@spfn/auth 0.3.0-beta.7 → 0.3.0-beta.9

package/dist/server.js

@@ -4473,7 +4473,7 @@ var init_types = __esm({
 
 // src/server/routes/schema.ts
 import { EMAIL_PATTERN, PHONE_PATTERN } from "@spfn/auth";
-var EmailSchema, PhoneSchema, DeviceNameSchema, PlatformSchema, PasswordSchema, TargetTypeSchema, VERIFICATION_TARGET_TYPES, VerificationPurposeSchema, VERIFICATION_PURPOSES;
+var EmailSchema, PhoneSchema, DeviceNameSchema, PlatformSchema, PublicKeySchema, KeyIdSchema, FingerprintSchema, UserCodeSchema, DeviceAuthPollResponseSchema, PasswordSchema, TargetTypeSchema, VERIFICATION_TARGET_TYPES, VerificationPurposeSchema, VERIFICATION_PURPOSES;
 var init_schema3 = __esm({
   "src/server/routes/schema.ts"() {
     "use strict";
@@ -4495,6 +4495,39 @@ var init_schema3 = __esm({
       KEY_PLATFORM.map((platform) => Type.Literal(platform)),
       { description: "Platform the key lives on" }
     );
+    PublicKeySchema = Type.String({
+      maxLength: 2048,
+      description: "Client public key, SPKI DER in base64"
+    });
+    KeyIdSchema = Type.String({
+      maxLength: 64,
+      description: "Key identifier"
+    });
+    FingerprintSchema = Type.String({
+      maxLength: 128,
+      description: "SHA-256 hex fingerprint of the public key"
+    });
+    UserCodeSchema = Type.String({
+      minLength: 8,
+      maxLength: 16,
+      description: "Device user code as displayed, e.g. WXYZ-2345. Dashes, spaces and case are ignored."
+    });
+    DeviceAuthPollResponseSchema = Type.Union([
+      Type.Object({
+        status: Type.Literal("pending"),
+        intervalMillis: Type.Integer({ description: "Milliseconds to wait before polling again" })
+      }),
+      Type.Object({
+        status: Type.Literal("approved"),
+        userId: Type.String(),
+        publicId: Type.String(),
+        email: Type.Optional(Type.String()),
+        phone: Type.Optional(Type.String()),
+        passwordChangeRequired: Type.Boolean()
+      })
+    ], {
+      description: "Pending, or the login the approval produced"
+    });
     PasswordSchema = Type.String({
       minLength: 8,
       maxLength: 72,
@@ -5028,9 +5061,72 @@ var init_signup_link_tokens = __esm({
   }
 });
 
+// src/server/entities/device-authorizations.ts
+import { text as text8, uniqueIndex as uniqueIndex3 } from "drizzle-orm/pg-core";
+import { id as id8, timestamps as timestamps7, enumText as enumText5, utcTimestamp as utcTimestamp6, optionalForeignKey } from "@spfn/core/db";
+var DEVICE_AUTH_STATUSES, deviceAuthorizations;
+var init_device_authorizations = __esm({
+  "src/server/entities/device-authorizations.ts"() {
+    "use strict";
+    init_types();
+    init_users();
+    init_schema4();
+    DEVICE_AUTH_STATUSES = ["pending", "approved", "denied", "consumed"];
+    deviceAuthorizations = authSchema.table(
+      "device_authorizations",
+      {
+        id: id8(),
+        // SHA-256 of the device code, hex
+        // The code itself (32 random bytes, base64url) is returned to the waiting
+        // device once and never stored: it is the only thing that device holds,
+        // so a dump of this table must not let its reader finish someone's login
+        deviceCodeHash: text8("device_code_hash").notNull().unique(),
+        // The code a person reads off the waiting device's screen
+        // Stored normalized — uppercase, no dash — because that is the only form
+        // a lookup can match; the dash is put back for display
+        // Plaintext on purpose: it authorizes nothing without an approver who is
+        // already authenticated, and it has to be found by exact match
+        userCode: text8("user_code").notNull(),
+        // Key material the waiting device generated, same shapes as user_public_keys
+        // Parked, not registered: it can sign nothing until a poll moves it over
+        publicKey: text8("public_key").notNull(),
+        keyId: text8("key_id").notNull(),
+        fingerprint: text8("fingerprint").notNull(),
+        algorithm: enumText5("algorithm", KEY_ALGORITHM).notNull().default("ES256"),
+        // Device labels the waiting device supplied
+        // null: it sent none
+        // Shown to the approver so they can tell whether the device asking is the
+        // one in front of them — display only, so a client that lies gains nothing
+        // but a wrong line on the approval screen
+        deviceName: text8("device_name"),
+        platform: enumText5("platform", KEY_PLATFORM),
+        status: enumText5("status", DEVICE_AUTH_STATUSES).notNull().default("pending"),
+        // Who approved, written at approve time from the approver's session
+        // null while pending, and on every record that was denied or expired
+        // Never taken from a request body — that would be the whole authorization
+        userId: optionalForeignKey("user", () => users.id, { onDelete: "cascade" }),
+        // Expiry — 10 minutes from creation by default
+        // Judged on read; no job clears the row
+        expiresAt: utcTimestamp6("expires_at").notNull(),
+        // Set when the approver said yes
+        approvedAt: utcTimestamp6("approved_at"),
+        // Set when the poll that registered the key won the race
+        // Non-null means the record is spent, whatever else it says
+        consumedAt: utcTimestamp6("consumed_at"),
+        ...timestamps7()
+      },
+      (table) => [
+        // Lookup path for info/approve/deny
+        // Unique so a typed code can never address two records
+        uniqueIndex3("device_authorization_user_code_idx").on(table.userCode)
+      ]
+    );
+  }
+});
+
 // src/server/entities/user-invitations.ts
-import { text as text8, index as index8 } from "drizzle-orm/pg-core";
-import { id as id8, timestamps as timestamps7, enumText as enumText5, utcTimestamp as utcTimestamp6, typedJsonb as typedJsonb2, foreignKey as foreignKey5 } from "@spfn/core/db";
+import { text as text9, index as index8 } from "drizzle-orm/pg-core";
+import { id as id9, timestamps as timestamps8, enumText as enumText6, utcTimestamp as utcTimestamp7, typedJsonb as typedJsonb2, foreignKey as foreignKey5 } from "@spfn/core/db";
 var userInvitations;
 var init_user_invitations = __esm({
   "src/server/entities/user-invitations.ts"() {
@@ -5043,14 +5139,14 @@ var init_user_invitations = __esm({
       "user_invitations",
       {
         // Primary key
-        id: id8(),
+        id: id9(),
         // Target email address for the invitation
         // Will become the user's email upon acceptance
-        email: text8("email").notNull(),
+        email: text9("email").notNull(),
         // Unique invitation token (UUID v4)
         // Used in invitation URL: /auth/invite/{token}
         // Single-use token that expires after acceptance
-        token: text8("token").notNull().unique(),
+        token: text9("token").notNull().unique(),
         // Role to be assigned when invitation is accepted
         // Foreign key to roles table
         roleId: foreignKey5("role", () => roles.id),
@@ -5063,19 +5159,19 @@ var init_user_invitations = __esm({
         // - accepted: User accepted and account created
         // - expired: Invitation expired (automatic)
         // - cancelled: Invitation cancelled by admin
-        status: enumText5("status", INVITATION_STATUSES).default("pending").notNull(),
+        status: enumText6("status", INVITATION_STATUSES).default("pending").notNull(),
         // Expiration timestamp (default: 7 days from creation)
         // Invitation cannot be accepted after this time
         // Background job should update status to 'expired'
-        expiresAt: utcTimestamp6("expires_at").notNull(),
+        expiresAt: utcTimestamp7("expires_at").notNull(),
         // Timestamp when invitation was accepted
         // null = not yet accepted
         // Used for: audit trail, analytics
-        acceptedAt: utcTimestamp6("accepted_at"),
+        acceptedAt: utcTimestamp7("accepted_at"),
         // Timestamp when invitation was cancelled
         // null = not cancelled
         // Used for: audit trail
-        cancelledAt: utcTimestamp6("cancelled_at"),
+        cancelledAt: utcTimestamp7("cancelled_at"),
         // Additional metadata (JSONB)
         // Use cases:
         // - Custom welcome message
@@ -5084,7 +5180,7 @@ var init_user_invitations = __esm({
         // - Custom fields for app-specific data
         // Example: { message: "Welcome!", department: "Engineering" }
         metadata: typedJsonb2("metadata"),
-        ...timestamps7()
+        ...timestamps8()
       },
       (table) => [
         // Indexes for query optimization
@@ -5101,9 +5197,9 @@ var init_user_invitations = __esm({
 });
 
 // src/server/entities/account-deletion-requests.ts
-import { text as text9, index as index9, uniqueIndex as uniqueIndex3 } from "drizzle-orm/pg-core";
+import { text as text10, index as index9, uniqueIndex as uniqueIndex4 } from "drizzle-orm/pg-core";
 import { sql as sql2 } from "drizzle-orm";
-import { id as id9, timestamps as timestamps8, enumText as enumText6, utcTimestamp as utcTimestamp7, optionalForeignKey } from "@spfn/core/db";
+import { id as id10, timestamps as timestamps9, enumText as enumText7, utcTimestamp as utcTimestamp8, optionalForeignKey as optionalForeignKey2 } from "@spfn/core/db";
 var accountDeletionRequests;
 var init_account_deletion_requests = __esm({
   "src/server/entities/account-deletion-requests.ts"() {
@@ -5114,32 +5210,32 @@ var init_account_deletion_requests = __esm({
     accountDeletionRequests = authSchema.table(
       "account_deletion_requests",
       {
-        id: id9(),
+        id: id10(),
         // Foreign key to users table. `set null` (optionalForeignKey default) so this
         // row survives a hard-delete purge of the user it refers to.
-        userId: optionalForeignKey("user", () => users.id),
+        userId: optionalForeignKey2("user", () => users.id),
         // Snapshot of the user's public UUID at request time — stays readable even
         // after userId is nulled out or the account is anonymized.
-        userPublicId: text9("user_public_id").notNull(),
+        userPublicId: text10("user_public_id").notNull(),
         // When the deletion was requested
-        requestedAt: utcTimestamp7("requested_at").notNull().defaultNow(),
+        requestedAt: utcTimestamp8("requested_at").notNull().defaultNow(),
         // When the purge job is allowed to run (requestedAt + grace period; equals
         // requestedAt itself for immediate/zero-grace deletions)
-        purgeScheduledAt: utcTimestamp7("purge_scheduled_at").notNull(),
+        purgeScheduledAt: utcTimestamp8("purge_scheduled_at").notNull(),
         // Request lifecycle status
         // - pending: awaiting purgeScheduledAt (or immediate purge)
         // - cancelled: recovered before purge
         // - completed: purge ran
-        status: enumText6("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
+        status: enumText7("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
         // Who initiated the request
-        requestedBy: enumText6("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
+        requestedBy: enumText7("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
         // Optional free-text reason (self-service UI, admin note, DSR reference, ...)
-        reason: text9("reason"),
-        cancelledAt: utcTimestamp7("cancelled_at"),
-        completedAt: utcTimestamp7("completed_at"),
+        reason: text10("reason"),
+        cancelledAt: utcTimestamp8("cancelled_at"),
+        completedAt: utcTimestamp8("completed_at"),
         // Purge strategy actually executed (set on completion; null while pending)
-        purgeStrategy: enumText6("purge_strategy", PURGE_STRATEGIES),
-        ...timestamps8()
+        purgeStrategy: enumText7("purge_strategy", PURGE_STRATEGIES),
+        ...timestamps9()
       },
       (table) => [
         index9("account_deletion_requests_user_id_idx").on(table.userId),
@@ -5147,7 +5243,7 @@ var init_account_deletion_requests = __esm({
         index9("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
         index9("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
         // Partial unique index: at most one pending request per user at a time.
-        uniqueIndex3("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
+        uniqueIndex4("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
       ]
     );
   }
@@ -5299,8 +5395,8 @@ var init_rbac = __esm({
 });
 
 // src/server/entities/permissions.ts
-import { text as text10, boolean as boolean4, index as index10 } from "drizzle-orm/pg-core";
-import { id as id10, timestamps as timestamps9, enumText as enumText7, typedJsonb as typedJsonb3 } from "@spfn/core/db";
+import { text as text11, boolean as boolean4, index as index10 } from "drizzle-orm/pg-core";
+import { id as id11, timestamps as timestamps10, enumText as enumText8, typedJsonb as typedJsonb3 } from "@spfn/core/db";
 var permissions;
 var init_permissions = __esm({
   "src/server/entities/permissions.ts"() {
@@ -5311,7 +5407,7 @@ var init_permissions = __esm({
       "permissions",
       {
         // Primary key
-        id: id10(),
+        id: id11(),
         // Permission identifier
         // Format: resource:action or namespace:resource:action
         // Examples:
@@ -5319,20 +5415,20 @@ var init_permissions = __esm({
         // - Namespaced: 'auth:user:delete', 'cms:post:publish'
         // Must be unique across all permissions
         // Used in: permission checks, role assignments, API guards
-        name: text10("name").notNull().unique(),
+        name: text11("name").notNull().unique(),
         // Display name for UI
         // Human-readable name shown in admin panels
         // Example: "Delete Users", "Publish Posts"
-        displayName: text10("display_name").notNull(),
+        displayName: text11("display_name").notNull(),
         // Permission description
         // Detailed explanation of what this permission allows
         // Example: "Allows deletion of user accounts from the system"
-        description: text10("description"),
+        description: text11("description"),
         // Category for grouping
         // Used for: organizing permissions in UI, filtering
         // Built-in categories: auth, user, rbac, system
         // Custom categories: any app-specific category
-        category: enumText7("category", PERMISSION_CATEGORIES),
+        category: enumText8("category", PERMISSION_CATEGORIES),
         // Built-in permission flag
         // true: Core package permissions (auth:*, user:*, rbac:*)
         //       - Cannot be deleted or modified
@@ -5363,7 +5459,7 @@ var init_permissions = __esm({
         // - Audit: { createdBy: 123, source: 'migration', version: '1.0.0' }
         // Example: { icon: 'trash', color: 'red', requiresMfa: true }
         metadata: typedJsonb3("metadata"),
-        ...timestamps9()
+        ...timestamps10()
       },
       (table) => [
         index10("permissions_name_idx").on(table.name),
@@ -5378,7 +5474,7 @@ var init_permissions = __esm({
 
 // src/server/entities/role-permissions.ts
 import { index as index11, unique } from "drizzle-orm/pg-core";
-import { id as id11, timestamps as timestamps10, foreignKey as foreignKey6 } from "@spfn/core/db";
+import { id as id12, timestamps as timestamps11, foreignKey as foreignKey6 } from "@spfn/core/db";
 var rolePermissions;
 var init_role_permissions = __esm({
   "src/server/entities/role-permissions.ts"() {
@@ -5390,7 +5486,7 @@ var init_role_permissions = __esm({
       "role_permissions",
       {
         // Primary key
-        id: id11(),
+        id: id12(),
         // Role reference
         // Foreign key to roles table
         // Cascade delete: when role is deleted, all role-permission mappings are removed
@@ -5403,7 +5499,7 @@ var init_role_permissions = __esm({
         // Used for: granting permissions to roles
         // Example: user:delete permission → [Admin, Superadmin]
         permissionId: foreignKey6("permission", () => permissions.id, { onDelete: "cascade" }),
-        ...timestamps10()
+        ...timestamps11()
       },
       (table) => [
         // Indexes for query performance
@@ -5417,8 +5513,8 @@ var init_role_permissions = __esm({
 });
 
 // src/server/entities/user-permissions.ts
-import { boolean as boolean5, text as text11, index as index12, unique as unique2 } from "drizzle-orm/pg-core";
-import { id as id12, timestamps as timestamps11, utcTimestamp as utcTimestamp8, foreignKey as foreignKey7 } from "@spfn/core/db";
+import { boolean as boolean5, text as text12, index as index12, unique as unique2 } from "drizzle-orm/pg-core";
+import { id as id13, timestamps as timestamps12, utcTimestamp as utcTimestamp9, foreignKey as foreignKey7 } from "@spfn/core/db";
 var userPermissions;
 var init_user_permissions = __esm({
   "src/server/entities/user-permissions.ts"() {
@@ -5430,7 +5526,7 @@ var init_user_permissions = __esm({
       "user_permissions",
       {
         // Primary key
-        id: id12(),
+        id: id13(),
         // User reference
         // Foreign key to users table
         // Cascade delete: when user is deleted, all overrides are removed
@@ -5453,13 +5549,13 @@ var init_user_permissions = __esm({
         // Reason for grant/revocation
         // Used for: audit trail, compliance documentation
         // Example: "Temporary access for project X", "Security incident - restricted"
-        reason: text11("reason"),
+        reason: text12("reason"),
         // Expiration timestamp (optional)
         // null: Permanent override (remains until manually removed)
         // timestamp: Permission expires at this time (auto-revoked by background job)
         // Use case: Time-limited elevated access, temporary restrictions
-        expiresAt: utcTimestamp8("expires_at"),
-        ...timestamps11()
+        expiresAt: utcTimestamp9("expires_at"),
+        ...timestamps12()
       },
       (table) => [
         // Indexes for query performance
@@ -5475,7 +5571,7 @@ var init_user_permissions = __esm({
 
 // src/server/entities/auth-metadata.ts
 import { sql as sql3 } from "drizzle-orm";
-import { text as text12, timestamp } from "drizzle-orm/pg-core";
+import { text as text13, timestamp } from "drizzle-orm/pg-core";
 var authMetadata;
 var init_auth_metadata = __esm({
   "src/server/entities/auth-metadata.ts"() {
@@ -5485,9 +5581,9 @@ var init_auth_metadata = __esm({
       "auth_metadata",
       {
         // Metadata key (primary key)
-        key: text12("key").primaryKey(),
+        key: text13("key").primaryKey(),
         // Metadata value
-        value: text12("value").notNull(),
+        value: text13("value").notNull(),
         // Last updated timestamp — stamped by the database on insert and on update
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow().$onUpdate(() => sql3`now()`)
       }
@@ -5496,8 +5592,8 @@ var init_auth_metadata = __esm({
 });
 
 // src/server/entities/ops-tokens.ts
-import { text as text13 } from "drizzle-orm/pg-core";
-import { id as id13, timestamps as timestamps12, utcTimestamp as utcTimestamp9 } from "@spfn/core/db";
+import { text as text14 } from "drizzle-orm/pg-core";
+import { id as id14, timestamps as timestamps13, utcTimestamp as utcTimestamp10 } from "@spfn/core/db";
 var opsTokens;
 var init_ops_tokens = __esm({
   "src/server/entities/ops-tokens.ts"() {
@@ -5506,22 +5602,22 @@ var init_ops_tokens = __esm({
     opsTokens = authSchema.table(
       "ops_tokens",
       {
-        id: id13(),
+        id: id14(),
         // Operator-facing label ("ci-deploy", "rayim-laptop")
-        name: text13("name").notNull(),
+        name: text14("name").notNull(),
         // SHA-256 hex of the token secret. Lookup key — the secret never lands
         // here, and the unique constraint doubles as the lookup index.
-        tokenHash: text13("token_hash").notNull().unique(),
+        tokenHash: text14("token_hash").notNull().unique(),
         // Granted scopes as permission strings ('waitlist:read', ...).
         // '*' grants every scope.
-        scopes: text13("scopes").array().notNull(),
+        scopes: text14("scopes").array().notNull(),
         // null = the token does not expire
-        expiresAt: utcTimestamp9("expires_at"),
+        expiresAt: utcTimestamp10("expires_at"),
         // null = active; a timestamp revokes the token permanently
-        revokedAt: utcTimestamp9("revoked_at"),
+        revokedAt: utcTimestamp10("revoked_at"),
         // Last successful verification, updated fire-and-forget
-        lastUsedAt: utcTimestamp9("last_used_at"),
-        ...timestamps12()
+        lastUsedAt: utcTimestamp10("last_used_at"),
+        ...timestamps13()
       }
     );
   }
@@ -5538,6 +5634,7 @@ var init_entities = __esm({
     init_user_social_accounts();
     init_verification_codes();
     init_signup_link_tokens();
+    init_device_authorizations();
     init_user_invitations();
     init_account_deletion_requests();
     init_roles();
@@ -5564,8 +5661,8 @@ var init_users_repository = __esm({
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5575,8 +5672,8 @@ var init_users_repository = __esm({
        * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
        * 계속 사용할 것.
        */
-      async findByIdOnPrimary(id14) {
-        const result = await this.db.select().from(users).where(eq(users.id, id14)).limit(1);
+      async findByIdOnPrimary(id15) {
+        const result = await this.db.select().from(users).where(eq(users.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5647,13 +5744,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id14) {
+      async findByIdWithRole(id15) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id14)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id15)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -5728,9 +5825,9 @@ var init_users_repository = __esm({
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id14, data) {
+      async updateById(id15, data) {
         const patch = "email" in data ? { ...data, email: normalizeOptionalEmail(data.email) } : data;
-        const result = await this.db.update(users).set(patch).where(eq(users.id, id14)).returning();
+        const result = await this.db.update(users).set(patch).where(eq(users.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5742,10 +5839,10 @@ var init_users_repository = __esm({
        * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
        * Write primary 사용
        */
-      async reactivateFromPendingDeletion(id14) {
+      async reactivateFromPendingDeletion(id15) {
         const result = await this.db.update(users).set({ status: "active" }).where(
           and(
-            eq(users.id, id14),
+            eq(users.id, id15),
             eq(users.status, "pending_deletion")
           )
         ).returning();
@@ -5755,32 +5852,32 @@ var init_users_repository = __esm({
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id14, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id15, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash
         };
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id14)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id14) {
+      async updateLastLogin(id15) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id14)).returning();
+        }).where(eq(users.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id14) {
-        const result = await this.db.delete(users).where(eq(users.id, id14)).returning();
+      async deleteById(id15) {
+        const result = await this.db.delete(users).where(eq(users.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6128,14 +6225,14 @@ var init_keys_repository = __esm({
        * stored, so it answers "since when has this device been on this release"
        * rather than "when was it last seen", which lastUsedAt already answers.
        */
-      async updateLastUsedById(id14, identity) {
+      async updateLastUsedById(id15, identity) {
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
         const lastUsedIsStale = or(
           isNull(userPublicKeys.lastUsedAt),
           lt(userPublicKeys.lastUsedAt, staleBefore)
         );
         if (!identity) {
-          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id14), lastUsedIsStale));
+          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id15), lastUsedIsStale));
           return;
         }
         const identityChanged = sql5`(
@@ -6152,7 +6249,7 @@ var init_keys_repository = __esm({
           clientContractVersion: identity.contractVersion,
           clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
         }).where(and2(
-          eq2(userPublicKeys.id, id14),
+          eq2(userPublicKeys.id, id15),
           or(lastUsedIsStale, identityChanged)
         ));
       }
@@ -6191,8 +6288,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6206,22 +6303,22 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id14) {
+      async markAsUsed(id15) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id14)).returning();
+        }).where(eq3(verificationCodes.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id14) {
-        const code = await this.findById(id14);
+      async incrementAttempts(id15) {
+        const code = await this.findById(id15);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1
-        }).where(eq3(verificationCodes.id, id14)).returning();
+        }).where(eq3(verificationCodes.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6309,14 +6406,14 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request claimed it first
        */
-      async claimLink(id14, setupSecretHash, setupExpiresAt) {
+      async claimLink(id15, setupSecretHash, setupExpiresAt) {
         const result = await this.db.update(signupLinkTokens).set({
           consumedAt: /* @__PURE__ */ new Date(),
           setupSecretHash,
           setupExpiresAt
         }).where(
           and4(
-            eq4(signupLinkTokens.id, id14),
+            eq4(signupLinkTokens.id, id15),
             isNull3(signupLinkTokens.consumedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -6329,10 +6426,10 @@ var init_signup_link_tokens_repository = __esm({
        *
        * @returns the updated row, or null if another request completed it first
        */
-      async claimSetupSession(id14) {
+      async claimSetupSession(id15) {
         const result = await this.db.update(signupLinkTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
           and4(
-            eq4(signupLinkTokens.id, id14),
+            eq4(signupLinkTokens.id, id15),
             isNull3(signupLinkTokens.completedAt),
             isNull3(signupLinkTokens.supersededAt)
           )
@@ -6374,27 +6471,172 @@ var init_signup_link_tokens_repository = __esm({
   }
 });
 
-// src/server/repositories/roles.repository.ts
+// src/server/repositories/device-authorizations.repository.ts
 import { BaseRepository as BaseRepository5 } from "@spfn/core/db";
-import { eq as eq5, asc } from "drizzle-orm";
+import { eq as eq5, and as and5, gt as gt2, inArray, sql as sql6 } from "drizzle-orm";
+var notExpired, DeviceAuthorizationsRepository, deviceAuthorizationsRepository;
+var init_device_authorizations_repository = __esm({
+  "src/server/repositories/device-authorizations.repository.ts"() {
+    "use strict";
+    init_device_authorizations();
+    notExpired = () => gt2(deviceAuthorizations.expiresAt, sql6`now()`);
+    DeviceAuthorizationsRepository = class extends BaseRepository5 {
+      /**
+       * Insert a pending authorization, unless one of its codes is already taken.
+       *
+       * `onConflictDoNothing` rather than letting the unique index raise: the start
+       * route runs inside a transaction, and a raised unique violation aborts it,
+       * so the retry that a generated-code collision calls for could not run — every
+       * statement after it would fail with "current transaction is aborted" instead.
+       * An empty result is the collision signal, and the caller draws a fresh code.
+       *
+       * Write primary.
+       *
+       * @returns the inserted row, or null if either code collided
+       */
+      async create(data) {
+        const result = await this.db.insert(deviceAuthorizations).values(data).onConflictDoNothing().returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Find a record by its normalized user code, in any state.
+       *
+       * Deliberately unfiltered: which refusal a caller is owed — expired, already
+       * handled, unknown — is the service's decision, and a row filtered out here
+       * would be indistinguishable from a code that was never issued.
+       *
+       * Read replica.
+       */
+      async findByUserCode(userCode) {
+        const result = await this.readDb.select().from(deviceAuthorizations).where(eq5(deviceAuthorizations.userCode, userCode)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Find a record by the hash of a device code, in any state.
+       * Unfiltered for the same reason as `findByUserCode`.
+       *
+       * Read replica.
+       */
+      async findByDeviceCodeHash(deviceCodeHash) {
+        const result = await this.readDb.select().from(deviceAuthorizations).where(eq5(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Bind the approving user and move the record to `approved`, but only from
+       * `pending`.
+       *
+       * `userId` comes from the approver's authenticated session — never from a
+       * request body — so this is the point where the record gains an owner.
+       *
+       * @returns the updated row, or null if it was no longer pending, or expired
+       */
+      async approve(id15, userId) {
+        const result = await this.db.update(deviceAuthorizations).set({ status: "approved", userId, approvedAt: /* @__PURE__ */ new Date() }).where(
+          and5(
+            eq5(deviceAuthorizations.id, id15),
+            eq5(deviceAuthorizations.status, "pending"),
+            notExpired()
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Move the record to `denied`, but only from `pending`.
+       *
+       * No user is bound: a refusal should leave no record of who was asked.
+       *
+       * @returns the updated row, or null if it was no longer pending, or expired
+       */
+      async deny(id15) {
+        const result = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
+          and5(
+            eq5(deviceAuthorizations.id, id15),
+            eq5(deviceAuthorizations.status, "pending"),
+            notExpired()
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Refuse every authorization a user still has in flight.
+       *
+       * This is the device-code half of a global revocation. Revoking
+       * `user_public_keys` alone leaves an approved-but-uncollected record behind,
+       * and the next poll on it registers a brand-new active key — so "sign every
+       * device out" would hand one straight back to whoever was still waiting,
+       * which is exactly the person a revoke-all is usually aimed at.
+       *
+       * `denied` rather than a status of its own: a swept record owes its holder
+       * the answer a refused one owes, on all four operations — the waiting device
+       * is told no and stops polling, and info/approve/deny say the request was
+       * already answered. Adding a fourth live status would add a migration and a
+       * case-table row to record a distinction nothing acts on.
+       *
+       * Expired rows are swept too. A global revoke is not the place to reason
+       * about which dead rows were about to die anyway.
+       *
+       * `pending` alongside `approved` even though a pending row carries no
+       * `userId` today, so only approved rows can match: the state list says which
+       * states this is meant to close, and a later change that binds the user
+       * earlier should not silently reopen the hole.
+       *
+       * @returns the rows this call refused
+       */
+      async denyAllActiveByUserId(userId) {
+        return await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
+          and5(
+            eq5(deviceAuthorizations.userId, userId),
+            inArray(deviceAuthorizations.status, ["pending", "approved"])
+          )
+        ).returning();
+      }
+      /**
+       * Spend an approved record, but only from `approved`, and address it by the
+       * device code hash the caller actually presented.
+       *
+       * This is the one-shot: the winner of two concurrent polls registers the key,
+       * and the loser sees no approved record and is answered as if the code were
+       * unknown. Matching on the hash rather than on an id read a moment ago keeps
+       * the whole decision in one statement.
+       *
+       * @returns the spent row, or null if it was not approved (any more), or expired
+       */
+      async consumeApproved(deviceCodeHash) {
+        const result = await this.db.update(deviceAuthorizations).set({ status: "consumed", consumedAt: /* @__PURE__ */ new Date() }).where(
+          and5(
+            eq5(deviceAuthorizations.deviceCodeHash, deviceCodeHash),
+            eq5(deviceAuthorizations.status, "approved"),
+            notExpired()
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+    };
+    deviceAuthorizationsRepository = new DeviceAuthorizationsRepository();
+  }
+});
+
+// src/server/repositories/roles.repository.ts
+import { BaseRepository as BaseRepository6 } from "@spfn/core/db";
+import { eq as eq6, asc } from "drizzle-orm";
 var RolesRepository, rolesRepository;
 var init_roles_repository = __esm({
   "src/server/repositories/roles.repository.ts"() {
     "use strict";
     init_roles();
-    RolesRepository = class extends BaseRepository5 {
+    RolesRepository = class extends BaseRepository6 {
       /**
        * ID로 역할 조회
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(roles).where(eq5(roles.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(roles).where(eq6(roles.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 역할 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(roles).where(eq5(roles.name, name)).limit(1);
+        const result = await this.readDb.select().from(roles).where(eq6(roles.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6407,7 +6649,7 @@ var init_roles_repository = __esm({
        * 활성 역할만 조회
        */
       async findActive() {
-        return this.readDb.select().from(roles).where(eq5(roles.isActive, true)).orderBy(asc(roles.priority));
+        return this.readDb.select().from(roles).where(eq6(roles.isActive, true)).orderBy(asc(roles.priority));
       }
       /**
        * 역할 생성
@@ -6418,15 +6660,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id14, data) {
-        const result = await this.db.update(roles).set(data).where(eq5(roles.id, id14)).returning();
+      async updateById(id15, data) {
+        const result = await this.db.update(roles).set(data).where(eq6(roles.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id14) {
-        const result = await this.db.delete(roles).where(eq5(roles.id, id14)).returning();
+      async deleteById(id15) {
+        const result = await this.db.delete(roles).where(eq6(roles.id, id15)).returning();
         return result[0] ?? null;
       }
     };
@@ -6435,26 +6677,26 @@ var init_roles_repository = __esm({
 });
 
 // src/server/repositories/permissions.repository.ts
-import { BaseRepository as BaseRepository6 } from "@spfn/core/db";
-import { asc as asc2, eq as eq6, inArray } from "drizzle-orm";
+import { BaseRepository as BaseRepository7 } from "@spfn/core/db";
+import { asc as asc2, eq as eq7, inArray as inArray2 } from "drizzle-orm";
 var PermissionsRepository, permissionsRepository;
 var init_permissions_repository = __esm({
   "src/server/repositories/permissions.repository.ts"() {
     "use strict";
     init_permissions();
-    PermissionsRepository = class extends BaseRepository6 {
+    PermissionsRepository = class extends BaseRepository7 {
       /**
        * ID로 권한 조회
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(permissions).where(eq6(permissions.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(permissions).where(eq7(permissions.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 권한 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(permissions).where(eq6(permissions.name, name)).limit(1);
+        const result = await this.readDb.select().from(permissions).where(eq7(permissions.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6462,7 +6704,7 @@ var init_permissions_repository = __esm({
        */
       async findByNames(names) {
         if (names.length === 0) return [];
-        return this.readDb.select().from(permissions).where(inArray(permissions.name, names));
+        return this.readDb.select().from(permissions).where(inArray2(permissions.name, names));
       }
       /**
        * 모든 권한 조회
@@ -6474,13 +6716,13 @@ var init_permissions_repository = __esm({
        * 활성 권한만 조회
        */
       async findActive() {
-        return this.readDb.select().from(permissions).where(eq6(permissions.isActive, true)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq7(permissions.isActive, true)).orderBy(asc2(permissions.name));
       }
       /**
        * 카테고리별 권한 조회
        */
       async findByCategory(category) {
-        return this.readDb.select().from(permissions).where(eq6(permissions.category, category)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq7(permissions.category, category)).orderBy(asc2(permissions.name));
       }
       /**
        * 권한 생성
@@ -6498,15 +6740,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id14, data) {
-        const result = await this.db.update(permissions).set(data).where(eq6(permissions.id, id14)).returning();
+      async updateById(id15, data) {
+        const result = await this.db.update(permissions).set(data).where(eq7(permissions.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id14) {
-        const result = await this.db.delete(permissions).where(eq6(permissions.id, id14)).returning();
+      async deleteById(id15) {
+        const result = await this.db.delete(permissions).where(eq7(permissions.id, id15)).returning();
         return result[0] ?? null;
       }
     };
@@ -6515,25 +6757,25 @@ var init_permissions_repository = __esm({
 });
 
 // src/server/repositories/role-permissions.repository.ts
-import { BaseRepository as BaseRepository7 } from "@spfn/core/db";
-import { and as and5, eq as eq7 } from "drizzle-orm";
+import { BaseRepository as BaseRepository8 } from "@spfn/core/db";
+import { and as and6, eq as eq8 } from "drizzle-orm";
 var RolePermissionsRepository, rolePermissionsRepository;
 var init_role_permissions_repository = __esm({
   "src/server/repositories/role-permissions.repository.ts"() {
     "use strict";
     init_role_permissions();
-    RolePermissionsRepository = class extends BaseRepository7 {
+    RolePermissionsRepository = class extends BaseRepository8 {
       /**
        * 역할 ID로 모든 권한 조회
        */
       async findByRoleId(roleId) {
-        return this.readDb.select().from(rolePermissions).where(eq7(rolePermissions.roleId, roleId));
+        return this.readDb.select().from(rolePermissions).where(eq8(rolePermissions.roleId, roleId));
       }
       /**
        * 권한 ID로 모든 역할 조회
        */
       async findByPermissionId(permissionId) {
-        return this.readDb.select().from(rolePermissions).where(eq7(rolePermissions.permissionId, permissionId));
+        return this.readDb.select().from(rolePermissions).where(eq8(rolePermissions.permissionId, permissionId));
       }
       /**
        * 역할-권한 매핑 생성
@@ -6553,9 +6795,9 @@ var init_role_permissions_repository = __esm({
        */
       async deleteByRoleIdAndPermissionId(roleId, permissionId) {
         const result = await this.db.delete(rolePermissions).where(
-          and5(
-            eq7(rolePermissions.roleId, roleId),
-            eq7(rolePermissions.permissionId, permissionId)
+          and6(
+            eq8(rolePermissions.roleId, roleId),
+            eq8(rolePermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -6564,7 +6806,7 @@ var init_role_permissions_repository = __esm({
        * 역할의 모든 권한 매핑 삭제
        */
       async deleteByRoleId(roleId) {
-        const result = await this.db.delete(rolePermissions).where(eq7(rolePermissions.roleId, roleId)).returning();
+        const result = await this.db.delete(rolePermissions).where(eq8(rolePermissions.roleId, roleId)).returning();
         return result.length;
       }
       /**
@@ -6585,19 +6827,19 @@ var init_role_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-permissions.repository.ts
-import { BaseRepository as BaseRepository8 } from "@spfn/core/db";
-import { eq as eq8, and as and6, or as or2, isNull as isNull4, isNotNull, lt as lt3, gt as gt2 } from "drizzle-orm";
+import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
+import { eq as eq9, and as and7, or as or2, isNull as isNull4, isNotNull, lt as lt3, gt as gt3 } from "drizzle-orm";
 var UserPermissionsRepository, userPermissionsRepository;
 var init_user_permissions_repository = __esm({
   "src/server/repositories/user-permissions.repository.ts"() {
     "use strict";
     init_user_permissions();
-    UserPermissionsRepository = class extends BaseRepository8 {
+    UserPermissionsRepository = class extends BaseRepository9 {
       /**
        * 사용자 ID로 모든 권한 오버라이드 조회
        */
       async findByUserId(userId) {
-        return this.readDb.select().from(userPermissions).where(eq8(userPermissions.userId, userId));
+        return this.readDb.select().from(userPermissions).where(eq9(userPermissions.userId, userId));
       }
       /**
        * 사용자 ID로 유효한 권한 오버라이드만 조회
@@ -6606,11 +6848,11 @@ var init_user_permissions_repository = __esm({
       async findValidByUserId(userId) {
         const now = /* @__PURE__ */ new Date();
         return this.readDb.select().from(userPermissions).where(
-          and6(
-            eq8(userPermissions.userId, userId),
+          and7(
+            eq9(userPermissions.userId, userId),
             or2(
               isNull4(userPermissions.expiresAt),
-              gt2(userPermissions.expiresAt, now)
+              gt3(userPermissions.expiresAt, now)
             )
           )
         );
@@ -6620,9 +6862,9 @@ var init_user_permissions_repository = __esm({
        */
       async findByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.readDb.select().from(userPermissions).where(
-          and6(
-            eq8(userPermissions.userId, userId),
-            eq8(userPermissions.permissionId, permissionId)
+          and7(
+            eq9(userPermissions.userId, userId),
+            eq9(userPermissions.permissionId, permissionId)
           )
         ).limit(1);
         return result[0] ?? null;
@@ -6636,8 +6878,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id14, data) {
-        const result = await this.db.update(userPermissions).set(data).where(eq8(userPermissions.id, id14)).returning();
+      async updateById(id15, data) {
+        const result = await this.db.update(userPermissions).set(data).where(eq9(userPermissions.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6645,9 +6887,9 @@ var init_user_permissions_repository = __esm({
        */
       async deleteByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.db.delete(userPermissions).where(
-          and6(
-            eq8(userPermissions.userId, userId),
-            eq8(userPermissions.permissionId, permissionId)
+          and7(
+            eq9(userPermissions.userId, userId),
+            eq9(userPermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -6656,7 +6898,7 @@ var init_user_permissions_repository = __esm({
        * 사용자의 모든 권한 오버라이드 삭제
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userPermissions).where(eq8(userPermissions.userId, userId)).returning();
+        const result = await this.db.delete(userPermissions).where(eq9(userPermissions.userId, userId)).returning();
         return result.length;
       }
       /**
@@ -6665,7 +6907,7 @@ var init_user_permissions_repository = __esm({
       async deleteExpired() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.delete(userPermissions).where(
-          and6(
+          and7(
             isNotNull(userPermissions.expiresAt),
             lt3(userPermissions.expiresAt, now)
           )
@@ -6678,33 +6920,33 @@ var init_user_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-profiles.repository.ts
-import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
-import { eq as eq9 } from "drizzle-orm";
+import { BaseRepository as BaseRepository10 } from "@spfn/core/db";
+import { eq as eq10 } from "drizzle-orm";
 var UserProfilesRepository, userProfilesRepository;
 var init_user_profiles_repository = __esm({
   "src/server/repositories/user-profiles.repository.ts"() {
     "use strict";
     init_user_profiles();
-    UserProfilesRepository = class extends BaseRepository9 {
+    UserProfilesRepository = class extends BaseRepository10 {
       /**
        * ID로 프로필 조회
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(userProfiles).where(eq9(userProfiles.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(userProfiles).where(eq10(userProfiles.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
        * User ID로 locale만 조회 (경량)
        */
       async findLocaleByUserId(userId) {
-        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq9(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq10(userProfiles.userId, userId)).limit(1);
         return result[0]?.locale || "en";
       }
       /**
        * User ID로 프로필 조회
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userProfiles).where(eq9(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select().from(userProfiles).where(eq10(userProfiles.userId, userId)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6716,29 +6958,29 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id14, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq9(userProfiles.id, id14)).returning();
+      async updateById(id15, data) {
+        const result = await this.db.update(userProfiles).set(data).where(eq10(userProfiles.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 업데이트 (by User ID)
        */
       async updateByUserId(userId, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq9(userProfiles.userId, userId)).returning();
+        const result = await this.db.update(userProfiles).set(data).where(eq10(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id14) {
-        const result = await this.db.delete(userProfiles).where(eq9(userProfiles.id, id14)).returning();
+      async deleteById(id15) {
+        const result = await this.db.delete(userProfiles).where(eq10(userProfiles.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by User ID)
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userProfiles).where(eq9(userProfiles.userId, userId)).returning();
+        const result = await this.db.delete(userProfiles).where(eq10(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6780,7 +7022,7 @@ var init_user_profiles_repository = __esm({
           metadata: userProfiles.metadata,
           createdAt: userProfiles.createdAt,
           updatedAt: userProfiles.updatedAt
-        }).from(userProfiles).where(eq9(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
+        }).from(userProfiles).where(eq10(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
         if (!profile) {
           return null;
         }
@@ -6808,8 +7050,8 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq10, and as and7, lt as lt4, desc as desc2, sql as sql6 } from "drizzle-orm";
-import { BaseRepository as BaseRepository10 } from "@spfn/core/db";
+import { eq as eq11, and as and8, lt as lt4, desc as desc2, sql as sql7 } from "drizzle-orm";
+import { BaseRepository as BaseRepository11 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
   "src/server/repositories/invitations.repository.ts"() {
@@ -6818,19 +7060,19 @@ var init_invitations_repository = __esm({
     init_roles();
     init_user_invitations();
     init_email();
-    InvitationsRepository = class extends BaseRepository10 {
+    InvitationsRepository = class extends BaseRepository11 {
       /**
        * ID로 초대 조회
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(userInvitations).where(eq10(userInvitations.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(userInvitations).where(eq11(userInvitations.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Token으로 초대 조회
        */
       async findByToken(token) {
-        const result = await this.readDb.select().from(userInvitations).where(eq10(userInvitations.token, token)).limit(1);
+        const result = await this.readDb.select().from(userInvitations).where(eq11(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6838,9 +7080,9 @@ var init_invitations_repository = __esm({
        */
       async findPendingByEmail(email) {
         const result = await this.readDb.select().from(userInvitations).where(
-          and7(
-            eq10(userInvitations.email, normalizeEmail(email)),
-            eq10(userInvitations.status, "pending")
+          and8(
+            eq11(userInvitations.email, normalizeEmail(email)),
+            eq11(userInvitations.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -6849,13 +7091,13 @@ var init_invitations_repository = __esm({
        * 초대자 ID로 모든 초대 조회
        */
       async findByInvitedBy(invitedBy) {
-        return this.readDb.select().from(userInvitations).where(eq10(userInvitations.invitedBy, invitedBy));
+        return this.readDb.select().from(userInvitations).where(eq11(userInvitations.invitedBy, invitedBy));
       }
       /**
        * 상태별 초대 조회
        */
       async findByStatus(status) {
-        return this.readDb.select().from(userInvitations).where(eq10(userInvitations.status, status));
+        return this.readDb.select().from(userInvitations).where(eq11(userInvitations.status, status));
       }
       /**
        * 초대 생성
@@ -6866,7 +7108,7 @@ var init_invitations_repository = __esm({
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id14, status, timestamp2) {
+      async updateStatus(id15, status, timestamp2) {
         const updates = {
           status
         };
@@ -6877,14 +7119,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq10(userInvitations.id, id14)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq11(userInvitations.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id14) {
-        const result = await this.db.delete(userInvitations).where(eq10(userInvitations.id, id14)).returning();
+      async deleteById(id15) {
+        const result = await this.db.delete(userInvitations).where(eq11(userInvitations.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6893,8 +7135,8 @@ var init_invitations_repository = __esm({
       async updateExpiredInvitations() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.update(userInvitations).set({ status: "expired" }).where(
-          and7(
-            eq10(userInvitations.status, "pending"),
+          and8(
+            eq11(userInvitations.status, "pending"),
             lt4(userInvitations.expiresAt, now)
           )
         ).returning();
@@ -6926,7 +7168,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq10(userInvitations.roleId, roles.id)).innerJoin(users, eq10(userInvitations.invitedBy, users.id)).where(eq10(userInvitations.token, token)).limit(1);
+        }).from(userInvitations).innerJoin(roles, eq11(userInvitations.roleId, roles.id)).innerJoin(users, eq11(userInvitations.invitedBy, users.id)).where(eq11(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6937,13 +7179,13 @@ var init_invitations_repository = __esm({
         const offset = (page - 1) * limit;
         const conditions = [];
         if (status) {
-          conditions.push(eq10(userInvitations.status, status));
+          conditions.push(eq11(userInvitations.status, status));
         }
         if (invitedBy) {
-          conditions.push(eq10(userInvitations.invitedBy, invitedBy));
+          conditions.push(eq11(userInvitations.invitedBy, invitedBy));
         }
-        const whereClause = conditions.length > 0 ? and7(...conditions) : void 0;
-        const countResult = await this.readDb.select({ count: sql6`count(*)` }).from(userInvitations).where(whereClause);
+        const whereClause = conditions.length > 0 ? and8(...conditions) : void 0;
+        const countResult = await this.readDb.select({ count: sql7`count(*)` }).from(userInvitations).where(whereClause);
         const total = Number(countResult[0]?.count || 0);
         const results = await this.readDb.select({
           id: userInvitations.id,
@@ -6967,7 +7209,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq10(userInvitations.roleId, roles.id)).innerJoin(users, eq10(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc2(userInvitations.createdAt)).limit(limit).offset(offset);
+        }).from(userInvitations).innerJoin(roles, eq11(userInvitations.roleId, roles.id)).innerJoin(users, eq11(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc2(userInvitations.createdAt)).limit(limit).offset(offset);
         return {
           invitations: results,
           total,
@@ -6979,31 +7221,31 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id14, data) {
+      async updateById(id15, data) {
         const patch = "email" in data && typeof data.email === "string" ? { ...data, email: normalizeEmail(data.email) } : data;
-        const result = await this.db.update(userInvitations).set(patch).where(eq10(userInvitations.id, id14)).returning();
+        const result = await this.db.update(userInvitations).set(patch).where(eq11(userInvitations.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id14, newExpiresAt) {
+      async resend(id15, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt
-        }).where(eq10(userInvitations.id, id14)).returning();
+        }).where(eq11(userInvitations.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id14, cancelledBy, reason, currentMetadata) {
+      async cancel(id15, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata
-        }).where(eq10(userInvitations.id, id14)).returning();
+        }).where(eq11(userInvitations.id, id15)).returning();
         return result[0] ?? null;
       }
     };
@@ -7090,6 +7332,15 @@ var init_schema5 = __esm({
           examples: [true, false]
         })
       },
+      SPFN_AUTH_CSRF: {
+        ...envString({
+          description: 'CSRF protection for cookie-session mutations in the Next.js proxy: off | warn | enforce. Unset behaves as "warn" (log what would be refused, allow it through). configureAuth({ csrf: { mode } }) takes precedence.',
+          required: false,
+          nextjs: true,
+          // The check runs in the Next.js proxy
+          examples: ["enforce", "warn", "off"]
+        })
+      },
       SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
         ...envNumber({
           description: "Bcrypt salt rounds (cost factor, higher = more secure but slower)",
@@ -7317,7 +7568,7 @@ var init_schema5 = __esm({
       },
       SPFN_AUTH_GOOGLE_REDIRECT_URI: {
         ...envString({
-          description: "Google OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/google/callback \u2014 the callback must return to the web app origin that set the oauth_csrf cookie (the app rewrites /_auth/:path* to the API). Set this explicitly only when the callback should hit a different host (e.g. the API host for the direct oauthStart flow).",
+          description: "Google OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/google/callback. The override must stay on the web app origin at this exact path \u2014 the CSRF cookie for the callback is host-only and the app rewrites /_auth/:path* to the API, so a callback that lands anywhere else is refused for CSRF. Checked at boot: a value off the web app origin or off the callback path refuses to start. The one case for an override elsewhere is the direct POST /_auth/oauth/start flow on a split deployment (no Next.js interceptor, so its CSRF cookie is on the API host), which also needs SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK=off.",
           required: false,
           examples: [
             "https://app.example.com/_auth/oauth/google/callback",
@@ -7360,7 +7611,7 @@ var init_schema5 = __esm({
       },
       SPFN_AUTH_KAKAO_REDIRECT_URI: {
         ...envString({
-          description: "Kakao OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/kakao/callback.",
+          description: "Kakao OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/kakao/callback. The override must stay on the web app origin at this exact path \u2014 the CSRF cookie for the callback is host-only and the app rewrites /_auth/:path* to the API, so a callback that lands anywhere else is refused for CSRF. Checked at boot: a value off the web app origin or off the callback path refuses to start. The one case for an override elsewhere is the direct POST /_auth/oauth/start flow on a split deployment (no Next.js interceptor, so its CSRF cookie is on the API host), which also needs SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK=off.",
           required: false,
           examples: ["https://app.example.com/_auth/oauth/kakao/callback"]
         })
@@ -7385,7 +7636,7 @@ var init_schema5 = __esm({
       },
       SPFN_AUTH_NAVER_REDIRECT_URI: {
         ...envString({
-          description: "Naver OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/naver/callback.",
+          description: "Naver OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/naver/callback. The override must stay on the web app origin at this exact path \u2014 the CSRF cookie for the callback is host-only and the app rewrites /_auth/:path* to the API, so a callback that lands anywhere else is refused for CSRF. Checked at boot: a value off the web app origin or off the callback path refuses to start. The one case for an override elsewhere is the direct POST /_auth/oauth/start flow on a split deployment (no Next.js interceptor, so its CSRF cookie is on the API host), which also needs SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK=off.",
           required: false,
           examples: ["https://app.example.com/_auth/oauth/naver/callback"]
         })
@@ -7417,11 +7668,18 @@ var init_schema5 = __esm({
       },
       SPFN_AUTH_GITHUB_REDIRECT_URI: {
         ...envString({
-          description: "GitHub OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/github/callback.",
+          description: "GitHub OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/github/callback. The override must stay on the web app origin at this exact path \u2014 the CSRF cookie for the callback is host-only and the app rewrites /_auth/:path* to the API, so a callback that lands anywhere else is refused for CSRF. Checked at boot: a value off the web app origin or off the callback path refuses to start. The one case for an override elsewhere is the direct POST /_auth/oauth/start flow on a split deployment (no Next.js interceptor, so its CSRF cookie is on the API host), which also needs SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK=off.",
           required: false,
           examples: ["https://app.example.com/_auth/oauth/github/callback"]
         })
       },
+      SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK: {
+        ...envString({
+          description: 'Boot-time check of the four SPFN_AUTH_<PROVIDER>_REDIRECT_URI overrides: each one that is set must sit on the web app origin ({NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}) at /_auth/oauth/<provider>/callback, because the callback CSRF cookie is host-only. "off" is the only value that disables the check \u2014 unset, "on" and anything else all run it.',
+          required: false,
+          examples: ["off"]
+        })
+      },
       // ============================================================================
       // Native Social Login (mobile/web id_token verification)
       //
@@ -7650,15 +7908,15 @@ var init_token_cipher = __esm({
 });
 
 // src/server/repositories/social-accounts.repository.ts
-import { eq as eq11, and as and8 } from "drizzle-orm";
-import { BaseRepository as BaseRepository11 } from "@spfn/core/db";
+import { eq as eq12, and as and9 } from "drizzle-orm";
+import { BaseRepository as BaseRepository12 } from "@spfn/core/db";
 var SocialAccountsRepository, socialAccountsRepository;
 var init_social_accounts_repository = __esm({
   "src/server/repositories/social-accounts.repository.ts"() {
     "use strict";
     init_entities();
     init_token_cipher();
-    SocialAccountsRepository = class extends BaseRepository11 {
+    SocialAccountsRepository = class extends BaseRepository12 {
       /**
        * 저장 row 의 토큰을 평문으로 복호화해 반환한다.
        *
@@ -7686,10 +7944,10 @@ var init_social_accounts_repository = __esm({
             if (refresh?.needsRotation) {
               heal.refreshToken = await encryptToken(refresh.value, context("refresh"));
             }
-            await this.db.update(userSocialAccounts).set(heal).where(and8(
-              eq11(userSocialAccounts.id, account.id),
-              access?.needsRotation && account.accessToken !== null ? eq11(userSocialAccounts.accessToken, account.accessToken) : void 0,
-              refresh?.needsRotation && account.refreshToken !== null ? eq11(userSocialAccounts.refreshToken, account.refreshToken) : void 0
+            await this.db.update(userSocialAccounts).set(heal).where(and9(
+              eq12(userSocialAccounts.id, account.id),
+              access?.needsRotation && account.accessToken !== null ? eq12(userSocialAccounts.accessToken, account.accessToken) : void 0,
+              refresh?.needsRotation && account.refreshToken !== null ? eq12(userSocialAccounts.refreshToken, account.refreshToken) : void 0
             ));
           } catch {
           }
@@ -7706,9 +7964,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByProviderAndProviderId(provider, providerUserId) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and8(
-            eq11(userSocialAccounts.provider, provider),
-            eq11(userSocialAccounts.providerUserId, providerUserId)
+          and9(
+            eq12(userSocialAccounts.provider, provider),
+            eq12(userSocialAccounts.providerUserId, providerUserId)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -7718,7 +7976,7 @@ var init_social_accounts_repository = __esm({
        * Read replica 사용
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userSocialAccounts).where(eq11(userSocialAccounts.userId, userId));
+        const result = await this.readDb.select().from(userSocialAccounts).where(eq12(userSocialAccounts.userId, userId));
         return Promise.all(result.map((account) => this.decryptAccount(account)));
       }
       /**
@@ -7727,9 +7985,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByUserIdAndProvider(userId, provider) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and8(
-            eq11(userSocialAccounts.userId, userId),
-            eq11(userSocialAccounts.provider, provider)
+          and9(
+            eq12(userSocialAccounts.userId, userId),
+            eq12(userSocialAccounts.provider, provider)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -7755,11 +8013,11 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id14, data) {
+      async updateTokens(id15, data) {
         const accounts = await this.db.select({
           provider: userSocialAccounts.provider,
           providerUserId: userSocialAccounts.providerUserId
-        }).from(userSocialAccounts).where(eq11(userSocialAccounts.id, id14)).limit(1);
+        }).from(userSocialAccounts).where(eq12(userSocialAccounts.id, id15)).limit(1);
         const account = accounts[0];
         if (!account) {
           return null;
@@ -7773,15 +8031,15 @@ var init_social_accounts_repository = __esm({
           ...data,
           accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
           refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken
-        }).where(eq11(userSocialAccounts.id, id14)).returning();
+        }).where(eq12(userSocialAccounts.id, id15)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id14) {
-        const result = await this.db.delete(userSocialAccounts).where(eq11(userSocialAccounts.id, id14)).returning();
+      async deleteById(id15) {
+        const result = await this.db.delete(userSocialAccounts).where(eq12(userSocialAccounts.id, id15)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7790,9 +8048,9 @@ var init_social_accounts_repository = __esm({
        */
       async deleteByUserIdAndProvider(userId, provider) {
         const result = await this.db.delete(userSocialAccounts).where(
-          and8(
-            eq11(userSocialAccounts.userId, userId),
-            eq11(userSocialAccounts.provider, provider)
+          and9(
+            eq12(userSocialAccounts.userId, userId),
+            eq12(userSocialAccounts.provider, provider)
           )
         ).returning();
         return result[0] ?? null;
@@ -7805,7 +8063,7 @@ var init_social_accounts_repository = __esm({
        * Write primary 사용
        */
       async deleteAllByUserId(userId) {
-        const result = await this.db.delete(userSocialAccounts).where(eq11(userSocialAccounts.userId, userId)).returning();
+        const result = await this.db.delete(userSocialAccounts).where(eq12(userSocialAccounts.userId, userId)).returning();
         return result.length;
       }
     };
@@ -7814,19 +8072,19 @@ var init_social_accounts_repository = __esm({
 });
 
 // src/server/repositories/auth-metadata.repository.ts
-import { BaseRepository as BaseRepository12 } from "@spfn/core/db";
-import { eq as eq12 } from "drizzle-orm";
+import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
+import { eq as eq13 } from "drizzle-orm";
 var AuthMetadataRepository, authMetadataRepository;
 var init_auth_metadata_repository = __esm({
   "src/server/repositories/auth-metadata.repository.ts"() {
     "use strict";
     init_auth_metadata();
-    AuthMetadataRepository = class extends BaseRepository12 {
+    AuthMetadataRepository = class extends BaseRepository13 {
       /**
        * 키로 값 조회
        */
       async get(key) {
-        const result = await this.readDb.select().from(authMetadata).where(eq12(authMetadata.key, key)).limit(1);
+        const result = await this.readDb.select().from(authMetadata).where(eq13(authMetadata.key, key)).limit(1);
         return result[0]?.value ?? null;
       }
       /**
@@ -7849,20 +8107,20 @@ var init_auth_metadata_repository = __esm({
 });
 
 // src/server/repositories/account-deletion-requests.repository.ts
-import { eq as eq13, and as and9, lte } from "drizzle-orm";
-import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
+import { eq as eq14, and as and10, lte } from "drizzle-orm";
+import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
 var AccountDeletionRequestsRepository, accountDeletionRequestsRepository;
 var init_account_deletion_requests_repository = __esm({
   "src/server/repositories/account-deletion-requests.repository.ts"() {
     "use strict";
     init_account_deletion_requests();
-    AccountDeletionRequestsRepository = class extends BaseRepository13 {
+    AccountDeletionRequestsRepository = class extends BaseRepository14 {
       /**
        * ID로 요청 조회
        * Read replica 사용
        */
-      async findById(id14) {
-        const result = await this.readDb.select().from(accountDeletionRequests).where(eq13(accountDeletionRequests.id, id14)).limit(1);
+      async findById(id15) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq14(accountDeletionRequests.id, id15)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7871,9 +8129,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserId(userId) {
         const result = await this.readDb.select().from(accountDeletionRequests).where(
-          and9(
-            eq13(accountDeletionRequests.userId, userId),
-            eq13(accountDeletionRequests.status, "pending")
+          and10(
+            eq14(accountDeletionRequests.userId, userId),
+            eq14(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -7887,9 +8145,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserIdOnPrimary(userId) {
         const result = await this.db.select().from(accountDeletionRequests).where(
-          and9(
-            eq13(accountDeletionRequests.userId, userId),
-            eq13(accountDeletionRequests.status, "pending")
+          and10(
+            eq14(accountDeletionRequests.userId, userId),
+            eq14(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -7900,8 +8158,8 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findDueForPurge(now) {
         return this.readDb.select().from(accountDeletionRequests).where(
-          and9(
-            eq13(accountDeletionRequests.status, "pending"),
+          and10(
+            eq14(accountDeletionRequests.status, "pending"),
             lte(accountDeletionRequests.purgeScheduledAt, now)
           )
         );
@@ -7921,14 +8179,14 @@ var init_account_deletion_requests_repository = __esm({
        * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCancelled(id14) {
+      async markCancelled(id15) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date()
         }).where(
-          and9(
-            eq13(accountDeletionRequests.id, id14),
-            eq13(accountDeletionRequests.status, "pending")
+          and10(
+            eq14(accountDeletionRequests.id, id15),
+            eq14(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -7943,15 +8201,15 @@ var init_account_deletion_requests_repository = __esm({
        * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCompleted(id14, purgeStrategy) {
+      async markCompleted(id15, purgeStrategy) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "completed",
           completedAt: /* @__PURE__ */ new Date(),
           purgeStrategy
         }).where(
-          and9(
-            eq13(accountDeletionRequests.id, id14),
-            eq13(accountDeletionRequests.status, "pending")
+          and10(
+            eq14(accountDeletionRequests.id, id15),
+            eq14(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -7962,14 +8220,14 @@ var init_account_deletion_requests_repository = __esm({
 });
 
 // src/server/repositories/ops-tokens.repository.ts
-import { and as and10, desc as desc3, eq as eq14, isNull as isNull5 } from "drizzle-orm";
-import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
+import { and as and11, desc as desc3, eq as eq15, isNull as isNull5 } from "drizzle-orm";
+import { BaseRepository as BaseRepository15 } from "@spfn/core/db";
 var OpsTokensRepository, opsTokensRepository;
 var init_ops_tokens_repository = __esm({
   "src/server/repositories/ops-tokens.repository.ts"() {
     "use strict";
     init_ops_tokens();
-    OpsTokensRepository = class extends BaseRepository14 {
+    OpsTokensRepository = class extends BaseRepository15 {
       /**
        * Lookup by the secret's hash — the verification path.
        *
@@ -7979,7 +8237,7 @@ var init_ops_tokens_repository = __esm({
        * and revocation is documented as taking effect immediately.
        */
       async findByTokenHash(tokenHash) {
-        const result = await this.db.select().from(opsTokens).where(eq14(opsTokens.tokenHash, tokenHash)).limit(1);
+        const result = await this.db.select().from(opsTokens).where(eq15(opsTokens.tokenHash, tokenHash)).limit(1);
         return result[0] ?? null;
       }
       async create(data) {
@@ -7994,13 +8252,13 @@ var init_ops_tokens_repository = __esm({
        * token is already revoked — the first revocation's timestamp is never
        * overwritten.
        */
-      async revokeById(id14) {
-        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and10(eq14(opsTokens.id, id14), isNull5(opsTokens.revokedAt))).returning();
+      async revokeById(id15) {
+        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and11(eq15(opsTokens.id, id15), isNull5(opsTokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path. */
-      async updateLastUsedById(id14) {
-        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq14(opsTokens.id, id14));
+      async updateLastUsedById(id15) {
+        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq15(opsTokens.id, id15));
       }
     };
     opsTokensRepository = new OpsTokensRepository();
@@ -8015,6 +8273,7 @@ var init_repositories = __esm({
     init_keys_repository();
     init_verification_codes_repository();
     init_signup_link_tokens_repository();
+    init_device_authorizations_repository();
     init_roles_repository();
     init_permissions_repository();
     init_role_permissions_repository();
@@ -8116,7 +8375,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id14) => Number(id14));
+  const permissionIdNums = permissionIds.map((id15) => Number(id15));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -8136,7 +8395,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id14) => permissionsRepository.findById(id14))
+    permissionIds.map((id15) => permissionsRepository.findById(id15))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -8222,6 +8481,7 @@ function validatePasswordStrength(password) {
 import jwt from "jsonwebtoken";
 import crypto2 from "crypto";
 import { env as env2 } from "@spfn/auth/config";
+import { KeyAlgorithmMismatchError } from "@spfn/auth/errors";
 var PUBLIC_KEY_CACHE_MAX = 1e3;
 var publicKeyCache = /* @__PURE__ */ new Map();
 function getPublicKeyObject(publicKeyB64) {
@@ -8302,6 +8562,39 @@ function verifyKeyFingerprint(publicKeyB64, expectedFingerprint) {
     return false;
   }
 }
+function readPublicKey(publicKeyB64) {
+  try {
+    return getPublicKeyObject(publicKeyB64);
+  } catch {
+    return null;
+  }
+}
+function describeKeyType(key) {
+  if (!key) {
+    return "not a readable SPKI public key";
+  }
+  if (key.asymmetricKeyType === "ec") {
+    return `a ${key.asymmetricKeyDetails?.namedCurve ?? "unknown-curve"} EC key`;
+  }
+  return `a ${key.asymmetricKeyType ?? "unrecognised"} key`;
+}
+function keyMatchesAlgorithm(key, algorithm) {
+  if (!key) {
+    return false;
+  }
+  if (algorithm === "ES256") {
+    return key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1";
+  }
+  return key.asymmetricKeyType === "rsa";
+}
+function assertKeyMatchesAlgorithm(publicKeyB64, algorithm) {
+  const key = readPublicKey(publicKeyB64);
+  if (!keyMatchesAlgorithm(key, algorithm)) {
+    throw new KeyAlgorithmMismatchError({
+      message: `Public key is ${describeKeyType(key)} but the declared algorithm is ${algorithm}`
+    });
+  }
+}
 
 // src/server/helpers/context.ts
 function getAuth(c) {
@@ -8353,6 +8646,27 @@ import {
 // src/server/lib/config.ts
 init_email();
 import { env as env4 } from "@spfn/auth/config";
+
+// src/server/logger.ts
+import { logger as rootLogger } from "@spfn/core/logger";
+var authLogger = {
+  plugin: rootLogger.child("@spfn/auth:plugin"),
+  middleware: rootLogger.child("@spfn/auth:middleware"),
+  interceptor: {
+    general: rootLogger.child("@spfn/auth:interceptor:general"),
+    login: rootLogger.child("@spfn/auth:interceptor:login"),
+    keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
+    oauth: rootLogger.child("@spfn/auth:interceptor:oauth"),
+    csrf: rootLogger.child("@spfn/auth:interceptor:csrf")
+  },
+  session: rootLogger.child("@spfn/auth:session"),
+  service: rootLogger.child("@spfn/auth:service"),
+  setup: rootLogger.child("@spfn/auth:setup"),
+  email: rootLogger.child("@spfn/auth:email"),
+  sms: rootLogger.child("@spfn/auth:sms")
+};
+
+// src/server/lib/config.ts
 function getCookieSuffix() {
   const port = process.env.SPFN_PORT;
   return port ? `_${port}` : "";
@@ -8377,6 +8691,10 @@ var COOKIE_NAMES = {
   /** Password-setup session for verified-email signup — temporary, single-purpose */
   get SIGNUP_SETUP() {
     return `spfn_signup_setup${getCookieSuffix()}`;
+  },
+  /** CSRF token — the only cookie here the browser can read */
+  get CSRF() {
+    return `spfn_csrf${getCookieSuffix()}`;
   }
 };
 function matchOAuthCsrfCookies(cookies) {
@@ -8409,10 +8727,10 @@ var globalConfig = {
   sessionTtl: "7d"
   // Default: 7 days
 };
-function configureAuth(config2) {
+function configureAuth(config3) {
   globalConfig = {
     ...globalConfig,
-    ...config2
+    ...config3
   };
 }
 function getAuthConfig() {
@@ -8437,6 +8755,28 @@ function getSessionTtl(override) {
   }
   return 7 * 24 * 60 * 60;
 }
+var CSRF_MODES = ["off", "warn", "enforce"];
+var unrecognizedCsrfModeReported = false;
+function getCsrfMode() {
+  const configured2 = globalConfig.csrf?.mode ?? env4.SPFN_AUTH_CSRF;
+  if (!configured2) {
+    return "warn";
+  }
+  const normalized = String(configured2).trim().toLowerCase();
+  if (!CSRF_MODES.includes(normalized)) {
+    if (!unrecognizedCsrfModeReported) {
+      unrecognizedCsrfModeReported = true;
+      authLogger.interceptor.csrf.error(
+        `Unrecognized CSRF mode "${configured2}" \u2014 expected off | warn | enforce. Enforcing.`
+      );
+    }
+    return "enforce";
+  }
+  return normalized;
+}
+function getCsrfExemptPaths() {
+  return globalConfig.csrf?.exemptPaths ?? [];
+}
 
 // src/server/services/verification.service.ts
 import crypto4 from "crypto";
@@ -8444,26 +8784,6 @@ import { env as env5 } from "@spfn/auth/config";
 import { InvalidVerificationCodeError } from "@spfn/auth/errors";
 import jwt2 from "jsonwebtoken";
 import { sendEmail, sendSMS } from "@spfn/notification/server";
-
-// src/server/logger.ts
-import { logger as rootLogger } from "@spfn/core/logger";
-var authLogger = {
-  plugin: rootLogger.child("@spfn/auth:plugin"),
-  middleware: rootLogger.child("@spfn/auth:middleware"),
-  interceptor: {
-    general: rootLogger.child("@spfn/auth:interceptor:general"),
-    login: rootLogger.child("@spfn/auth:interceptor:login"),
-    keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
-    oauth: rootLogger.child("@spfn/auth:interceptor:oauth")
-  },
-  session: rootLogger.child("@spfn/auth:session"),
-  service: rootLogger.child("@spfn/auth:service"),
-  setup: rootLogger.child("@spfn/auth:setup"),
-  email: rootLogger.child("@spfn/auth:email"),
-  sms: rootLogger.child("@spfn/auth:sms")
-};
-
-// src/server/services/verification.service.ts
 init_email();
 init_repositories();
 var ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES = 60;
@@ -8646,6 +8966,7 @@ var KEY_TTL_DAYS = 90;
 init_repositories();
 import { InvalidKeyFingerprintError, KeyIdAlreadyRegisteredError } from "@spfn/auth/errors";
 var KEY_FINGERPRINT_PREFIX_LENGTH = 8;
+var DEFAULT_KEY_ALGORITHM = "ES256";
 function getKeyExpiryDate() {
   const expiresAt = /* @__PURE__ */ new Date();
   expiresAt.setDate(expiresAt.getDate() + KEY_TTL_DAYS);
@@ -8655,7 +8976,7 @@ function isExpired(expiresAt) {
   return expiresAt !== null && /* @__PURE__ */ new Date() > expiresAt;
 }
 async function registerPublicKeyService(params) {
-  const { userId, keyId, publicKey, fingerprint, algorithm = "ES256", deviceName, platform } = params;
+  const { userId, keyId, publicKey, fingerprint, algorithm = DEFAULT_KEY_ALGORITHM, deviceName, platform } = params;
   const existing = await keysRepository.findByKeyId(keyId);
   if (existing) {
     if (existing.userId === userId && existing.isActive) {
@@ -8670,6 +8991,7 @@ async function registerPublicKeyService(params) {
   if (!isValidFingerprint) {
     throw new InvalidKeyFingerprintError();
   }
+  assertKeyMatchesAlgorithm(publicKey, algorithm);
   await keysRepository.create({
     userId,
     keyId,
@@ -8683,11 +9005,12 @@ async function registerPublicKeyService(params) {
   });
 }
 async function rotateKeyService(params) {
-  const { userId, oldKeyId, newKeyId, newPublicKey, fingerprint, algorithm = "ES256" } = params;
+  const { userId, oldKeyId, newKeyId, newPublicKey, fingerprint, algorithm = DEFAULT_KEY_ALGORITHM } = params;
   const isValidFingerprint = verifyKeyFingerprint(newPublicKey, fingerprint);
   if (!isValidFingerprint) {
     throw new InvalidKeyFingerprintError();
   }
+  assertKeyMatchesAlgorithm(newPublicKey, algorithm);
   const replaced = await keysRepository.findByKeyIdAndUserId(oldKeyId, userId);
   await keysRepository.revokeByKeyIdAndUserId(
     oldKeyId,
@@ -8734,6 +9057,7 @@ async function listKeysService(params) {
 async function revokeAllKeysService(params) {
   const { userId, currentKeyId, includeCurrent = false, reason } = params;
   const revoked = includeCurrent ? await keysRepository.revokeAllActiveByUserId(userId, reason) : await keysRepository.revokeAllActiveByUserIdExcept(userId, currentKeyId, reason);
+  await deviceAuthorizationsRepository.denyAllActiveByUserId(userId);
   return { revokedCount: revoked.length, currentKeyRevoked: includeCurrent };
 }
 
@@ -8859,11 +9183,17 @@ var AuthProviderSchema = Type.Union([
   Type.Literal("phone"),
   ...SOCIAL_PROVIDERS.map((p) => Type.Literal(p))
 ]);
+var AuthLoginProviderSchema = Type.Union([
+  Type.Literal("email"),
+  Type.Literal("phone"),
+  Type.Literal("device"),
+  ...SOCIAL_PROVIDERS.map((p) => Type.Literal(p))
+]);
 var authLoginEvent = defineEvent(
   "auth.login",
   Type.Object({
     userId: Type.String(),
-    provider: AuthProviderSchema,
+    provider: AuthLoginProviderSchema,
     email: Type.Optional(Type.String()),
     phone: Type.Optional(Type.String())
   })
@@ -8971,8 +9301,8 @@ async function verifyReauthCredential(user, params) {
     throw new VerificationTokenTargetMismatchError();
   }
 }
-async function sendDeletionEmail(to, subject, text14) {
-  const result = await sendEmail2({ to, subject, text: text14 });
+async function sendDeletionEmail(to, subject, text15) {
+  const result = await sendEmail2({ to, subject, text: text15 });
   if (!result.success) {
     authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
   }
@@ -9024,12 +9354,12 @@ async function requestAccountDeletionService(userId, params) {
   if (requestedBy === "self") {
     await verifyReauthCredential(user, { password, verificationToken });
   }
-  const config2 = getDeletionConfig();
+  const config3 = getDeletionConfig();
   const wantsImmediate = immediate === true;
-  if (wantsImmediate && requestedBy === "self" && !config2.allowSelfImmediate) {
+  if (wantsImmediate && requestedBy === "self" && !config3.allowSelfImmediate) {
     throw new ImmediateDeletionNotAllowedError();
   }
-  const gracePeriodDays = wantsImmediate ? 0 : config2.gracePeriodDays;
+  const gracePeriodDays = wantsImmediate ? 0 : config3.gracePeriodDays;
   const requestedAt = /* @__PURE__ */ new Date();
   const purgeScheduledAt = addDays(requestedAt, gracePeriodDays);
   await usersRepository.updateById(user.id, { status: "pending_deletion" });
@@ -9051,6 +9381,7 @@ async function requestAccountDeletionService(userId, params) {
     throw error;
   }
   await keysRepository.revokeAllActiveByUserId(user.id, "Account deletion requested");
+  await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
   onAfterCommit(() => authDeletionRequestedEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId,
@@ -9133,10 +9464,10 @@ async function purgePendingRequest(request) {
   if (!precheckUser || precheckUser.status !== "pending_deletion") {
     return { outcome: "skipped" };
   }
-  const config2 = getDeletionConfig();
-  if (config2.onBeforePurge) {
+  const config3 = getDeletionConfig();
+  if (config3.onBeforePurge) {
     try {
-      await config2.onBeforePurge({
+      await config3.onBeforePurge({
         id: precheckUser.id,
         publicId: precheckUser.publicId,
         email: precheckUser.email,
@@ -9150,7 +9481,7 @@ async function purgePendingRequest(request) {
       return { outcome: "skipped" };
     }
   }
-  const purgeStrategy = config2.purgeStrategy;
+  const purgeStrategy = config3.purgeStrategy;
   let purgedUser = null;
   await runInTransaction(async () => {
     const user = await usersRepository.findById(userId);
@@ -9371,6 +9702,7 @@ async function changePasswordService(params) {
   }
   const newPasswordHash = await hashPassword(newPassword);
   await usersRepository.updatePassword(userId, newPasswordHash, true);
+  await deviceAuthorizationsRepository.denyAllActiveByUserId(userId);
   await keysRepository.revokeAllActiveByUserId(userId, "Revoked by password change");
 }
 
@@ -9513,23 +9845,252 @@ async function completeSignupService(params) {
     authLogger.service.warn("Signup setup session refused", { reason: "lost the claim race" });
     throw new InvalidSignupSetupSessionError();
   }
-  return await createVerifiedAccount({
-    email: claimed.email,
-    password: params.password,
-    publicKey: params.publicKey,
-    keyId: params.keyId,
-    fingerprint: params.fingerprint,
-    algorithm: params.algorithm,
-    deviceName: params.deviceName,
-    platform: params.platform,
-    metadata: params.metadata
+  return await createVerifiedAccount({
+    email: claimed.email,
+    password: params.password,
+    publicKey: params.publicKey,
+    keyId: params.keyId,
+    fingerprint: params.fingerprint,
+    algorithm: params.algorithm,
+    deviceName: params.deviceName,
+    platform: params.platform,
+    metadata: params.metadata
+  });
+}
+
+// src/server/services/device-auth.service.ts
+init_repositories();
+import {
+  AccountDisabledError as AccountDisabledError2,
+  AccountPendingDeletionError as AccountPendingDeletionError2,
+  DeviceAuthNotFoundError,
+  DeviceAuthExpiredError,
+  DeviceAuthAlreadyHandledError,
+  DeviceAuthDeniedError,
+  InvalidKeyFingerprintError as InvalidKeyFingerprintError2
+} from "@spfn/auth/errors";
+import { onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
+
+// src/server/lib/device-auth-config.ts
+var DEFAULT_DEVICE_AUTH_TTL_MS = 10 * 60 * 1e3;
+var DEFAULT_DEVICE_AUTH_INTERVAL_MS = 5 * 1e3;
+var config2 = {
+  ttlMs: DEFAULT_DEVICE_AUTH_TTL_MS,
+  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS
+};
+function configureDeviceAuth(options) {
+  const ttlMs = options?.ttlMs ?? DEFAULT_DEVICE_AUTH_TTL_MS;
+  const intervalMs = options?.intervalMs ?? DEFAULT_DEVICE_AUTH_INTERVAL_MS;
+  assertWholeMillis("ttlMs", ttlMs);
+  assertWholeMillis("intervalMs", intervalMs);
+  config2 = { ttlMs, intervalMs };
+}
+function assertWholeMillis(name, value) {
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(
+      `deviceAuth.${name} must be a positive whole number of milliseconds, received ${value}.`
+    );
+  }
+}
+function getDeviceAuthConfig() {
+  return config2;
+}
+
+// src/server/lib/device-code.ts
+import { createHash, randomBytes, randomInt } from "crypto";
+var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+var USER_CODE_LENGTH = 8;
+var USER_CODE_GROUP_SIZE = 4;
+var DEVICE_CODE_BYTES = 32;
+function generateUserCode() {
+  let code = "";
+  for (let position = 0; position < USER_CODE_LENGTH; position++) {
+    code += USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)];
+  }
+  return code;
+}
+function formatUserCode(userCode) {
+  return `${userCode.slice(0, USER_CODE_GROUP_SIZE)}-${userCode.slice(USER_CODE_GROUP_SIZE)}`;
+}
+function normalizeUserCode(input) {
+  return input.replace(/[^A-Za-z0-9]/g, "").toUpperCase();
+}
+function generateDeviceCode() {
+  return randomBytes(DEVICE_CODE_BYTES).toString("base64url");
+}
+function hashDeviceCode(deviceCode) {
+  return createHash("sha256").update(deviceCode).digest("hex");
+}
+
+// src/server/services/device-auth.service.ts
+var USER_CODE_ATTEMPTS = 3;
+function assertActionable(record) {
+  if (!record || record.status === "consumed") {
+    throw new DeviceAuthNotFoundError();
+  }
+  if (record.expiresAt.getTime() < Date.now()) {
+    throw new DeviceAuthExpiredError();
+  }
+  return record;
+}
+function refuseMissedTransition(record, from, moved) {
+  if (!record || record.status === "consumed") {
+    throw new DeviceAuthNotFoundError();
+  }
+  if (record.status === from) {
+    throw new DeviceAuthExpiredError();
+  }
+  throw moved();
+}
+function describeDevice(record) {
+  return {
+    deviceName: record.deviceName ?? void 0,
+    platform: record.platform ?? void 0,
+    fingerprintPrefix: record.fingerprint.slice(0, KEY_FINGERPRINT_PREFIX_LENGTH),
+    requestedAtMillis: record.createdAt.getTime(),
+    expiresAtMillis: record.expiresAt.getTime()
+  };
+}
+async function startDeviceAuthService(params) {
+  if (!verifyKeyFingerprint(params.publicKey, params.fingerprint)) {
+    throw new InvalidKeyFingerprintError2();
+  }
+  assertKeyMatchesAlgorithm(params.publicKey, params.algorithm ?? DEFAULT_KEY_ALGORITHM);
+  const { ttlMs, intervalMs } = getDeviceAuthConfig();
+  const expiresAt = new Date(Date.now() + ttlMs);
+  for (let attempt = 0; attempt < USER_CODE_ATTEMPTS; attempt++) {
+    const deviceCode = generateDeviceCode();
+    const userCode = generateUserCode();
+    const record = await deviceAuthorizationsRepository.create({
+      deviceCodeHash: hashDeviceCode(deviceCode),
+      userCode,
+      publicKey: params.publicKey,
+      keyId: params.keyId,
+      fingerprint: params.fingerprint,
+      algorithm: params.algorithm,
+      deviceName: params.deviceName,
+      platform: params.platform,
+      expiresAt
+    });
+    if (record) {
+      return {
+        deviceCode,
+        userCode: formatUserCode(userCode),
+        expiresAtMillis: expiresAt.getTime(),
+        intervalMillis: intervalMs
+      };
+    }
+  }
+  throw new Error(
+    `Could not allocate a unique device user code in ${USER_CODE_ATTEMPTS} attempts. Check the code generator and the user_code unique index.`
+  );
+}
+async function getDeviceAuthInfoService(params) {
+  const record = assertActionable(
+    await deviceAuthorizationsRepository.findByUserCode(normalizeUserCode(params.userCode))
+  );
+  if (record.status !== "pending") {
+    throw new DeviceAuthAlreadyHandledError();
+  }
+  return describeDevice(record);
+}
+async function approveDeviceAuthService(params) {
+  const userCode = normalizeUserCode(params.userCode);
+  const record = assertActionable(
+    await deviceAuthorizationsRepository.findByUserCode(userCode)
+  );
+  const approved = await deviceAuthorizationsRepository.approve(record.id, params.userId);
+  if (!approved) {
+    refuseMissedTransition(
+      await deviceAuthorizationsRepository.findByUserCode(userCode),
+      "pending",
+      () => new DeviceAuthAlreadyHandledError()
+    );
+  }
+  return describeDevice(approved);
+}
+async function denyDeviceAuthService(params) {
+  const userCode = normalizeUserCode(params.userCode);
+  const record = assertActionable(
+    await deviceAuthorizationsRepository.findByUserCode(userCode)
+  );
+  const denied = await deviceAuthorizationsRepository.deny(record.id);
+  if (!denied) {
+    refuseMissedTransition(
+      await deviceAuthorizationsRepository.findByUserCode(userCode),
+      "pending",
+      () => new DeviceAuthAlreadyHandledError()
+    );
+  }
+}
+async function pollDeviceAuthService(params) {
+  const deviceCodeHash = hashDeviceCode(params.deviceCode);
+  const record = assertActionable(
+    await deviceAuthorizationsRepository.findByDeviceCodeHash(deviceCodeHash)
+  );
+  if (record.status === "denied") {
+    throw new DeviceAuthDeniedError();
+  }
+  if (record.status === "pending") {
+    return { status: "pending", intervalMillis: getDeviceAuthConfig().intervalMs };
+  }
+  const consumed = await deviceAuthorizationsRepository.consumeApproved(deviceCodeHash);
+  if (!consumed) {
+    refuseMissedTransition(
+      await deviceAuthorizationsRepository.findByDeviceCodeHash(deviceCodeHash),
+      "approved",
+      () => new DeviceAuthNotFoundError()
+    );
+  }
+  return { status: "approved", ...await completeDeviceLogin(consumed) };
+}
+async function completeDeviceLogin(record) {
+  if (record.userId === null) {
+    throw new DeviceAuthNotFoundError();
+  }
+  const user = await usersRepository.findById(record.userId);
+  if (!user) {
+    throw new DeviceAuthNotFoundError();
+  }
+  if (user.status !== "active") {
+    if (user.status === "pending_deletion") {
+      const pending = await getPendingDeletionInfo(user.id);
+      throw new AccountPendingDeletionError2({
+        purgeScheduledAt: pending?.purgeScheduledAt.toISOString()
+      });
+    }
+    throw new AccountDisabledError2({ status: user.status });
+  }
+  await registerPublicKeyService({
+    userId: user.id,
+    keyId: record.keyId,
+    publicKey: record.publicKey,
+    fingerprint: record.fingerprint,
+    algorithm: record.algorithm,
+    deviceName: record.deviceName ?? void 0,
+    platform: record.platform ?? void 0
   });
+  await updateLastLoginService(user.id);
+  const result = {
+    userId: String(user.id),
+    publicId: user.publicId,
+    email: user.email || void 0,
+    phone: user.phone || void 0,
+    passwordChangeRequired: user.passwordChangeRequired
+  };
+  onAfterCommit2(() => authLoginEvent.emit({
+    userId: result.userId,
+    provider: "device",
+    email: result.email,
+    phone: result.phone
+  }));
+  return result;
 }
 
 // src/server/services/rbac.service.ts
 init_repositories();
 init_rbac();
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var RBAC_HASH_KEY = "rbac_config_hash";
 function computeConfigHash(allRoles, allPermissions, allMappings) {
   const payload = JSON.stringify({
@@ -9540,7 +10101,7 @@ function computeConfigHash(allRoles, allPermissions, allMappings) {
       return acc;
     }, {})
   });
-  return createHash("sha256").update(payload).digest("hex");
+  return createHash2("sha256").update(payload).digest("hex");
 }
 function collectMappings(options) {
   const allMappings = { ...BUILTIN_ROLE_PERMISSIONS };
@@ -9598,51 +10159,51 @@ async function initializeAuth(options = {}) {
   authLogger.service.info("\u{1F512} Built-in roles: user, admin, superadmin");
 }
 async function syncRoles(configs, existingByName) {
-  for (const config2 of configs) {
-    const existing = existingByName.get(config2.name);
+  for (const config3 of configs) {
+    const existing = existingByName.get(config3.name);
     if (!existing) {
       await rolesRepository.create({
-        name: config2.name,
-        displayName: config2.displayName,
-        description: config2.description || null,
-        priority: config2.priority ?? 10,
-        isSystem: config2.isSystem ?? false,
-        isBuiltin: config2.isBuiltin ?? false,
+        name: config3.name,
+        displayName: config3.displayName,
+        description: config3.description || null,
+        priority: config3.priority ?? 10,
+        isSystem: config3.isSystem ?? false,
+        isBuiltin: config3.isBuiltin ?? false,
         isActive: true
       });
-      authLogger.service.info(`  \u2705 Created role: ${config2.name}`);
+      authLogger.service.info(`  \u2705 Created role: ${config3.name}`);
     } else {
       const updateData = {
-        displayName: config2.displayName,
-        description: config2.description || null
+        displayName: config3.displayName,
+        description: config3.description || null
       };
       if (!existing.isBuiltin) {
-        updateData.priority = config2.priority ?? existing.priority;
+        updateData.priority = config3.priority ?? existing.priority;
       }
       await rolesRepository.updateById(existing.id, updateData);
     }
   }
 }
 async function syncPermissions(configs, existingByName) {
-  for (const config2 of configs) {
-    const existing = existingByName.get(config2.name);
+  for (const config3 of configs) {
+    const existing = existingByName.get(config3.name);
     if (!existing) {
       await permissionsRepository.create({
-        name: config2.name,
-        displayName: config2.displayName,
-        description: config2.description || null,
-        category: config2.category || null,
-        isSystem: config2.isSystem ?? false,
-        isBuiltin: config2.isBuiltin ?? false,
+        name: config3.name,
+        displayName: config3.displayName,
+        description: config3.description || null,
+        category: config3.category || null,
+        isSystem: config3.isSystem ?? false,
+        isBuiltin: config3.isBuiltin ?? false,
         isActive: true,
         metadata: null
       });
-      authLogger.service.info(`  \u2705 Created permission: ${config2.name}`);
+      authLogger.service.info(`  \u2705 Created permission: ${config3.name}`);
     } else {
       await permissionsRepository.updateById(existing.id, {
-        displayName: config2.displayName,
-        description: config2.description || null,
-        category: config2.category || null
+        displayName: config3.displayName,
+        description: config3.description || null,
+        category: config3.category || null
       });
     }
   }
@@ -9703,7 +10264,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id14) => permissionsRepository.findById(id14))
+      permIds.map((id15) => permissionsRepository.findById(id15))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -9860,6 +10421,7 @@ async function validateInvitation(token) {
 }
 async function acceptInvitation(params) {
   const { token, password, publicKey, keyId, fingerprint, algorithm } = params;
+  assertKeyMatchesAlgorithm(publicKey, algorithm);
   const validation = await validateInvitation(token);
   if (!validation.valid || !validation.invitation) {
     throw new BadRequestError({ message: validation.error || "Invalid invitation" });
@@ -9916,20 +10478,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id14, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id14);
+async function cancelInvitation(id15, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id15);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id14, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id15, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id14) {
-  await invitationsRepository.deleteById(id14);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id14}`);
+async function deleteInvitation(id15) {
+  await invitationsRepository.deleteById(id15);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id15}`);
 }
 async function expireOldInvitations() {
   const count = await invitationsRepository.updateExpiredInvitations();
@@ -9938,8 +10500,8 @@ async function expireOldInvitations() {
   }
   return count;
 }
-async function resendInvitation(id14, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id14);
+async function resendInvitation(id15, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id15);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
@@ -9947,7 +10509,7 @@ async function resendInvitation(id14, expiresInDays = 7) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id14, newExpiresAt);
+  const updated = await invitationsRepository.resend(id15, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -9986,13 +10548,13 @@ async function getAuthSessionService(userId) {
 // src/server/lib/one-time-token.ts
 import { SSETokenManager } from "@spfn/core/event/sse";
 var manager = null;
-function initOneTimeTokenManager(config2) {
+function initOneTimeTokenManager(config3) {
   if (manager) {
     manager.destroy();
   }
   manager = new SSETokenManager({
-    ttl: config2?.ttl,
-    store: config2?.store
+    ttl: config3?.ttl,
+    store: config3?.store
   });
 }
 function getOneTimeTokenManager() {
@@ -10104,8 +10666,8 @@ init_repositories();
 import { env as env12 } from "@spfn/auth/config";
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 import {
-  AccountDisabledError as AccountDisabledError2,
-  AccountPendingDeletionError as AccountPendingDeletionError2,
+  AccountDisabledError as AccountDisabledError3,
+  AccountPendingDeletionError as AccountPendingDeletionError3,
   UnverifiedEmailLinkError
 } from "@spfn/auth/errors";
 
@@ -10140,10 +10702,10 @@ function getDefaultScopes() {
 }
 function getGoogleAuthUrl(state, scopes) {
   const resolvedScopes = scopes ?? getDefaultScopes();
-  const config2 = getGoogleOAuthConfig();
+  const config3 = getGoogleOAuthConfig();
   const params = new URLSearchParams({
-    client_id: config2.clientId,
-    redirect_uri: config2.redirectUri,
+    client_id: config3.clientId,
+    redirect_uri: config3.redirectUri,
     response_type: "code",
     scope: resolvedScopes.join(" "),
     state,
@@ -10155,16 +10717,16 @@ function getGoogleAuthUrl(state, scopes) {
   return `${GOOGLE_AUTH_URL}?${params.toString()}`;
 }
 async function exchangeCodeForTokens(code) {
-  const config2 = getGoogleOAuthConfig();
+  const config3 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config2.clientId,
-      client_secret: config2.clientSecret,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      client_secret: config3.clientSecret,
+      redirect_uri: config3.redirectUri,
       grant_type: "authorization_code",
       code
     })
@@ -10188,15 +10750,15 @@ async function getGoogleUserInfo(accessToken) {
   return response.json();
 }
 async function refreshAccessToken(refreshToken) {
-  const config2 = getGoogleOAuthConfig();
+  const config3 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config2.clientId,
-      client_secret: config2.clientSecret,
+      client_id: config3.clientId,
+      client_secret: config3.clientSecret,
       refresh_token: refreshToken,
       grant_type: "refresh_token"
     })
@@ -10261,8 +10823,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id14) {
-  return registry2.get(id14);
+function getOAuthProvider(id15) {
+  return registry2.get(id15);
 }
 function getRegisteredProviders() {
   return [...registry2.values()];
@@ -10383,7 +10945,7 @@ var googleProvider = {
 registerOAuthProvider(googleProvider);
 
 // src/server/lib/oauth/apple-provider.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { env as env11 } from "@spfn/auth/config";
 import { ValidationError as ValidationError4 } from "@spfn/core/errors";
 import { NativeSignInUnsupportedError as NativeSignInUnsupportedError2 } from "@spfn/auth/errors";
@@ -10393,7 +10955,7 @@ function getAppleClientIds() {
   return (env11.SPFN_AUTH_APPLE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
 }
 function hashNonce(rawNonce) {
-  return createHash2("sha256").update(rawNonce).digest("hex");
+  return createHash3("sha256").update(rawNonce).digest("hex");
 }
 function unsupportedWebFlow() {
   throw new ValidationError4({
@@ -10516,21 +11078,21 @@ var githubProvider = {
     return !!(env3.SPFN_AUTH_GITHUB_CLIENT_ID && env3.SPFN_AUTH_GITHUB_CLIENT_SECRET);
   },
   getAuthUrl(state, scopes) {
-    const config2 = getGithubConfig();
+    const config3 = getGithubConfig();
     const params = new URLSearchParams({
-      client_id: config2.clientId,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      redirect_uri: config3.redirectUri,
       state,
       scope: (scopes ?? getGithubScopes()).join(" ")
     });
     return `${GITHUB_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code) {
-    const config2 = getGithubConfig();
+    const config3 = getGithubConfig();
     return requestGithubTokens(new URLSearchParams({
-      client_id: config2.clientId,
-      client_secret: config2.clientSecret,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      client_secret: config3.clientSecret,
+      redirect_uri: config3.redirectUri,
       code
     }));
   },
@@ -10560,11 +11122,11 @@ var githubProvider = {
     };
   },
   async refreshTokens(refreshToken) {
-    const config2 = getGithubConfig();
+    const config3 = getGithubConfig();
     return requestGithubTokens(new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config2.clientId,
-      client_secret: config2.clientSecret,
+      client_id: config3.clientId,
+      client_secret: config3.clientSecret,
       refresh_token: refreshToken
     }));
   }
@@ -10687,26 +11249,26 @@ var kakaoProvider = {
     return !!env3.SPFN_AUTH_KAKAO_CLIENT_ID;
   },
   getAuthUrl(state, scopes) {
-    const config2 = getKakaoConfig();
+    const config3 = getKakaoConfig();
     const params = new URLSearchParams({
       response_type: "code",
-      client_id: config2.clientId,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      redirect_uri: config3.redirectUri,
       state,
       scope: (scopes ?? getKakaoScopes()).join(",")
     });
     return `${KAKAO_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code) {
-    const config2 = getKakaoConfig();
+    const config3 = getKakaoConfig();
     const params = new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: config2.clientId,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      redirect_uri: config3.redirectUri,
       code
     });
-    if (config2.clientSecret) {
-      params.set("client_secret", config2.clientSecret);
+    if (config3.clientSecret) {
+      params.set("client_secret", config3.clientSecret);
     }
     return requestKakaoTokens(params);
   },
@@ -10748,14 +11310,14 @@ var kakaoProvider = {
     return options.accessToken ? withKakaoVerifiedEmail(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
-    const config2 = getKakaoConfig();
+    const config3 = getKakaoConfig();
     const params = new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config2.clientId,
+      client_id: config3.clientId,
       refresh_token: refreshToken
     });
-    if (config2.clientSecret) {
-      params.set("client_secret", config2.clientSecret);
+    if (config3.clientSecret) {
+      params.set("client_secret", config3.clientSecret);
     }
     return requestKakaoTokens(params);
   },
@@ -10792,7 +11354,7 @@ registerOAuthProvider(kakaoProvider);
 init_config();
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
 import { NativeSignInUnsupportedError as NativeSignInUnsupportedError4 } from "@spfn/auth/errors";
-import { createDecipheriv, createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createDecipheriv, createHash as createHash4, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var NAVER_AUTH_URL = "https://nid.naver.com/oauth2.0/authorize";
 var NAVER_TOKEN_URL = "https://nid.naver.com/oauth2.0/token";
 var NAVER_USERINFO_URL = "https://openapi.naver.com/v1/nid/me";
@@ -10842,7 +11404,7 @@ async function requestNaverTokens(params) {
   };
 }
 function deriveNaverUnlinkKey(clientSecret) {
-  return createHash3("md5").update(clientSecret).digest().subarray(0, 16);
+  return createHash4("md5").update(clientSecret).digest().subarray(0, 16);
 }
 function decodeBase64Url(value) {
   return Buffer.from(value.replace(/-/g, "+").replace(/_/g, "/"), "base64");
@@ -10913,22 +11475,22 @@ var naverProvider = {
     return !!(env3.SPFN_AUTH_NAVER_CLIENT_ID && env3.SPFN_AUTH_NAVER_CLIENT_SECRET);
   },
   getAuthUrl(state) {
-    const config2 = getNaverConfig();
+    const config3 = getNaverConfig();
     const params = new URLSearchParams({
       response_type: "code",
-      client_id: config2.clientId,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      redirect_uri: config3.redirectUri,
       state
     });
     return `${NAVER_AUTH_URL}?${params.toString()}`;
   },
   async exchangeCodeForTokens(code, options) {
-    const config2 = getNaverConfig();
+    const config3 = getNaverConfig();
     return requestNaverTokens(new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: config2.clientId,
-      client_secret: config2.clientSecret,
-      redirect_uri: config2.redirectUri,
+      client_id: config3.clientId,
+      client_secret: config3.clientSecret,
+      redirect_uri: config3.redirectUri,
       code,
       state: options.state
     }));
@@ -10969,11 +11531,11 @@ var naverProvider = {
     return options.accessToken ? withNaverProfile(identity, options.accessToken) : identity;
   },
   async refreshTokens(refreshToken) {
-    const config2 = getNaverConfig();
+    const config3 = getNaverConfig();
     return requestNaverTokens(new URLSearchParams({
       grant_type: "refresh_token",
-      client_id: config2.clientId,
-      client_secret: config2.clientSecret,
+      client_id: config3.clientId,
+      client_secret: config3.clientSecret,
       refresh_token: refreshToken
     }));
   },
@@ -11142,9 +11704,9 @@ async function assertActiveForOAuthSession(userId) {
   }
   if (user.status === "pending_deletion") {
     const pending = await getPendingDeletionInfo(user.id);
-    throw new AccountPendingDeletionError2({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
+    throw new AccountPendingDeletionError3({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
   }
-  throw new AccountDisabledError2({ status: user.status });
+  throw new AccountDisabledError3({ status: user.status });
 }
 async function backfillVerifiedEmail(userId, identity) {
   if (!identity.email || !identity.emailVerified) {
@@ -11287,9 +11849,9 @@ async function oauthUnlinkNotifyService(provider, notification) {
 }
 
 // src/server/services/oauth-native.service.ts
-import { runInTransaction as runInTransaction2, onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction2, onAfterCommit as onAfterCommit3 } from "@spfn/core/db";
 import {
-  InvalidKeyFingerprintError as InvalidKeyFingerprintError2,
+  InvalidKeyFingerprintError as InvalidKeyFingerprintError3,
   NativeSignInUnsupportedError as NativeSignInUnsupportedError5,
   NonceKeyBindingError
 } from "@spfn/auth/errors";
@@ -11316,7 +11878,7 @@ function assertNonceBindsPublicKey(params) {
     throw new NonceKeyBindingError();
   }
   if (!verifyKeyFingerprint(params.publicKey, params.fingerprint)) {
-    throw new InvalidKeyFingerprintError2();
+    throw new InvalidKeyFingerprintError3();
   }
 }
 async function persistNativeLogin(identity, params) {
@@ -11352,23 +11914,23 @@ async function persistNativeLogin(identity, params) {
       email: identity.email || void 0,
       metadata: params.metadata
     };
-    onAfterCommit2(() => (isNewUser ? authRegisterEvent : authLoginEvent).emit(eventPayload));
+    onAfterCommit3(() => (isNewUser ? authRegisterEvent : authLoginEvent).emit(eventPayload));
     return { userId: String(userId), keyId: params.keyId, isNewUser };
   }, { context: "auth:oauth-native" });
 }
 
 // src/server/services/ops-token.service.ts
 init_ops_tokens_repository();
-import { createHash as createHash4, randomBytes } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes2 } from "crypto";
 var OPS_TOKEN_PREFIX = "spfn_ops_";
 function hashOpsToken(token) {
-  return createHash4("sha256").update(token).digest("hex");
+  return createHash5("sha256").update(token).digest("hex");
 }
 async function issueOpsTokenService(name, scopes, expiresAt) {
   if (scopes.length === 0) {
     throw new Error("An ops token needs at least one scope ('*' grants all).");
   }
-  const token = OPS_TOKEN_PREFIX + randomBytes(32).toString("hex");
+  const token = OPS_TOKEN_PREFIX + randomBytes2(32).toString("hex");
   const record = await opsTokensRepository.create({
     name,
     tokenHash: hashOpsToken(token),
@@ -11398,8 +11960,8 @@ async function verifyOpsTokenService(token) {
     scopes: record.scopes
   };
 }
-async function revokeOpsTokenService(id14) {
-  return await opsTokensRepository.revokeById(id14);
+async function revokeOpsTokenService(id15) {
+  return await opsTokensRepository.revokeById(id15);
 }
 async function listOpsTokensService() {
   return await opsTokensRepository.list();
@@ -11412,7 +11974,7 @@ import { rateLimitPolicy } from "@spfn/core/middleware";
 
 // src/server/lib/rate-limit-keys.ts
 init_email();
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { getClientIp } from "@spfn/core/middleware";
 async function readJsonBody(c) {
   try {
@@ -11448,11 +12010,20 @@ function byIpAndAccount(options = {}) {
     ];
   };
 }
+function byIpAndCaller(options = {}) {
+  return async (c) => {
+    const auth = getOptionalAuth(c);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      auth ? `caller:${auth.userId}` : void 0
+    ];
+  };
+}
 function idTokenKey(body) {
   if (typeof body.idToken !== "string" || !body.idToken) {
     return void 0;
   }
-  return `tok:${createHash5("sha256").update(body.idToken).digest("hex")}`;
+  return `tok:${createHash6("sha256").update(body.idToken).digest("hex")}`;
 }
 function byIpAndIdToken(options = {}) {
   return async (c) => {
@@ -11610,6 +12181,69 @@ var login = route.post("/_auth/login").input({
   const { body } = await c.data();
   return await loginService(body);
 });
+var startDeviceAuth = route.post("/_auth/device/start").input({
+  // Bounded, unlike the interceptor bodies the authenticated enrolment
+  // routes use: this is the one place key material arrives from a caller
+  // with nothing to authenticate and is stored before anyone has agreed to
+  // it. Validation refuses an oversize payload before it reaches a row.
+  body: Type.Object({
+    publicKey: PublicKeySchema,
+    keyId: KeyIdSchema,
+    fingerprint: FingerprintSchema,
+    algorithm: Type.Optional(Type.Union(
+      KEY_ALGORITHM.map((algo) => Type.Literal(algo)),
+      { description: "Signature algorithm" }
+    )),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
+  })
+}).use([rateLimitPolicy("auth-device-start", { limit: 10, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await startDeviceAuthService(body);
+});
+var pollDeviceAuth = route.post("/_auth/device/poll").input({
+  body: Type.Object({
+    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" })
+  })
+}).use([rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await pollDeviceAuthService(body);
+});
+var getDeviceAuthInfo = route.post("/_auth/device/info").input({
+  body: Type.Object({
+    userCode: UserCodeSchema
+  })
+}).use([
+  rateLimitPolicy("auth-device-info", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) }),
+  Transactional()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  return await getDeviceAuthInfoService(body);
+});
+var approveDeviceAuth = route.post("/_auth/device/approve").input({
+  body: Type.Object({
+    userCode: UserCodeSchema
+  })
+}).use([
+  rateLimitPolicy("auth-device-approve", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) }),
+  Transactional()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId } = getAuth(c);
+  return await approveDeviceAuthService({ userCode: body.userCode, userId: Number(userId) });
+});
+var denyDeviceAuth = route.post("/_auth/device/deny").input({
+  body: Type.Object({
+    userCode: UserCodeSchema
+  })
+}).use([
+  rateLimitPolicy("auth-device-deny", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 50 }) }),
+  Transactional()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  await denyDeviceAuthService(body);
+  return c.noContent();
+});
 var logout = route.post("/_auth/logout").handler(async (c) => {
   const auth = getAuth(c);
   if (!auth) {
@@ -11718,6 +12352,11 @@ var authRouter = defineRouter({
   verifyCode,
   register,
   login,
+  startDeviceAuth,
+  pollDeviceAuth,
+  getDeviceAuthInfo,
+  approveDeviceAuth,
+  denyDeviceAuth,
   logout,
   rotateKey,
   listKeys,
@@ -11732,8 +12371,8 @@ var authRouter = defineRouter({
 import { EMAIL_PATTERN as EMAIL_PATTERN2, UUID_PATTERN } from "@spfn/auth";
 
 // src/server/middleware/authenticate.ts
-import { defineMiddleware } from "@spfn/core/route";
-import { UnauthorizedError as UnauthorizedError2 } from "@spfn/core/errors";
+import { defineMiddleware as defineMiddleware2 } from "@spfn/core/route";
+import { UnauthorizedError as UnauthorizedError3 } from "@spfn/core/errors";
 import { verifyClientToken as verifyClientToken2, decodeToken as decodeToken2, authLogger as authLogger3, keysRepository as keysRepository3, usersRepository as usersRepository3, userProfilesRepository as userProfilesRepository3 } from "@spfn/auth/server";
 import {
   InvalidTokenError,
@@ -11742,7 +12381,7 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/client-proof/refusal.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 
 // src/server/client-proof/canonical-json.ts
 var CanonicalJsonError = class extends Error {
@@ -11755,13 +12394,13 @@ var CanonicalJsonError = class extends Error {
 var INT64_MIN = -(2n ** 63n);
 var INT64_MAX = 2n ** 63n - 1n;
 function parseCanonicalJson(bytes) {
-  let text14;
+  let text15;
   try {
-    text14 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text15 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new CanonicalJsonError("INVALID_UTF8");
   }
-  const parser = new Parser(text14);
+  const parser = new Parser(text15);
   const value = parser.parseValue();
   parser.skipWhitespace();
   if (!parser.atEnd()) {
@@ -11782,8 +12421,8 @@ function isCanonicalBytes(bytes, value) {
   return true;
 }
 var Parser = class {
-  constructor(text14) {
-    this.text = text14;
+  constructor(text15) {
+    this.text = text15;
   }
   pos = 0;
   atEnd() {
@@ -12100,7 +12739,7 @@ var HTTP_STATUS = {
   CONTRACT_UNSUPPORTED: 409
 };
 function newHexId() {
-  return randomBytes2(16).toString("hex");
+  return randomBytes3(16).toString("hex");
 }
 var ClientProofRefusal = class _ClientProofRefusal {
   constructor(code, message) {
@@ -12202,7 +12841,7 @@ function contractViolation(message) {
 }
 
 // src/server/client-proof/contract-bundle.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import {
   CORE_TIME_OPERATION_ID as CORE_TIME_OPERATION_ID2,
   ServerTimeResponseSchema
@@ -12210,7 +12849,7 @@ import {
 init_types();
 
 // src/server/client-proof/proof.ts
-import { createHash as createHash6, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
+import { createHash as createHash7, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
 var CLIENT_PROOF_PROFILE = "clientProofV1";
 var ABSENT_BODY_SHA256 = "0".repeat(64);
 var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
@@ -12280,7 +12919,7 @@ function verifyClientProof(input, presentedProof, publicKey) {
   );
 }
 function sha256Hex(bytes) {
-  return createHash6("sha256").update(bytes).digest("hex");
+  return createHash7("sha256").update(bytes).digest("hex");
 }
 
 // src/server/client-proof/admission.ts
@@ -12372,8 +13011,8 @@ var CORE_PREREQUISITE_OPERATIONS = [
 
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.9.0";
-var CONTRACT_SUPPORTED_RANGE = ">=0.9.0 <0.10.0";
+var CONTRACT_VERSION = "0.10.1";
+var CONTRACT_SUPPORTED_RANGE = ">=0.10.0 <0.11.0";
 function required(name, type) {
   return { name, type, optional: false };
 }
@@ -12544,7 +13183,7 @@ var CONTRACT_TYPES = [
     fields: [
       required("keyId", "string"),
       optional("deviceName", "string"),
-      optional("platform", "string"),
+      optional("platform", "KeyPlatform"),
       required("algorithm", "KeyAlgorithm"),
       required("fingerprintPrefix", "string"),
       required("createdAtMillis", "integer"),
@@ -12586,10 +13225,94 @@ var CONTRACT_TYPES = [
       required("revokedCount", "integer"),
       required("currentKeyRevoked", "boolean")
     ]
+  },
+  {
+    name: "StartDeviceAuthRequest",
+    fields: [
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      optional("algorithm", "KeyAlgorithm"),
+      optional("deviceName", "string"),
+      optional("platform", "KeyPlatform")
+    ]
+  },
+  {
+    name: "StartDeviceAuthResponse",
+    fields: [
+      required("deviceCode", "string"),
+      required("userCode", "string"),
+      required("expiresAtMillis", "integer"),
+      required("intervalMillis", "integer")
+    ]
+  },
+  {
+    name: "PollDeviceAuthRequest",
+    fields: [
+      required("deviceCode", "string")
+    ]
+  },
+  /**
+   * The poll union, flattened into the one shape this grammar can carry.
+   *
+   * `status` is the discriminant and the only required field; everything else
+   * belongs to one branch and is therefore optional. `intervalMillis` is the
+   * pending branch, and the five after it are the approved branch — the same
+   * fields `LoginResponse` carries, because an approved poll is the login the
+   * approval produced. `deviceAuthorization.pollStatusRule` states the pairing
+   * the grammar cannot.
+   */
+  {
+    name: "PollDeviceAuthResponse",
+    fields: [
+      required("status", "DeviceAuthPollStatus"),
+      optional("intervalMillis", "integer"),
+      optional("userId", "string"),
+      optional("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string"),
+      optional("passwordChangeRequired", "boolean")
+    ]
+  },
+  /**
+   * Info, approve and deny each declare their own request type although all
+   * three carry nothing but `userCode`. An operation's request shape is its
+   * own: a field added to one of them later must not appear on the other two
+   * by accident, which is what a shared type would do.
+   */
+  {
+    name: "DeviceAuthInfoRequest",
+    fields: [
+      required("userCode", "string")
+    ]
+  },
+  {
+    name: "DeviceAuthInfoResponse",
+    fields: [
+      optional("deviceName", "string"),
+      optional("platform", "KeyPlatform"),
+      required("fingerprintPrefix", "string"),
+      required("requestedAtMillis", "integer"),
+      required("expiresAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ApproveDeviceAuthRequest",
+    fields: [
+      required("userCode", "string")
+    ]
+  },
+  {
+    name: "DenyDeviceAuthRequest",
+    fields: [
+      required("userCode", "string")
+    ]
   }
 ];
 var CONTRACT_ENUMS = [
-  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] }
+  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] },
+  { name: "KeyPlatform", values: [...KEY_PLATFORM] },
+  { name: "DeviceAuthPollStatus", values: ["pending", "approved"] }
 ];
 var BUNDLE_FILENAME = "spfn-mobile-contract.json";
 var BUNDLE_REPO_PATH = `contracts/mobile/${BUNDLE_FILENAME}`;
@@ -12623,7 +13346,7 @@ import {
   userProfilesRepository as userProfilesRepository2,
   getPendingDeletionInfo as getPendingDeletionInfo2
 } from "@spfn/auth/server";
-import { AccountDisabledError as AccountDisabledError3, AccountPendingDeletionError as AccountPendingDeletionError3 } from "@spfn/auth/errors";
+import { AccountDisabledError as AccountDisabledError4, AccountPendingDeletionError as AccountPendingDeletionError4 } from "@spfn/auth/errors";
 
 // src/server/client-proof/refusal-response.ts
 function clientProofRefusalResponse(c, refusal) {
@@ -12718,9 +13441,9 @@ async function resolveAuthenticatedUser(userId) {
   if (user.status !== "active") {
     if (user.status === "pending_deletion") {
       const pending = await getPendingDeletionInfo2(user.id);
-      throw new AccountPendingDeletionError3({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
+      throw new AccountPendingDeletionError4({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
     }
-    throw new AccountDisabledError3({ status: user.status });
+    throw new AccountDisabledError4({ status: user.status });
   }
   return { user, role: role?.name ?? null, locale };
 }
@@ -12739,6 +13462,9 @@ var ClientProofRefusalError = class extends SerializableError {
 function refusalError(refusal) {
   return new ClientProofRefusalError(refusal);
 }
+function clientProofRefusalOf(err) {
+  return err instanceof ClientProofRefusalError ? err.refusal : null;
+}
 async function runAuthProfile(c) {
   try {
     const verifier = selectAuthProfile(c);
@@ -12884,8 +13610,172 @@ function registerAuthProfile(profileId, verifier) {
   AUTH_PROFILE_VERIFIERS.set(profileId, { verify: verifier.verify.bind(verifier) });
 }
 
+// src/server/middleware/machine-principals.ts
+import { decodeProtectedHeader } from "jose";
+import { defineMiddleware } from "@spfn/core/route";
+import { ForbiddenError as ForbiddenError2, UnauthorizedError as UnauthorizedError2 } from "@spfn/core/errors";
+function getMachinePrincipal(c) {
+  return c.get("machinePrincipal") ?? null;
+}
+var TOKEN_PREFIX_VERIFIERS = [];
+var KID_PREFIX_VERIFIERS = [];
+var REGISTERED_IDS = /* @__PURE__ */ new Set();
+function readDiscriminator(match) {
+  const tokenPrefix = match?.tokenPrefix;
+  const kidPrefix = match?.kidPrefix;
+  if (tokenPrefix !== void 0 && kidPrefix !== void 0) {
+    return null;
+  }
+  if (typeof tokenPrefix === "string" && tokenPrefix.length > 0) {
+    return { kind: "tokenPrefix", prefix: tokenPrefix };
+  }
+  if (typeof kidPrefix === "string" && kidPrefix.length > 0) {
+    return { kind: "kidPrefix", prefix: kidPrefix };
+  }
+  return null;
+}
+function prefixesCollide(a, b) {
+  return a.startsWith(b) || b.startsWith(a);
+}
+function registerMachineVerifier(reg) {
+  if (typeof reg?.id !== "string" || reg.id.length === 0) {
+    throw new Error("registerMachineVerifier: id must be a non-empty string");
+  }
+  if (typeof reg.verify !== "function") {
+    throw new Error(`registerMachineVerifier: '${reg.id}' needs a verifier with a callable verify(token, c)`);
+  }
+  const discriminator = readDiscriminator(reg.match);
+  if (discriminator === null) {
+    throw new Error(`registerMachineVerifier: '${reg.id}' needs exactly one non-empty discriminator \u2014 { tokenPrefix } or { kidPrefix }`);
+  }
+  if (REGISTERED_IDS.has(reg.id)) {
+    throw new Error(`registerMachineVerifier: '${reg.id}' is already registered`);
+  }
+  const peers = discriminator.kind === "tokenPrefix" ? TOKEN_PREFIX_VERIFIERS : KID_PREFIX_VERIFIERS;
+  const shadowed = peers.find((peer) => prefixesCollide(peer.prefix, discriminator.prefix));
+  if (shadowed !== void 0) {
+    throw new Error(
+      `registerMachineVerifier: '${reg.id}' ${discriminator.kind} '${discriminator.prefix}' collides with '${shadowed.id}' \u2014 one prefix would shadow the other`
+    );
+  }
+  peers.push({ id: reg.id, prefix: discriminator.prefix, verify: reg.verify.bind(reg) });
+  REGISTERED_IDS.add(reg.id);
+}
+function findMachineVerifier(token) {
+  const byTokenPrefix = TOKEN_PREFIX_VERIFIERS.find((entry) => token.startsWith(entry.prefix));
+  if (byTokenPrefix !== void 0) {
+    return byTokenPrefix;
+  }
+  if (KID_PREFIX_VERIFIERS.length === 0) {
+    return null;
+  }
+  const kid = readProtectedKid(token);
+  if (kid === null) {
+    return null;
+  }
+  return KID_PREFIX_VERIFIERS.find((entry) => kid.startsWith(entry.prefix)) ?? null;
+}
+function matchesMachineDiscriminator(token) {
+  return findMachineVerifier(token) !== null;
+}
+function readProtectedKid(token) {
+  try {
+    const { kid } = decodeProtectedHeader(token);
+    return typeof kid === "string" ? kid : null;
+  } catch {
+    return null;
+  }
+}
+var MACHINE_REFUSAL_MESSAGE = "Machine authentication required: Authorization: Bearer <token>";
+function machineRefusal() {
+  return new UnauthorizedError2({ message: MACHINE_REFUSAL_MESSAGE });
+}
+var machineAuth = defineMiddleware("machineAuth", async (c, next) => {
+  const refused = profileChannelRefusal(c);
+  if (refused !== null) {
+    return refused;
+  }
+  const token = extractBearer(c.req.header("Authorization"));
+  if (token === null) {
+    throw machineRefusal();
+  }
+  const entry = findMachineVerifier(token);
+  if (entry === null) {
+    throw machineRefusal();
+  }
+  const principal = await verifiedPrincipal(entry, token, c);
+  if (principal === null) {
+    throw machineRefusal();
+  }
+  c.set("machinePrincipal", principal);
+  await next();
+  return void 0;
+}, { skips: ["auth"] });
+function profileChannelRefusal(c) {
+  try {
+    selectAuthProfile(c);
+    return null;
+  } catch (err) {
+    const refusal = clientProofRefusalOf(err);
+    if (refusal === null) {
+      throw err;
+    }
+    return clientProofRefusalResponse(c, refusal);
+  }
+}
+async function verifiedPrincipal(entry, token, c) {
+  try {
+    const principal = copyPrincipal(await entry.verify(token, c), entry.id);
+    if (principal === null) {
+      authLogger.middleware.error(`machine verifier '${entry.id}' resolved no principal`);
+    }
+    return principal;
+  } catch (err) {
+    authLogger.middleware.error(`machine verifier '${entry.id}' refused or failed`, err);
+    return null;
+  }
+}
+function copyPrincipal(resolved, scheme) {
+  const subjectType = resolved?.subjectType;
+  const subjectId = resolved?.subjectId;
+  const scopes = resolved?.scopes;
+  const claims = resolved?.claims;
+  if (typeof subjectType !== "string" || subjectType.length === 0 || typeof subjectId !== "string" || subjectId.length === 0 || !Array.isArray(scopes)) {
+    return null;
+  }
+  return {
+    subjectType,
+    subjectId,
+    scopes: [...scopes],
+    claims: claims === void 0 ? void 0 : structuredClone(claims),
+    scheme
+  };
+}
+var requireMachineScope = defineMiddleware(
+  "machineScope",
+  (...scopes) => async (c, next) => {
+    const principal = getMachinePrincipal(c);
+    if (!principal) {
+      throw machineRefusal();
+    }
+    const granted = new Set(principal.scopes);
+    const missing = scopes.filter((scope) => !granted.has(scope));
+    if (missing.length > 0) {
+      throw new ForbiddenError2({ message: `Machine principal lacks scope: ${missing.join(", ")}` });
+    }
+    await next();
+  }
+);
+function extractBearer(header) {
+  if (!header || !header.startsWith("Bearer ")) {
+    return null;
+  }
+  return header.substring(7);
+}
+
 // src/server/middleware/authenticate.ts
-var authenticate = defineMiddleware("auth", async (c, next) => {
+var INVALID_TOKEN_MESSAGE = "Invalid token: missing keyId";
+var authenticate = defineMiddleware2("auth", async (c, next) => {
   const profile = await runAuthProfile(c);
   if (profile.kind === "refused") {
     return profile.response;
@@ -12901,17 +13791,21 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
       headers: c.req.header(),
       path: c.req.path
     });
-    throw new UnauthorizedError2({ message: "Authentication header missing or invalid: Bearer {token}" });
+    throw new UnauthorizedError3({ message: "Authentication header missing or invalid: Bearer {token}" });
   }
   const token = authHeader.substring(7);
+  if (matchesMachineDiscriminator(token)) {
+    authLogger3.middleware.warn("Machine credential presented to the user path \u2014 refused", { path: c.req.path });
+    throw new UnauthorizedError3({ message: INVALID_TOKEN_MESSAGE });
+  }
   const decoded = decodeToken2(token);
   if (!decoded || !decoded.keyId) {
-    throw new UnauthorizedError2({ message: "Invalid token: missing keyId" });
+    throw new UnauthorizedError3({ message: INVALID_TOKEN_MESSAGE });
   }
   const keyId = decoded.keyId;
   const keyRecord = await keysRepository3.findActiveByKeyId(keyId);
   if (!keyRecord) {
-    throw new UnauthorizedError2({ message: "Invalid or revoked key" });
+    throw new UnauthorizedError3({ message: "Invalid or revoked key" });
   }
   if (keyRecord.expiresAt && /* @__PURE__ */ new Date() > keyRecord.expiresAt) {
     throw new KeyExpiredError();
@@ -12932,7 +13826,7 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
         throw new InvalidTokenError({ message: "Invalid token signature" });
       }
     }
-    throw new UnauthorizedError2({ message: "Authentication failed" });
+    throw new UnauthorizedError3({ message: "Authentication failed" });
   }
   const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
   keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
@@ -12958,7 +13852,7 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
   await next();
   return void 0;
 });
-var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
+var optionalAuth = defineMiddleware2("optionalAuth", async (c, next) => {
   const profile = await runAuthProfile(c);
   if (profile.kind === "refused") {
     return profile.response;
@@ -12974,6 +13868,10 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
     return void 0;
   }
   const token = authHeader.substring(7);
+  if (matchesMachineDiscriminator(token)) {
+    authLogger3.middleware.warn("Machine credential presented to the user path \u2014 refused", { path: c.req.path });
+    throw new UnauthorizedError3({ message: INVALID_TOKEN_MESSAGE });
+  }
   try {
     const decoded = decodeToken2(token);
     if (!decoded || !decoded.keyId) {
@@ -13020,11 +13918,11 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
 }, { skips: ["auth"] });
 
 // src/server/middleware/require-permission.ts
-import { defineMiddleware as defineMiddleware2 } from "@spfn/core/route";
-import { ForbiddenError as ForbiddenError2 } from "@spfn/core/errors";
+import { defineMiddleware as defineMiddleware3 } from "@spfn/core/route";
+import { ForbiddenError as ForbiddenError3 } from "@spfn/core/errors";
 import { InsufficientPermissionsError } from "@spfn/auth/errors";
 import { getAuth as getAuth2, hasAllPermissions as hasAllPermissions2, hasAnyPermission as hasAnyPermission2, authLogger as authLogger4 } from "@spfn/auth/server";
-var requirePermissions = defineMiddleware2(
+var requirePermissions = defineMiddleware3(
   "permission",
   (...permissionNames) => async (c, next) => {
     const auth = getAuth2(c);
@@ -13033,7 +13931,7 @@ var requirePermissions = defineMiddleware2(
         permissions: permissionNames,
         path: c.req.path
       });
-      throw new ForbiddenError2({ message: "Authentication required" });
+      throw new ForbiddenError3({ message: "Authentication required" });
     }
     const { userId } = auth;
     const allowed = await hasAllPermissions2(userId, permissionNames);
@@ -13052,7 +13950,7 @@ var requirePermissions = defineMiddleware2(
     await next();
   }
 );
-var requireAnyPermission = defineMiddleware2(
+var requireAnyPermission = defineMiddleware3(
   "anyPermission",
   (...permissionNames) => async (c, next) => {
     const auth = getAuth2(c);
@@ -13061,7 +13959,7 @@ var requireAnyPermission = defineMiddleware2(
         permissions: permissionNames,
         path: c.req.path
       });
-      throw new ForbiddenError2({ message: "Authentication required" });
+      throw new ForbiddenError3({ message: "Authentication required" });
     }
     const { userId } = auth;
     const allowed = await hasAnyPermission2(userId, permissionNames);
@@ -13082,11 +13980,11 @@ var requireAnyPermission = defineMiddleware2(
 );
 
 // src/server/middleware/require-role.ts
-import { defineMiddleware as defineMiddleware3 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware4 } from "@spfn/core/route";
 import { getAuth as getAuth3, authLogger as authLogger5 } from "@spfn/auth/server";
-import { ForbiddenError as ForbiddenError3 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
 import { InsufficientRoleError } from "@spfn/auth/errors";
-var requireRole = defineMiddleware3(
+var requireRole = defineMiddleware4(
   "role",
   (...roleNames) => async (c, next) => {
     const auth = getAuth3(c);
@@ -13095,7 +13993,7 @@ var requireRole = defineMiddleware3(
         roles: roleNames,
         path: c.req.path
       });
-      throw new ForbiddenError3({ message: "Authentication required" });
+      throw new ForbiddenError4({ message: "Authentication required" });
     }
     const { userId, role: userRole } = auth;
     if (!userRole || !roleNames.includes(userRole)) {
@@ -13117,11 +14015,11 @@ var requireRole = defineMiddleware3(
 );
 
 // src/server/middleware/role-guard.ts
-import { defineMiddleware as defineMiddleware4 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware5 } from "@spfn/core/route";
 import { getAuth as getAuth4, authLogger as authLogger6 } from "@spfn/auth/server";
-import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError5 } from "@spfn/core/errors";
 import { InsufficientRoleError as InsufficientRoleError2 } from "@spfn/auth/errors";
-var roleGuard = defineMiddleware4(
+var roleGuard = defineMiddleware5(
   "roleGuard",
   (options) => async (c, next) => {
     const { allow, deny } = options;
@@ -13133,7 +14031,7 @@ var roleGuard = defineMiddleware4(
       authLogger6.middleware.warn("Role guard failed: not authenticated", {
         path: c.req.path
       });
-      throw new ForbiddenError4({ message: "Authentication required" });
+      throw new ForbiddenError5({ message: "Authentication required" });
     }
     const { userId, role: userRole } = auth;
     if (deny && deny.length > 0) {
@@ -13169,28 +14067,28 @@ var roleGuard = defineMiddleware4(
 );
 
 // src/server/middleware/one-time-token-auth.ts
-import { defineMiddleware as defineMiddleware5 } from "@spfn/core/route";
-import { UnauthorizedError as UnauthorizedError3 } from "@spfn/core/errors";
+import { defineMiddleware as defineMiddleware6 } from "@spfn/core/route";
+import { UnauthorizedError as UnauthorizedError4 } from "@spfn/core/errors";
 import { usersRepository as usersRepository4, userProfilesRepository as userProfilesRepository4 } from "@spfn/auth/server";
-var oneTimeTokenAuth = defineMiddleware5("oneTimeTokenAuth", async (c, next) => {
+var oneTimeTokenAuth = defineMiddleware6("oneTimeTokenAuth", async (c, next) => {
   const token = c.req.query("token") ?? extractOTTHeader(c.req.header("Authorization"));
   if (!token) {
-    throw new UnauthorizedError3({ message: "One-time token required: ?token=xxx or Authorization: OTT xxx" });
+    throw new UnauthorizedError4({ message: "One-time token required: ?token=xxx or Authorization: OTT xxx" });
   }
   const userId = await verifyOneTimeTokenService(token);
   if (!userId) {
-    throw new UnauthorizedError3({ message: "Invalid or expired one-time token" });
+    throw new UnauthorizedError4({ message: "Invalid or expired one-time token" });
   }
   const [result, locale] = await Promise.all([
     usersRepository4.findByIdWithRole(Number(userId)),
     userProfilesRepository4.findLocaleByUserId(Number(userId))
   ]);
   if (!result) {
-    throw new UnauthorizedError3({ message: "User not found" });
+    throw new UnauthorizedError4({ message: "User not found" });
   }
   const { user, role } = result;
   if (user.status !== "active") {
-    throw new UnauthorizedError3({ message: "Account is not active" });
+    throw new UnauthorizedError4({ message: "Account is not active" });
   }
   c.set("auth", {
     user,
@@ -13211,39 +14109,39 @@ function extractOTTHeader(header) {
 }
 
 // src/server/middleware/ops-token-auth.ts
-import { defineMiddleware as defineMiddleware6 } from "@spfn/core/route";
-import { ForbiddenError as ForbiddenError5, UnauthorizedError as UnauthorizedError4 } from "@spfn/core/errors";
+import { defineMiddleware as defineMiddleware7 } from "@spfn/core/route";
+import { ForbiddenError as ForbiddenError6, UnauthorizedError as UnauthorizedError5 } from "@spfn/core/errors";
 function getOpsToken(c) {
   return c.get("opsToken") ?? null;
 }
-var opsTokenAuth = defineMiddleware6("opsTokenAuth", async (c, next) => {
-  const token = extractBearer(c.req.header("Authorization"));
+var opsTokenAuth = defineMiddleware7("opsTokenAuth", async (c, next) => {
+  const token = extractBearer2(c.req.header("Authorization"));
   if (!token) {
-    throw new UnauthorizedError4({ message: "Ops token required: Authorization: Bearer <token>" });
+    throw new UnauthorizedError5({ message: "Ops token required: Authorization: Bearer <token>" });
   }
   const verified = await verifyOpsTokenService(token);
   if (!verified) {
-    throw new UnauthorizedError4({ message: "Invalid ops token" });
+    throw new UnauthorizedError5({ message: "Invalid ops token" });
   }
   c.set("opsToken", verified);
   await next();
 }, { skips: ["auth"] });
-var requireOpsScope = defineMiddleware6(
+var requireOpsScope = defineMiddleware7(
   "opsScope",
   (...scopes) => async (c, next) => {
     const token = getOpsToken(c);
     if (!token) {
-      throw new UnauthorizedError4({ message: "Ops token required: Authorization: Bearer <token>" });
+      throw new UnauthorizedError5({ message: "Ops token required: Authorization: Bearer <token>" });
     }
     const granted = new Set(token.scopes);
     const missing = scopes.filter((scope) => !granted.has(scope) && !granted.has("*"));
     if (missing.length > 0) {
-      throw new ForbiddenError5({ message: `Ops token lacks scope: ${missing.join(", ")}` });
+      throw new ForbiddenError6({ message: `Ops token lacks scope: ${missing.join(", ")}` });
     }
     await next();
   }
 );
-function extractBearer(header) {
+function extractBearer2(header) {
   if (!header || !header.startsWith("Bearer ")) {
     return null;
   }
@@ -14038,7 +14936,7 @@ var oauthRouter = defineRouter4({
 
 // src/server/routes/admin/index.ts
 init_esm();
-import { ForbiddenError as ForbiddenError6 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError7 } from "@spfn/core/errors";
 import { route as route5 } from "@spfn/core/route";
 var listRoles = route5.get("/_auth/admin/roles").input({
   query: Type.Object({
@@ -14108,11 +15006,11 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
   const { params, body } = await c.data();
   const auth = getAuth(c);
   if (params.userId === Number(auth.userId)) {
-    throw new ForbiddenError6({ message: "Cannot change your own role" });
+    throw new ForbiddenError7({ message: "Cannot change your own role" });
   }
   const targetRole = await getUserRole(params.userId);
   if (targetRole === "superadmin") {
-    throw new ForbiddenError6({ message: "Cannot modify superadmin role" });
+    throw new ForbiddenError7({ message: "Cannot modify superadmin role" });
   }
   await assertCanAssignRole(auth.userId, body.roleId);
   await updateUserService(params.userId, { roleId: body.roleId });
@@ -14236,6 +15134,12 @@ var mainAuthRouter = defineRouter6({
   confirmSignupLink,
   completeSignup,
   login,
+  // Device-code login routes
+  startDeviceAuth,
+  pollDeviceAuth,
+  getDeviceAuthInfo,
+  approveDeviceAuth,
+  denyDeviceAuth,
   logout,
   rotateKey,
   listKeys,
@@ -14479,15 +15383,64 @@ async function shouldRefreshSession(jwt4, thresholdHours = 24) {
   return hoursRemaining < thresholdHours;
 }
 
-// src/server/setup.ts
+// src/server/lib/csrf.ts
 import { env as env14 } from "@spfn/auth/config";
+var CSRF_HEADER = "x-spfn-csrf";
+var CSRF_SUBKEY_LABEL = "spfn-auth-csrf-token-v1";
+var MAX_CANDIDATES = 32;
+function sessionSecret() {
+  const secret = env14.SPFN_AUTH_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "SPFN_AUTH_SESSION_SECRET is required for CSRF protection. Set it (sessions need it anyway), or set SPFN_AUTH_CSRF=off."
+    );
+  }
+  return secret;
+}
+async function hmacSha256(key, message) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key.buffer,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return new Uint8Array(signature);
+}
+function toHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function deriveCsrfToken(keyId) {
+  const subkey = await hmacSha256(new TextEncoder().encode(sessionSecret()), CSRF_SUBKEY_LABEL);
+  return toHex(await hmacSha256(subkey, keyId));
+}
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function matchesCsrfToken(expected, presented) {
+  if (!presented) {
+    return false;
+  }
+  return presented.split(",", MAX_CANDIDATES).some((candidate) => timingSafeEqualString(expected, candidate.trim()));
+}
+
+// src/server/setup.ts
+import { env as env15 } from "@spfn/auth/config";
 import { getRoleByName as getRoleByName2 } from "@spfn/auth/server";
 init_repositories();
 function parseAdminAccounts() {
   const accounts = [];
-  if (env14.SPFN_AUTH_ADMIN_ACCOUNTS) {
+  if (env15.SPFN_AUTH_ADMIN_ACCOUNTS) {
     try {
-      const accountsJson = env14.SPFN_AUTH_ADMIN_ACCOUNTS;
+      const accountsJson = env15.SPFN_AUTH_ADMIN_ACCOUNTS;
       const parsed = JSON.parse(accountsJson);
       if (!Array.isArray(parsed)) {
         authLogger.setup.error("\u274C SPFN_AUTH_ADMIN_ACCOUNTS must be an array");
@@ -14514,11 +15467,11 @@ function parseAdminAccounts() {
       return accounts;
     }
   }
-  const adminEmails = env14.SPFN_AUTH_ADMIN_EMAILS;
+  const adminEmails = env15.SPFN_AUTH_ADMIN_EMAILS;
   if (adminEmails) {
     const emails = adminEmails.split(",").map((s) => s.trim());
-    const passwords = (env14.SPFN_AUTH_ADMIN_PASSWORDS || "").split(",").map((s) => s.trim());
-    const roles2 = (env14.SPFN_AUTH_ADMIN_ROLES || "").split(",").map((s) => s.trim());
+    const passwords = (env15.SPFN_AUTH_ADMIN_PASSWORDS || "").split(",").map((s) => s.trim());
+    const roles2 = (env15.SPFN_AUTH_ADMIN_ROLES || "").split(",").map((s) => s.trim());
     if (passwords.length !== emails.length) {
       authLogger.setup.error("\u274C SPFN_AUTH_ADMIN_EMAILS and SPFN_AUTH_ADMIN_PASSWORDS length mismatch");
       return accounts;
@@ -14540,8 +15493,8 @@ function parseAdminAccounts() {
     }
     return accounts;
   }
-  const adminEmail = env14.SPFN_AUTH_ADMIN_EMAIL;
-  const adminPassword = env14.SPFN_AUTH_ADMIN_PASSWORD;
+  const adminEmail = env15.SPFN_AUTH_ADMIN_EMAIL;
+  const adminPassword = env15.SPFN_AUTH_ADMIN_PASSWORD;
   if (adminEmail && adminPassword) {
     accounts.push({
       email: adminEmail,
@@ -14602,19 +15555,88 @@ async function ensureAdminExists() {
   }
 }
 
+// src/server/lib/oauth/redirect-uri-check.ts
+var PROVIDERS = ["google", "kakao", "naver", "github"];
+var OPT_OUT_VAR = "SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK";
+function redirectUriVar(provider) {
+  return `SPFN_AUTH_${provider.toUpperCase()}_REDIRECT_URI`;
+}
+function resolveWebAppOrigin(env16) {
+  const configured2 = env16.NEXT_PUBLIC_SPFN_APP_URL || env16.SPFN_APP_URL;
+  if (!configured2) {
+    return null;
+  }
+  try {
+    return new URL(configured2).origin;
+  } catch {
+    return null;
+  }
+}
+function conformanceDetail(value, webAppOrigin, callbackPath) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return " The value is not a URL.";
+  }
+  if (url.origin !== webAppOrigin || url.pathname !== callbackPath) {
+    return "";
+  }
+  if (url.search !== "" || url.hash !== "") {
+    return " The value carries a query string or fragment; the callback URL is the path alone.";
+  }
+  return null;
+}
+function providerRefusal(provider, env16, webAppOrigin) {
+  const variable = redirectUriVar(provider);
+  const value = env16[variable];
+  if (!value) {
+    return null;
+  }
+  const callbackPath = `/_auth/oauth/${provider}/callback`;
+  const detail = conformanceDetail(value, webAppOrigin, callbackPath);
+  if (detail === null) {
+    return null;
+  }
+  return `${variable} must be on the web app origin (${webAppOrigin}) at ${callbackPath}: the callback's CSRF cookie is host-only and /_auth/* is forwarded to the API by the app's rewrite. Unset it to use the default, fix the origin, or set ${OPT_OUT_VAR}=off for a deployment that deliberately terminates the callback elsewhere.${detail}`;
+}
+function assertOAuthRedirectUris(env16 = process.env) {
+  const examined = PROVIDERS.map(redirectUriVar).join(", ");
+  if (env16[OPT_OUT_VAR] === "off") {
+    authLogger.service.info(
+      `${OPT_OUT_VAR}=off: the OAuth callback origin check is disabled. Not examined: ${examined}.`
+    );
+    return;
+  }
+  const webAppOrigin = resolveWebAppOrigin(env16);
+  if (!webAppOrigin) {
+    authLogger.service.info(
+      `The OAuth callback origin check was skipped: neither NEXT_PUBLIC_SPFN_APP_URL nor SPFN_APP_URL resolves to a parseable URL, which the startup env validation reports on its own. Not examined: ${examined}.`
+    );
+    return;
+  }
+  const refusals = PROVIDERS.map((provider) => providerRefusal(provider, env16, webAppOrigin)).filter((refusal) => refusal !== null);
+  if (refusals.length > 0) {
+    throw new Error(refusals.join("\n"));
+  }
+}
+
 // src/server/lifecycle.ts
 function createAuthLifecycle(options = {}) {
   configureDeletion(options.deletion);
+  configureDeviceAuth(options.deviceAuth);
   return {
     /**
      * Initialize auth system after database is ready
      *
      * Performs:
+     * 0. Refuses boot on an OAuth redirect URI override off the web app origin
      * 1. Ensures admin account exists (creates if missing)
      * 2. Initializes RBAC system with built-in + custom roles/permissions
      * 3. Initializes one-time token manager
      */
     afterInfrastructure: async () => {
+      assertOAuthRedirectUris();
       await initializeAuth(options);
       try {
         await normalizeStoredEmails();
@@ -14653,20 +15675,28 @@ export {
   AuthMetadataRepository,
   AuthProviderSchema,
   COOKIE_NAMES,
+  CSRF_HEADER,
   DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE,
   DEFAULT_DELETION_GRACE_PERIOD_DAYS,
   DEFAULT_DELETION_PURGE_CRON,
   DEFAULT_DELETION_PURGE_STRATEGY,
   DEFAULT_DELETION_SEND_NOTIFICATIONS,
+  DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  DEFAULT_DEVICE_AUTH_TTL_MS,
+  DEVICE_AUTH_STATUSES,
+  DeviceAuthPollResponseSchema,
+  DeviceAuthorizationsRepository,
   DeviceNameSchema,
   EmailSchema,
   EnvironmentKeyringTokenCipher,
+  FingerprintSchema,
   INVITATION_STATUSES,
   InvitationsRepository,
   KEY_ALGORITHM,
   KEY_DEVICE_NAME_MAX_LENGTH,
   KEY_FINGERPRINT_PREFIX_LENGTH,
   KEY_PLATFORM,
+  KeyIdSchema,
   KeysRepository,
   OpsTokensRepository,
   PURGE_STRATEGIES,
@@ -14674,14 +15704,18 @@ export {
   PermissionsRepository,
   PhoneSchema,
   PlatformSchema,
+  PublicKeySchema,
   RolePermissionsRepository,
   RolesRepository,
   SOCIAL_PROVIDERS,
   SignupLinkTokensRepository,
   SocialAccountsRepository,
   TargetTypeSchema,
+  USER_CODE_ALPHABET,
+  USER_CODE_LENGTH,
   USER_STATUSES,
   UnlinkNotifyRejection,
+  UserCodeSchema,
   UserPermissionsRepository,
   UserProfilesRepository,
   UsersRepository,
@@ -14694,7 +15728,9 @@ export {
   accountDeletionRequestsRepository,
   addPermissionToRole,
   appleProvider,
+  approveDeviceAuthService,
   assertCanAssignRole,
+  assertKeyMatchesAlgorithm,
   authDeletionCancelledEvent,
   authDeletionCompletedEvent,
   authDeletionRequestedEvent,
@@ -14715,6 +15751,7 @@ export {
   completeSignupService,
   configureAuth,
   configureDeletion,
+  configureDeviceAuth,
   configureOAuthTokenCipher,
   confirmSignupLinkService,
   createAuthDeletionJobRouter,
@@ -14727,20 +15764,31 @@ export {
   decryptToken,
   deleteInvitation,
   deleteRole,
+  denyDeviceAuthService,
+  deriveCsrfToken,
+  deviceAuthorizations,
+  deviceAuthorizationsRepository,
   encryptToken,
   exchangeCodeForTokens,
   expireOldInvitations,
+  formatUserCode,
   generateClientToken,
+  generateDeviceCode,
   generateKeyPair,
   generateKeyPairES256,
   generateKeyPairRS256,
   generateOAuthNonce,
   generateToken,
+  generateUserCode,
   getAllRoles,
   getAuth,
   getAuthConfig,
   getAuthSessionService,
+  getCsrfExemptPaths,
+  getCsrfMode,
   getDeletionConfig,
+  getDeviceAuthConfig,
+  getDeviceAuthInfoService,
   getDummyPasswordHash,
   getEnabledOAuthProviders,
   getGoogleAccessToken,
@@ -14752,6 +15800,7 @@ export {
   getKeyId,
   getKeySize,
   getLocale,
+  getMachinePrincipal,
   getOAuthProvider,
   getOneTimeTokenManager,
   getOpsToken,
@@ -14778,6 +15827,7 @@ export {
   hasAnyRole,
   hasPermission,
   hasRole,
+  hashDeviceCode,
   hashPassword,
   initOneTimeTokenManager,
   initializeAuth,
@@ -14797,11 +15847,14 @@ export {
   listOpsTokensService,
   loginService,
   logoutService,
+  machineAuth,
   matchOAuthCsrfCookies,
+  matchesCsrfToken,
   naverProvider,
   normalizeEmail,
   normalizeOptionalEmail,
   normalizeStoredEmails,
+  normalizeUserCode,
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,
@@ -14815,9 +15868,11 @@ export {
   parseDuration,
   permissions,
   permissionsRepository,
+  pollDeviceAuthService,
   purgeUserService,
   refreshAccessToken,
   registerAuthProfile,
+  registerMachineVerifier,
   registerOAuthProvider,
   registerPublicKeyService,
   registerService,
@@ -14826,6 +15881,7 @@ export {
   requestSignupLinkService,
   requireAnyPermission,
   requireEnabledProvider,
+  requireMachineScope,
   requireOpsScope,
   requirePermissions,
   requireRole,
@@ -14851,6 +15907,7 @@ export {
   signupLinkTokens,
   signupLinkTokensRepository,
   socialAccountsRepository,
+  startDeviceAuthService,
   sweepDuePurges,
   unsealSession,
   updateLastLoginService,