserId(userId) {
         const result = await this.readDb.select().from(accountDeletionRequests).where(
-          and19(
-            eq23(accountDeletionRequests.userId, userId),
-            eq23(accountDeletionRequests.status, "pending")
+          and20(
+            eq24(accountDeletionRequests.userId, userId),
+            eq24(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -10356,9 +10796,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserIdOnPrimary(userId) {
         const result = await this.db.select().from(accountDeletionRequests).where(
-          and19(
-            eq23(accountDeletionRequests.userId, userId),
-            eq23(accountDeletionRequests.status, "pending")
+          and20(
+            eq24(accountDeletionRequests.userId, userId),
+            eq24(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -10369,8 +10809,8 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findDueForPurge(now) {
         return this.readDb.select().from(accountDeletionRequests).where(
-          and19(
-            eq23(accountDeletionRequests.status, "pending"),
+          and20(
+            eq24(accountDeletionRequests.status, "pending"),
             lte2(accountDeletionRequests.purgeScheduledAt, now)
           )
         );
@@ -10390,14 +10830,14 @@ var init_account_deletion_requests_repository = __esm({
        * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCancelled(id26) {
+      async markCancelled(id27) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date()
         }).where(
-          and19(
-            eq23(accountDeletionRequests.id, id26),
-            eq23(accountDeletionRequests.status, "pending")
+          and20(
+            eq24(accountDeletionRequests.id, id27),
+            eq24(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -10412,15 +10852,15 @@ var init_account_deletion_requests_repository = __esm({
        * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCompleted(id26, purgeStrategy) {
+      async markCompleted(id27, purgeStrategy) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "completed",
           completedAt: /* @__PURE__ */ new Date(),
           purgeStrategy
         }).where(
-          and19(
-            eq23(accountDeletionRequests.id, id26),
-            eq23(accountDeletionRequests.status, "pending")
+          and20(
+            eq24(accountDeletionRequests.id, id27),
+            eq24(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -10431,14 +10871,14 @@ var init_account_deletion_requests_repository = __esm({
 });
 
 // src/server/repositories/ops-tokens.repository.ts
-import { and as and20, desc as desc4, eq as eq24, isNull as isNull13 } from "drizzle-orm";
-import { BaseRepository as BaseRepository24 } from "@spfn/core/db";
+import { and as and21, desc as desc4, eq as eq25, isNull as isNull14 } from "drizzle-orm";
+import { BaseRepository as BaseRepository25 } from "@spfn/core/db";
 var OpsTokensRepository, opsTokensRepository;
 var init_ops_tokens_repository = __esm({
   "src/server/repositories/ops-tokens.repository.ts"() {
     "use strict";
     init_ops_tokens();
-    OpsTokensRepository = class extends BaseRepository24 {
+    OpsTokensRepository = class extends BaseRepository25 {
       /**
        * Lookup by the secret's hash — the verification path.
        *
@@ -10448,7 +10888,7 @@ var init_ops_tokens_repository = __esm({
        * and revocation is documented as taking effect immediately.
        */
       async findByTokenHash(tokenHash) {
-        const result = await this.db.select().from(opsTokens).where(eq24(opsTokens.tokenHash, tokenHash)).limit(1);
+        const result = await this.db.select().from(opsTokens).where(eq25(opsTokens.tokenHash, tokenHash)).limit(1);
         return result[0] ?? null;
       }
       async create(data) {
@@ -10463,13 +10903,13 @@ var init_ops_tokens_repository = __esm({
        * token is already revoked — the first revocation's timestamp is never
        * overwritten.
        */
-      async revokeById(id26) {
-        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and20(eq24(opsTokens.id, id26), isNull13(opsTokens.revokedAt))).returning();
+      async revokeById(id27) {
+        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and21(eq25(opsTokens.id, id27), isNull14(opsTokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path. */
-      async updateLastUsedById(id26) {
-        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq24(opsTokens.id, id26));
+      async updateLastUsedById(id27) {
+        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq25(opsTokens.id, id27));
       }
     };
     opsTokensRepository = new OpsTokensRepository();
@@ -10477,15 +10917,15 @@ var init_ops_tokens_repository = __esm({
 });
 
 // src/server/repositories/oauth2-clients.repository.ts
-import { and as and21, eq as eq25, gt as gt9, lt as lt8, sql as sql11 } from "drizzle-orm";
-import { BaseRepository as BaseRepository25, runInTransaction } from "@spfn/core/db";
+import { and as and22, eq as eq26, gt as gt10, lt as lt8, sql as sql12 } from "drizzle-orm";
+import { BaseRepository as BaseRepository26, runInTransaction } from "@spfn/core/db";
 var OAuth2ClientsRepository, oauth2ClientsRepository;
 var init_oauth2_clients_repository = __esm({
   "src/server/repositories/oauth2-clients.repository.ts"() {
     "use strict";
     init_oauth2_clients();
     init_oauth2_grants();
-    OAuth2ClientsRepository = class extends BaseRepository25 {
+    OAuth2ClientsRepository = class extends BaseRepository26 {
       async create(data) {
         const result = await this.db.insert(oauth2Clients).values(data).returning();
         return result[0];
@@ -10499,12 +10939,12 @@ var init_oauth2_clients_repository = __esm({
        * at the one moment a CLI is being connected.
        */
       async findByClientId(clientId) {
-        const result = await this.db.select().from(oauth2Clients).where(eq25(oauth2Clients.clientId, clientId)).limit(1);
+        const result = await this.db.select().from(oauth2Clients).where(eq26(oauth2Clients.clientId, clientId)).limit(1);
         return result[0] ?? null;
       }
       /** Fire-and-forget from the token-issuing path. */
-      async updateLastUsedById(id26) {
-        await this.db.update(oauth2Clients).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq25(oauth2Clients.id, id26));
+      async updateLastUsedById(id27) {
+        await this.db.update(oauth2Clients).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq26(oauth2Clients.id, id27));
       }
       /**
        * Register a client unless this address is already at its standing cap.
@@ -10526,7 +10966,7 @@ var init_oauth2_clients_repository = __esm({
        */
       async createWithinStandingCap(data, limit) {
         return await runInTransaction(async () => {
-          await this.db.execute(sql11`select pg_advisory_xact_lock(hashtext(${limit.ip}))`);
+          await this.db.execute(sql12`select pg_advisory_xact_lock(hashtext(${limit.ip}))`);
           const standing = await this.countRecentUngrantedByIp(limit.ip, limit.windowMs);
           return standing < limit.max ? await this.create(data) : null;
         });
@@ -10548,11 +10988,11 @@ var init_oauth2_clients_repository = __esm({
        * count exists to see.
        */
       async countRecentUngrantedByIp(ip, windowMs) {
-        const result = await this.db.select({ count: sql11`count(*)::int` }).from(oauth2Clients).where(
-          and21(
-            eq25(oauth2Clients.createdIp, ip),
-            gt9(oauth2Clients.createdAt, new Date(Date.now() - windowMs)),
-            sql11`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
+        const result = await this.db.select({ count: sql12`count(*)::int` }).from(oauth2Clients).where(
+          and22(
+            eq26(oauth2Clients.createdIp, ip),
+            gt10(oauth2Clients.createdAt, new Date(Date.now() - windowMs)),
+            sql12`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
           )
         );
         return result[0]?.count ?? 0;
@@ -10569,9 +11009,9 @@ var init_oauth2_clients_repository = __esm({
        */
       async deleteStaleUngranted(before) {
         const deleted = await this.db.delete(oauth2Clients).where(
-          and21(
+          and22(
             lt8(oauth2Clients.createdAt, before),
-            sql11`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
+            sql12`not exists (select 1 from ${oauth2Grants} where ${oauth2Grants.client} = ${oauth2Clients.id})`
           )
         ).returning({ id: oauth2Clients.id });
         return deleted.length;
@@ -10582,8 +11022,8 @@ var init_oauth2_clients_repository = __esm({
 });
 
 // src/server/repositories/oauth2-grants.repository.ts
-import { and as and22, desc as desc5, eq as eq26, inArray as inArray4, isNull as isNull14, sql as sql12 } from "drizzle-orm";
-import { BaseRepository as BaseRepository26 } from "@spfn/core/db";
+import { and as and23, desc as desc5, eq as eq27, inArray as inArray5, isNull as isNull15, sql as sql13 } from "drizzle-orm";
+import { BaseRepository as BaseRepository27 } from "@spfn/core/db";
 var OAuth2GrantsRepository, oauth2GrantsRepository;
 var init_oauth2_grants_repository = __esm({
   "src/server/repositories/oauth2-grants.repository.ts"() {
@@ -10591,7 +11031,7 @@ var init_oauth2_grants_repository = __esm({
     init_oauth2_grants();
     init_oauth2_clients();
     init_oauth2_tokens();
-    OAuth2GrantsRepository = class extends BaseRepository26 {
+    OAuth2GrantsRepository = class extends BaseRepository27 {
       /**
        * Record a consent, or refresh the scopes of the one already there.
        *
@@ -10618,13 +11058,13 @@ var init_oauth2_grants_repository = __esm({
        *
        * Read primary: revocation is documented as taking effect immediately.
        */
-      async findWithClientById(id26) {
-        const result = await this.db.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq26(oauth2Grants.client, oauth2Clients.id)).where(eq26(oauth2Grants.id, id26)).limit(1);
+      async findWithClientById(id27) {
+        const result = await this.db.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq27(oauth2Grants.client, oauth2Clients.id)).where(eq27(oauth2Grants.id, id27)).limit(1);
         return result[0] ?? null;
       }
       /** What the user's "connected apps" screen lists. Read replica. */
       async listActiveByUserId(userId) {
-        return await this.readDb.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq26(oauth2Grants.client, oauth2Clients.id)).where(and22(eq26(oauth2Grants.user, userId), isNull14(oauth2Grants.revokedAt))).orderBy(desc5(oauth2Grants.createdAt));
+        return await this.readDb.select({ grant: oauth2Grants, client: oauth2Clients }).from(oauth2Grants).innerJoin(oauth2Clients, eq27(oauth2Grants.client, oauth2Clients.id)).where(and23(eq27(oauth2Grants.user, userId), isNull15(oauth2Grants.revokedAt))).orderBy(desc5(oauth2Grants.createdAt));
       }
       /**
        * Revoke one live grant belonging to one user.
@@ -10637,19 +11077,19 @@ var init_oauth2_grants_repository = __esm({
        * @returns the revoked row, or null if there was no live grant of that id
        *          for that user
        */
-      async revokeByIdForUser(id26, userId) {
+      async revokeByIdForUser(id27, userId) {
         const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(
-          and22(
-            eq26(oauth2Grants.id, id26),
-            eq26(oauth2Grants.user, userId),
-            isNull14(oauth2Grants.revokedAt)
+          and23(
+            eq27(oauth2Grants.id, id27),
+            eq27(oauth2Grants.user, userId),
+            isNull15(oauth2Grants.revokedAt)
           )
         ).returning();
         return result[0] ?? null;
       }
       /** Revoke one grant by id, whoever it belongs to — the replay detections. */
-      async revokeById(id26) {
-        const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and22(eq26(oauth2Grants.id, id26), isNull14(oauth2Grants.revokedAt))).returning();
+      async revokeById(id27) {
+        const result = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and23(eq27(oauth2Grants.id, id27), isNull15(oauth2Grants.revokedAt))).returning();
         return result[0] ?? null;
       }
       /**
@@ -10659,7 +11099,7 @@ var init_oauth2_grants_repository = __esm({
        * @returns the grant ids this call revoked
        */
       async revokeAllActiveByUserId(userId) {
-        const revoked = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and22(eq26(oauth2Grants.user, userId), isNull14(oauth2Grants.revokedAt))).returning({ id: oauth2Grants.id });
+        const revoked = await this.db.update(oauth2Grants).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and23(eq27(oauth2Grants.user, userId), isNull15(oauth2Grants.revokedAt))).returning({ id: oauth2Grants.id });
         return revoked.map((row) => row.id);
       }
       /**
@@ -10675,7 +11115,7 @@ var init_oauth2_grants_repository = __esm({
         if (grantIds.length === 0) {
           return 0;
         }
-        const revoked = await this.db.update(oauth2Tokens).set({ revokedAt: sql12`now()` }).where(and22(inArray4(oauth2Tokens.grant, grantIds), isNull14(oauth2Tokens.revokedAt))).returning({ id: oauth2Tokens.id });
+        const revoked = await this.db.update(oauth2Tokens).set({ revokedAt: sql13`now()` }).where(and23(inArray5(oauth2Tokens.grant, grantIds), isNull15(oauth2Tokens.revokedAt))).returning({ id: oauth2Tokens.id });
         return revoked.length;
       }
     };
@@ -10684,14 +11124,14 @@ var init_oauth2_grants_repository = __esm({
 });
 
 // src/server/repositories/oauth2-authorization-codes.repository.ts
-import { and as and23, eq as eq27, gt as gt10, isNull as isNull15, sql as sql13 } from "drizzle-orm";
-import { BaseRepository as BaseRepository27 } from "@spfn/core/db";
+import { and as and24, eq as eq28, gt as gt11, isNull as isNull16, sql as sql14 } from "drizzle-orm";
+import { BaseRepository as BaseRepository28 } from "@spfn/core/db";
 var OAuth2AuthorizationCodesRepository, oauth2AuthorizationCodesRepository;
 var init_oauth2_authorization_codes_repository = __esm({
   "src/server/repositories/oauth2-authorization-codes.repository.ts"() {
     "use strict";
     init_oauth2_authorization_codes();
-    OAuth2AuthorizationCodesRepository = class extends BaseRepository27 {
+    OAuth2AuthorizationCodesRepository = class extends BaseRepository28 {
       async create(data) {
         const result = await this.db.insert(oauth2AuthorizationCodes).values(data).returning();
         return result[0];
@@ -10703,11 +11143,11 @@ var init_oauth2_authorization_codes_repository = __esm({
        *          spent, or past its 60 seconds
        */
       async consume(codeHash) {
-        const result = await this.db.update(oauth2AuthorizationCodes).set({ usedAt: sql13`now()` }).where(
-          and23(
-            eq27(oauth2AuthorizationCodes.codeHash, codeHash),
-            isNull15(oauth2AuthorizationCodes.usedAt),
-            gt10(oauth2AuthorizationCodes.expiresAt, sql13`now()`)
+        const result = await this.db.update(oauth2AuthorizationCodes).set({ usedAt: sql14`now()` }).where(
+          and24(
+            eq28(oauth2AuthorizationCodes.codeHash, codeHash),
+            isNull16(oauth2AuthorizationCodes.usedAt),
+            gt11(oauth2AuthorizationCodes.expiresAt, sql14`now()`)
           )
         ).returning();
         return result[0] ?? null;
@@ -10718,7 +11158,7 @@ var init_oauth2_authorization_codes_repository = __esm({
        * would be indistinguishable from a code that never existed.
        */
       async findByCodeHash(codeHash) {
-        const result = await this.db.select().from(oauth2AuthorizationCodes).where(eq27(oauth2AuthorizationCodes.codeHash, codeHash)).limit(1);
+        const result = await this.db.select().from(oauth2AuthorizationCodes).where(eq28(oauth2AuthorizationCodes.codeHash, codeHash)).limit(1);
         return result[0] ?? null;
       }
     };
@@ -10727,14 +11167,14 @@ var init_oauth2_authorization_codes_repository = __esm({
 });
 
 // src/server/repositories/oauth2-tokens.repository.ts
-import { and as and24, eq as eq28, gt as gt11, isNull as isNull16, sql as sql14 } from "drizzle-orm";
-import { BaseRepository as BaseRepository28 } from "@spfn/core/db";
+import { and as and25, eq as eq29, gt as gt12, isNull as isNull17, sql as sql15 } from "drizzle-orm";
+import { BaseRepository as BaseRepository29 } from "@spfn/core/db";
 var OAuth2TokensRepository, oauth2TokensRepository;
 var init_oauth2_tokens_repository = __esm({
   "src/server/repositories/oauth2-tokens.repository.ts"() {
     "use strict";
     init_oauth2_tokens();
-    OAuth2TokensRepository = class extends BaseRepository28 {
+    OAuth2TokensRepository = class extends BaseRepository29 {
       async create(data) {
         const result = await this.db.insert(oauth2Tokens).values(data).returning();
         return result[0];
@@ -10748,7 +11188,7 @@ var init_oauth2_tokens_repository = __esm({
        * Unfiltered, so the service can tell revoked from expired from unknown.
        */
       async findByTokenHash(tokenHash) {
-        const result = await this.db.select().from(oauth2Tokens).where(eq28(oauth2Tokens.tokenHash, tokenHash)).limit(1);
+        const result = await this.db.select().from(oauth2Tokens).where(eq29(oauth2Tokens.tokenHash, tokenHash)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -10758,13 +11198,13 @@ var init_oauth2_tokens_repository = __esm({
        *          rotated, revoked, or expired
        */
       async rotate(tokenHash) {
-        const result = await this.db.update(oauth2Tokens).set({ replacedAt: sql14`now()` }).where(
-          and24(
-            eq28(oauth2Tokens.tokenHash, tokenHash),
-            eq28(oauth2Tokens.kind, "refresh"),
-            isNull16(oauth2Tokens.replacedAt),
-            isNull16(oauth2Tokens.revokedAt),
-            gt11(oauth2Tokens.expiresAt, sql14`now()`)
+        const result = await this.db.update(oauth2Tokens).set({ replacedAt: sql15`now()` }).where(
+          and25(
+            eq29(oauth2Tokens.tokenHash, tokenHash),
+            eq29(oauth2Tokens.kind, "refresh"),
+            isNull17(oauth2Tokens.replacedAt),
+            isNull17(oauth2Tokens.revokedAt),
+            gt12(oauth2Tokens.expiresAt, sql15`now()`)
           )
         ).returning();
         return result[0] ?? null;
@@ -10777,12 +11217,12 @@ var init_oauth2_tokens_repository = __esm({
        *          about whether the value it presented ever existed.
        */
       async revokeByTokenHash(tokenHash) {
-        const result = await this.db.update(oauth2Tokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and24(eq28(oauth2Tokens.tokenHash, tokenHash), isNull16(oauth2Tokens.revokedAt))).returning();
+        const result = await this.db.update(oauth2Tokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and25(eq29(oauth2Tokens.tokenHash, tokenHash), isNull17(oauth2Tokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path, as ops tokens do. */
-      async updateLastUsedById(id26) {
-        await this.db.update(oauth2Tokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq28(oauth2Tokens.id, id26));
+      async updateLastUsedById(id27) {
+        await this.db.update(oauth2Tokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq29(oauth2Tokens.id, id27));
       }
     };
     oauth2TokensRepository = new OAuth2TokensRepository();
@@ -10807,6 +11247,7 @@ var init_repositories = __esm({
     init_mfa_challenges_repository();
     init_mfa_enrolment_repository();
     init_device_authorizations_repository();
+    init_device_links_repository();
     init_roles_repository();
     init_permissions_repository();
     init_role_permissions_repository();
@@ -10912,7 +11353,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id26) => Number(id26));
+  const permissionIdNums = permissionIds.map((id27) => Number(id27));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -10932,7 +11373,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id26) => permissionsRepository.findById(id26))
+    permissionIds.map((id27) => permissionsRepository.findById(id27))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -11196,8 +11637,8 @@ async function listOAuth2GrantsService(userId) {
     lastUsedAtMillis: client.lastUsedAt?.getTime()
   }));
 }
-async function revokeOAuth2GrantService(id26, userId) {
-  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id26, userId);
+async function revokeOAuth2GrantService(id27, userId) {
+  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id27, userId);
   if (!revoked) {
     throw new OAuth2GrantNotFoundError();
   }
@@ -11587,7 +12028,7 @@ import { InvalidKeyFingerprintError, KeyIdAlreadyRegisteredError } from "@spfn/a
 import { ValidationError as ValidationError3 } from "@spfn/core/errors";
 
 // src/server/services/device-registration.service.ts
-import { onAfterCommit } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
 
 // src/server/events/index.ts
 init_esm();
@@ -11623,6 +12064,7 @@ var DeviceRegistrationChannelSchema = Type.Union([
   Type.Literal("oauth"),
   Type.Literal("oauth-native"),
   Type.Literal("device-code"),
+  Type.Literal("device-link"),
   Type.Literal("password-reset"),
   Type.Literal("passkey"),
   Type.Literal("renewal")
@@ -11739,7 +12181,7 @@ init_repositories();
 var DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH = 12;
 async function emitDeviceRegistered(row, channel) {
   const mfaEnrolled = await mfaEnrolmentRepository.isEnrolled(row.userId);
-  onAfterCommit(() => authDeviceRegisteredEvent.emit({
+  onAfterCommit2(() => authDeviceRegisteredEvent.emit({
     userId: String(row.userId),
     keyId: row.keyId,
     algorithm: row.algorithm,
@@ -11757,7 +12199,7 @@ async function emitDeviceRegistered(row, channel) {
 // src/server/services/mfa.service.ts
 init_logger();
 init_config();
-import { onAfterCommit as onAfterCommit2, runInTransaction as runInTransaction2 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit3, runInTransaction as runInTransaction2 } from "@spfn/core/db";
 import { ValidationError as ValidationError2 } from "@spfn/core/errors";
 import {
   MfaAlreadyEnrolledError,
@@ -11855,16 +12297,16 @@ function encodeBase32(bytes) {
   }
   return bits > 0 ? output + BASE32_ALPHABET[value << 5 - bits & 31] : output;
 }
-function decodeBase32(text27) {
+function decodeBase32(text28) {
   let bits = 0;
   let value = 0;
   const bytes = [];
-  for (const character of text27.replace(/=+$/, "").toUpperCase()) {
-    const index21 = BASE32_ALPHABET.indexOf(character);
-    if (index21 < 0) {
+  for (const character of text28.replace(/=+$/, "").toUpperCase()) {
+    const index22 = BASE32_ALPHABET.indexOf(character);
+    if (index22 < 0) {
       throw new Error("Value is not RFC 4648 base32");
     }
-    value = value << 5 | index21;
+    value = value << 5 | index22;
     bits += 5;
     if (bits >= 8) {
       bytes.push(value >>> bits - 8 & 255);
@@ -12154,9 +12596,9 @@ function presentedChallenge(clientDataJSON) {
   const decoded = parseJson(Buffer.from(clientDataJSON, "base64url").toString("utf8"));
   return typeof decoded?.challenge === "string" ? decoded.challenge : "";
 }
-function parseJson(text27) {
+function parseJson(text28) {
   try {
-    return JSON.parse(text27);
+    return JSON.parse(text28);
   } catch {
     return null;
   }
@@ -12230,7 +12672,7 @@ async function releaseDeferredAnnouncements(row, key) {
     return;
   }
   const mfaEnrolled = await mfaEnrolledForUser(row.userId);
-  onAfterCommit2(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
+  onAfterCommit3(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
 }
 async function verifyMfaChallengeService(params) {
   const challengeHash = hashCredential(params.challenge);
@@ -12324,7 +12766,7 @@ async function countConfirmFailure(userId) {
 function readSecret(secretEnc, userId) {
   const { value, needsRotation } = decryptMfaSecret(secretEnc, userId);
   if (needsRotation) {
-    onAfterCommit2(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
+    onAfterCommit3(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
   }
   return value;
 }
@@ -12623,6 +13065,7 @@ async function revokeAllKeysService(params) {
   }
   const revoked = !includeCurrent && currentKeyId ? await keysRepository.revokeAllActiveByUserIdExcept(userId, currentKeyId, reason) : await keysRepository.revokeAllActiveByUserId(userId, reason);
   await deviceAuthorizationsRepository.denyAllActiveByUserId(userId);
+  await deviceLinksRepository.expireAllLiveByUserId(userId);
   await revokeAllOAuth2GrantsForUser(userId);
   return { revokedCount: revoked.length, currentKeyRevoked: includeCurrent };
 }
@@ -12633,7 +13076,7 @@ init_key_policy();
 // src/server/services/account-deletion.service.ts
 init_repositories();
 import { ValidationError as ValidationError4, NotFoundError as NotFoundError2 } from "@spfn/core/errors";
-import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit3 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
 import { sendEmail as sendEmail3 } from "@spfn/notification/server";
 import {
   InvalidCredentialsError,
@@ -12708,8 +13151,8 @@ async function verifyReauthCredential(user, params) {
     throw new VerificationTokenTargetMismatchError();
   }
 }
-async function sendDeletionEmail(to, subject, text27) {
-  const result = await sendEmail3({ to, subject, text: text27 });
+async function sendDeletionEmail(to, subject, text28) {
+  const result = await sendEmail3({ to, subject, text: text28 });
   if (!result.success) {
     authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
   }
@@ -12761,12 +13204,12 @@ async function requestAccountDeletionService(userId, params) {
   if (requestedBy === "self") {
     await verifyReauthCredential(user, { password, verificationToken });
   }
-  const config4 = getDeletionConfig();
+  const config5 = getDeletionConfig();
   const wantsImmediate = immediate === true;
-  if (wantsImmediate && requestedBy === "self" && !config4.allowSelfImmediate) {
+  if (wantsImmediate && requestedBy === "self" && !config5.allowSelfImmediate) {
     throw new ImmediateDeletionNotAllowedError();
   }
-  const gracePeriodDays = wantsImmediate ? 0 : config4.gracePeriodDays;
+  const gracePeriodDays = wantsImmediate ? 0 : config5.gracePeriodDays;
   const requestedAt = /* @__PURE__ */ new Date();
   const purgeScheduledAt = addDays(requestedAt, gracePeriodDays);
   await usersRepository.updateById(user.id, { status: "pending_deletion" });
@@ -12789,14 +13232,15 @@ async function requestAccountDeletionService(userId, params) {
   }
   await keysRepository.revokeAllActiveByUserId(user.id, "Account deletion requested");
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
+  await deviceLinksRepository.expireAllLiveByUserId(user.id);
   await revokeAllOAuth2GrantsForUser(user.id);
-  onAfterCommit3(() => authDeletionRequestedEvent.emit({
+  onAfterCommit4(() => authDeletionRequestedEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId,
     purgeScheduledAt: purgeScheduledAt.toISOString(),
     requestedBy
   }));
-  onAfterCommit3(() => notifyDeletionRequested(user, purgeScheduledAt));
+  onAfterCommit4(() => notifyDeletionRequested(user, purgeScheduledAt));
   if (gracePeriodDays === 0) {
     await purgePendingRequest(request);
   }
@@ -12828,11 +13272,11 @@ async function cancelAccountDeletionService(params) {
     throw new DeletionNotRequestedError();
   }
   await usersRepository.reactivateFromPendingDeletion(user.id);
-  onAfterCommit3(() => authDeletionCancelledEvent.emit({
+  onAfterCommit4(() => authDeletionCancelledEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId
   }));
-  onAfterCommit3(() => notifyDeletionCancelled(user));
+  onAfterCommit4(() => notifyDeletionCancelled(user));
   return { userId: String(user.id) };
 }
 async function anonymizeUser(user) {
@@ -12873,10 +13317,10 @@ async function purgePendingRequest(request) {
   if (!precheckUser || precheckUser.status !== "pending_deletion") {
     return { outcome: "skipped" };
   }
-  const config4 = getDeletionConfig();
-  if (config4.onBeforePurge) {
+  const config5 = getDeletionConfig();
+  if (config5.onBeforePurge) {
     try {
-      await config4.onBeforePurge({
+      await config5.onBeforePurge({
         id: precheckUser.id,
         publicId: precheckUser.publicId,
         email: precheckUser.email,
@@ -12890,7 +13334,7 @@ async function purgePendingRequest(request) {
       return { outcome: "skipped" };
     }
   }
-  const purgeStrategy = config4.purgeStrategy;
+  const purgeStrategy = config5.purgeStrategy;
   let purgedUser = null;
   await runInTransaction3(async () => {
     const user = await usersRepository.findById(userId);
@@ -12919,9 +13363,9 @@ async function purgePendingRequest(request) {
   }
   const { email, publicId } = purgedUser;
   if (email) {
-    onAfterCommit3(() => notifyPurgeFinal(email));
+    onAfterCommit4(() => notifyPurgeFinal(email));
   }
-  onAfterCommit3(() => authDeletionCompletedEvent.emit({
+  onAfterCommit4(() => authDeletionCompletedEvent.emit({
     userPublicId: publicId,
     purgeStrategy
   }));
@@ -13135,6 +13579,7 @@ async function changePasswordService(params) {
   const newPasswordHash = await hashPassword(newPassword);
   await usersRepository.updatePassword(userId, newPasswordHash, true);
   await deviceAuthorizationsRepository.denyAllActiveByUserId(userId);
+  await deviceLinksRepository.expireAllLiveByUserId(userId);
   await revokeAllOAuth2GrantsForUser(userId);
   await keysRepository.revokeAllActiveByUserId(userId, "Revoked by password change");
 }
@@ -13275,7 +13720,7 @@ init_repositories();
 import { env as env11 } from "@spfn/auth/config";
 import { PasswordResetLinkError, PasswordResetSessionError } from "@spfn/auth/errors";
 import { ValidationError as ValidationError6 } from "@spfn/core/errors";
-import { onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
 init_key_policy();
 async function activeUserOf(userId) {
   const user = await usersRepository.findByIdOnPrimary(userId);
@@ -13336,7 +13781,9 @@ async function replaceCredentials(row, user, params) {
     // for accounts created before the register flows stamped it.
     ...user.emailVerifiedAt ? {} : { emailVerifiedAt: /* @__PURE__ */ new Date() }
   });
+  await keysRepository.lockActiveByUserId(user.id);
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
+  await deviceLinksRepository.expireAllLiveByUserId(user.id);
   await revokeAllOAuth2GrantsForUser(user.id);
   await keysRepository.revokeAllActiveByUserId(user.id, "Revoked by password reset");
   const registered = await registerPublicKeyService({
@@ -13376,7 +13823,7 @@ async function completePasswordResetService(params) {
     throw new PasswordResetSessionError();
   }
   const registered = await replaceCredentials(row, user, params);
-  onAfterCommit4(() => authPasswordResetEvent.emit({
+  onAfterCommit5(() => authPasswordResetEvent.emit({
     userId: String(user.id),
     email: row.email
   }));
@@ -13468,21 +13915,26 @@ import {
   DeviceAuthDeniedError,
   InvalidKeyFingerprintError as InvalidKeyFingerprintError2
 } from "@spfn/auth/errors";
-import { onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit6 } from "@spfn/core/db";
+import { getShutdownManager } from "@spfn/core/server";
 
 // src/server/lib/device-auth-config.ts
 var DEFAULT_DEVICE_AUTH_TTL_MS = 10 * 60 * 1e3;
 var DEFAULT_DEVICE_AUTH_INTERVAL_MS = 5 * 1e3;
+var DEFAULT_DEVICE_AUTH_MAX_WAIT_MS = 20 * 1e3;
 var config2 = {
   ttlMs: DEFAULT_DEVICE_AUTH_TTL_MS,
-  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS
+  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  maxWaitMs: DEFAULT_DEVICE_AUTH_MAX_WAIT_MS
 };
 function configureDeviceAuth(options) {
   const ttlMs = options?.ttlMs ?? DEFAULT_DEVICE_AUTH_TTL_MS;
   const intervalMs = options?.intervalMs ?? DEFAULT_DEVICE_AUTH_INTERVAL_MS;
+  const maxWaitMs = options?.maxWaitMs ?? DEFAULT_DEVICE_AUTH_MAX_WAIT_MS;
   assertWholeMillis("ttlMs", ttlMs);
   assertWholeMillis("intervalMs", intervalMs);
-  config2 = { ttlMs, intervalMs };
+  assertWholeMillis("maxWaitMs", maxWaitMs);
+  config2 = { ttlMs, intervalMs, maxWaitMs };
 }
 function assertWholeMillis(name, value) {
   if (!Number.isInteger(value) || value <= 0) {
@@ -13495,6 +13947,9 @@ function getDeviceAuthConfig() {
   return config2;
 }
 
+// src/server/services/device-auth.service.ts
+init_device_auth_waiters();
+
 // src/server/lib/device-code.ts
 import { createHash, randomBytes, randomInt } from "crypto";
 var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
@@ -13524,6 +13979,8 @@ function hashDeviceCode(deviceCode) {
 // src/server/services/device-auth.service.ts
 init_key_policy();
 var USER_CODE_ATTEMPTS = 3;
+var WAIT_RECHECK_MS = 1e3;
+var MAX_WAITERS_PER_RECORD = 3;
 function assertActionable(record) {
   if (!record || record.status === "consumed") {
     throw new DeviceAuthNotFoundError();
@@ -13623,6 +14080,37 @@ async function denyDeviceAuthService(params) {
     );
   }
 }
+async function waitForDeviceAuthAnswerService(params) {
+  const requested = Math.min(params.waitMillis, getDeviceAuthConfig().maxWaitMs);
+  const deviceCodeHash = hashDeviceCode(params.deviceCode);
+  const record = requested > 0 ? await readWaitable(deviceCodeHash) : null;
+  if (!record || waitingOnDeviceAuth(record.id) >= MAX_WAITERS_PER_RECORD) {
+    return 0;
+  }
+  const startedAt = Date.now();
+  const deadline = Math.min(startedAt + requested, record.expiresAt.getTime());
+  await holdDeviceAuthWait(record.id, () => waitUntil(record.id, deviceCodeHash, deadline, params.signal));
+  return Date.now() - startedAt;
+}
+async function waitUntil(id27, deviceCodeHash, deadline, signal) {
+  while (!signal?.aborted && !getShutdownManager().isShuttingDown()) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      return;
+    }
+    await waitForDeviceAuthAnswer(id27, Math.min(remaining, WAIT_RECHECK_MS), signal);
+    if (!await readWaitable(deviceCodeHash)) {
+      return;
+    }
+  }
+}
+async function readWaitable(deviceCodeHash) {
+  const record = await deviceAuthorizationsRepository.findByDeviceCodeHashOnPrimary(deviceCodeHash).catch(() => null);
+  return isWaitable(record) ? record : null;
+}
+function isWaitable(record) {
+  return record?.status === "pending" && record.expiresAt.getTime() > Date.now();
+}
 async function pollDeviceAuthService(params) {
   const deviceCodeHash = hashDeviceCode(params.deviceCode);
   const record = assertActionable(
@@ -13632,7 +14120,10 @@ async function pollDeviceAuthService(params) {
     throw new DeviceAuthDeniedError();
   }
   if (record.status === "pending") {
-    return { status: "pending", intervalMillis: getDeviceAuthConfig().intervalMs };
+    return {
+      status: "pending",
+      intervalMillis: Math.max(0, getDeviceAuthConfig().intervalMs - (params.waitedMillis ?? 0))
+    };
   }
   const consumed = await deviceAuthorizationsRepository.consumeApproved(deviceCodeHash);
   if (!consumed) {
@@ -13642,15 +14133,25 @@ async function pollDeviceAuthService(params) {
       () => new DeviceAuthNotFoundError()
     );
   }
-  return { status: "approved", ...await completeDeviceLogin(consumed, params) };
-}
-async function completeDeviceLogin(record, provenance) {
-  if (record.userId === null) {
+  if (consumed.userId === null) {
     throw new DeviceAuthNotFoundError();
   }
-  const user = await usersRepository.findById(record.userId);
+  return {
+    status: "approved",
+    ...await completeDeviceLogin({
+      userId: consumed.userId,
+      key: consumed,
+      channel: "device-code",
+      provenance: params,
+      missingAccount: () => new DeviceAuthNotFoundError()
+    })
+  };
+}
+async function completeDeviceLogin(params) {
+  const { key, provenance } = params;
+  const user = await usersRepository.findById(params.userId);
   if (!user) {
-    throw new DeviceAuthNotFoundError();
+    throw params.missingAccount();
   }
   if (user.status !== "active") {
     if (user.status === "pending_deletion") {
@@ -13663,22 +14164,22 @@ async function completeDeviceLogin(record, provenance) {
   }
   const registered = await registerPublicKeyService({
     userId: user.id,
-    keyId: record.keyId,
-    publicKey: record.publicKey,
-    fingerprint: record.fingerprint,
-    algorithm: record.algorithm,
-    deviceName: record.deviceName ?? void 0,
-    platform: record.platform ?? void 0,
-    channel: "device-code",
+    keyId: key.keyId,
+    publicKey: key.publicKey,
+    fingerprint: key.fingerprint,
+    algorithm: key.algorithm,
+    deviceName: key.deviceName ?? void 0,
+    platform: key.platform ?? void 0,
+    channel: params.channel,
     ip: provenance.ip,
     userAgent: provenance.userAgent,
     binding: decideKeyBinding(user.sessionBinding, provenance.webProxy)
   });
   await updateLastLoginService(user.id);
   const result = {
-    // A device-code approval is itself a second factor: the owner read the
-    // code on a device that is already signed in and said yes, so this
-    // channel never steps up (#95).
+    // An approval from a device that is already signed in is itself a
+    // second factor — the owner read the code there and said yes — so
+    // neither channel ever steps up (#95).
     mfaRequired: false,
     userId: String(user.id),
     publicId: user.publicId,
@@ -13688,7 +14189,7 @@ async function completeDeviceLogin(record, provenance) {
     ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
-  onAfterCommit5(() => authLoginEvent.emit({
+  onAfterCommit6(() => authLoginEvent.emit({
     userId: String(user.id),
     provider: "device",
     email: result.email,
@@ -13698,10 +14199,324 @@ async function completeDeviceLogin(record, provenance) {
   return result;
 }
 
+// src/server/services/device-link.service.ts
+init_repositories();
+import { randomUUID } from "crypto";
+import {
+  DeviceLinkAlreadyHandledError,
+  DeviceLinkDeniedError,
+  DeviceLinkExpiredError,
+  DeviceLinkNotFoundError,
+  DeviceLinkNotRedeemedError,
+  DeviceLinkWrongMatchError,
+  InvalidKeyFingerprintError as InvalidKeyFingerprintError3
+} from "@spfn/auth/errors";
+import { getShutdownManager as getShutdownManager2 } from "@spfn/core/server";
+
+// src/server/lib/device-link-config.ts
+var DEFAULT_DEVICE_LINK_TTL_MS = 5 * 60 * 1e3;
+var config3 = {
+  ttlMs: DEFAULT_DEVICE_LINK_TTL_MS
+};
+function configureDeviceLink(options) {
+  const ttlMs = options?.ttlMs ?? DEFAULT_DEVICE_LINK_TTL_MS;
+  if (!Number.isInteger(ttlMs) || ttlMs <= 0) {
+    throw new Error(`deviceLink.ttlMs must be a positive whole number of milliseconds, received ${ttlMs}.`);
+  }
+  config3 = { ttlMs };
+}
+function getDeviceLinkConfig() {
+  return config3;
+}
+
+// src/server/lib/device-link-match.ts
+import { randomInt as randomInt2 } from "crypto";
+var MATCH_MIN = 10;
+var MATCH_MAX_EXCLUSIVE = 100;
+var DEVICE_LINK_CHOICE_COUNT = 3;
+function generateMatchNumber() {
+  return randomInt2(MATCH_MIN, MATCH_MAX_EXCLUSIVE);
+}
+function generateChoices(matchNumber) {
+  const choices = /* @__PURE__ */ new Set([matchNumber]);
+  while (choices.size < DEVICE_LINK_CHOICE_COUNT) {
+    choices.add(generateMatchNumber());
+  }
+  return shuffle([...choices]);
+}
+function shuffle(values) {
+  for (let index22 = values.length - 1; index22 > 0; index22--) {
+    const other = randomInt2(index22 + 1);
+    [values[index22], values[other]] = [values[other], values[index22]];
+  }
+  return values;
+}
+
+// src/server/services/device-link.service.ts
+init_device_link_waiters();
+var USER_CODE_ATTEMPTS2 = 3;
+var WAIT_RECHECK_MS2 = 1e3;
+var MAX_WAITERS_PER_RECORD2 = 3;
+function isDead(record) {
+  return record.status === "expired" || record.expiresAt.getTime() <= Date.now() || !record.issuerKeyLive;
+}
+function assertReachable(record) {
+  if (!record || record.status === "consumed") {
+    throw new DeviceLinkNotFoundError();
+  }
+  if (isDead(record)) {
+    throw new DeviceLinkExpiredError();
+  }
+  return record;
+}
+function assertIssuedBy(record, issuer) {
+  if (!record || record.issuerUserId !== issuer.userId || record.issuerKeyId !== issuer.keyId) {
+    throw new DeviceLinkNotFoundError();
+  }
+  if (isDead(record)) {
+    throw new DeviceLinkExpiredError();
+  }
+  return record;
+}
+function refuseMissedTransition2(record, from, moved) {
+  if (!record || record.status === "consumed") {
+    throw new DeviceLinkNotFoundError();
+  }
+  if (record.status === from || isDead(record)) {
+    throw new DeviceLinkExpiredError();
+  }
+  throw moved();
+}
+function assertAwaitingDecision(record) {
+  if (record.status === "issued") {
+    throw new DeviceLinkNotRedeemedError();
+  }
+  if (record.status !== "redeemed") {
+    throw new DeviceLinkAlreadyHandledError();
+  }
+}
+function describeLink(record) {
+  return {
+    status: record.status,
+    expiresAtMillis: record.expiresAt.getTime(),
+    ...describeDevice2(record),
+    ...record.status === "redeemed" && record.choices ? { choices: record.choices } : {}
+  };
+}
+function describeDevice2(record) {
+  if (!record.redeemedAt || !record.fingerprint) {
+    return {};
+  }
+  return {
+    deviceName: record.deviceName ?? void 0,
+    platform: record.platform ?? void 0,
+    fingerprintPrefix: record.fingerprint.slice(0, KEY_FINGERPRINT_PREFIX_LENGTH),
+    redeemedAtMillis: record.redeemedAt.getTime()
+  };
+}
+async function issueDeviceLinkService(issuer) {
+  await deviceLinksRepository.lockIssuerKey(issuer.keyId);
+  await deviceLinksRepository.expireLiveByIssuerKey(issuer.keyId);
+  const expiresAt = new Date(Date.now() + getDeviceLinkConfig().ttlMs);
+  for (let attempt = 0; attempt < USER_CODE_ATTEMPTS2; attempt++) {
+    const record = await deviceLinksRepository.create({
+      linkId: randomUUID(),
+      userCode: generateUserCode(),
+      issuerUserId: issuer.userId,
+      issuerKeyId: issuer.keyId,
+      expiresAt
+    });
+    if (record) {
+      return {
+        linkId: record.linkId,
+        userCode: formatUserCode(record.userCode),
+        expiresAtMillis: expiresAt.getTime()
+      };
+    }
+  }
+  throw new Error(
+    `Could not allocate a unique device link code in ${USER_CODE_ATTEMPTS2} attempts. Check the code generator and the user_code unique index.`
+  );
+}
+async function redeemDeviceLinkService(params) {
+  if (!verifyKeyFingerprint(params.publicKey, params.fingerprint)) {
+    throw new InvalidKeyFingerprintError3();
+  }
+  const algorithm = params.algorithm ?? DEFAULT_KEY_ALGORITHM;
+  assertKeyMatchesAlgorithm(params.publicKey, algorithm);
+  const userCode = normalizeUserCode(params.userCode);
+  const record = assertReachable(await deviceLinksRepository.findByUserCode(userCode));
+  if (record.status !== "issued") {
+    throw new DeviceLinkNotFoundError();
+  }
+  const deviceCode = generateDeviceCode();
+  const matchNumber = generateMatchNumber();
+  const redeemed = await deviceLinksRepository.redeem(record.id, {
+    deviceCodeHash: hashDeviceCode(deviceCode),
+    publicKey: params.publicKey,
+    keyId: params.keyId,
+    fingerprint: params.fingerprint,
+    algorithm,
+    deviceName: params.deviceName,
+    platform: params.platform,
+    matchNumber,
+    choices: generateChoices(matchNumber)
+  });
+  if (!redeemed) {
+    refuseMissedTransition2(
+      await deviceLinksRepository.findByUserCode(userCode),
+      "issued",
+      () => new DeviceLinkNotFoundError()
+    );
+  }
+  return {
+    deviceCode,
+    matchNumber,
+    expiresAtMillis: redeemed.expiresAt.getTime(),
+    intervalMillis: getDeviceAuthConfig().intervalMs
+  };
+}
+async function getDeviceLinkStatusService(params) {
+  return describeLink(assertIssuedBy(await deviceLinksRepository.findByLinkId(params.linkId), params.issuer));
+}
+async function confirmDeviceLinkService(params) {
+  const record = assertIssuedBy(await deviceLinksRepository.findByLinkId(params.linkId), params.issuer);
+  assertAwaitingDecision(record);
+  if (params.choice !== record.matchNumber) {
+    await refuse(record);
+    throw new DeviceLinkWrongMatchError();
+  }
+  const approved = await deviceLinksRepository.approve(record.id);
+  if (!approved) {
+    refuseMissedTransition2(
+      await deviceLinksRepository.findByLinkId(params.linkId),
+      "redeemed",
+      () => new DeviceLinkAlreadyHandledError()
+    );
+  }
+  return describeLink(approved);
+}
+async function denyDeviceLinkService(params) {
+  const record = assertIssuedBy(await deviceLinksRepository.findByLinkId(params.linkId), params.issuer);
+  assertAwaitingDecision(record);
+  return describeLink(await refuse(record));
+}
+async function refuse(record) {
+  const denied = await deviceLinksRepository.deny(record.id);
+  if (!denied) {
+    refuseMissedTransition2(
+      await deviceLinksRepository.findByLinkId(record.linkId),
+      "redeemed",
+      () => new DeviceLinkAlreadyHandledError()
+    );
+  }
+  return denied;
+}
+async function cancelDeviceLinkService(params) {
+  const record = assertIssuedBy(await deviceLinksRepository.findByLinkId(params.linkId), params.issuer);
+  if (record.status !== "issued" && record.status !== "redeemed") {
+    throw new DeviceLinkAlreadyHandledError();
+  }
+  const cancelled = await deviceLinksRepository.cancel(record.id);
+  if (!cancelled) {
+    refuseMissedTransition2(
+      await deviceLinksRepository.findByLinkId(params.linkId),
+      record.status,
+      () => new DeviceLinkAlreadyHandledError()
+    );
+  }
+  return describeLink(cancelled);
+}
+async function pollDeviceLinkService(params) {
+  const deviceCodeHash = hashDeviceCode(params.deviceCode);
+  const record = assertReachable(await deviceLinksRepository.findByDeviceCodeHash(deviceCodeHash));
+  if (record.status === "denied") {
+    throw new DeviceLinkDeniedError();
+  }
+  if (record.status === "redeemed") {
+    return {
+      status: "pending",
+      intervalMillis: Math.max(0, getDeviceAuthConfig().intervalMs - (params.waitedMillis ?? 0))
+    };
+  }
+  const consumed = await deviceLinksRepository.consumeApproved(deviceCodeHash);
+  if (!consumed) {
+    refuseMissedTransition2(
+      await deviceLinksRepository.findByDeviceCodeHash(deviceCodeHash),
+      "approved",
+      () => new DeviceLinkNotFoundError()
+    );
+  }
+  return {
+    status: "approved",
+    ...await completeDeviceLogin({
+      userId: consumed.issuerUserId,
+      key: parkedKey(consumed),
+      channel: "device-link",
+      provenance: params,
+      missingAccount: () => new DeviceLinkNotFoundError()
+    })
+  };
+}
+function parkedKey(link) {
+  const { keyId, publicKey, fingerprint, algorithm } = link;
+  if (!keyId || !publicKey || !fingerprint || !algorithm) {
+    throw new DeviceLinkNotFoundError();
+  }
+  return { keyId, publicKey, fingerprint, algorithm, deviceName: link.deviceName, platform: link.platform };
+}
+async function waitForDeviceLinkStatusService(params) {
+  return holdWhileUnmoved(
+    () => deviceLinksRepository.findByLinkId(params.linkId),
+    (record) => isIssuedBy(record, params.issuer) && (record.status === "issued" || record.status === "approved"),
+    params.waitMillis,
+    params.signal
+  );
+}
+async function waitForDeviceLinkAnswerService(params) {
+  const deviceCodeHash = hashDeviceCode(params.deviceCode);
+  return holdWhileUnmoved(
+    () => deviceLinksRepository.findByDeviceCodeHash(deviceCodeHash),
+    (record) => record.status === "redeemed",
+    params.waitMillis,
+    params.signal
+  );
+}
+function isIssuedBy(record, issuer) {
+  return record.issuerUserId === issuer.userId && record.issuerKeyId === issuer.keyId;
+}
+async function holdWhileUnmoved(read, waitable, waitMillis, signal) {
+  const requested = Math.min(waitMillis, getDeviceAuthConfig().maxWaitMs);
+  const record = requested > 0 ? await read().catch(() => null) : null;
+  if (!record || isDead(record) || !waitable(record) || waitingOnDeviceLink(record.id) >= MAX_WAITERS_PER_RECORD2) {
+    return 0;
+  }
+  const startedAt = Date.now();
+  const deadline = Math.min(startedAt + requested, record.expiresAt.getTime());
+  const unmoved = async () => {
+    const current = await read().catch(() => null);
+    return current !== null && !isDead(current) && current.status === record.status;
+  };
+  await holdDeviceLinkWait(record.id, () => waitUntil2(record.id, deadline, unmoved, signal));
+  return Date.now() - startedAt;
+}
+async function waitUntil2(id27, deadline, unmoved, signal) {
+  while (!signal?.aborted && !getShutdownManager2().isShuttingDown()) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      return;
+    }
+    await waitForDeviceLinkMove(id27, Math.min(remaining, WAIT_RECHECK_MS2), signal);
+    if (!await unmoved()) {
+      return;
+    }
+  }
+}
+
 // src/server/services/passkey.service.ts
 init_logger();
 init_config();
-import { onAfterCommit as onAfterCommit6, runInTransaction as runInTransaction4 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit7, runInTransaction as runInTransaction4 } from "@spfn/core/db";
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 import {
   AccountDisabledError as AccountDisabledError3,
@@ -13819,7 +14634,7 @@ async function finishPasskeyEnrollmentService(params) {
     aaguid: verified.aaguid,
     label: params.label ?? null
   });
-  onAfterCommit6(() => passkeyEnrolledEvent.emit({
+  onAfterCommit7(() => passkeyEnrolledEvent.emit({
     userId: String(params.userId),
     passkeyId: String(row.id),
     label: row.label ?? void 0
@@ -13919,7 +14734,7 @@ async function startSession(user, params) {
     ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
-  onAfterCommit6(() => authLoginEvent.emit({
+  onAfterCommit7(() => authLoginEvent.emit({
     userId: String(user.id),
     provider: "passkey",
     email: result.email,
@@ -14002,7 +14817,7 @@ async function revokePasskeyService(params) {
   if (!revoked) {
     throw new PasskeyNotFoundError2();
   }
-  onAfterCommit6(() => passkeyRevokedEvent.emit({
+  onAfterCommit7(() => passkeyRevokedEvent.emit({
     userId: String(params.userId),
     passkeyId: String(revoked.id),
     reason: "user"
@@ -14085,51 +14900,51 @@ async function initializeAuth(options = {}) {
   authLogger.service.info("\u{1F512} Built-in roles: user, admin, superadmin");
 }
 async function syncRoles(configs, existingByName) {
-  for (const config4 of configs) {
-    const existing = existingByName.get(config4.name);
+  for (const config5 of configs) {
+    const existing = existingByName.get(config5.name);
     if (!existing) {
       await rolesRepository.create({
-        name: config4.name,
-        displayName: config4.displayName,
-        description: config4.description || null,
-        priority: config4.priority ?? 10,
-        isSystem: config4.isSystem ?? false,
-        isBuiltin: config4.isBuiltin ?? false,
+        name: config5.name,
+        displayName: config5.displayName,
+        description: config5.description || null,
+        priority: config5.priority ?? 10,
+        isSystem: config5.isSystem ?? false,
+        isBuiltin: config5.isBuiltin ?? false,
         isActive: true
       });
-      authLogger.service.info(`  \u2705 Created role: ${config4.name}`);
+      authLogger.service.info(`  \u2705 Created role: ${config5.name}`);
     } else {
       const updateData = {
-        displayName: config4.displayName,
-        description: config4.description || null
+        displayName: config5.displayName,
+        description: config5.description || null
       };
       if (!existing.isBuiltin) {
-        updateData.priority = config4.priority ?? existing.priority;
+        updateData.priority = config5.priority ?? existing.priority;
       }
       await rolesRepository.updateById(existing.id, updateData);
     }
   }
 }
 async function syncPermissions(configs, existingByName) {
-  for (const config4 of configs) {
-    const existing = existingByName.get(config4.name);
+  for (const config5 of configs) {
+    const existing = existingByName.get(config5.name);
     if (!existing) {
       await permissionsRepository.create({
-        name: config4.name,
-        displayName: config4.displayName,
-        description: config4.description || null,
-        category: config4.category || null,
-        isSystem: config4.isSystem ?? false,
-        isBuiltin: config4.isBuiltin ?? false,
+        name: config5.name,
+        displayName: config5.displayName,
+        description: config5.description || null,
+        category: config5.category || null,
+        isSystem: config5.isSystem ?? false,
+        isBuiltin: config5.isBuiltin ?? false,
         isActive: true,
         metadata: null
       });
-      authLogger.service.info(`  \u2705 Created permission: ${config4.name}`);
+      authLogger.service.info(`  \u2705 Created permission: ${config5.name}`);
     } else {
       await permissionsRepository.updateById(existing.id, {
-        displayName: config4.displayName,
-        description: config4.description || null,
-        category: config4.category || null
+        displayName: config5.displayName,
+        description: config5.description || null,
+        category: config5.category || null
       });
     }
   }
@@ -14191,7 +15006,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id26) => permissionsRepository.findById(id26))
+      permIds.map((id27) => permissionsRepository.findById(id27))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -14409,20 +15224,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id26, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id26);
+async function cancelInvitation(id27, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id27);
   if (!invitation) {
     throw new NotFoundError4({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id26, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id27, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id26) {
-  await invitationsRepository.deleteById(id26);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id26}`);
+async function deleteInvitation(id27) {
+  await invitationsRepository.deleteById(id27);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id27}`);
 }
 async function expireOldInvitations() {
   const count2 = await invitationsRepository.updateExpiredInvitations();
@@ -14431,8 +15246,8 @@ async function expireOldInvitations() {
   }
   return count2;
 }
-async function resendInvitation(id26, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id26);
+async function resendInvitation(id27, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id27);
   if (!invitation) {
     throw new NotFoundError4({ message: "Invitation not found", resource: "Invitation" });
   }
@@ -14440,7 +15255,7 @@ async function resendInvitation(id26, expiresInDays = 7) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id26, newExpiresAt);
+  const updated = await invitationsRepository.resend(id27, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -14479,13 +15294,13 @@ async function getAuthSessionService(userId) {
 // src/server/lib/one-time-token.ts
 import { SSETokenManager } from "@spfn/core/event/sse";
 var manager = null;
-function initOneTimeTokenManager(config4) {
+function initOneTimeTokenManager(config5) {
   if (manager) {
     manager.destroy();
   }
   manager = new SSETokenManager({
-    ttl: config4?.ttl,
-    store: config4?.store
+    ttl: config5?.ttl,
+    store: config5?.store
   });
 }
 function getOneTimeTokenManager() {
@@ -14635,10 +15450,10 @@ function getDefaultScopes() {
 }
 function getGoogleAuthUrl(state, scopes) {
   const resolvedScopes = scopes ?? getDefaultScopes();
-  const config4 = getGoogleOAuthConfig();
+  const config5 = getGoogleOAuthConfig();
   const params = new URLSearchParams({
-    client_id: config4.clientId,
-    redirect_uri: config4.redirectUri,
+    client_id: config5.clientId,
+    redirect_uri: config5.redirectUri,
     response_type: "code",
     scope: resolvedScopes.join(" "),
     state,
@@ -14650,16 +15465,16 @@ function getGoogleAuthUrl(state, scopes) {
   return `${GOOGLE_AUTH_URL}?${params.toString()}`;
 }
 async function exchangeCodeForTokens(code) {
-  const config4 = getGoogleOAuthConfig();
+  const config5 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config4.clientId,
-      client_secret: config4.clientSecret,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      client_secret: config5.clientSecret,
+      redirect_uri: config5.redirectUri,
       grant_type: "authorization_code",
       code
     })
@@ -14683,15 +15498,15 @@ async function getGoogleUserInfo(accessToken) {
   return response.json();
 }
 async function refreshAccessToken(refreshToken) {
-  const config4 = getGoogleOAuthConfig();
+  const config5 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config4.clientId,
-      client_secret: config4.clientSecret,
+      client_id: config5.clientId,
+      client_secret: config5.clientSecret,
       refresh_token: refreshToken,
       grant_type: "refresh_token"
     })
@@ -14756,8 +15571,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id26) {
-  return registry2.get(id26);
+function getOAuthProvider(id27) {
+  return registry2.get(id27);
 }
 function getRegisteredProviders() {
   return [...registry2.values()];
@@ -15012,21 +15827,21 @@ var githubProvider = {
     return !!(env4.SPFN_AUTH_GITHUB_CLIENT_ID && env4.SPFN_AUTH_GITHUB_CLIENT_SECRET);
   },
   getAuthUrl(state, scopes) {
-    const config4 = getGithubConfig();
+    const config5 = getGithubConfig();
     const params = new URLSearchParams({
-      client_id: config4.clientId,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      redirect_uri: config5.redirectUri,
       state,
       scope: (scopes ?? getGithubScopes()).join(" ")
     });
     return `${GITHUB_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code) {
-    const config4 = getGithubConfig();
+    const config5 = getGithubConfig();
     return requestGithubTokens(new URLSearchParams({
-      client_id: config4.clientId,
-      client_secret: config4.clientSecret,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      client_secret: config5.clientSecret,
+      redirect_uri: config5.redirectUri,
       code
     }));
   },
@@ -15056,11 +15871,11 @@ var githubProvider = {
     };
   },
   async refreshTokens(refreshToken) {
-    const config4 = getGithubConfig();
+    const config5 = getGithubConfig();
     return requestGithubTokens(new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config4.clientId,
-      client_secret: config4.clientSecret,
+      client_id: config5.clientId,
+      client_secret: config5.clientSecret,
       refresh_token: refreshToken
     }));
   }
@@ -15184,26 +15999,26 @@ var kakaoProvider = {
     return !!env4.SPFN_AUTH_KAKAO_CLIENT_ID;
   },
   getAuthUrl(state, scopes) {
-    const config4 = getKakaoConfig();
+    const config5 = getKakaoConfig();
     const params = new URLSearchParams({
       response_type: "code",
-      client_id: config4.clientId,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      redirect_uri: config5.redirectUri,
       state,
       scope: (scopes ?? getKakaoScopes()).join(",")
     });
     return `${KAKAO_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code) {
-    const config4 = getKakaoConfig();
+    const config5 = getKakaoConfig();
     const params = new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: config4.clientId,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      redirect_uri: config5.redirectUri,
       code
     });
-    if (config4.clientSecret) {
-      params.set("client_secret", config4.clientSecret);
+    if (config5.clientSecret) {
+      params.set("client_secret", config5.clientSecret);
     }
     return requestKakaoTokens(params);
   },
@@ -15245,14 +16060,14 @@ var kakaoProvider = {
     return options.accessToken ? withKakaoVerifiedEmail(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
-    const config4 = getKakaoConfig();
+    const config5 = getKakaoConfig();
     const params = new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config4.clientId,
+      client_id: config5.clientId,
       refresh_token: refreshToken
     });
-    if (config4.clientSecret) {
-      params.set("client_secret", config4.clientSecret);
+    if (config5.clientSecret) {
+      params.set("client_secret", config5.clientSecret);
     }
     return requestKakaoTokens(params);
   },
@@ -15411,22 +16226,22 @@ var naverProvider = {
     return !!(env4.SPFN_AUTH_NAVER_CLIENT_ID && env4.SPFN_AUTH_NAVER_CLIENT_SECRET);
   },
   getAuthUrl(state) {
-    const config4 = getNaverConfig();
+    const config5 = getNaverConfig();
     const params = new URLSearchParams({
       response_type: "code",
-      client_id: config4.clientId,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      redirect_uri: config5.redirectUri,
       state
     });
     return `${NAVER_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code, options) {
-    const config4 = getNaverConfig();
+    const config5 = getNaverConfig();
     return requestNaverTokens(new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: config4.clientId,
-      client_secret: config4.clientSecret,
-      redirect_uri: config4.redirectUri,
+      client_id: config5.clientId,
+      client_secret: config5.clientSecret,
+      redirect_uri: config5.redirectUri,
       code,
       state: options.state
     }));
@@ -15467,11 +16282,11 @@ var naverProvider = {
     return options.accessToken ? withNaverProfile(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
-    const config4 = getNaverConfig();
+    const config5 = getNaverConfig();
     return requestNaverTokens(new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config4.clientId,
-      client_secret: config4.clientSecret,
+      client_id: config5.clientId,
+      client_secret: config5.clientSecret,
       refresh_token: refreshToken
     }));
   },
@@ -15830,9 +16645,9 @@ async function oauthUnlinkNotifyService(provider, notification) {
 }
 
 // src/server/services/oauth-native.service.ts
-import { runInTransaction as runInTransaction5, onAfterCommit as onAfterCommit7 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction5, onAfterCommit as onAfterCommit8 } from "@spfn/core/db";
 import {
-  InvalidKeyFingerprintError as InvalidKeyFingerprintError3,
+  InvalidKeyFingerprintError as InvalidKeyFingerprintError4,
   NativeSignInUnsupportedError as NativeSignInUnsupportedError5,
   NonceKeyBindingError
 } from "@spfn/auth/errors";
@@ -15859,7 +16674,7 @@ function assertNonceBindsPublicKey(params) {
     throw new NonceKeyBindingError();
   }
   if (!verifyKeyFingerprint(params.publicKey, params.fingerprint)) {
-    throw new InvalidKeyFingerprintError3();
+    throw new InvalidKeyFingerprintError4();
   }
 }
 async function persistNativeLogin(identity, params) {
@@ -15903,7 +16718,7 @@ async function persistNativeLogin(identity, params) {
     }
     await updateLastLoginService(userId);
     const mfaEnrolled = isNewUser ? false : await mfaEnrolledForUser(userId);
-    onAfterCommit7(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
+    onAfterCommit8(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
     return { mfaRequired: false, userId: String(userId), keyId: params.keyId, isNewUser };
   }, { context: "auth:oauth-native" });
 }
@@ -15953,8 +16768,8 @@ async function verifyOpsTokenService(token) {
     scopes: record.scopes
   };
 }
-async function revokeOpsTokenService(id26) {
-  return await opsTokensRepository.revokeById(id26);
+async function revokeOpsTokenService(id27) {
+  return await opsTokensRepository.revokeById(id27);
 }
 async function listOpsTokensService() {
   return await opsTokensRepository.list();
@@ -15970,7 +16785,7 @@ var DEFAULT_ACCESS_TOKEN_TTL_MS = 8 * 60 * 60 * 1e3;
 var DEFAULT_REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var DEFAULT_CODE_TTL_MS = 60 * 1e3;
 var AUTHORIZE_PATH = "/oauth/authorize";
-var config3 = null;
+var config4 = null;
 function resolveIssuerSource(env21 = process.env) {
   return { value: env21.SPFN_API_URL, variable: "SPFN_API_URL" };
 }
@@ -15980,7 +16795,7 @@ function resolveAuthorizeUrl(env21) {
 }
 function configureAuthorizationServer(options, env21 = process.env) {
   if (!options) {
-    config3 = null;
+    config4 = null;
     return;
   }
   const scopeNames = Object.keys(options.scopes ?? {});
@@ -15989,7 +16804,7 @@ function configureAuthorizationServer(options, env21 = process.env) {
       "authorizationServer.scopes must name at least one scope. The names are published in /.well-known/oauth-authorization-server and shown on the consent screen, so there is nothing to derive them from."
     );
   }
-  config3 = {
+  config4 = {
     issuer: canonicalIssuer(options.issuer ?? resolveIssuerSource(env21).value ?? ""),
     issuerSource: options.issuer ? "authorizationServer.issuer" : resolveIssuerSource(env21).variable,
     authorizeUrl: options.authorizeUrl ?? resolveAuthorizeUrl(env21),
@@ -16000,7 +16815,7 @@ function configureAuthorizationServer(options, env21 = process.env) {
     refreshTokenTtlMs: options.refreshTokenTtlMs ?? DEFAULT_REFRESH_TOKEN_TTL_MS,
     codeTtlMs: options.codeTtlMs ?? DEFAULT_CODE_TTL_MS
   };
-  assertKnownDefaultScopes(config3);
+  assertKnownDefaultScopes(config4);
 }
 function assertKnownDefaultScopes(resolved) {
   const unknown = resolved.defaultScopes.filter((scope) => !(scope in resolved.scopes));
@@ -16011,7 +16826,7 @@ function assertKnownDefaultScopes(resolved) {
   }
 }
 function getAuthorizationServerConfig() {
-  return config3;
+  return config4;
 }
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
@@ -16234,15 +17049,15 @@ var STALE_CLIENT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var SUPPORTED_AUTH_METHOD = "none";
 var SUPPORTED_GRANT_TYPES = ["authorization_code", "refresh_token"];
 var SUPPORTED_RESPONSE_TYPES = ["code"];
-function refuse(status, error, description) {
+function refuse2(status, error, description) {
   return { ok: false, status, error, description };
 }
 function requireConfig() {
-  const config4 = getAuthorizationServerConfig();
-  if (!config4) {
+  const config5 = getAuthorizationServerConfig();
+  if (!config5) {
     throw new Error("OAuth2 client service called with no authorization server configured.");
   }
-  return config4;
+  return config5;
 }
 function asStringArray(value) {
   if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
@@ -16253,7 +17068,7 @@ function asStringArray(value) {
 function refuseDeclaredMetadata(request) {
   const { token_endpoint_auth_method: authMethod } = request;
   if (authMethod !== void 0 && authMethod !== SUPPORTED_AUTH_METHOD) {
-    return refuse(
+    return refuse2(
       400,
       "invalid_client_metadata",
       `token_endpoint_auth_method must be "${SUPPORTED_AUTH_METHOD}". This authorization server registers public clients only \u2014 a client on a user's own machine cannot keep a secret.`
@@ -16267,7 +17082,7 @@ function refuseListedMetadata(field, value, supported) {
   }
   const declared = asStringArray(value);
   if (!declared || declared.length === 0 || declared.some((entry) => !supported.includes(entry))) {
-    return refuse(
+    return refuse2(
       400,
       "invalid_client_metadata",
       `${field} must be a non-empty subset of ${supported.join(", ")}.`
@@ -16278,7 +17093,7 @@ function refuseListedMetadata(field, value, supported) {
 function refuseRedirectUris(uris, allowedRedirectOrigins) {
   const declared = asStringArray(uris);
   if (!declared || declared.length === 0) {
-    return refuse(
+    return refuse2(
       400,
       "invalid_client_metadata",
       "redirect_uris must list at least one absolute URI. There is nowhere to send an authorization code without one."
@@ -16287,20 +17102,20 @@ function refuseRedirectUris(uris, allowedRedirectOrigins) {
   for (const uri of declared) {
     const detail = refuseRedirectUriRegistration(uri, allowedRedirectOrigins);
     if (detail) {
-      return refuse(400, "invalid_redirect_uri", detail);
+      return refuse2(400, "invalid_redirect_uri", detail);
     }
   }
   return null;
 }
 async function registerOAuth2ClientService(request, clientIp) {
-  const config4 = requireConfig();
-  const refusal = refuseRedirectUris(request.redirect_uris, config4.allowedRedirectOrigins) ?? refuseDeclaredMetadata(request);
+  const config5 = requireConfig();
+  const refusal = refuseRedirectUris(request.redirect_uris, config5.allowedRedirectOrigins) ?? refuseDeclaredMetadata(request);
   if (refusal) {
     return refusal;
   }
   const record = await createUnderStandingCap(newClientRow(request, clientIp), clientIp);
   if (!record) {
-    return refuse(429, "invalid_client_metadata", OVER_STANDING_CAP_MESSAGE);
+    return refuse2(429, "invalid_client_metadata", OVER_STANDING_CAP_MESSAGE);
   }
   authLogger.service.info("OAuth2 client registered", { clientName: record.clientName });
   return { ok: true, client: describeClient(record) };
@@ -16379,11 +17194,11 @@ function sameResource(presented, granted) {
 
 // src/server/services/oauth2-authorize.service.ts
 function requireConfig2() {
-  const config4 = getAuthorizationServerConfig();
-  if (!config4) {
+  const config5 = getAuthorizationServerConfig();
+  if (!config5) {
     throw new Error("OAuth2 authorize service called with no authorization server configured.");
   }
-  return config4;
+  return config5;
 }
 async function resolveRedirectTarget(params) {
   const client = await oauth2ClientsRepository.findByClientId(params.clientId);
@@ -16395,10 +17210,10 @@ async function resolveRedirectTarget(params) {
   }
   return { client, redirectUri: params.redirectUri };
 }
-function resolveScopes(params, config4) {
+function resolveScopes(params, config5) {
   const requested = params.scope?.trim();
   if (!requested) {
-    return config4.defaultScopes;
+    return config5.defaultScopes;
   }
   return requested.split(/\s+/);
 }
@@ -16410,7 +17225,7 @@ function refuseRedirectable(params, redirectUri, error, message) {
 function hasUsableS256Challenge(params) {
   return params.codeChallengeMethod === "S256" && !!params.codeChallenge && isPkceS256ChallengeShaped(params.codeChallenge);
 }
-function assertRedirectableRules(params, redirectUri, config4) {
+function assertRedirectableRules(params, redirectUri, config5) {
   if (!hasUsableS256Challenge(params)) {
     refuseRedirectable(params, redirectUri, "invalid_request", PKCE_REQUIRED_MESSAGE);
   }
@@ -16418,31 +17233,31 @@ function assertRedirectableRules(params, redirectUri, config4) {
   if (!resource) {
     refuseRedirectable(params, redirectUri, "invalid_target", RESOURCE_REQUIRED_MESSAGE);
   }
-  const scopes = resolveScopes(params, config4);
-  const unknown = scopes.filter((scope) => !(scope in config4.scopes));
+  const scopes = resolveScopes(params, config5);
+  const unknown = scopes.filter((scope) => !(scope in config5.scopes));
   if (unknown.length > 0) {
     refuseRedirectable(params, redirectUri, "invalid_scope", `Unknown scope: ${unknown.join(", ")}.`);
   }
   return { resource, scopes, codeChallenge: params.codeChallenge };
 }
 async function validate(params) {
-  const config4 = requireConfig2();
+  const config5 = requireConfig2();
   const { client, redirectUri } = await resolveRedirectTarget(params);
-  const { resource, scopes, codeChallenge } = assertRedirectableRules(params, redirectUri, config4);
+  const { resource, scopes, codeChallenge } = assertRedirectableRules(params, redirectUri, config5);
   return { client, redirectUri, resource, scopes, codeChallenge, state: params.state };
 }
 async function describeOAuth2AuthorizeRequestService(params) {
-  const config4 = requireConfig2();
+  const config5 = requireConfig2();
   const validated = await validate(params);
   return {
     clientName: validated.client.clientName,
     redirectHost: redirectHostOf(validated.redirectUri),
-    scopes: validated.scopes.map((name) => ({ name, description: config4.scopes[name] })),
+    scopes: validated.scopes.map((name) => ({ name, description: config5.scopes[name] })),
     resource: validated.resource
   };
 }
 async function approveOAuth2AuthorizeService(params, userId) {
-  const config4 = requireConfig2();
+  const config5 = requireConfig2();
   const validated = await validate(params);
   const grant = await oauth2GrantsRepository.upsert({
     client: validated.client.id,
@@ -16456,7 +17271,7 @@ async function approveOAuth2AuthorizeService(params, userId) {
     grant: grant.id,
     redirectUri: validated.redirectUri,
     codeChallenge: validated.codeChallenge,
-    expiresAt: new Date(Date.now() + config4.codeTtlMs)
+    expiresAt: new Date(Date.now() + config5.codeTtlMs)
   });
   return { code, redirectUri: validated.redirectUri, state: validated.state };
 }
@@ -16484,15 +17299,15 @@ function invalidGrant() {
     description: "The authorization code or refresh token is invalid, expired, already used, or was issued to another client."
   };
 }
-function refuse2(error, description) {
+function refuse3(error, description) {
   return { ok: false, error, description };
 }
 function requireConfig3() {
-  const config4 = getAuthorizationServerConfig();
-  if (!config4) {
+  const config5 = getAuthorizationServerConfig();
+  if (!config5) {
     throw new Error("OAuth2 token service called with no authorization server configured.");
   }
-  return config4;
+  return config5;
 }
 async function oauth2TokenService(request) {
   if (request.grant_type === "authorization_code") {
@@ -16501,14 +17316,14 @@ async function oauth2TokenService(request) {
   if (request.grant_type === "refresh_token") {
     return await refreshTokens(request);
   }
-  return refuse2(
+  return refuse3(
     "unsupported_grant_type",
     "grant_type must be authorization_code or refresh_token."
   );
 }
 async function exchangeAuthorizationCode(request) {
   if (!request.code || !request.code_verifier || !request.client_id || !request.redirect_uri) {
-    return refuse2(
+    return refuse3(
       "invalid_request",
       "authorization_code requires code, code_verifier, client_id and redirect_uri."
     );
@@ -16542,13 +17357,13 @@ async function spendBoundCode(request, record, pair) {
     return invalidGrant();
   }
   if (resolveResource(request.resource, pair.grant) === null) {
-    return refuse2("invalid_target", "resource does not match the resource this grant was issued for.");
+    return refuse3("invalid_target", "resource does not match the resource this grant was issued for.");
   }
   return { ok: true, tokens: await issueTokenPair(pair.grant, pair.grant.scopes) };
 }
 async function refreshTokens(request) {
   if (!request.refresh_token || !request.client_id) {
-    return refuse2("invalid_request", "refresh_token requires refresh_token and client_id.");
+    return refuse3("invalid_request", "refresh_token requires refresh_token and client_id.");
   }
   const tokenHash = hashOAuth2Secret(request.refresh_token);
   const presented = await oauth2TokensRepository.findByTokenHash(tokenHash);
@@ -16570,11 +17385,11 @@ async function rotateRefresh(request, tokenHash, grantId, presentedScopes) {
     return invalidGrant();
   }
   if (resolveResource(request.resource, pair.grant) === null) {
-    return refuse2("invalid_target", "resource does not match the resource this grant was issued for.");
+    return refuse3("invalid_target", "resource does not match the resource this grant was issued for.");
   }
   const scopes = resolveRefreshScopes(request.scope, pair.grant, presentedScopes);
   if (!scopes) {
-    return refuse2("invalid_scope", "A refresh may ask for a subset of the granted scopes, never more.");
+    return refuse3("invalid_scope", "A refresh may ask for a subset of the granted scopes, never more.");
   }
   if (!await oauth2TokensRepository.rotate(tokenHash)) {
     return await refuseLostRotation(tokenHash, grantId);
@@ -16603,10 +17418,10 @@ function resolveResource(requested, grant) {
   return sameResource(requested, grant.resource) ? grant.resource : null;
 }
 async function issueTokenPair(grant, scopes) {
-  const config4 = requireConfig3();
+  const config5 = requireConfig3();
   const accessToken = generateAccessToken();
   const refreshToken = generateRefreshToken();
-  const expiresAt = new Date(Date.now() + config4.accessTokenTtlMs);
+  const expiresAt = new Date(Date.now() + config5.accessTokenTtlMs);
   await runInTransaction6(async () => {
     await storeToken(accessToken, "access", grant.id, scopes, expiresAt);
     await storeToken(
@@ -16614,7 +17429,7 @@ async function issueTokenPair(grant, scopes) {
       "refresh",
       grant.id,
       scopes,
-      new Date(Date.now() + config4.refreshTokenTtlMs)
+      new Date(Date.now() + config5.refreshTokenTtlMs)
     );
   });
   oauth2ClientsRepository.updateLastUsedById(grant.client).catch((err) => authLogger.service.error("Failed to update OAuth2 client lastUsedAt", err));
@@ -16937,6 +17752,72 @@ function attestedClientIp(c) {
   return provenance.webProxy ? provenance.ip ?? null : null;
 }
 
+// src/server/middleware/device-auth-long-poll.ts
+var DEVICE_AUTH_WAITED_MILLIS = "deviceAuthWaitedMillis";
+function deviceAuthLongPoll() {
+  return async (c, next) => {
+    const target = waitTarget(await c.req.json().catch(() => null));
+    if (!target) {
+      return next();
+    }
+    const signal = c.req.raw.signal;
+    const waitedMillis = await waitForDeviceAuthAnswerService({ ...target, signal });
+    if (signal.aborted) {
+      return c.body(null, 204);
+    }
+    c.set(DEVICE_AUTH_WAITED_MILLIS, waitedMillis);
+    return next();
+  };
+}
+function waitTarget(body) {
+  const { deviceCode, waitMillis } = body ?? {};
+  if (typeof deviceCode !== "string" || !Number.isInteger(waitMillis) || waitMillis <= 0) {
+    return null;
+  }
+  return { deviceCode, waitMillis };
+}
+
+// src/server/middleware/device-link-long-poll.ts
+var DEVICE_LINK_WAITED_MILLIS = "deviceLinkWaitedMillis";
+function deviceLinkStatusLongPoll() {
+  return longPoll(async (c, body, waitMillis, signal) => {
+    const auth = getOptionalAuth(c);
+    if (typeof body.linkId !== "string" || !auth) {
+      return 0;
+    }
+    return waitForDeviceLinkStatusService({
+      linkId: body.linkId,
+      issuer: { userId: Number(auth.userId), keyId: auth.keyId },
+      waitMillis,
+      signal
+    });
+  });
+}
+function deviceLinkPollLongPoll() {
+  return longPoll(async (_c, body, waitMillis, signal) => {
+    if (typeof body.deviceCode !== "string") {
+      return 0;
+    }
+    return waitForDeviceLinkAnswerService({ deviceCode: body.deviceCode, waitMillis, signal });
+  });
+}
+function longPoll(wait) {
+  return async (c, next) => {
+    const body = await c.req.json().catch(() => null) ?? {};
+    const { waitMillis } = body;
+    if (!Number.isInteger(waitMillis) || waitMillis <= 0) {
+      return next();
+    }
+    const signal = c.req.raw.signal;
+    const waitedMillis = await wait(c, body, waitMillis, signal);
+    if (signal.aborted) {
+      return c.body(null, 204);
+    }
+    c.set(DEVICE_LINK_WAITED_MILLIS, waitedMillis);
+    return next();
+  };
+}
+
 // src/server/routes/auth/index.ts
 var sendVerificationCode = route.post("/_auth/codes").input({
   body: Type.Object({
@@ -17095,11 +17976,23 @@ var startDeviceAuth = route.post("/_auth/device/start").input({
 });
 var pollDeviceAuth = route.post("/_auth/device/poll").input({
   body: Type.Object({
-    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" })
+    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" }),
+    waitMillis: Type.Optional(Type.Integer({
+      minimum: 0,
+      description: "Longest to hold the request while nobody has answered; capped by the server"
+    }))
   })
-}).use([rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([
+  rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }),
+  deviceAuthLongPoll(),
+  Transactional()
+]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  return await pollDeviceAuthService({ ...body, ...deviceProvenance(c.raw) });
+  return await pollDeviceAuthService({
+    deviceCode: body.deviceCode,
+    ...deviceProvenance(c.raw),
+    waitedMillis: Number(c.raw.get(DEVICE_AUTH_WAITED_MILLIS) ?? 0)
+  });
 });
 var getDeviceAuthInfo = route.post("/_auth/device/info").input({
   body: Type.Object({
@@ -17136,6 +18029,101 @@ var denyDeviceAuth = route.post("/_auth/device/deny").input({
   await denyDeviceAuthService(body);
   return c.noContent();
 });
+function issuerOf(c) {
+  const { userId, keyId } = getAuth(c);
+  return { userId: Number(userId), keyId };
+}
+var issueDeviceLink = route.post("/_auth/device/link/issue").use([
+  rateLimitPolicy("auth-device-link-issue", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) }),
+  Transactional()
+]).handler(async (c) => {
+  return await issueDeviceLinkService(issuerOf(c));
+});
+var redeemDeviceLink = route.post("/_auth/device/link/redeem").input({
+  body: Type.Object({
+    userCode: UserCodeSchema,
+    publicKey: PublicKeySchema,
+    keyId: KeyIdSchema,
+    fingerprint: FingerprintSchema,
+    algorithm: Type.Optional(Type.Union(
+      KEY_ALGORITHM.map((algo) => Type.Literal(algo)),
+      { description: "Signature algorithm" }
+    )),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
+  })
+}).use([rateLimitPolicy("auth-device-link-redeem", { limit: 10, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await redeemDeviceLinkService(body);
+});
+var getDeviceLinkStatus = route.post("/_auth/device/link/status").input({
+  body: Type.Object({
+    linkId: LinkIdSchema,
+    waitMillis: Type.Optional(Type.Integer({
+      minimum: 0,
+      description: "Longest to hold the request while the link waits on the other device; capped by the server"
+    }))
+  })
+}).use([
+  rateLimitPolicy("auth-device-link-status", { limit: 30, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 150 }) }),
+  deviceLinkStatusLongPoll()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  return await getDeviceLinkStatusService({ linkId: body.linkId, issuer: issuerOf(c) });
+});
+var confirmDeviceLink = route.post("/_auth/device/link/confirm").input({
+  body: Type.Object({
+    linkId: LinkIdSchema,
+    choice: MatchChoiceSchema
+  })
+}).use([
+  rateLimitPolicy("auth-device-link-confirm", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) })
+]).handler(async (c) => {
+  const { body } = await c.data();
+  return await confirmDeviceLinkService({ linkId: body.linkId, choice: body.choice, issuer: issuerOf(c) });
+});
+var denyDeviceLink = route.post("/_auth/device/link/deny").input({
+  body: Type.Object({
+    linkId: LinkIdSchema
+  })
+}).use([
+  rateLimitPolicy("auth-device-link-deny", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) }),
+  Transactional()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  return await denyDeviceLinkService({ linkId: body.linkId, issuer: issuerOf(c) });
+});
+var cancelDeviceLink = route.post("/_auth/device/link/cancel").input({
+  body: Type.Object({
+    linkId: LinkIdSchema
+  })
+}).use([
+  rateLimitPolicy("auth-device-link-cancel", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) }),
+  Transactional()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  return await cancelDeviceLinkService({ linkId: body.linkId, issuer: issuerOf(c) });
+});
+var pollDeviceLink = route.post("/_auth/device/link/poll").input({
+  body: Type.Object({
+    deviceCode: Type.String({ description: "Device code returned by /_auth/device/link/redeem" }),
+    waitMillis: Type.Optional(Type.Integer({
+      minimum: 0,
+      description: "Longest to hold the request while the issuer has not picked; capped by the server"
+    }))
+  })
+}).use([
+  rateLimitPolicy("auth-device-link-poll", { limit: 30, windowMs: 6e4 }),
+  deviceLinkPollLongPoll(),
+  Transactional()
+]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await pollDeviceLinkService({
+    deviceCode: body.deviceCode,
+    ...deviceProvenance(c.raw),
+    waitedMillis: Number(c.raw.get(DEVICE_LINK_WAITED_MILLIS) ?? 0)
+  });
+});
 var logout = route.post("/_auth/logout").handler(async (c) => {
   const auth = getAuth(c);
   if (!auth) {
@@ -17251,6 +18239,13 @@ var authRouter = defineRouter({
   getDeviceAuthInfo,
   approveDeviceAuth,
   denyDeviceAuth,
+  issueDeviceLink,
+  redeemDeviceLink,
+  getDeviceLinkStatus,
+  confirmDeviceLink,
+  denyDeviceLink,
+  cancelDeviceLink,
+  pollDeviceLink,
   logout,
   rotateKey,
   listKeys,
@@ -17558,13 +18553,13 @@ var CanonicalJsonError = class extends Error {
 var INT64_MIN = -(2n ** 63n);
 var INT64_MAX = 2n ** 63n - 1n;
 function parseCanonicalJson(bytes) {
-  let text27;
+  let text28;
   try {
-    text27 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text28 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new CanonicalJsonError("INVALID_UTF8");
   }
-  const parser = new Parser(text27);
+  const parser = new Parser(text28);
   const value = parser.parseValue();
   parser.skipWhitespace();
   if (!parser.atEnd()) {
@@ -17585,8 +18580,8 @@ function isCanonicalBytes(bytes, value) {
   return true;
 }
 var Parser = class {
-  constructor(text27) {
-    this.text = text27;
+  constructor(text28) {
+    this.text = text28;
   }
   pos = 0;
   atEnd() {
@@ -18176,7 +19171,7 @@ var CORE_PREREQUISITE_OPERATIONS = [
 
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.13.0";
+var CONTRACT_VERSION = "0.13.2";
 var CONTRACT_SUPPORTED_RANGE = ">=0.13.0 <0.14.0";
 function required(name, type) {
   return { name, type, optional: false };
@@ -18510,7 +19505,8 @@ var CONTRACT_TYPES = [
   {
     name: "PollDeviceAuthRequest",
     fields: [
-      required("deviceCode", "string")
+      required("deviceCode", "string"),
+      optional("waitMillis", "integer")
     ]
   },
   /**
@@ -18571,6 +19567,39 @@ var CONTRACT_TYPES = [
     fields: [
       required("userCode", "string")
     ]
+  },
+  /**
+   * `StartDeviceAuthRequest` with the code it redeems in front: the same key
+   * material under the same bounds, since this is the other place a caller
+   * with nothing to authenticate parks a key before anyone agreed to it.
+   */
+  {
+    name: "RedeemDeviceLinkRequest",
+    fields: [
+      required("userCode", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      optional("algorithm", "KeyAlgorithm"),
+      optional("deviceName", "string"),
+      optional("platform", "KeyPlatform")
+    ]
+  },
+  {
+    name: "RedeemDeviceLinkResponse",
+    fields: [
+      required("deviceCode", "string"),
+      required("matchNumber", "integer"),
+      required("expiresAtMillis", "integer"),
+      required("intervalMillis", "integer")
+    ]
+  },
+  {
+    name: "PollDeviceLinkRequest",
+    fields: [
+      required("deviceCode", "string"),
+      optional("waitMillis", "integer")
+    ]
   }
 ];
 var CONTRACT_ENUMS = [
@@ -19638,16 +20667,16 @@ function extractBearer2(header) {
 }
 
 // src/server/middleware/ops-or-user.ts
-function opsOrUser(config4) {
-  const roles2 = config4.roles ?? [];
-  const permissions2 = config4.permissions ?? [];
-  if (!config4.opsScopes || config4.opsScopes.length === 0) {
+function opsOrUser(config5) {
+  const roles2 = config5.roles ?? [];
+  const permissions2 = config5.permissions ?? [];
+  if (!config5.opsScopes || config5.opsScopes.length === 0) {
     throw new Error("opsOrUser: opsScopes must name at least one scope \u2014 an ops token would otherwise be admitted unchecked.");
   }
   if (roles2.length === 0 && permissions2.length === 0) {
     throw new Error("opsOrUser: give roles, permissions, or both \u2014 a user session would otherwise be admitted unchecked.");
   }
-  const ops = chain([opsTokenAuth.handler, requireOpsScope(...config4.opsScopes)]);
+  const ops = chain([opsTokenAuth.handler, requireOpsScope(...config5.opsScopes)]);
   const user = chain([
     authenticate.handler,
     ...roles2.length > 0 ? [requireRole(...roles2)] : [],
@@ -19662,8 +20691,8 @@ function bearerOf(header) {
 function chain(handlers) {
   return async (c, next) => {
     let answer;
-    const runFrom = async (index21) => {
-      const produced = index21 < handlers.length ? await handlers[index21](c, () => runFrom(index21 + 1)) : await next();
+    const runFrom = async (index22) => {
+      const produced = index22 < handlers.length ? await handlers[index22](c, () => runFrom(index22 + 1)) : await next();
       if (produced instanceof Response) {
         answer = produced;
       }
@@ -20690,13 +21719,13 @@ var NO_STORE_HEADERS = {
   Pragma: "no-cache"
 };
 function requireAuthorizationServer() {
-  const config4 = getAuthorizationServerConfig();
-  if (!config4) {
+  const config5 = getAuthorizationServerConfig();
+  if (!config5) {
     throw new NotFoundError6({
       message: "This application does not run an OAuth 2.1 authorization server. Pass `authorizationServer` to createAuthLifecycle() to enable one."
     });
   }
-  return config4;
+  return config5;
 }
 function oauth2ErrorResponse(c, status, error, description) {
   return c.json({ error, error_description: description }, status, NO_STORE_HEADERS);
@@ -20767,18 +21796,18 @@ var revokeOAuth2Grant = route14.delete("/_auth/oauth2/grants/:id").input({ param
   return { revoked: true };
 });
 var oauth2AuthorizationServerMetadata = route14.get("/.well-known/oauth-authorization-server").skip(["auth"]).handler(async (c) => {
-  const config4 = requireAuthorizationServer();
+  const config5 = requireAuthorizationServer();
   return c.json({
-    issuer: config4.issuer,
-    authorization_endpoint: config4.authorizeUrl,
-    token_endpoint: new URL("/_auth/oauth2/token", config4.issuer).toString(),
-    registration_endpoint: new URL("/_auth/oauth2/register", config4.issuer).toString(),
-    revocation_endpoint: new URL("/_auth/oauth2/revoke", config4.issuer).toString(),
+    issuer: config5.issuer,
+    authorization_endpoint: config5.authorizeUrl,
+    token_endpoint: new URL("/_auth/oauth2/token", config5.issuer).toString(),
+    registration_endpoint: new URL("/_auth/oauth2/register", config5.issuer).toString(),
+    revocation_endpoint: new URL("/_auth/oauth2/revoke", config5.issuer).toString(),
     response_types_supported: SUPPORTED_RESPONSE_TYPES,
     grant_types_supported: SUPPORTED_GRANT_TYPES,
     token_endpoint_auth_methods_supported: ["none"],
     code_challenge_methods_supported: ["S256"],
-    scopes_supported: Object.keys(config4.scopes)
+    scopes_supported: Object.keys(config5.scopes)
   });
 });
 
@@ -20878,6 +21907,14 @@ var mainAuthRouter = defineRouter6({
   getDeviceAuthInfo,
   approveDeviceAuth,
   denyDeviceAuth,
+  // Device link routes
+  issueDeviceLink,
+  redeemDeviceLink,
+  getDeviceLinkStatus,
+  confirmDeviceLink,
+  denyDeviceLink,
+  cancelDeviceLink,
+  pollDeviceLink,
   // Passkey routes (WebAuthn)
   passkeyRegisterOptions,
   passkeyRegisterVerify,
@@ -21365,6 +22402,7 @@ function assertOAuthRedirectUris(env21 = process.env) {
 function createAuthLifecycle(options = {}) {
   configureDeletion(options.deletion);
   configureDeviceAuth(options.deviceAuth);
+  configureDeviceLink(options.deviceLink);
   configureAuthorizationServer(options.authorizationServer);
   return {
     /**
@@ -21479,12 +22517,16 @@ export {
   DEFAULT_DELETION_PURGE_STRATEGY,
   DEFAULT_DELETION_SEND_NOTIFICATIONS,
   DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  DEFAULT_DEVICE_AUTH_MAX_WAIT_MS,
   DEFAULT_DEVICE_AUTH_TTL_MS,
+  DEFAULT_DEVICE_LINK_TTL_MS,
   DEFAULT_REFRESH_TOKEN_TTL_MS,
   DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON,
   DEVICE_AUTH_STATUSES,
+  DEVICE_LINK_STATUSES,
   DeviceAuthPollResponseSchema,
   DeviceAuthorizationsRepository,
+  DeviceLinksRepository,
   DeviceNameSchema,
   EmailSchema,
   EnvironmentKeyringTokenCipher,
@@ -21498,11 +22540,13 @@ export {
   KeyIdSchema,
   KeyRevokeAllTokensRepository,
   KeysRepository,
+  LinkIdSchema,
   MAX_UNGRANTED_CLIENTS_PER_IP,
   MFA_CHALLENGE_ATTEMPT_LIMIT,
   MFA_CHALLENGE_CHANNELS,
   MFA_CONFIRM_ATTEMPT_LIMIT,
   MFA_VERIFICATION_METHODS,
+  MatchChoiceSchema,
   MfaChallengesRepository,
   MfaEnrolmentRepository,
   MfaRecoveryCodesRepository,
@@ -21587,6 +22631,7 @@ export {
   bearerAuthContext,
   buildOAuthErrorUrl,
   cancelAccountDeletionService,
+  cancelDeviceLinkService,
   cancelInvitation,
   carryStepUpVerification,
   changePasswordService,
@@ -21597,7 +22642,9 @@ export {
   configureAuthorizationServer,
   configureDeletion,
   configureDeviceAuth,
+  configureDeviceLink,
   configureOAuthTokenCipher,
+  confirmDeviceLinkService,
   confirmPasswordResetService,
   confirmSignupLinkService,
   confirmTotpEnrolmentService,
@@ -21616,12 +22663,15 @@ export {
   deleteInvitation,
   deleteRole,
   denyDeviceAuthService,
+  denyDeviceLinkService,
   denyOAuth2AuthorizeService,
   deriveCsrfToken,
   describeOAuth2AuthorizeRequestService,
   describeRevokeAllLink,
   deviceAuthorizations,
   deviceAuthorizationsRepository,
+  deviceLinks,
+  deviceLinksRepository,
   disableMfaService,
   disableSessionBindingService,
   enableSessionBindingService,
@@ -21656,6 +22706,8 @@ export {
   getDeletionConfig,
   getDeviceAuthConfig,
   getDeviceAuthInfoService,
+  getDeviceLinkConfig,
+  getDeviceLinkStatusService,
   getDummyPasswordHash,
   getEnabledOAuthProviders,
   getEncryptionKeyring,
@@ -21716,6 +22768,7 @@ export {
   isPkceS256ChallengeShaped,
   isPkceVerifierShaped,
   isSafeReturnPath,
+  issueDeviceLinkService,
   issueOneTimeTokenService,
   issueOpsTokenService,
   kakaoProvider,
@@ -21783,9 +22836,11 @@ export {
   permissionsRepository,
   pkceChallengeFor,
   pollDeviceAuthService,
+  pollDeviceLinkService,
   purgeRevokeAllTokensService,
   purgeStaleOAuth2ClientsService,
   purgeUserService,
+  redeemDeviceLinkService,
   redirectHostOf,
   refreshAccessToken,
   refuseRedirectUriRegistration,