diff --git a/.cursorignore b/.cursorignore
new file mode 100644
index 0000000..6f9f00f
--- /dev/null
+++ b/.cursorignore
@@ -0,0 +1 @@
+# Add directories or file patterns to ignore during indexing (e.g. foo/ or *.csv)
diff --git a/OIDC_ARCHITECTURE_UPDATE.md b/OIDC_ARCHITECTURE_UPDATE.md
new file mode 100644
index 0000000..a95c80a
--- /dev/null
+++ b/OIDC_ARCHITECTURE_UPDATE.md
@@ -0,0 +1,133 @@
+# OIDC 架构更新总结
+
+## 🎯 更新目标
+
+将项目从混合认证架构改为标准的 OIDC 架构，确保所有用户认证都在 OIDC Provider 中处理。
+
+## 🔄 主要改动
+
+### 1. 删除客户端登录页面
+- ❌ 删除了 `apps/web/app/auth/login/page.tsx`
+- ❌ 删除了客户端应用中的自定义认证逻辑
+
+### 2. 修复回调页面
+- ✅ 更新 `apps/web/app/auth/callback/page.tsx` 中的错误链接
+- ✅ 移除对已删除登录页面的引用
+
+### 3. 添加测试页面
+- ✅ 创建 `apps/web/app/test-oidc/page.tsx` 用于测试OIDC流程
+- ✅ 在首页添加测试页面链接
+
+### 4. 更新文档
+- ✅ 更新 `apps/backend/README.md` 以反映正确的架构
+
+## 🏗️ 当前架构
+
+### 正确的 OIDC 流程
+```
+用户点击登录
+    ↓
+客户端重定向到 OIDC Provider 授权端点
+    ↓
+OIDC Provider 显示内置登录页面
+    ↓
+用户在 Provider 页面上登录
+    ↓
+Provider 生成授权码并重定向回客户端
+    ↓
+客户端用授权码换取令牌
+    ↓
+认证完成
+```
+
+### 架构优势
+
+#### ✅ 已实现的正确做法
+- OIDC Provider 包含登录页面
+- 标准授权码流程
+- PKCE 支持
+- 内置会话管理
+- 自动令牌刷新
+
+#### ❌ 已移除的错误做法
+- 客户端应用的登录页面
+- 自定义认证逻辑
+- 重复的用户管理
+- 混合认证流程
+
+## 🧪 测试方法
+
+### 1. 访问测试页面
+访问 `http://localhost:3001/test-oidc` 进行完整的流程测试
+
+### 2. 测试 Discovery 端点
+在测试页面点击"测试 Discovery 端点"按钮
+
+### 3. 完整认证流程测试
+1. 在测试页面点击"开始 OIDC 认证流程"
+2. 将跳转到 OIDC Provider 的内置登录页面
+3. 使用演示账号登录：`demouser` / `demo123`
+4. 登录成功后会重定向回客户端应用
+
+## 🔧 技术细节
+
+### OIDC Provider 配置
+```typescript
+export const oidcApp = createOIDCProvider({
+    config: oidcConfig,
+    useBuiltInAuth: true,
+    builtInAuthConfig: {
+        passwordValidator: validatePassword,
+        sessionTTL: 24 * 60 * 60, // 24小时
+        loginPageTitle: 'OIDC Demo 登录',
+        brandName: 'OIDC Demo Provider',
+    },
+});
+```
+
+### 客户端配置
+```typescript
+export const oidcConfig = {
+    authority: 'http://localhost:3000/oidc',
+    client_id: 'demo-client',
+    redirect_uri: 'http://localhost:3001/auth/callback',
+    response_type: 'code',
+    scope: 'openid profile email',
+    // ... 其他标准OIDC配置
+};
+```
+
+## 📋 验证清单
+
+- [x] 删除客户端登录页面
+- [x] 修复回调页面引用
+- [x] OIDC Provider 内置认证正常工作
+- [x] 标准 OIDC 流程可以完整运行
+- [x] Discovery 端点返回正确配置
+- [x] 文档已更新
+- [x] 测试页面可用
+
+## 🚀 启动说明
+
+1. 启动后端 OIDC Provider：
+   ```bash
+   cd apps/backend
+   bun run dev
+   ```
+
+2. 启动前端客户端：
+   ```bash
+   cd apps/web
+   npm run dev
+   ```
+
+3. 访问测试页面：
+   http://localhost:3001/test-oidc
+
+## 🎉 总结
+
+现在项目已经完全符合标准的 OIDC 架构：
+- **分离关注点**: OIDC Provider 专注于认证，客户端专注于业务逻辑
+- **标准合规**: 完全符合 OpenID Connect 规范
+- **简化维护**: 认证逻辑集中在 Provider 中
+- **更好的安全性**: 用户凭据只在 Provider 中处理 
\ No newline at end of file
diff --git a/apps/backend/README.md b/apps/backend/README.md
index 6dd13e7..e11cbeb 100644
--- a/apps/backend/README.md
+++ b/apps/backend/README.md
@@ -1,11 +1,286 @@
-To install dependencies:
-```sh
-bun install
+# OIDC Provider Demo
+
+这是一个基于 Hono 后端的 OpenID Connect (OIDC) Provider 演示应用，使用了标准的OIDC架构设计。
+
+## 功能特性
+
+- ✅ 完整的 OIDC Provider 实现
+- ✅ 支持授权码流程 (Authorization Code Flow)
+- ✅ 支持 PKCE (Proof Key for Code Exchange)
+- ✅ 内置认证处理器
+- ✅ JWT 令牌签发和验证
+- ✅ 用户信息端点
+- ✅ 令牌撤销
+- ✅ Redis 存储适配器
+- ✅ 内置登录页面
+
+## 标准OIDC架构
+
+### 使用内置认证处理器（推荐）
+
+```typescript
+import { createOIDCProvider } from '@repo/oidc-provider';
+
+// 使用内置认证处理器，Provider自己处理登录
+const oidcApp = createOIDCProvider({
+  config: oidcConfig,
+  useBuiltInAuth: true,
+  builtInAuthConfig: {
+    passwordValidator: validatePassword,
+    sessionTTL: 24 * 60 * 60, // 24小时
+    loginPageTitle: 'OIDC Demo 登录',
+    brandName: 'OIDC Demo Provider',
+  },
+});
 ```
 
-To run:
-```sh
+### 自定义认证处理器（高级用法）
+
+```typescript
+import { createOIDCProvider, type AuthHandler } from '@repo/oidc-provider';
+
+class MyAuthHandler implements AuthHandler {
+  async getCurrentUser(c: Context): Promise<string | null> {
+    // 检查用户认证状态
+    // 例如：从JWT token、session或cookie中获取用户ID
+    const token = c.req.header('Authorization');
+    return await verifyTokenAndGetUserId(token);
+  }
+
+  async handleAuthRequired(c: Context, authRequest: AuthorizationRequest): Promise<Response> {
+    // 处理未认证用户
+    // 例如：显示自定义登录页面或重定向到外部认证服务
+    return this.showCustomLoginPage(c, authRequest);
+  }
+}
+
+const oidcApp = createOIDCProvider({
+  config: oidcConfig,
+  authHandler: new MyAuthHandler()
+});
+```
+
+## 启动服务
+
+```bash
+# 在项目根目录
+cd apps/backend
 bun run dev
 ```
 
-open http://localhost:3000
+服务将在 `http://localhost:8000` 启动。
+
+## 当前配置
+
+当前的 OIDC Provider 已配置为：
+- 使用内置认证处理器，Provider自己处理所有登录逻辑
+- 支持标准OIDC授权码流程
+- 使用 Redis 存储令牌和会话
+
+## OIDC 端点
+
+### 发现文档
+```
+GET http://localhost:8000/oidc/.well-known/openid-configuration
+```
+
+### 主要端点
+- **授权端点**: `http://localhost:8000/oidc/auth`
+- **令牌端点**: `http://localhost:8000/oidc/token`
+- **用户信息端点**: `http://localhost:8000/oidc/userinfo`
+- **JWKS端点**: `http://localhost:8000/oidc/.well-known/jwks.json`
+- **撤销端点**: `http://localhost:8000/oidc/revoke`
+
+## 测试客户端
+
+### 机密客户端 (Confidential Client)
+```
+Client ID: demo-client
+Client Secret: demo-client-secret
+重定向URI: 
+  - http://localhost:3000/callback
+  - http://localhost:8080/callback
+  - https://oauth.pstmn.io/v1/callback
+```
+
+### 公共客户端 (Public Client)
+```
+Client ID: demo-public-client
+重定向URI:
+  - http://localhost:3000/callback
+  - myapp://callback
+```
+
+## 测试用户
+
+```
+用户名: demouser
+密码: password
+用户ID (sub): demo-user
+```
+
+## API 测试
+
+运行测试脚本验证新API：
+
+```bash
+cd apps/backend
+bun run test-oidc.ts
+```
+
+## 授权流程
+
+1. **客户端发起授权请求**: 访问 `/oidc/auth` 端点
+2. **检查用户认证**: AuthHandler 检查用户是否已认证
+3. **用户认证**: 如未认证，重定向到登录页面
+4. **生成授权码**: 认证成功后生成授权码
+5. **交换访问令牌**: 客户端使用授权码换取访问令牌
+6. **访问资源**: 使用访问令牌访问用户信息等资源
+
+## 配置说明
+
+```typescript
+import { createOIDCProvider, DefaultAuthHandler } from '@repo/oidc-provider';
+
+const oidcConfig = {
+  issuer: 'http://localhost:8000/oidc',
+  signingKey: 'your-secret-key',
+  storage: redisAdapter,
+  findClient: async (clientId) => { /* 查找客户端 */ },
+  findUser: async (userId) => { /* 查找用户 */ },
+  // ... 其他配置
+};
+
+// 方式1: 使用内置认证处理器（推荐）
+const app1 = createOIDCProvider({
+  config: oidcConfig,
+  useBuiltInAuth: true,
+  builtInAuthConfig: {
+    passwordValidator: validatePassword,
+    sessionTTL: 24 * 60 * 60,
+    loginPageTitle: 'OIDC Demo 登录',
+    brandName: 'OIDC Demo Provider',
+  },
+});
+
+// 方式2: 使用自定义处理器（高级用法）
+const app2 = createOIDCProvider({
+  config: oidcConfig,
+  authHandler: new CustomAuthHandler()
+});
+```
+
+## 与 Next.js Web 应用集成
+
+1. **标准OIDC流程**: Next.js 应用使用标准 oidc-client-ts 库
+2. **认证处理**: OIDC Provider 自己处理所有用户认证和登录页面
+3. **令牌管理**: OIDC Provider 负责生成和管理所有令牌
+4. **回调处理**: Next.js 应用只需处理OIDC回调，获取令牌
+
+## 技术架构
+
+- **框架**: Hono.js
+- **存储**: Redis (令牌存储)
+- **JWT**: JOSE 库
+- **PKCE**: 支持 SHA256 和 plain 方法
+- **算法**: HS256 (可配置 RS256, ES256)
+- **认证**: 可自定义认证处理器
+
+## 优势
+
+相比之前的实现，新API具有以下优势：
+
+1. **简化配置**: 只需要提供配置对象和认证处理器
+2. **灵活认证**: 支持任意认证方式（JWT、Session、OAuth等）
+3. **清晰分离**: 认证逻辑与OIDC协议逻辑分离
+4. **易于扩展**: 通过实现 AuthHandler 接口轻松自定义
+5. **类型安全**: 完整的 TypeScript 类型支持
+
+## 开发说明
+
+- 修改客户端或用户数据：编辑 `src/oidc-demo.ts`
+- 自定义认证逻辑：实现 `AuthHandler` 接口
+- 配置调整：修改 `oidcConfig` 对象
+
+## 快速测试
+
+1. **Web界面测试**：
+   访问 http://localhost:8000 查看完整的测试界面
+
+2. **授权流程测试**：
+   访问 http://localhost:8000/oidc/auth?response_type=code&client_id=demo-client&redirect_uri=https://oauth.pstmn.io/v1/callback&scope=openid%20profile%20email&state=test-state
+
+3. **Postman测试**：
+   使用以下配置在 Postman 中测试 OAuth 2.0:
+   ```
+   授权URL: http://localhost:8000/oidc/auth
+   令牌URL: http://localhost:8000/oidc/token
+   回调URL: https://oauth.pstmn.io/v1/callback
+   Client ID: demo-client
+   Client Secret: demo-client-secret
+   作用域: openid profile email
+   ```
+
+## 完整的授权码流程
+
+### 1. 授权请求
+```
+GET http://localhost:8000/oidc/auth?response_type=code&client_id=demo-client&redirect_uri=https://oauth.pstmn.io/v1/callback&scope=openid%20profile%20email&state=random-state
+```
+
+### 2. 用户登录
+系统会自动重定向到登录页面，使用测试用户登录
+
+### 3. 获取授权码
+登录成功后会重定向到 `redirect_uri` 并携带授权码
+
+### 4. 交换访问令牌
+```bash
+curl -X POST http://localhost:8000/oidc/token \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=authorization_code&code=YOUR_CODE&redirect_uri=https://oauth.pstmn.io/v1/callback&client_id=demo-client&client_secret=demo-client-secret"
+```
+
+### 5. 访问用户信息
+```bash
+curl -X GET http://localhost:8000/oidc/userinfo \
+  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
+```
+
+## 支持的作用域和声明
+
+### 作用域 (Scopes)
+- `openid` - 必需的基础作用域
+- `profile` - 用户基本信息
+- `email` - 邮箱信息
+- `phone` - 电话号码
+- `address` - 地址信息
+
+### 声明 (Claims)
+- `sub` - 用户唯一标识
+- `name`, `given_name`, `family_name` - 姓名信息
+- `email`, `email_verified` - 邮箱信息
+- `phone_number`, `phone_number_verified` - 电话信息
+- `picture`, `profile`, `website` - 个人资料
+- `gender`, `birthdate`, `zoneinfo`, `locale` - 基本信息
+- `address` - 地址信息
+- `updated_at` - 更新时间
+
+## 安全注意事项
+
+⚠️ **这是一个演示应用，不应用于生产环境！**
+
+生产环境部署时需要注意：
+1. 使用强密钥和安全的签名算法
+2. 实现真实的用户认证和会话管理
+3. 添加适当的安全头和 CSRF 保护
+4. 使用 HTTPS
+5. 实现客户端注册和管理
+6. 添加速率限制和监控
+7. 定期轮换密钥
+
+## 开发和扩展
+
+如需修改客户端或用户数据，编辑 `src/oidc-demo.ts` 文件中的 `demoClients` 和 `demoUsers` 数组。
+
+如需自定义认证逻辑，修改 `src/index.ts` 中的登录处理逻辑。 
\ No newline at end of file
diff --git a/apps/backend/package.json b/apps/backend/package.json
index 1472d63..4b7406c 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -1,32 +1,32 @@
 {
-	"name": "backend",
-	"scripts": {
-		"dev": "bun run --hot src/index.ts"
-	},
-	"dependencies": {
-		"@elastic/elasticsearch": "^9.0.2",
-		"@hono/trpc-server": "^0.3.4",
-		"@hono/zod-validator": "^0.5.0",
-		"@repo/db": "workspace:*",
-		"@repo/tus": "workspace:*",
-		"@trpc/server": "11.1.2",
-		"@types/oidc-provider": "^9.1.0",
-		"hono": "^4.7.10",
-		"ioredis": "5.4.1",
-		"jose": "^6.0.11",
-		"minio": "7.1.3",
-		"nanoid": "^5.1.5",
-		"nanoid-cjs": "^0.0.7",
-		"transliteration": "^2.3.5",
-		"node-cron": "^4.0.7",
-		"oidc-provider": "^9.1.1",
-		"superjson": "^2.2.2",
-		"dayjs": "^1.11.13",
-		"dotenv": "^16.4.7",
-		"zod": "^3.25.23"
-	},
-	"devDependencies": {
-		"@types/bun": "latest",
-		"@types/node": "^22.15.21"
-	}
+  "name": "backend",
+  "scripts": {
+    "dev": "bun run --hot src/index.ts"
+  },
+  "dependencies": {
+    "@elastic/elasticsearch": "^9.0.2",
+    "@hono/node-server": "^1.14.3",
+    "@hono/trpc-server": "^0.3.4",
+    "@hono/zod-validator": "^0.5.0",
+    "@repo/db": "workspace:*",
+    "@repo/oidc-provider": "workspace:*",
+    "@trpc/server": "11.1.2",
+    "hono": "^4.7.10",
+    "ioredis": "5.4.1",
+    "jose": "^6.0.11",
+    "minio": "7.1.3",
+    "nanoid": "^5.1.5",
+    "node-cron": "^4.0.7",
+    "oidc-provider": "^9.1.1",
+    "superjson": "^2.2.2",
+    "valibot": "^1.1.0",
+    "zod": "^3.25.23"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/node": "^22.15.21",
+    "@types/oidc-provider": "^9.1.0",
+    "supertest": "^7.1.1",
+    "vitest": "^3.1.4"
+  }
 }
diff --git a/apps/backend/src/index.ts b/apps/backend/src/index.ts
index 8962108..4c70029 100644
--- a/apps/backend/src/index.ts
+++ b/apps/backend/src/index.ts
@@ -9,7 +9,7 @@ import Redis from 'ioredis';
 import redis from './redis';
 import minioClient from './minio';
 import { Client } from 'minio';
-import oidc from './oidc/provider';
+
 import { appRouter } from './trpc';
 
 import { createBunWebSocket } from 'hono/bun';
@@ -60,12 +60,7 @@ app.use(
 app.route('/api/users', userRest);
 app.route('/api/upload', uploadRest);
 
-app.use('/oidc/*', async (c, next) => {
-	// @ts-ignore
-	await oidc.callback(c.req.raw, c.res.raw);
-	// return void 也可以
-	return;
-});
+
 
 // 添加 WebSocket 路由
 app.get('/ws', wsHandler);
diff --git a/apps/backend/src/oidc-demo.ts b/apps/backend/src/oidc-demo.ts
new file mode 100644
index 0000000..5c28e89
--- /dev/null
+++ b/apps/backend/src/oidc-demo.ts
@@ -0,0 +1,134 @@
+import { createOIDCProvider } from '@repo/oidc-provider';
+import { RedisStorageAdapter } from '@repo/oidc-provider';
+import type { OIDCClient, OIDCUser, OIDCProviderConfig } from '@repo/oidc-provider';
+import redis from './redis';
+
+// 示例客户端数据
+const demoClients: OIDCClient[] = [
+    {
+        client_id: 'demo-client',
+        client_secret: 'demo-client-secret',
+        client_name: 'Demo Application',
+        client_type: 'confidential',
+        redirect_uris: [
+            'http://localhost:3001/auth/callback',
+            'http://localhost:8080/callback',
+            'https://oauth.pstmn.io/v1/callback'
+        ],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        scopes: ['openid', 'profile', 'email'],
+        token_endpoint_auth_method: 'client_secret_basic',
+        created_at: new Date(),
+        updated_at: new Date(),
+    },
+    {
+        client_id: 'demo-public-client',
+        client_name: 'Demo Public Application',
+        client_type: 'public',
+        redirect_uris: [
+            'http://localhost:3000/callback',
+            'myapp://callback'
+        ],
+        grant_types: ['authorization_code'],
+        response_types: ['code'],
+        scopes: ['openid', 'profile', 'email'],
+        token_endpoint_auth_method: 'none',
+        created_at: new Date(),
+        updated_at: new Date(),
+    }
+];
+
+// 示例用户数据
+const demoUsers: OIDCUser[] = [
+    {
+        sub: 'demo-user',
+        username: 'demouser',
+        email: 'demo@example.com',
+        email_verified: true,
+        name: 'Demo User',
+        given_name: 'Demo',
+        family_name: 'User',
+        picture: 'https://via.placeholder.com/150',
+        profile: 'https://example.com/demouser',
+        website: 'https://example.com',
+        gender: 'prefer_not_to_say',
+        birthdate: '1990-01-01',
+        zoneinfo: 'Asia/Shanghai',
+        locale: 'zh-CN',
+        phone_number: '+86-123-4567-8901',
+        phone_number_verified: true,
+        address: {
+            formatted: '北京市朝阳区建国门外大街1号',
+            street_address: '建国门外大街1号',
+            locality: '朝阳区',
+            region: '北京市',
+            postal_code: '100020',
+            country: 'CN'
+        },
+        updated_at: Math.floor(Date.now() / 1000)
+    }
+];
+
+// 查找客户端的函数
+async function findClient(clientId: string): Promise<OIDCClient | null> {
+    return demoClients.find(client => client.client_id === clientId) || null;
+}
+
+// 查找用户的函数
+async function findUser(userId: string): Promise<OIDCUser | null> {
+    return demoUsers.find(user => user.sub === userId) || null;
+}
+
+// 密码验证函数
+async function validatePassword(username: string, password: string): Promise<string | null> {
+    // 查找用户并验证密码
+    const user = demoUsers.find(u => u.username === username);
+    if (!user || password !== 'demo123') {
+        return null;
+    }
+    return user.sub; // 返回用户ID
+}
+
+// OIDC Provider 配置
+const oidcConfig: OIDCProviderConfig = {
+    issuer: 'http://localhost:3000/oidc',
+    signingKey: 'your-super-secret-signing-key-at-least-32-characters-long',
+    signingAlgorithm: 'HS256',
+    storage: new RedisStorageAdapter(redis),
+    findClient,
+    findUser,
+    tokenTTL: {
+        accessToken: 3600, // 1小时
+        refreshToken: 30 * 24 * 3600, // 30天
+        authorizationCode: 600, // 10分钟
+        idToken: 3600, // 1小时
+    },
+    responseTypes: ['code'],
+    grantTypes: ['authorization_code', 'refresh_token'],
+    scopes: ['openid', 'profile', 'email', 'phone', 'address'],
+    claims: [
+        'sub', 'name', 'given_name', 'family_name', 'middle_name', 'nickname',
+        'preferred_username', 'profile', 'picture', 'website', 'email',
+        'email_verified', 'gender', 'birthdate', 'zoneinfo', 'locale',
+        'phone_number', 'phone_number_verified', 'address', 'updated_at'
+    ],
+    enablePKCE: true,
+    requirePKCE: false,
+    rotateRefreshTokens: true,
+};
+
+// 使用新的内置认证处理器创建OIDC Provider
+export const oidcApp = createOIDCProvider({
+    config: oidcConfig,
+    useBuiltInAuth: true,
+    builtInAuthConfig: {
+        passwordValidator: validatePassword,
+        sessionTTL: 24 * 60 * 60, // 24小时
+        loginPageTitle: 'OIDC Demo 登录',
+        brandName: 'OIDC Demo Provider',
+    },
+});
+
+// 导出示例数据用于测试
+export { demoClients, demoUsers, oidcConfig }; 
\ No newline at end of file
diff --git a/apps/backend/src/oidc/config.ts b/apps/backend/src/oidc/config.ts
deleted file mode 100644
index e518af0..0000000
--- a/apps/backend/src/oidc/config.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-import { Configuration } from 'oidc-provider';
-import { RedisAdapter } from './redis-adapter';
-import { prisma } from '@repo/db';
-
-async function getClients() {
-	const dbClients = await prisma.oidcClient.findMany?.();
-	const dbClientList =
-		dbClients && dbClients.length > 0
-			? dbClients.map((c) => ({
-					client_id: c.clientId,
-					client_secret: c.clientSecret,
-					grant_types: JSON.parse(c.grantTypes), // string -> string[]
-					redirect_uris: JSON.parse(c.redirectUris), // string -> string[]
-					response_types: JSON.parse(c.responseTypes), // string -> string[]
-					scope: c.scope,
-				}))
-			: [];
-
-	// 管理后台client，通过环境变量读取
-	const defaultClient = {
-		client_id: process.env.OIDC_CLIENT_ID || 'admin-client',
-		client_secret: process.env.OIDC_CLIENT_SECRET || 'admin-secret',
-		grant_types: ['authorization_code', 'refresh_token'],
-		redirect_uris: [process.env.OIDC_REDIRECT_URI || 'http://localhost:3000/callback'],
-		response_types: ['code'],
-		scope: 'openid email profile',
-	};
-
-	// 检查是否与数据库client_id重复
-	const allClients = [defaultClient, ...dbClientList.filter((c) => c.client_id !== defaultClient.client_id)];
-
-	return allClients;
-}
-
-const OIDC_COOKIE_KEY = process.env.OIDC_COOKIE_KEY || 'HrbEPlzByV0CcjFJhl2pjKV2iG8FgQIc';
-
-const config: Configuration = {
-	adapter: RedisAdapter,
-	// 注意：clients字段现在是Promise，需在Provider初始化时await
-	clients: await getClients(),
-	pkce: {
-		required: () => true,
-	},
-	features: {
-		devInteractions: { enabled: false },
-		resourceIndicators: { enabled: true },
-		revocation: { enabled: true },
-		userinfo: { enabled: true },
-		registration: { enabled: true },
-	},
-	cookies: {
-		keys: [OIDC_COOKIE_KEY],
-	},
-	jwks: {
-		keys: [
-			{
-				d: 'VEZOsY07JTFzGTqv6cC2Y32vsfChind2I_TTuvV225_-0zrSej3XLRg8iE_u0-3GSgiGi4WImmTwmEgLo4Qp3uEcxCYbt4NMJC7fwT2i3dfRZjtZ4yJwFl0SIj8TgfQ8ptwZbFZUlcHGXZIr4nL8GXyQT0CK8wy4COfmymHrrUoyfZA154ql_OsoiupSUCRcKVvZj2JHL2KILsq_sh_l7g2dqAN8D7jYfJ58MkqlknBMa2-zi5I0-1JUOwztVNml_zGrp27UbEU60RqV3GHjoqwI6m01U7K0a8Q_SQAKYGqgepbAYOA-P4_TLl5KC4-WWBZu_rVfwgSENwWNEhw8oQ',
-				dp: 'E1Y-SN4bQqX7kP-bNgZ_gEv-pixJ5F_EGocHKfS56jtzRqQdTurrk4jIVpI-ZITA88lWAHxjD-OaoJUh9Jupd_lwD5Si80PyVxOMI2xaGQiF0lbKJfD38Sh8frRpgelZVaK_gm834B6SLfxKdNsP04DsJqGKktODF_fZeaGFPH0',
-				dq: 'F90JPxevQYOlAgEH0TUt1-3_hyxY6cfPRU2HQBaahyWrtCWpaOzenKZnvGFZdg-BuLVKjCchq3G_70OLE-XDP_ol0UTJmDTT-WyuJQdEMpt_WFF9yJGoeIu8yohfeLatU-67ukjghJ0s9CBzNE_LrGEV6Cup3FXywpSYZAV3iqc',
-				e: 'AQAB',
-				kty: 'RSA',
-				n: 'xwQ72P9z9OYshiQ-ntDYaPnnfwG6u9JAdLMZ5o0dmjlcyrvwQRdoFIKPnO65Q8mh6F_LDSxjxa2Yzo_wdjhbPZLjfUJXgCzm54cClXzT5twzo7lzoAfaJlkTsoZc2HFWqmcri0BuzmTFLZx2Q7wYBm0pXHmQKF0V-C1O6NWfd4mfBhbM-I1tHYSpAMgarSm22WDMDx-WWI7TEzy2QhaBVaENW9BKaKkJklocAZCxk18WhR0fckIGiWiSM5FcU1PY2jfGsTmX505Ub7P5Dz75Ygqrutd5tFrcqyPAtPTFDk8X1InxkkUwpP3nFU5o50DGhwQolGYKPGtQ-ZtmbOfcWQ',
-				p: '5wC6nY6Ev5FqcLPCqn9fC6R9KUuBej6NaAVOKW7GXiOJAq2WrileGKfMc9kIny20zW3uWkRLm-O-3Yzze1zFpxmqvsvCxZ5ERVZ6leiNXSu3tez71ZZwp0O9gys4knjrI-9w46l_vFuRtjL6XEeFfHEZFaNJpz-lcnb3w0okrbM',
-				q: '3I1qeEDslZFB8iNfpKAdWtz_Wzm6-jayT_V6aIvhvMj5mnU-Xpj75zLPQSGa9wunMlOoZW9w1wDO1FVuDhwzeOJaTm-Ds0MezeC4U6nVGyyDHb4CUA3ml2tzt4yLrqGYMT7XbADSvuWYADHw79OFjEi4T3s3tJymhaBvy1ulv8M',
-				qi: 'wSbXte9PcPtr788e713KHQ4waE26CzoXx-JNOgN0iqJMN6C4_XJEX-cSvCZDf4rh7xpXN6SGLVd5ibIyDJi7bbi5EQ5AXjazPbLBjRthcGXsIuZ3AtQyR0CEWNSdM7EyM5TRdyZQ9kftfz9nI03guW3iKKASETqX2vh0Z8XRjyU',
-				use: 'sig',
-			},
-			{
-				crv: 'P-256',
-				d: 'K9xfPv773dZR22TVUB80xouzdF7qCg5cWjPjkHyv7Ws',
-				kty: 'EC',
-				use: 'sig',
-				x: 'FWZ9rSkLt6Dx9E3pxLybhdM6xgR5obGsj5_pqmnz5J4',
-				y: '_n8G69C-A2Xl4xUW2lF0i8ZGZnk_KPYrhv4GbTGu5G4',
-			},
-		],
-	},
-	ttl: {
-		AccessToken: 3600,
-		AuthorizationCode: 600,
-		IdToken: 3600,
-		RefreshToken: 1209600,
-		BackchannelAuthenticationRequest: 600,
-		ClientCredentials: 600,
-		DeviceCode: 600,
-		Grant: 1209600,
-		Interaction: 3600,
-		Session: 1209600,
-		RegistrationAccessToken: 3600,
-		DPoPProof: 300,
-		PushedAuthorizationRequest: 600,
-		ReplayDetection: 3600,
-		LogoutToken: 600,
-	},
-	findAccount: async (ctx, id) => {
-		const user = await prisma.user.findUnique({ where: { id } });
-		if (!user) return undefined;
-		return {
-			accountId: user.id,
-			async claims() {
-				return {
-					sub: user.id,
-					email: user.email,
-					name: user.name,
-				};
-			},
-		};
-	},
-};
-
-export default config;
diff --git a/apps/backend/src/oidc/provider.ts b/apps/backend/src/oidc/provider.ts
deleted file mode 100644
index aca144d..0000000
--- a/apps/backend/src/oidc/provider.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { Provider } from 'oidc-provider';
-import config from './config';
-
-const oidc = new Provider('http://localhost:3000', config);
-
-export default oidc;
\ No newline at end of file
diff --git a/apps/backend/src/oidc/redis-adapter.ts b/apps/backend/src/oidc/redis-adapter.ts
deleted file mode 100644
index d62fe20..0000000
--- a/apps/backend/src/oidc/redis-adapter.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import type { Adapter, AdapterPayload } from 'oidc-provider';
-import redis from '../redis';
-
-export class RedisAdapter implements Adapter {
-    name: string;
-    constructor(name: string) {
-        this.name = name;
-    }
-
-    key(id: string) {
-        return `${this.name}:${id}`;
-    }
-
-    async upsert(id: string, payload: AdapterPayload, expiresIn: number) {
-        const key = this.key(id);
-        await redis.set(key, JSON.stringify(payload), 'EX', expiresIn);
-        if (payload && payload.grantId) {
-            // 记录grantId到id的映射，便于revokeByGrantId
-            await redis.sadd(this.grantKey(payload.grantId), id);
-            await redis.expire(this.grantKey(payload.grantId), expiresIn);
-        }
-        if (payload && payload.userCode) {
-            await redis.set(this.userCodeKey(payload.userCode), id, 'EX', expiresIn);
-        }
-        if (payload && payload.uid) {
-            await redis.set(this.uidKey(payload.uid), id, 'EX', expiresIn);
-        }
-    }
-
-    async find(id: string) {
-        const data = await redis.get(this.key(id));
-        return data ? JSON.parse(data) : undefined;
-    }
-
-    async findByUserCode(userCode: string) {
-        const id = await redis.get(this.userCodeKey(userCode));
-        return id ? this.find(id) : undefined;
-    }
-
-    async findByUid(uid: string) {
-        const id = await redis.get(this.uidKey(uid));
-        return id ? this.find(id) : undefined;
-    }
-
-    async destroy(id: string) {
-        const data = await this.find(id);
-        await redis.del(this.key(id));
-        if (data && data.grantId) {
-            await redis.srem(this.grantKey(data.grantId), id);
-        }
-        if (data && data.userCode) {
-            await redis.del(this.userCodeKey(data.userCode));
-        }
-        if (data && data.uid) {
-            await redis.del(this.uidKey(data.uid));
-        }
-    }
-
-    async revokeByGrantId(grantId: string) {
-        const key = this.grantKey(grantId);
-        const ids = await redis.smembers(key);
-        if (ids && ids.length) {
-            await Promise.all(ids.map((id) => this.destroy(id)));
-        }
-        await redis.del(key);
-    }
-
-    async consume(id: string) {
-        const key = this.key(id);
-        const data = await this.find(id);
-        if (data) {
-            data.consumed = Math.floor(Date.now() / 1000);
-            await redis.set(key, JSON.stringify(data));
-        }
-    }
-
-    grantKey(grantId: string) {
-        return `${this.name}:grant:${grantId}`;
-    }
-    userCodeKey(userCode: string) {
-        return `${this.name}:userCode:${userCode}`;
-    }
-    uidKey(uid: string) {
-        return `${this.name}:uid:${uid}`;
-    }
-}
diff --git a/apps/backend/src/user/user.trpc.ts b/apps/backend/src/user/user.trpc.ts
index 4c2dcbd..b3e7d82 100644
--- a/apps/backend/src/user/user.trpc.ts
+++ b/apps/backend/src/user/user.trpc.ts
@@ -3,6 +3,6 @@ import { publicProcedure, router } from "../trpc/base"
 export const userRouter = router({
     getUser: publicProcedure.query(async ({ ctx }) => {
 
-        return '123'
+        return '1234'
     })
 })
\ No newline at end of file
diff --git a/apps/web/app/auth/callback/page.tsx b/apps/web/app/auth/callback/page.tsx
new file mode 100644
index 0000000..2888e70
--- /dev/null
+++ b/apps/web/app/auth/callback/page.tsx
@@ -0,0 +1,120 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useSearchParams, useRouter } from 'next/navigation';
+import { userManager } from '@/lib/oidc-config';
+import { Loader2, CheckCircle, XCircle } from 'lucide-react';
+import { Card, CardContent, CardHeader, CardTitle } from '@repo/ui/components/card';
+import { Alert, AlertDescription } from '@repo/ui/components/alert';
+
+export default function CallbackPage() {
+	const searchParams = useSearchParams();
+	const router = useRouter();
+	const [status, setStatus] = useState<'loading' | 'success' | 'error'>('loading');
+	const [error, setError] = useState<string | null>(null);
+
+	useEffect(() => {
+		const handleCallback = async () => {
+			try {
+				if (!userManager) {
+					throw new Error('用户管理器未初始化');
+				}
+
+				// 处理OIDC回调
+				const user = await userManager.signinRedirectCallback();
+
+				if (user) {
+					setStatus('success');
+					// 延迟跳转到首页
+					setTimeout(() => {
+						router.push('/');
+					}, 2000);
+				} else {
+					throw new Error('未收到用户信息');
+				}
+			} catch (err) {
+				console.error('回调处理失败:', err);
+				setError(err instanceof Error ? err.message : '未知错误');
+				setStatus('error');
+			}
+		};
+
+		// 检查是否有授权码或错误参数
+		const code = searchParams.get('code');
+		const error = searchParams.get('error');
+		const errorDescription = searchParams.get('error_description');
+
+		if (error) {
+			setError(`${error}: ${errorDescription || '授权失败'}`);
+			setStatus('error');
+			return;
+		}
+
+		if (code) {
+			handleCallback();
+		} else {
+			setError('缺少授权码');
+			setStatus('error');
+		}
+	}, [searchParams, router]);
+
+	const getStatusIcon = () => {
+		switch (status) {
+			case 'loading':
+				return <Loader2 className="h-8 w-8 animate-spin text-blue-500" />;
+			case 'success':
+				return <CheckCircle className="h-8 w-8 text-green-500" />;
+			case 'error':
+				return <XCircle className="h-8 w-8 text-red-500" />;
+		}
+	};
+
+	const getStatusMessage = () => {
+		switch (status) {
+			case 'loading':
+				return '正在处理登录回调...';
+			case 'success':
+				return '登录成功！正在跳转...';
+			case 'error':
+				return '登录失败';
+		}
+	};
+
+	return (
+		<div className="min-h-screen flex items-center justify-center bg-gray-50 dark:bg-gray-900">
+			<Card className="w-full max-w-md">
+				<CardHeader className="text-center">
+					<div className="flex justify-center mb-4">{getStatusIcon()}</div>
+					<CardTitle className="text-xl">{getStatusMessage()}</CardTitle>
+				</CardHeader>
+				<CardContent>
+					{status === 'error' && error && (
+						<Alert variant="destructive">
+							<AlertDescription>{error}</AlertDescription>
+						</Alert>
+					)}
+
+					{status === 'loading' && (
+						<div className="text-center text-sm text-gray-600 dark:text-gray-400">
+							<p>请等待，正在验证您的登录信息...</p>
+						</div>
+					)}
+
+					{status === 'success' && (
+						<div className="text-center text-sm text-gray-600 dark:text-gray-400">
+							<p>登录成功！即将跳转到首页...</p>
+						</div>
+					)}
+
+					{status === 'error' && (
+						<div className="text-center mt-4">
+							<button onClick={() => router.push('/')} className="text-blue-600 hover:text-blue-800 text-sm">
+								返回首页
+							</button>
+						</div>
+					)}
+				</CardContent>
+			</Card>
+		</div>
+	);
+}
diff --git a/apps/web/app/opengraph-image.png b/apps/web/app/opengraph-image.png
deleted file mode 100644
index f2f8ff4..0000000
Binary files a/apps/web/app/opengraph-image.png and /dev/null differ
diff --git a/apps/web/app/page.tsx b/apps/web/app/page.tsx
index b235c7d..41faba0 100644
--- a/apps/web/app/page.tsx
+++ b/apps/web/app/page.tsx
@@ -1,26 +1,170 @@
 'use client';
-import { useHello, useTRPC } from '@repo/client';
-import { useQuery } from '@tanstack/react-query';
-import Link from 'next/link';
 
-export default function Home() {
-	const trpc = useTRPC();
-	const { data, isLoading } = useQuery(trpc.user.getUser.queryOptions());
+import { useAuth } from '@/providers/auth-provider';
+import { UserProfile } from '@/components/user-profile';
+import { LoginButton } from '@/components/login-button';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@repo/ui/components/card';
+import { Badge } from '@repo/ui/components/badge';
+import { Separator } from '@repo/ui/components/separator';
+import { Shield, Key, Users, CheckCircle, Info } from 'lucide-react';
+
+export default function HomePage() {
+	const { isAuthenticated, isLoading, error } = useAuth();
 
 	return (
-		<div className="p-4">
-			<h1 className="text-2xl font-bold mb-4">首页</h1>
-			<div className="space-y-4">
-				<div className="p-4 border rounded">
-					<h2 className="text-xl mb-2">功能导航</h2>
-					<ul className="space-y-2">
-						<li>
-							<Link href="/websocket" className="text-blue-500 hover:text-blue-600 hover:underline">
-								WebSocket 聊天室
-							</Link>
-						</li>
-						{/* 可以在这里添加更多功能链接 */}
-					</ul>
+		<div className="min-h-screen bg-gradient-to-br from-blue-50 to-indigo-100 dark:from-gray-900 dark:to-gray-800">
+			<div className="container mx-auto px-4 py-8">
+				{/* 页面标题 */}
+				<div className="text-center mb-8">
+					<h1 className="text-4xl font-bold text-gray-900 dark:text-white mb-4">OIDC 认证演示</h1>
+					<p className="text-xl text-gray-600 dark:text-gray-300 max-w-2xl mx-auto">
+						基于 OpenID Connect 协议的安全认证系统演示
+					</p>
+					<div className="mt-4">
+						<a
+							href="/test-oidc"
+							className="inline-flex items-center px-4 py-2 text-sm font-medium text-blue-600 hover:text-blue-800 border border-blue-300 rounded-lg hover:bg-blue-50 dark:text-blue-400 dark:border-blue-600 dark:hover:bg-blue-900"
+						>
+							测试 OIDC 流程
+						</a>
+					</div>
+				</div>
+
+				{/* 功能特性卡片 */}
+				<div className="grid grid-cols-1 md:grid-cols-3 gap-6 mb-8">
+					<Card>
+						<CardHeader>
+							<Shield className="h-8 w-8 text-blue-600 mb-2" />
+							<CardTitle className="text-lg">安全认证</CardTitle>
+							<CardDescription>基于 OAuth 2.0 和 OpenID Connect 标准的安全认证流程</CardDescription>
+						</CardHeader>
+					</Card>
+
+					<Card>
+						<CardHeader>
+							<Key className="h-8 w-8 text-green-600 mb-2" />
+							<CardTitle className="text-lg">Token 管理</CardTitle>
+							<CardDescription>自动管理访问令牌、刷新令牌和 ID 令牌的生命周期</CardDescription>
+						</CardHeader>
+					</Card>
+
+					<Card>
+						<CardHeader>
+							<Users className="h-8 w-8 text-purple-600 mb-2" />
+							<CardTitle className="text-lg">用户信息</CardTitle>
+							<CardDescription>获取和展示完整的用户配置文件信息</CardDescription>
+						</CardHeader>
+					</Card>
+				</div>
+
+				{/* 状态显示 */}
+				{error && (
+					<Card className="mb-6 border-red-200 bg-red-50 dark:border-red-800 dark:bg-red-900/20">
+						<CardContent className="p-4">
+							<div className="flex items-center gap-2 text-red-700 dark:text-red-300">
+								<Info className="h-5 w-5" />
+								<span className="font-medium">错误:</span>
+								<span>{error}</span>
+							</div>
+						</CardContent>
+					</Card>
+				)}
+
+				{/* 主要内容区域 */}
+				<div className="flex flex-col items-center space-y-8">
+					{isLoading ? (
+						<Card className="w-full max-w-2xl">
+							<CardContent className="p-8">
+								<div className="animate-pulse space-y-4">
+									<div className="h-4 bg-gray-200 rounded w-1/3 mx-auto"></div>
+									<div className="h-4 bg-gray-200 rounded w-1/2 mx-auto"></div>
+									<div className="h-4 bg-gray-200 rounded w-2/3 mx-auto"></div>
+								</div>
+							</CardContent>
+						</Card>
+					) : isAuthenticated ? (
+						<UserProfile />
+					) : (
+						<Card className="w-full max-w-md">
+							<CardHeader className="text-center">
+								<CardTitle className="text-2xl">欢迎使用</CardTitle>
+								<CardDescription>请点击下方按钮开始 OIDC 认证流程</CardDescription>
+							</CardHeader>
+							<CardContent className="flex flex-col items-center space-y-4">
+								<LoginButton size="lg" className="w-full" />
+
+								<Separator />
+
+								<div className="text-sm text-gray-600 dark:text-gray-400 space-y-2">
+									<p className="font-medium">演示账户信息：</p>
+									<div className="bg-gray-100 dark:bg-gray-800 p-3 rounded-md">
+										<p>
+											用户名: <code className="text-sm">demouser</code>
+										</p>
+										<p>
+											密码: <code className="text-sm">demo123</code>
+										</p>
+									</div>
+								</div>
+							</CardContent>
+						</Card>
+					)}
+
+					{/* 技术信息 */}
+					<Card className="w-full max-w-4xl">
+						<CardHeader>
+							<CardTitle className="flex items-center gap-2">
+								<CheckCircle className="h-5 w-5 text-green-600" />
+								技术实现特性
+							</CardTitle>
+						</CardHeader>
+						<CardContent>
+							<div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+								<div>
+									<h4 className="font-semibold mb-3">前端技术栈</h4>
+									<div className="flex flex-wrap gap-2">
+										<Badge variant="outline">Next.js 15</Badge>
+										<Badge variant="outline">React 19</Badge>
+										<Badge variant="outline">TypeScript</Badge>
+										<Badge variant="outline">oidc-client-ts</Badge>
+										<Badge variant="outline">Tailwind CSS</Badge>
+									</div>
+								</div>
+
+								<div>
+									<h4 className="font-semibold mb-3">后端技术栈</h4>
+									<div className="flex flex-wrap gap-2">
+										<Badge variant="outline">Hono</Badge>
+										<Badge variant="outline">OIDC Provider</Badge>
+										<Badge variant="outline">Redis</Badge>
+										<Badge variant="outline">JWT</Badge>
+										<Badge variant="outline">PKCE</Badge>
+									</div>
+								</div>
+
+								<div>
+									<h4 className="font-semibold mb-3">安全特性</h4>
+									<div className="flex flex-wrap gap-2">
+										<Badge variant="secondary">授权码流程</Badge>
+										<Badge variant="secondary">PKCE 支持</Badge>
+										<Badge variant="secondary">Token 轮换</Badge>
+										<Badge variant="secondary">安全存储</Badge>
+									</div>
+								</div>
+
+								<div>
+									<h4 className="font-semibold mb-3">支持的作用域</h4>
+									<div className="flex flex-wrap gap-2">
+										<Badge variant="default">openid</Badge>
+										<Badge variant="default">profile</Badge>
+										<Badge variant="default">email</Badge>
+										<Badge variant="default">phone</Badge>
+										<Badge variant="default">address</Badge>
+									</div>
+								</div>
+							</div>
+						</CardContent>
+					</Card>
 				</div>
 			</div>
 		</div>
diff --git a/apps/web/app/test-oidc/page.tsx b/apps/web/app/test-oidc/page.tsx
new file mode 100644
index 0000000..c680bb0
--- /dev/null
+++ b/apps/web/app/test-oidc/page.tsx
@@ -0,0 +1,248 @@
+'use client';
+
+import { useState } from 'react';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@repo/ui/components/card';
+import { Button } from '@repo/ui/components/button';
+import { Badge } from '@repo/ui/components/badge';
+import { Alert, AlertDescription } from '@repo/ui/components/alert';
+import { CheckCircle, XCircle, Loader2, ArrowRight, Key, User, Shield } from 'lucide-react';
+
+export default function TestOidcPage() {
+	const [testResults, setTestResults] = useState<{
+		discovery: 'idle' | 'loading' | 'success' | 'error';
+		discoveryData?: any;
+		discoveryError?: string;
+	}>({
+		discovery: 'idle',
+	});
+
+	const testDiscoveryEndpoint = async () => {
+		setTestResults((prev) => ({ ...prev, discovery: 'loading' }));
+
+		try {
+			const response = await fetch('http://localhost:3000/oidc/.well-known/openid_configuration');
+			if (!response.ok) {
+				throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+			}
+
+			const data = await response.json();
+			setTestResults((prev) => ({
+				...prev,
+				discovery: 'success',
+				discoveryData: data,
+			}));
+		} catch (error) {
+			setTestResults((prev) => ({
+				...prev,
+				discovery: 'error',
+				discoveryError: error instanceof Error ? error.message : '未知错误',
+			}));
+		}
+	};
+
+	const startOidcFlow = () => {
+		const params = new URLSearchParams({
+			response_type: 'code',
+			client_id: 'demo-client',
+			redirect_uri: 'http://localhost:3001/auth/callback',
+			scope: 'openid profile email',
+			state: `test-${Date.now()}`,
+		});
+
+		window.location.href = `http://localhost:3000/oidc/auth?${params.toString()}`;
+	};
+
+	const getStatusIcon = (status: string) => {
+		switch (status) {
+			case 'loading':
+				return <Loader2 className="h-5 w-5 animate-spin text-blue-500" />;
+			case 'success':
+				return <CheckCircle className="h-5 w-5 text-green-500" />;
+			case 'error':
+				return <XCircle className="h-5 w-5 text-red-500" />;
+			default:
+				return <div className="h-5 w-5 rounded-full border-2 border-gray-300" />;
+		}
+	};
+
+	return (
+		<div className="min-h-screen bg-gradient-to-br from-blue-50 to-indigo-100 dark:from-gray-900 dark:to-gray-800 p-8">
+			<div className="max-w-4xl mx-auto space-y-8">
+				{/* 页面标题 */}
+				<div className="text-center">
+					<h1 className="text-3xl font-bold text-gray-900 dark:text-white mb-4">OIDC 流程测试</h1>
+					<p className="text-lg text-gray-600 dark:text-gray-300">测试和验证 OpenID Connect 认证流程的各个环节</p>
+				</div>
+
+				{/* OIDC 流程步骤 */}
+				<Card>
+					<CardHeader>
+						<CardTitle className="flex items-center gap-2">
+							<Shield className="h-5 w-5" />
+							标准 OIDC 认证流程
+						</CardTitle>
+						<CardDescription>按照正确的 OIDC 架构，所有登录都在 OIDC Provider 中处理</CardDescription>
+					</CardHeader>
+					<CardContent className="space-y-6">
+						{/* 流程步骤图示 */}
+						<div className="grid grid-cols-1 md:grid-cols-5 gap-4 text-center">
+							<div className="flex flex-col items-center space-y-2">
+								<div className="w-12 h-12 bg-blue-100 dark:bg-blue-900 rounded-full flex items-center justify-center">
+									<User className="h-6 w-6 text-blue-600 dark:text-blue-300" />
+								</div>
+								<p className="text-sm font-medium">用户点击登录</p>
+							</div>
+
+							<div className="flex items-center justify-center">
+								<ArrowRight className="h-5 w-5 text-gray-400" />
+							</div>
+
+							<div className="flex flex-col items-center space-y-2">
+								<div className="w-12 h-12 bg-green-100 dark:bg-green-900 rounded-full flex items-center justify-center">
+									<Shield className="h-6 w-6 text-green-600 dark:text-green-300" />
+								</div>
+								<p className="text-sm font-medium">重定向到 Provider</p>
+							</div>
+
+							<div className="flex items-center justify-center">
+								<ArrowRight className="h-5 w-5 text-gray-400" />
+							</div>
+
+							<div className="flex flex-col items-center space-y-2">
+								<div className="w-12 h-12 bg-purple-100 dark:bg-purple-900 rounded-full flex items-center justify-center">
+									<Key className="h-6 w-6 text-purple-600 dark:text-purple-300" />
+								</div>
+								<p className="text-sm font-medium">返回授权码</p>
+							</div>
+						</div>
+
+						{/* 测试按钮 */}
+						<div className="flex justify-center">
+							<Button onClick={startOidcFlow} size="lg" className="px-8">
+								开始 OIDC 认证流程
+							</Button>
+						</div>
+
+						{/* 提示信息 */}
+						<Alert>
+							<Shield className="h-4 w-4" />
+							<AlertDescription>
+								点击上方按钮将重定向到 OIDC Provider 的登录页面。
+								<br />
+								<strong>演示账号:</strong> demouser / demo123
+							</AlertDescription>
+						</Alert>
+					</CardContent>
+				</Card>
+
+				{/* Discovery 端点测试 */}
+				<Card>
+					<CardHeader>
+						<CardTitle className="flex items-center gap-2">
+							{getStatusIcon(testResults.discovery)}
+							Discovery 端点测试
+						</CardTitle>
+						<CardDescription>测试 OIDC Provider 的配置发现端点</CardDescription>
+					</CardHeader>
+					<CardContent className="space-y-4">
+						<Button onClick={testDiscoveryEndpoint} disabled={testResults.discovery === 'loading'}>
+							{testResults.discovery === 'loading' ? '测试中...' : '测试 Discovery 端点'}
+						</Button>
+
+						{testResults.discovery === 'error' && (
+							<Alert variant="destructive">
+								<XCircle className="h-4 w-4" />
+								<AlertDescription>
+									<strong>错误:</strong> {testResults.discoveryError}
+								</AlertDescription>
+							</Alert>
+						)}
+
+						{testResults.discovery === 'success' && testResults.discoveryData && (
+							<div className="space-y-4">
+								<Alert>
+									<CheckCircle className="h-4 w-4" />
+									<AlertDescription>
+										<strong>成功!</strong> OIDC Provider 配置已获取
+									</AlertDescription>
+								</Alert>
+
+								<div className="bg-gray-50 dark:bg-gray-800 p-4 rounded-lg">
+									<h4 className="font-semibold mb-3">Provider 信息</h4>
+									<div className="space-y-2 text-sm">
+										<p>
+											<strong>Issuer:</strong>{' '}
+											<code className="bg-gray-200 dark:bg-gray-700 px-1 rounded">
+												{testResults.discoveryData.issuer}
+											</code>
+										</p>
+										<p>
+											<strong>授权端点:</strong>{' '}
+											<code className="bg-gray-200 dark:bg-gray-700 px-1 rounded">
+												{testResults.discoveryData.authorization_endpoint}
+											</code>
+										</p>
+										<p>
+											<strong>令牌端点:</strong>{' '}
+											<code className="bg-gray-200 dark:bg-gray-700 px-1 rounded">
+												{testResults.discoveryData.token_endpoint}
+											</code>
+										</p>
+									</div>
+								</div>
+
+								<div>
+									<h4 className="font-semibold mb-3">支持的功能</h4>
+									<div className="flex flex-wrap gap-2">
+										{testResults.discoveryData.response_types_supported?.map((type: string) => (
+											<Badge key={type} variant="outline">
+												{type}
+											</Badge>
+										))}
+									</div>
+									<div className="flex flex-wrap gap-2 mt-2">
+										{testResults.discoveryData.scopes_supported?.map((scope: string) => (
+											<Badge key={scope} variant="secondary">
+												{scope}
+											</Badge>
+										))}
+									</div>
+								</div>
+							</div>
+						)}
+					</CardContent>
+				</Card>
+
+				{/* 架构说明 */}
+				<Card>
+					<CardHeader>
+						<CardTitle>正确的 OIDC 架构</CardTitle>
+					</CardHeader>
+					<CardContent className="space-y-4">
+						<div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+							<div>
+								<h4 className="font-semibold text-green-600 mb-2">✅ 已实现</h4>
+								<ul className="space-y-1 text-sm">
+									<li>• OIDC Provider 包含登录页面</li>
+									<li>• 标准授权码流程</li>
+									<li>• PKCE 支持</li>
+									<li>• 内置会话管理</li>
+									<li>• 自动令牌刷新</li>
+								</ul>
+							</div>
+							<div>
+								<h4 className="font-semibold text-red-600 mb-2">❌ 已移除</h4>
+								<ul className="space-y-1 text-sm">
+									<li>• 客户端应用的登录页面</li>
+									<li>• 自定义认证逻辑</li>
+									<li>• 重复的用户管理</li>
+									<li>• 混合认证流程</li>
+								</ul>
+							</div>
+						</div>
+					</CardContent>
+				</Card>
+			</div>
+		</div>
+	);
+}
diff --git a/apps/web/components/login-button.tsx b/apps/web/components/login-button.tsx
new file mode 100644
index 0000000..08e9490
--- /dev/null
+++ b/apps/web/components/login-button.tsx
@@ -0,0 +1,31 @@
+'use client';
+
+import { useAuth } from '@/providers/auth-provider';
+import { Button } from '@repo/ui/components/button';
+import { LogIn, Loader2 } from 'lucide-react';
+
+interface LoginButtonProps {
+	className?: string;
+	variant?: 'default' | 'destructive' | 'outline' | 'secondary' | 'ghost' | 'link';
+	size?: 'default' | 'sm' | 'lg' | 'icon';
+}
+
+export function LoginButton({ className, variant = 'default', size = 'default' }: LoginButtonProps) {
+	const { login, isLoading } = useAuth();
+
+	return (
+		<Button onClick={login} disabled={isLoading} variant={variant} size={size} className={className}>
+			{isLoading ? (
+				<>
+					<Loader2 className="mr-2 h-4 w-4 animate-spin" />
+					连接中...
+				</>
+			) : (
+				<>
+					<LogIn className="mr-2 h-4 w-4" />
+					登录
+				</>
+			)}
+		</Button>
+	);
+}
diff --git a/apps/web/components/providers.tsx b/apps/web/components/providers.tsx
index e112edb..8832538 100644
--- a/apps/web/components/providers.tsx
+++ b/apps/web/components/providers.tsx
@@ -3,6 +3,7 @@
 import * as React from 'react';
 import { ThemeProvider as NextThemesProvider } from 'next-themes';
 import QueryProvider from '@/providers/query-provider';
+import { AuthProvider } from '@/providers/auth-provider';
 
 export function Providers({ children }: { children: React.ReactNode }) {
 	return (
@@ -13,7 +14,9 @@ export function Providers({ children }: { children: React.ReactNode }) {
 			disableTransitionOnChange
 			enableColorScheme
 		>
-			<QueryProvider>{children}</QueryProvider>
+			<QueryProvider>
+				<AuthProvider>{children}</AuthProvider>
+			</QueryProvider>
 		</NextThemesProvider>
 	);
 }
diff --git a/apps/web/components/user-profile.tsx b/apps/web/components/user-profile.tsx
new file mode 100644
index 0000000..d638dc6
--- /dev/null
+++ b/apps/web/components/user-profile.tsx
@@ -0,0 +1,251 @@
+'use client';
+
+import { useAuth } from '@/providers/auth-provider';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@repo/ui/components/card';
+import { Button } from '@repo/ui/components/button';
+import { Badge } from '@repo/ui/components/badge';
+import { Separator } from '@repo/ui/components/separator';
+import { Avatar, AvatarFallback, AvatarImage } from '@repo/ui/components/avatar';
+import { LogOut, User, Mail, Phone, MapPin, Calendar, Globe } from 'lucide-react';
+
+export function UserProfile() {
+	const { user, isAuthenticated, logout, isLoading } = useAuth();
+
+	if (isLoading) {
+		return (
+			<Card className="w-full max-w-2xl">
+				<CardContent className="p-6">
+					<div className="animate-pulse space-y-4">
+						<div className="h-4 bg-gray-200 rounded w-1/3"></div>
+						<div className="h-4 bg-gray-200 rounded w-1/2"></div>
+						<div className="h-4 bg-gray-200 rounded w-2/3"></div>
+					</div>
+				</CardContent>
+			</Card>
+		);
+	}
+
+	if (!isAuthenticated || !user) {
+		return (
+			<Card className="w-full max-w-2xl">
+				<CardHeader>
+					<CardTitle>未登录</CardTitle>
+					<CardDescription>请先登录以查看用户信息</CardDescription>
+				</CardHeader>
+			</Card>
+		);
+	}
+
+	const profile = user.profile;
+	const formatDate = (timestamp?: number) => {
+		if (!timestamp) return '未知';
+		return new Date(timestamp * 1000).toLocaleString('zh-CN');
+	};
+
+	return (
+		<Card className="w-full max-w-2xl">
+			<CardHeader className="pb-4">
+				<div className="flex items-center justify-between">
+					<div className="flex items-center space-x-4">
+						<Avatar className="h-12 w-12">
+							<AvatarImage src={profile.picture} alt={profile.name} />
+							<AvatarFallback>{profile.name?.charAt(0) || profile.preferred_username?.charAt(0) || 'U'}</AvatarFallback>
+						</Avatar>
+						<div>
+							<CardTitle className="text-xl">{profile.name || profile.preferred_username || '未知用户'}</CardTitle>
+							<CardDescription>用户ID: {profile.sub}</CardDescription>
+						</div>
+					</div>
+					<Button variant="outline" onClick={logout} className="gap-2">
+						<LogOut className="h-4 w-4" />
+						登出
+					</Button>
+				</div>
+			</CardHeader>
+
+			<CardContent className="space-y-6">
+				{/* 基本信息 */}
+				<div>
+					<h3 className="text-lg font-semibold mb-3 flex items-center gap-2">
+						<User className="h-5 w-5" />
+						基本信息
+					</h3>
+					<div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+						{profile.given_name && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">名</label>
+								<p className="text-sm">{profile.given_name}</p>
+							</div>
+						)}
+						{profile.family_name && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">姓</label>
+								<p className="text-sm">{profile.family_name}</p>
+							</div>
+						)}
+						{profile.nickname && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">昵称</label>
+								<p className="text-sm">{profile.nickname}</p>
+							</div>
+						)}
+						{profile.gender && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">性别</label>
+								<p className="text-sm">{profile.gender}</p>
+							</div>
+						)}
+					</div>
+				</div>
+
+				<Separator />
+
+				{/* 联系信息 */}
+				<div>
+					<h3 className="text-lg font-semibold mb-3 flex items-center gap-2">
+						<Mail className="h-5 w-5" />
+						联系信息
+					</h3>
+					<div className="space-y-3">
+						{profile.email && (
+							<div className="flex items-center justify-between">
+								<div>
+									<label className="text-sm font-medium text-gray-600 dark:text-gray-400">邮箱</label>
+									<p className="text-sm">{profile.email}</p>
+								</div>
+								<Badge variant={profile.email_verified ? 'default' : 'secondary'}>
+									{profile.email_verified ? '已验证' : '未验证'}
+								</Badge>
+							</div>
+						)}
+						{profile.phone_number && (
+							<div className="flex items-center justify-between">
+								<div>
+									<label className="text-sm font-medium text-gray-600 dark:text-gray-400">电话</label>
+									<p className="text-sm">{profile.phone_number}</p>
+								</div>
+								<Badge variant={profile.phone_number_verified ? 'default' : 'secondary'}>
+									{profile.phone_number_verified ? '已验证' : '未验证'}
+								</Badge>
+							</div>
+						)}
+					</div>
+				</div>
+
+				{profile.address && (
+					<>
+						<Separator />
+						<div>
+							<h3 className="text-lg font-semibold mb-3 flex items-center gap-2">
+								<MapPin className="h-5 w-5" />
+								地址信息
+							</h3>
+							<div className="space-y-2">
+								{profile.address.formatted && (
+									<div>
+										<label className="text-sm font-medium text-gray-600 dark:text-gray-400">完整地址</label>
+										<p className="text-sm">{profile.address.formatted}</p>
+									</div>
+								)}
+								<div className="grid grid-cols-2 md:grid-cols-4 gap-4">
+									{profile.address.country && (
+										<div>
+											<label className="text-sm font-medium text-gray-600 dark:text-gray-400">国家</label>
+											<p className="text-sm">{profile.address.country}</p>
+										</div>
+									)}
+									{profile.address.region && (
+										<div>
+											<label className="text-sm font-medium text-gray-600 dark:text-gray-400">省/州</label>
+											<p className="text-sm">{profile.address.region}</p>
+										</div>
+									)}
+									{profile.address.locality && (
+										<div>
+											<label className="text-sm font-medium text-gray-600 dark:text-gray-400">城市</label>
+											<p className="text-sm">{profile.address.locality}</p>
+										</div>
+									)}
+									{profile.address.postal_code && (
+										<div>
+											<label className="text-sm font-medium text-gray-600 dark:text-gray-400">邮编</label>
+											<p className="text-sm">{profile.address.postal_code}</p>
+										</div>
+									)}
+								</div>
+							</div>
+						</div>
+					</>
+				)}
+
+				<Separator />
+
+				{/* 其他信息 */}
+				<div>
+					<h3 className="text-lg font-semibold mb-3 flex items-center gap-2">
+						<Globe className="h-5 w-5" />
+						其他信息
+					</h3>
+					<div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+						{profile.birthdate && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">生日</label>
+								<p className="text-sm">{profile.birthdate}</p>
+							</div>
+						)}
+						{profile.zoneinfo && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">时区</label>
+								<p className="text-sm">{profile.zoneinfo}</p>
+							</div>
+						)}
+						{profile.locale && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">语言</label>
+								<p className="text-sm">{profile.locale}</p>
+							</div>
+						)}
+						{profile.updated_at && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">更新时间</label>
+								<p className="text-sm">{formatDate(profile.updated_at)}</p>
+							</div>
+						)}
+					</div>
+				</div>
+
+				<Separator />
+
+				{/* Token 信息 */}
+				<div>
+					<h3 className="text-lg font-semibold mb-3 flex items-center gap-2">
+						<Calendar className="h-5 w-5" />
+						Token 信息
+					</h3>
+					<div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+						{user.expires_at && (
+							<div>
+								<label className="text-sm font-medium text-gray-600 dark:text-gray-400">访问令牌过期时间</label>
+								<p className="text-sm">{new Date(user.expires_at * 1000).toLocaleString('zh-CN')}</p>
+							</div>
+						)}
+						<div>
+							<label className="text-sm font-medium text-gray-600 dark:text-gray-400">Token类型</label>
+							<p className="text-sm">{user.token_type}</p>
+						</div>
+						<div className="md:col-span-2">
+							<label className="text-sm font-medium text-gray-600 dark:text-gray-400">作用域</label>
+							<div className="flex flex-wrap gap-1 mt-1">
+								{user.scope?.split(' ').map((scope) => (
+									<Badge key={scope} variant="outline" className="text-xs">
+										{scope}
+									</Badge>
+								))}
+							</div>
+						</div>
+					</div>
+				</div>
+			</CardContent>
+		</Card>
+	);
+}
diff --git a/apps/web/lib/oidc-config.ts b/apps/web/lib/oidc-config.ts
new file mode 100644
index 0000000..09ba761
--- /dev/null
+++ b/apps/web/lib/oidc-config.ts
@@ -0,0 +1,27 @@
+import { UserManager, WebStorageStateStore } from 'oidc-client-ts';
+
+// OIDC 客户端配置
+export const oidcConfig = {
+    authority: 'http://localhost:3000/oidc', // 后端OIDC provider地址
+    client_id: 'demo-client',
+    client_secret: 'demo-client-secret',
+    redirect_uri: 'http://localhost:3001/auth/callback',
+    post_logout_redirect_uri: 'http://localhost:3001',
+    response_type: 'code',
+    scope: 'openid profile email',
+    automaticSilentRenew: true,
+    includeIdTokenInSilentRenew: true,
+    revokeTokensOnSignout: true,
+    userStore: new WebStorageStateStore({ store: window?.localStorage }),
+};
+
+// 创建用户管理器实例
+export const userManager = typeof window !== 'undefined' ? new UserManager(oidcConfig) : null;
+
+// OIDC 相关的URL
+export const oidcUrls = {
+    login: `${oidcConfig.authority}/auth`,
+    logout: `${oidcConfig.authority}/logout`,
+    token: `${oidcConfig.authority}/token`,
+    userinfo: `${oidcConfig.authority}/userinfo`,
+}; 
\ No newline at end of file
diff --git a/apps/web/package.json b/apps/web/package.json
index 0cbeb59..78e928e 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,40 +1,45 @@
 {
-	"name": "web",
-	"version": "0.0.1",
-	"type": "module",
-	"private": true,
-	"scripts": {
-		"dev": "next dev --turbopack -p 3001",
-		"build": "next build",
-		"start": "next start",
-		"lint": "next lint"
-	},
-	"dependencies": {
-		"@repo/client": "workspace:*",
-		"@repo/db": "workspace:*",
-		"@repo/ui": "workspace:*",
-		"@tanstack/react-query": "^5.51.21",
-		"@trpc/client": "11.1.2",
-		"@trpc/react-query": "11.1.2",
-		"@trpc/server": "11.1.2",
-		"@trpc/tanstack-react-query": "11.1.2",
-		"axios": "^1.7.2",
-		"dayjs": "^1.11.12",
-		"lucide-react": "0.511.0",
-		"next": "15.3.2",
-		"next-themes": "^0.4.6",
-		"react": "^19.1.0",
-		"tus-js-client": "^4.1.0",
-		"react-dom": "^19.1.0",
-		"superjson": "^2.2.2"
-	},
-	"devDependencies": {
-		"@repo/eslint-config": "workspace:*",
-		"@repo/typescript-config": "workspace:*",
-		"@tailwindcss/postcss": "^4",
-		"@types/react": "^19.1.4",
-		"@types/react-dom": "^19.1.5",
-		"tailwindcss": "^4",
-		"typescript": "^5"
-	}
+  "name": "web",
+  "version": "0.0.1",
+  "type": "module",
+  "private": true,
+  "scripts": {
+    "dev": "next dev --turbopack -p 3001",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint"
+  },
+  "dependencies": {
+    "@radix-ui/react-avatar": "^1.1.10",
+    "@radix-ui/react-label": "^2.1.7",
+    "@radix-ui/react-separator": "^1.1.7",
+    "@radix-ui/react-slot": "^1.2.3",
+    "@repo/client": "workspace:*",
+    "@repo/db": "workspace:*",
+    "@repo/ui": "workspace:*",
+    "@tanstack/react-query": "^5.51.21",
+    "@trpc/client": "11.1.2",
+    "@trpc/react-query": "11.1.2",
+    "@trpc/server": "11.1.2",
+    "@trpc/tanstack-react-query": "11.1.2",
+    "axios": "^1.7.2",
+    "dayjs": "^1.11.12",
+    "lucide-react": "0.511.0",
+    "next": "15.3.2",
+    "next-themes": "^0.4.6",
+    "oidc-client-ts": "^3.2.1",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "superjson": "^2.2.2",
+    "valibot": "^1.1.0"
+  },
+  "devDependencies": {
+    "@repo/eslint-config": "workspace:*",
+    "@repo/typescript-config": "workspace:*",
+    "@tailwindcss/postcss": "^4",
+    "@types/react": "^19.1.4",
+    "@types/react-dom": "^19.1.5",
+    "tailwindcss": "^4",
+    "typescript": "^5"
+  }
 }
diff --git a/apps/web/providers/auth-provider.tsx b/apps/web/providers/auth-provider.tsx
new file mode 100644
index 0000000..55d5326
--- /dev/null
+++ b/apps/web/providers/auth-provider.tsx
@@ -0,0 +1,130 @@
+'use client';
+
+import React, { createContext, useContext, useEffect, useState, ReactNode } from 'react';
+import { User } from 'oidc-client-ts';
+import { userManager } from '@/lib/oidc-config';
+
+interface AuthContextType {
+	user: User | null;
+	isLoading: boolean;
+	isAuthenticated: boolean;
+	login: () => Promise<void>;
+	logout: () => Promise<void>;
+	error: string | null;
+}
+
+const AuthContext = createContext<AuthContextType | undefined>(undefined);
+
+export const useAuth = () => {
+	const context = useContext(AuthContext);
+	if (context === undefined) {
+		throw new Error('useAuth必须在AuthProvider内部使用');
+	}
+	return context;
+};
+
+interface AuthProviderProps {
+	children: ReactNode;
+}
+
+export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
+	const [user, setUser] = useState<User | null>(null);
+	const [isLoading, setIsLoading] = useState(true);
+	const [error, setError] = useState<string | null>(null);
+
+	const isAuthenticated = !!user && !user.expired;
+
+	useEffect(() => {
+		if (!userManager) return;
+
+		const initAuth = async () => {
+			try {
+				setIsLoading(true);
+				const currentUser = await userManager.getUser();
+				setUser(currentUser);
+			} catch (err) {
+				console.error('初始化认证失败:', err);
+				setError('认证初始化失败');
+			} finally {
+				setIsLoading(false);
+			}
+		};
+
+		initAuth();
+
+		// 监听用户状态变化
+		const handleUserLoaded = (user: User) => {
+			setUser(user);
+			setError(null);
+		};
+
+		const handleUserUnloaded = () => {
+			setUser(null);
+		};
+
+		const handleAccessTokenExpired = () => {
+			setUser(null);
+			setError('访问令牌已过期');
+		};
+
+		const handleSilentRenewError = (error: Error) => {
+			console.error('静默续约失败:', error);
+			setError('令牌续约失败');
+		};
+
+		userManager.events.addUserLoaded(handleUserLoaded);
+		userManager.events.addUserUnloaded(handleUserUnloaded);
+		userManager.events.addAccessTokenExpired(handleAccessTokenExpired);
+		userManager.events.addSilentRenewError(handleSilentRenewError);
+
+		return () => {
+			if (userManager) {
+				userManager.events.removeUserLoaded(handleUserLoaded);
+				userManager.events.removeUserUnloaded(handleUserUnloaded);
+				userManager.events.removeAccessTokenExpired(handleAccessTokenExpired);
+				userManager.events.removeSilentRenewError(handleSilentRenewError);
+			}
+		};
+	}, []);
+
+	const login = async () => {
+		if (!userManager) {
+			setError('用户管理器未初始化');
+			return;
+		}
+
+		try {
+			setError(null);
+			await userManager.signinRedirect();
+		} catch (err) {
+			console.error('登录失败:', err);
+			setError('登录失败');
+		}
+	};
+
+	const logout = async () => {
+		if (!userManager) {
+			setError('用户管理器未初始化');
+			return;
+		}
+
+		try {
+			setError(null);
+			await userManager.signoutRedirect();
+		} catch (err) {
+			console.error('登出失败:', err);
+			setError('登出失败');
+		}
+	};
+
+	const value: AuthContextType = {
+		user,
+		isLoading,
+		isAuthenticated,
+		login,
+		logout,
+		error,
+	};
+
+	return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
+};
diff --git a/packages/client/package.json b/packages/client/package.json
index 165800c..ed3abe8 100755
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -3,15 +3,12 @@
 	"version": "1.0.0",
 	"exports": {
 		".": "./src/index.ts"
-	  },
+	},
 	"sideEffects": false,
 	"files": [
 		"dist",
 		"src"
 	],
-	"dependencies": {
-		
-	},
 	"peerDependencies": {
 		"@tanstack/query-async-storage-persister": "^5.51.9",
 		"@tanstack/react-query": "^5.51.21",
@@ -25,9 +22,9 @@
 		"react": "^19.1.0"
 	},
 	"devDependencies": {
-		"rimraf": "^6.0.1",
-		"tsup": "^8.3.5",
 		"@types/react": "^19.1.4",
-		"@types/react-dom": "^19.1.5"
+		"@types/react-dom": "^19.1.5",
+		"rimraf": "^6.0.1",
+		"tsup": "^8.3.5"
 	}
 }
diff --git a/packages/oidc-provider/package.json b/packages/oidc-provider/package.json
new file mode 100644
index 0000000..542fc97
--- /dev/null
+++ b/packages/oidc-provider/package.json
@@ -0,0 +1,60 @@
+{
+  "name": "@repo/oidc-provider",
+  "version": "2.0.0",
+  "description": "OpenID Connect Provider implementation for Hono - 完全兼容 Hono 的 OIDC Provider",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@hono/zod-validator": "^0.5.0",
+    "hono": "^4.7.10",
+    "ioredis": "5.4.1",
+    "jose": "^6.0.11",
+    "nanoid": "^5.1.5",
+    "zod": "^3.25.23"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.21",
+    "typescript": "^5.0.0"
+  },
+  "peerDependencies": {
+    "hono": "^4.0.0",
+    "ioredis": "^5.0.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "keywords": [
+    "oidc",
+    "openid-connect",
+    "oauth2",
+    "hono",
+    "authentication",
+    "authorization",
+    "redis",
+    "typescript"
+  ],
+  "author": "Your Name",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/your-org/your-repo.git",
+    "directory": "packages/oidc-provider"
+  },
+  "bugs": {
+    "url": "https://github.com/your-org/your-repo/issues"
+  },
+  "homepage": "https://github.com/your-org/your-repo/tree/main/packages/oidc-provider#readme"
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/auth-manager.ts b/packages/oidc-provider/src/auth/auth-manager.ts
new file mode 100644
index 0000000..201c97c
--- /dev/null
+++ b/packages/oidc-provider/src/auth/auth-manager.ts
@@ -0,0 +1,157 @@
+import type { Context } from 'hono';
+import type { AuthorizationRequest, OIDCProviderConfig } from '../types';
+import { PasswordAuthStrategy, type AuthenticationResult, type PasswordAuthConfig } from './strategies/password-auth-strategy';
+
+/**
+ * 密码验证器类型
+ */
+export type PasswordValidator = (username: string, password: string) => Promise<string | null>;
+
+/**
+ * 认证管理器配置
+ */
+export interface AuthManagerConfig {
+  /** 会话TTL（秒） */
+  sessionTTL?: number;
+  /** 记住我最大存活时间（秒） */
+  rememberMeMaxAge?: number;
+  /** 页面配置 */
+  pageConfig?: {
+    title?: string;
+    brandName?: string;
+    logoUrl?: string;
+  };
+}
+
+/**
+ * 认证管理器
+ * 专门处理密码认证
+ */
+export class AuthManager {
+  private readonly passwordAuth: PasswordAuthStrategy;
+
+  constructor(
+    oidcConfig: OIDCProviderConfig,
+    passwordValidator: PasswordValidator,
+    config: AuthManagerConfig = {}
+  ) {
+    const passwordConfig: PasswordAuthConfig = {
+      sessionTTL: config.sessionTTL || 24 * 60 * 60, // 默认24小时
+      rememberMeMaxAge: config.rememberMeMaxAge || 30 * 24 * 60 * 60, // 默认30天
+      pageConfig: config.pageConfig || {}
+    };
+
+    this.passwordAuth = new PasswordAuthStrategy(
+      oidcConfig,
+      passwordValidator,
+      passwordConfig
+    );
+  }
+
+  /**
+   * 检查当前用户是否已认证
+   */
+  async getCurrentUser(c: Context): Promise<string | null> {
+    return await this.passwordAuth.getCurrentUser(c);
+  }
+
+  /**
+   * 处理认证要求
+   */
+  async handleAuthenticationRequired(
+    c: Context,
+    authRequest: AuthorizationRequest
+  ): Promise<Response> {
+    return await this.passwordAuth.handleAuthenticationRequired(c, authRequest);
+  }
+
+  /**
+   * 处理认证请求
+   */
+  async authenticate(c: Context): Promise<AuthenticationResult> {
+    return await this.passwordAuth.authenticate(c);
+  }
+
+  /**
+   * 处理登出请求
+   */
+  async logout(c: Context): Promise<Response> {
+    return await this.passwordAuth.logout(c);
+  }
+
+  /**
+   * 处理完整的登录流程
+   */
+  async handleLogin(c: Context, authRequest: AuthorizationRequest): Promise<Response> {
+    try {
+      // 执行认证
+      const authResult = await this.passwordAuth.authenticate(c);
+
+      if (authResult.success) {
+        // 认证成功，处理后续操作
+        return await this.handleAuthenticationSuccess(c, authResult);
+      } else {
+        // 认证失败，返回错误页面
+        return await this.handleAuthenticationFailure(c, authResult, authRequest);
+      }
+    } catch (error) {
+      console.error('登录流程处理失败:', error);
+
+      // 返回通用错误页面
+      return await this.handleAuthenticationFailure(
+        c,
+        { success: false, error: '服务器内部错误' },
+        authRequest
+      );
+    }
+  }
+
+  /**
+   * 检查认证状态并处理
+   */
+  async checkAuthenticationStatus(
+    c: Context,
+    authRequest: AuthorizationRequest
+  ): Promise<{ authenticated: boolean; userId?: string; response?: Response }> {
+    try {
+      const userId = await this.getCurrentUser(c);
+
+      if (userId) {
+        return {
+          authenticated: true,
+          userId
+        };
+      } else {
+        const response = await this.handleAuthenticationRequired(c, authRequest);
+        return {
+          authenticated: false,
+          response
+        };
+      }
+    } catch (error) {
+      console.error('检查认证状态失败:', error);
+      throw error;
+    }
+  }
+
+  /**
+   * 处理认证成功
+   */
+  private async handleAuthenticationSuccess(
+    c: Context,
+    result: AuthenticationResult
+  ): Promise<Response> {
+    return await this.passwordAuth.handleAuthenticationSuccess(c, result);
+  }
+
+  /**
+   * 处理认证失败
+   */
+  private async handleAuthenticationFailure(
+    c: Context,
+    result: AuthenticationResult,
+    authRequest: AuthorizationRequest
+  ): Promise<Response> {
+    return await this.passwordAuth.handleAuthenticationFailure(c, result, authRequest);
+  }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/index.ts b/packages/oidc-provider/src/auth/index.ts
new file mode 100644
index 0000000..4220fce
--- /dev/null
+++ b/packages/oidc-provider/src/auth/index.ts
@@ -0,0 +1,13 @@
+// 核心管理器
+export { AuthManager, type AuthManagerConfig, type PasswordValidator } from './auth-manager';
+
+// 密码认证
+export { PasswordAuthStrategy, type AuthenticationResult, type PasswordAuthConfig } from './strategies/password-auth-strategy';
+
+// 工具类
+export { CookieUtils, type CookieConfig } from './utils/cookie-utils';
+export { HtmlTemplates, type PageConfig } from './utils/html-templates';
+
+// 原有组件（向后兼容）
+export { TokenManager } from './token-manager';
+export { SessionManager } from './session-manager'; 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/session-manager.ts b/packages/oidc-provider/src/auth/session-manager.ts
new file mode 100644
index 0000000..0baedfb
--- /dev/null
+++ b/packages/oidc-provider/src/auth/session-manager.ts
@@ -0,0 +1,83 @@
+import type { StorageAdapter } from '../storage';
+import type { AuthorizationRequest } from '../types';
+
+/**
+ * 会话数据接口
+ */
+interface SessionData {
+    session_id: string;
+    user_id: string;
+    client_id: string;
+    created_at: number;
+    auth_params?: AuthorizationRequest;
+}
+
+/**
+ * 会话管理器
+ * 处理用户会话的存储业务逻辑
+ */
+export class SessionManager {
+    constructor(private storage: StorageAdapter, private sessionTTL: number = 3600) { }
+
+    private getSessionKey(sessionId: string): string {
+        return `session:${sessionId}`;
+    }
+
+    /**
+     * 生成唯一的会话ID
+     */
+    private generateSessionId(): string {
+        return Math.random().toString(36).substring(2) + Date.now().toString(36);
+    }
+
+    /**
+     * 创建新会话
+     */
+    async createSession(
+        userId: string,
+        clientId: string,
+        authParams?: AuthorizationRequest
+    ): Promise<SessionData> {
+        const sessionId = this.generateSessionId();
+        const sessionData: SessionData = {
+            session_id: sessionId,
+            user_id: userId,
+            client_id: clientId,
+            created_at: Date.now(),
+            auth_params: authParams,
+        };
+
+        await this.storeSession(sessionId, sessionData);
+        return sessionData;
+    }
+
+    /**
+     * 销毁会话
+     */
+    async destroySession(sessionId: string): Promise<void> {
+        await this.deleteSession(sessionId);
+    }
+
+    async storeSession(sessionId: string, data: any): Promise<void> {
+        const key = this.getSessionKey(sessionId);
+        await this.storage.set(key, data, this.sessionTTL);
+    }
+
+    async getSession(sessionId: string): Promise<any> {
+        const key = this.getSessionKey(sessionId);
+        return await this.storage.get(key);
+    }
+
+    async deleteSession(sessionId: string): Promise<void> {
+        const key = this.getSessionKey(sessionId);
+        await this.storage.delete(key);
+    }
+
+    async updateSession(sessionId: string, updates: any): Promise<void> {
+        const existingSession = await this.getSession(sessionId);
+        if (existingSession) {
+            const updatedSession = { ...existingSession, ...updates };
+            await this.storeSession(sessionId, updatedSession);
+        }
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/strategies/password-auth-strategy.ts b/packages/oidc-provider/src/auth/strategies/password-auth-strategy.ts
new file mode 100644
index 0000000..036bf53
--- /dev/null
+++ b/packages/oidc-provider/src/auth/strategies/password-auth-strategy.ts
@@ -0,0 +1,304 @@
+import type { Context } from 'hono';
+import type { AuthorizationRequest, LoginCredentials, PasswordValidator, OIDCProviderConfig } from '../../types';
+import { SessionManager } from '../session-manager';
+import { CookieUtils } from '../utils/cookie-utils';
+import { HtmlTemplates, type PageConfig } from '../utils/html-templates';
+
+/**
+ * 认证结果接口
+ */
+export interface AuthenticationResult {
+    /** 是否认证成功 */
+    success: boolean;
+    /** 用户ID（认证成功时） */
+    userId?: string;
+    /** 错误信息（认证失败时） */
+    error?: string;
+    /** 附加数据 */
+    metadata?: Record<string, any>;
+}
+
+/**
+ * 密码认证策略配置
+ */
+export interface PasswordAuthConfig {
+    /** 会话TTL（秒） */
+    sessionTTL?: number;
+    /** 页面配置 */
+    pageConfig?: PageConfig;
+    /** 记住我功能的最大时长（秒） */
+    rememberMeMaxAge?: number;
+}
+
+/**
+ * 密码认证服务
+ * 实现基于用户名和密码的传统认证方式
+ */
+export class PasswordAuthStrategy {
+    readonly name = 'password';
+
+    private readonly sessionManager: SessionManager;
+    private readonly config: PasswordAuthConfig;
+
+    constructor(
+        private readonly oidcConfig: OIDCProviderConfig,
+        private readonly passwordValidator: PasswordValidator,
+        config: PasswordAuthConfig = {}
+    ) {
+        this.config = {
+            sessionTTL: 24 * 60 * 60, // 默认24小时
+            rememberMeMaxAge: 30 * 24 * 60 * 60, // 默认30天
+            ...config
+        };
+        this.sessionManager = new SessionManager(oidcConfig.storage, this.config.sessionTTL);
+    }
+
+    /**
+     * 检查当前用户是否已认证
+     */
+    async getCurrentUser(c: Context): Promise<string | null> {
+        const sessionId = CookieUtils.getSessionIdFromCookie(c);
+        if (!sessionId) {
+            return null;
+        }
+
+        try {
+            const session = await this.sessionManager.getSession(sessionId);
+            return session?.user_id || null;
+        } catch (error) {
+            console.error('获取会话失败:', error);
+            return null;
+        }
+    }
+
+    /**
+     * 处理认证要求 - 显示登录页面
+     */
+    async handleAuthenticationRequired(c: Context, authRequest: AuthorizationRequest): Promise<Response> {
+        const loginHtml = HtmlTemplates.generateLoginPage(authRequest, this.config.pageConfig);
+
+        c.header('Content-Type', 'text/html; charset=utf-8');
+        return c.body(loginHtml);
+    }
+
+    /**
+     * 处理认证请求
+     */
+    async authenticate(c: Context): Promise<AuthenticationResult> {
+        try {
+            // 解析表单数据
+            const formData = await c.req.formData();
+            const credentials = this.parseCredentials(formData);
+            const authParams = this.extractAuthParams(formData);
+
+            // 验证输入
+            const validationError = this.validateCredentials(credentials);
+            if (validationError) {
+                return {
+                    success: false,
+                    error: validationError
+                };
+            }
+
+            // 验证用户密码
+            const userId = await this.passwordValidator(credentials.username, credentials.password);
+            if (!userId) {
+                return {
+                    success: false,
+                    error: '用户名或密码错误'
+                };
+            }
+
+            // 检查用户是否存在
+            const user = await this.oidcConfig.findUser(userId);
+            if (!user) {
+                return {
+                    success: false,
+                    error: '用户不存在'
+                };
+            }
+
+            // 创建会话
+            const session = await this.sessionManager.createSession(
+                userId,
+                authParams.client_id,
+                authParams
+            );
+
+            // 设置Cookie
+            const maxAge = credentials.remember_me
+                ? this.config.rememberMeMaxAge!
+                : this.config.sessionTTL!;
+
+            return {
+                success: true,
+                userId,
+                metadata: {
+                    sessionId: session.session_id,
+                    maxAge,
+                    authParams,
+                    rememberMe: credentials.remember_me
+                }
+            };
+
+        } catch (error) {
+            console.error('认证处理失败:', error);
+            return {
+                success: false,
+                error: '服务器内部错误，请稍后重试'
+            };
+        }
+    }
+
+    /**
+     * 处理登出请求
+     */
+    async logout(c: Context): Promise<Response> {
+        const sessionId = CookieUtils.getSessionIdFromCookie(c);
+
+        if (sessionId) {
+            try {
+                await this.sessionManager.destroySession(sessionId);
+            } catch (error) {
+                console.error('销毁会话失败:', error);
+            }
+        }
+
+        // 清除Cookie
+        CookieUtils.clearSessionCookie(c);
+
+        // 处理重定向
+        const postLogoutRedirectUri = c.req.query('post_logout_redirect_uri');
+        const state = c.req.query('state');
+
+        if (postLogoutRedirectUri) {
+            const redirectUrl = this.buildPostLogoutRedirectUrl(postLogoutRedirectUri, state);
+            return c.redirect(redirectUrl);
+        }
+
+        return c.json({
+            message: '已成功登出',
+            timestamp: new Date().toISOString()
+        });
+    }
+
+    /**
+     * 处理认证成功后的操作
+     */
+    async handleAuthenticationSuccess(
+        c: Context,
+        result: AuthenticationResult
+    ): Promise<Response> {
+        if (!result.success || !result.metadata) {
+            throw new Error('认证结果无效');
+        }
+
+        const { sessionId, maxAge, authParams } = result.metadata;
+
+        // 设置会话Cookie
+        CookieUtils.setSessionCookie(c, sessionId, maxAge);
+
+        // 重定向到授权端点
+        const authUrl = this.buildAuthorizationUrl(authParams);
+        return c.redirect(authUrl);
+    }
+
+    /**
+     * 处理认证失败后的操作
+     */
+    async handleAuthenticationFailure(
+        c: Context,
+        result: AuthenticationResult,
+        authRequest: AuthorizationRequest
+    ): Promise<Response> {
+        const errorHtml = HtmlTemplates.generateLoginPage(
+            authRequest,
+            this.config.pageConfig,
+            result.error
+        );
+
+        c.header('Content-Type', 'text/html; charset=utf-8');
+        return c.body(errorHtml);
+    }
+
+    /**
+     * 解析登录凭据
+     */
+    private parseCredentials(formData: FormData): LoginCredentials {
+        return {
+            username: formData.get('username')?.toString() || '',
+            password: formData.get('password')?.toString() || '',
+            remember_me: formData.get('remember_me') === 'on',
+        };
+    }
+
+    /**
+     * 验证登录凭据
+     */
+    private validateCredentials(credentials: LoginCredentials): string | null {
+        if (!credentials.username.trim()) {
+            return '请输入用户名';
+        }
+
+        if (!credentials.password) {
+            return '请输入密码';
+        }
+
+        if (credentials.username.length > 100) {
+            return '用户名过长';
+        }
+
+        if (credentials.password.length > 200) {
+            return '密码过长';
+        }
+
+        return null;
+    }
+
+    /**
+     * 构建登出后重定向URL
+     */
+    private buildPostLogoutRedirectUrl(redirectUri: string, state?: string): string {
+        if (!state) {
+            return redirectUri;
+        }
+
+        const url = new URL(redirectUri);
+        url.searchParams.set('state', state);
+        return url.toString();
+    }
+
+    /**
+     * 构建授权URL
+     */
+    protected buildAuthorizationUrl(authParams: AuthorizationRequest): string {
+        const params = new URLSearchParams();
+        params.set('response_type', authParams.response_type);
+        params.set('client_id', authParams.client_id);
+        params.set('redirect_uri', authParams.redirect_uri);
+        params.set('scope', authParams.scope);
+
+        if (authParams.state) params.set('state', authParams.state);
+        if (authParams.nonce) params.set('nonce', authParams.nonce);
+        if (authParams.code_challenge) params.set('code_challenge', authParams.code_challenge);
+        if (authParams.code_challenge_method) params.set('code_challenge_method', authParams.code_challenge_method);
+
+        return `/oidc/auth?${params.toString()}`;
+    }
+
+    /**
+     * 从表单数据提取授权参数
+     */
+    protected extractAuthParams(formData: FormData): AuthorizationRequest {
+        return {
+            response_type: formData.get('response_type')?.toString() || '',
+            client_id: formData.get('client_id')?.toString() || '',
+            redirect_uri: formData.get('redirect_uri')?.toString() || '',
+            scope: formData.get('scope')?.toString() || '',
+            state: formData.get('state')?.toString(),
+            nonce: formData.get('nonce')?.toString(),
+            code_challenge: formData.get('code_challenge')?.toString(),
+            code_challenge_method: formData.get('code_challenge_method')?.toString() as 'plain' | 'S256' | undefined,
+        };
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/token-manager.ts b/packages/oidc-provider/src/auth/token-manager.ts
new file mode 100644
index 0000000..0e18d26
--- /dev/null
+++ b/packages/oidc-provider/src/auth/token-manager.ts
@@ -0,0 +1,205 @@
+import type {
+    AuthorizationCode,
+    AccessToken,
+    RefreshToken,
+    IDToken,
+} from '../types';
+import type { StorageAdapter } from '../storage';
+
+/**
+ * 令牌管理器
+ * 处理所有令牌相关的存储业务逻辑
+ */
+export class TokenManager {
+    constructor(private storage: StorageAdapter) { }
+
+    // 生成存储键
+    private getTokenKey(type: string, token: string): string {
+        return `${type}:${token}`;
+    }
+
+    private getUserClientKey(type: string, userId: string, clientId: string): string {
+        return `${type}:user:${userId}:client:${clientId}`;
+    }
+
+    // 授权码管理
+    async storeAuthorizationCode(authCode: AuthorizationCode): Promise<void> {
+        const key = this.getTokenKey('auth_code', authCode.code);
+        const ttl = Math.floor((authCode.expires_at.getTime() - Date.now()) / 1000);
+
+        const data = {
+            ...authCode,
+            expires_at: authCode.expires_at.toISOString(),
+            created_at: authCode.created_at.toISOString(),
+        };
+
+        await this.storage.set(key, data, Math.max(ttl, 1));
+    }
+
+    async getAuthorizationCode(code: string): Promise<AuthorizationCode | null> {
+        const key = this.getTokenKey('auth_code', code);
+        const data = await this.storage.get(key);
+        if (!data) return null;
+
+        return {
+            ...data,
+            expires_at: new Date(data.expires_at),
+            created_at: new Date(data.created_at),
+        };
+    }
+
+    async deleteAuthorizationCode(code: string): Promise<void> {
+        const key = this.getTokenKey('auth_code', code);
+        await this.storage.delete(key);
+    }
+
+    // 访问令牌管理
+    async storeAccessToken(token: AccessToken): Promise<void> {
+        const key = this.getTokenKey('access_token', token.token);
+        const userClientKey = this.getUserClientKey('access_tokens', token.user_id, token.client_id);
+        const ttl = Math.floor((token.expires_at.getTime() - Date.now()) / 1000);
+
+        const data = {
+            ...token,
+            expires_at: token.expires_at.toISOString(),
+            created_at: token.created_at.toISOString(),
+        };
+
+        // 存储令牌数据
+        await this.storage.set(key, data, Math.max(ttl, 1));
+
+        // 存储用户-客户端索引
+        const existingTokens = await this.storage.get<string[]>(userClientKey) || [];
+        existingTokens.push(token.token);
+        await this.storage.set(userClientKey, existingTokens, Math.max(ttl, 1));
+    }
+
+    async getAccessToken(token: string): Promise<AccessToken | null> {
+        const key = this.getTokenKey('access_token', token);
+        const data = await this.storage.get(key);
+        if (!data) return null;
+
+        return {
+            ...data,
+            expires_at: new Date(data.expires_at),
+            created_at: new Date(data.created_at),
+        };
+    }
+
+    async deleteAccessToken(token: string): Promise<void> {
+        const key = this.getTokenKey('access_token', token);
+
+        // 获取令牌数据以清理索引
+        const tokenData = await this.storage.get(key);
+        if (tokenData) {
+            const userClientKey = this.getUserClientKey('access_tokens', tokenData.user_id, tokenData.client_id);
+            const tokens = await this.storage.get<string[]>(userClientKey) || [];
+            const filteredTokens = tokens.filter(t => t !== token);
+
+            if (filteredTokens.length > 0) {
+                await this.storage.set(userClientKey, filteredTokens);
+            } else {
+                await this.storage.delete(userClientKey);
+            }
+        }
+
+        await this.storage.delete(key);
+    }
+
+    async deleteAccessTokensByUserAndClient(userId: string, clientId: string): Promise<void> {
+        const userClientKey = this.getUserClientKey('access_tokens', userId, clientId);
+        const tokens = await this.storage.get<string[]>(userClientKey) || [];
+
+        // 删除所有相关令牌
+        for (const token of tokens) {
+            await this.storage.delete(this.getTokenKey('access_token', token));
+        }
+
+        // 删除索引
+        await this.storage.delete(userClientKey);
+    }
+
+    // 刷新令牌管理
+    async storeRefreshToken(token: RefreshToken): Promise<void> {
+        const key = this.getTokenKey('refresh_token', token.token);
+        const userClientKey = this.getUserClientKey('refresh_tokens', token.user_id, token.client_id);
+        const ttl = Math.floor((token.expires_at.getTime() - Date.now()) / 1000);
+
+        const data = {
+            ...token,
+            expires_at: token.expires_at.toISOString(),
+            created_at: token.created_at.toISOString(),
+        };
+
+        // 存储令牌数据
+        await this.storage.set(key, data, Math.max(ttl, 1));
+
+        // 存储用户-客户端索引
+        const existingTokens = await this.storage.get<string[]>(userClientKey) || [];
+        existingTokens.push(token.token);
+        await this.storage.set(userClientKey, existingTokens, Math.max(ttl, 1));
+    }
+
+    async getRefreshToken(token: string): Promise<RefreshToken | null> {
+        const key = this.getTokenKey('refresh_token', token);
+        const data = await this.storage.get(key);
+        if (!data) return null;
+
+        return {
+            ...data,
+            expires_at: new Date(data.expires_at),
+            created_at: new Date(data.created_at),
+        };
+    }
+
+    async deleteRefreshToken(token: string): Promise<void> {
+        const key = this.getTokenKey('refresh_token', token);
+
+        // 获取令牌数据以清理索引
+        const tokenData = await this.storage.get(key);
+        if (tokenData) {
+            const userClientKey = this.getUserClientKey('refresh_tokens', tokenData.user_id, tokenData.client_id);
+            const tokens = await this.storage.get<string[]>(userClientKey) || [];
+            const filteredTokens = tokens.filter(t => t !== token);
+
+            if (filteredTokens.length > 0) {
+                await this.storage.set(userClientKey, filteredTokens);
+            } else {
+                await this.storage.delete(userClientKey);
+            }
+        }
+
+        await this.storage.delete(key);
+    }
+
+    // ID令牌管理
+    async storeIDToken(token: IDToken): Promise<void> {
+        const key = this.getTokenKey('id_token', token.token);
+        const ttl = Math.floor((token.expires_at.getTime() - Date.now()) / 1000);
+
+        const data = {
+            ...token,
+            expires_at: token.expires_at.toISOString(),
+            created_at: token.created_at.toISOString(),
+        };
+
+        await this.storage.set(key, data, Math.max(ttl, 1));
+    }
+
+    async getIDToken(token: string): Promise<IDToken | null> {
+        const key = this.getTokenKey('id_token', token);
+        const data = await this.storage.get(key);
+        if (!data) return null;
+
+        return {
+            ...data,
+            expires_at: new Date(data.expires_at),
+            created_at: new Date(data.created_at),
+        };
+    }
+
+    async deleteIDToken(token: string): Promise<void> {
+        const key = this.getTokenKey('id_token', token);
+        await this.storage.delete(key);
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/utils/cookie-utils.ts b/packages/oidc-provider/src/auth/utils/cookie-utils.ts
new file mode 100644
index 0000000..18a754b
--- /dev/null
+++ b/packages/oidc-provider/src/auth/utils/cookie-utils.ts
@@ -0,0 +1,121 @@
+import type { Context } from 'hono';
+
+/**
+ * Cookie配置接口
+ */
+export interface CookieConfig {
+  /** Cookie名称 */
+  name: string;
+  /** 过期时间（秒） */
+  maxAge?: number;
+  /** 路径 */
+  path?: string;
+  /** 域名 */
+  domain?: string;
+  /** 是否安全连接 */
+  secure?: boolean;
+  /** HttpOnly标志 */
+  httpOnly?: boolean;
+  /** SameSite属性 */
+  sameSite?: 'Strict' | 'Lax' | 'None';
+}
+
+/**
+ * Cookie工具类
+ */
+export class CookieUtils {
+  private static readonly DEFAULT_SESSION_COOKIE_NAME = 'oidc-session';
+  private static readonly DEFAULT_MAX_AGE = 24 * 60 * 60; // 24小时
+
+  /**
+   * 设置Cookie
+   */
+  static setCookie(c: Context, value: string, config: Partial<CookieConfig> = {}): void {
+    const {
+      name = this.DEFAULT_SESSION_COOKIE_NAME,
+      maxAge = this.DEFAULT_MAX_AGE,
+      path = '/',
+      secure = process.env.NODE_ENV === 'production',
+      httpOnly = true,
+      sameSite = process.env.NODE_ENV === 'production' ? 'None' : 'Lax'
+    } = config;
+
+    const cookieParts = [
+      `${name}=${encodeURIComponent(value)}`,
+      `Path=${path}`,
+      `Max-Age=${maxAge}`
+    ];
+
+    if (httpOnly) cookieParts.push('HttpOnly');
+    if (secure) cookieParts.push('Secure');
+    cookieParts.push(`SameSite=${sameSite}`);
+
+    c.header('Set-Cookie', cookieParts.join('; '));
+  }
+
+  /**
+   * 设置会话Cookie
+   */
+  static setSessionCookie(c: Context, sessionId: string, maxAge?: number): void {
+    this.setCookie(c, sessionId, {
+      name: this.DEFAULT_SESSION_COOKIE_NAME,
+      maxAge: maxAge || this.DEFAULT_MAX_AGE
+    });
+  }
+
+  /**
+   * 清除Cookie
+   */
+  static clearCookie(c: Context, name: string = this.DEFAULT_SESSION_COOKIE_NAME): void {
+    this.setCookie(c, '', {
+      name,
+      maxAge: 0
+    });
+  }
+
+  /**
+   * 清除会话Cookie
+   */
+  static clearSessionCookie(c: Context): void {
+    this.clearCookie(c, this.DEFAULT_SESSION_COOKIE_NAME);
+  }
+
+  /**
+   * 获取Cookie值
+   */
+  static getCookie(c: Context, name: string): string | null {
+    const cookieHeader = c.req.header('Cookie');
+    if (!cookieHeader) return null;
+
+    const regex = new RegExp(`(?:^|; )${name}=([^;]*)`);
+    const match = cookieHeader.match(regex);
+    
+    return match && match[1] ? decodeURIComponent(match[1]) : null;
+  }
+
+  /**
+   * 获取会话ID从Cookie
+   */
+  static getSessionIdFromCookie(c: Context): string | null {
+    return this.getCookie(c, this.DEFAULT_SESSION_COOKIE_NAME);
+  }
+
+  /**
+   * 解析所有Cookie
+   */
+  static parseAllCookies(c: Context): Record<string, string> {
+    const cookieHeader = c.req.header('Cookie');
+    if (!cookieHeader) return {};
+
+    const cookies: Record<string, string> = {};
+    
+    cookieHeader.split(';').forEach(cookie => {
+      const [name, ...rest] = cookie.trim().split('=');
+      if (name && rest.length > 0) {
+        cookies[name] = decodeURIComponent(rest.join('='));
+      }
+    });
+
+    return cookies;
+  }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/auth/utils/html-templates.ts b/packages/oidc-provider/src/auth/utils/html-templates.ts
new file mode 100644
index 0000000..4f6f057
--- /dev/null
+++ b/packages/oidc-provider/src/auth/utils/html-templates.ts
@@ -0,0 +1,341 @@
+import type { AuthorizationRequest } from '../../types';
+
+/**
+ * 页面配置接口
+ */
+export interface PageConfig {
+    /** 页面标题 */
+    title?: string;
+    /** 品牌名称 */
+    brandName?: string;
+    /** 自定义CSS */
+    customCSS?: string;
+    /** 自定义Logo URL */
+    logoUrl?: string;
+}
+
+/**
+ * HTML模板工具类
+ */
+export class HtmlTemplates {
+    private static readonly DEFAULT_TITLE = '用户登录';
+    private static readonly DEFAULT_BRAND_NAME = 'OIDC Provider';
+
+    /**
+     * 生成登录页面HTML
+     */
+    static generateLoginPage(
+        authRequest: AuthorizationRequest,
+        config: PageConfig = {},
+        error?: string
+    ): string {
+        const {
+            title = this.DEFAULT_TITLE,
+            brandName = this.DEFAULT_BRAND_NAME,
+            customCSS = '',
+            logoUrl
+        } = config;
+
+        return `
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${this.escapeHtml(title)}</title>
+    <style>
+        ${this.getDefaultStyles()}
+        ${customCSS}
+    </style>
+</head>
+<body>
+    <div class="login-container">
+        <div class="login-header">
+            ${logoUrl ? `<img src="${this.escapeHtml(logoUrl)}" alt="Logo" class="logo" />` : ''}
+            <h1>${this.escapeHtml(brandName)}</h1>
+            <p>请登录以继续访问应用</p>
+        </div>
+        
+        <form class="login-form" method="POST" action="/oidc/login">
+            ${error ? `<div class="error-message">${this.escapeHtml(error)}</div>` : ''}
+            
+            <div class="client-info">
+                <h3>应用授权</h3>
+                <p>应用 <strong>${this.escapeHtml(authRequest.client_id)}</strong> 请求访问您的账户信息</p>
+                <p class="scope-info">权限范围: <code>${this.escapeHtml(authRequest.scope)}</code></p>
+            </div>
+            
+            <div class="form-group">
+                <label for="username">用户名</label>
+                <input type="text" id="username" name="username" required autocomplete="username" />
+            </div>
+            
+            <div class="form-group">
+                <label for="password">密码</label>
+                <input type="password" id="password" name="password" required autocomplete="current-password" />
+            </div>
+            
+            <div class="checkbox-group">
+                <input type="checkbox" id="remember_me" name="remember_me" />
+                <label for="remember_me">记住我</label>
+            </div>
+            
+            ${this.generateHiddenFields(authRequest)}
+            
+            <button type="submit" class="login-button">登录</button>
+        </form>
+    </div>
+</body>
+</html>`;
+    }
+
+    /**
+     * 生成错误页面HTML
+     */
+    static generateErrorPage(
+        error: string,
+        description?: string,
+        config: PageConfig = {}
+    ): string {
+        const {
+            title = '认证错误',
+            brandName = this.DEFAULT_BRAND_NAME
+        } = config;
+
+        return `
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${this.escapeHtml(title)}</title>
+    <style>
+        ${this.getDefaultStyles()}
+        .error-container {
+            max-width: 500px;
+            margin: 2rem auto;
+            padding: 2rem;
+            background: white;
+            border-radius: 12px;
+            box-shadow: 0 10px 30px rgba(0, 0, 0, 0.1);
+            text-align: center;
+        }
+        .error-icon {
+            font-size: 3rem;
+            color: #dc2626;
+            margin-bottom: 1rem;
+        }
+    </style>
+</head>
+<body>
+    <div class="error-container">
+        <div class="error-icon">⚠️</div>
+        <h1>${this.escapeHtml(brandName)}</h1>
+        <h2>认证失败</h2>
+        <div class="error-message">
+            <strong>${this.escapeHtml(error)}</strong>
+            ${description ? `<p>${this.escapeHtml(description)}</p>` : ''}
+        </div>
+        <button onclick="history.back()" class="login-button" style="margin-top: 1rem;">返回</button>
+    </div>
+</body>
+</html>`;
+    }
+
+    /**
+     * 获取默认样式
+     */
+    private static getDefaultStyles(): string {
+        return `
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+        
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', sans-serif;
+            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 20px;
+        }
+        
+        .login-container {
+            background: white;
+            border-radius: 12px;
+            box-shadow: 0 10px 30px rgba(0, 0, 0, 0.1);
+            overflow: hidden;
+            max-width: 400px;
+            width: 100%;
+        }
+        
+        .login-header {
+            background: #4f46e5;
+            color: white;
+            padding: 2rem;
+            text-align: center;
+        }
+        
+        .logo {
+            max-width: 60px;
+            height: auto;
+            margin-bottom: 1rem;
+            border-radius: 8px;
+        }
+        
+        .login-header h1 {
+            font-size: 1.5rem;
+            margin-bottom: 0.5rem;
+        }
+        
+        .login-header p {
+            opacity: 0.9;
+            font-size: 0.875rem;
+        }
+        
+        .login-form {
+            padding: 2rem;
+        }
+        
+        .form-group {
+            margin-bottom: 1.5rem;
+        }
+        
+        .form-group label {
+            display: block;
+            margin-bottom: 0.5rem;
+            font-weight: 500;
+            color: #374151;
+        }
+        
+        .form-group input {
+            width: 100%;
+            padding: 0.75rem;
+            border: 1px solid #d1d5db;
+            border-radius: 6px;
+            font-size: 1rem;
+            transition: border-color 0.2s, box-shadow 0.2s;
+        }
+        
+        .form-group input:focus {
+            outline: none;
+            border-color: #4f46e5;
+            box-shadow: 0 0 0 3px rgba(79, 70, 229, 0.1);
+        }
+        
+        .checkbox-group {
+            display: flex;
+            align-items: center;
+            margin-bottom: 1.5rem;
+        }
+        
+        .checkbox-group input {
+            margin-right: 0.5rem;
+        }
+        
+        .checkbox-group label {
+            margin: 0;
+            font-weight: normal;
+            font-size: 0.875rem;
+            color: #6b7280;
+            cursor: pointer;
+        }
+        
+        .login-button {
+            width: 100%;
+            background: #4f46e5;
+            color: white;
+            border: none;
+            border-radius: 6px;
+            padding: 0.75rem;
+            font-size: 1rem;
+            font-weight: 500;
+            cursor: pointer;
+            transition: background-color 0.2s;
+        }
+        
+        .login-button:hover {
+            background: #4338ca;
+        }
+        
+        .login-button:active {
+            background: #3730a3;
+        }
+        
+        .error-message {
+            background: #fee2e2;
+            border: 1px solid #fecaca;
+            color: #dc2626;
+            padding: 0.75rem;
+            border-radius: 6px;
+            margin-bottom: 1.5rem;
+            font-size: 0.875rem;
+        }
+        
+        .client-info {
+            background: #f9fafb;
+            border: 1px solid #e5e7eb;
+            border-radius: 6px;
+            padding: 1rem;
+            margin-bottom: 1.5rem;
+        }
+        
+        .client-info h3 {
+            font-size: 0.875rem;
+            font-weight: 600;
+            color: #374151;
+            margin-bottom: 0.5rem;
+        }
+        
+        .client-info p {
+            font-size: 0.75rem;
+            color: #6b7280;
+            margin-bottom: 0.25rem;
+        }
+        
+        .scope-info code {
+            background: #e5e7eb;
+            padding: 0.125rem 0.25rem;
+            border-radius: 3px;
+            font-size: 0.7rem;
+        }
+    `;
+    }
+
+    /**
+     * 生成隐藏字段
+     */
+    private static generateHiddenFields(authRequest: AuthorizationRequest): string {
+        const fields = [
+            { name: 'response_type', value: authRequest.response_type },
+            { name: 'client_id', value: authRequest.client_id },
+            { name: 'redirect_uri', value: authRequest.redirect_uri },
+            { name: 'scope', value: authRequest.scope },
+        ];
+
+        // 可选字段
+        if (authRequest.state) fields.push({ name: 'state', value: authRequest.state });
+        if (authRequest.nonce) fields.push({ name: 'nonce', value: authRequest.nonce });
+        if (authRequest.code_challenge) fields.push({ name: 'code_challenge', value: authRequest.code_challenge });
+        if (authRequest.code_challenge_method) fields.push({ name: 'code_challenge_method', value: authRequest.code_challenge_method });
+
+        return fields
+            .map(field => `<input type="hidden" name="${this.escapeHtml(field.name)}" value="${this.escapeHtml(field.value)}" />`)
+            .join('\n            ');
+    }
+
+    /**
+     * 转义HTML字符
+     */
+    private static escapeHtml(unsafe: string): string {
+        return unsafe
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#039;');
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/index.ts b/packages/oidc-provider/src/index.ts
new file mode 100644
index 0000000..db6c9c7
--- /dev/null
+++ b/packages/oidc-provider/src/index.ts
@@ -0,0 +1,60 @@
+// 核心类
+export { OIDCProvider } from './provider';
+
+// 类型定义
+export type {
+    OIDCProviderConfig,
+    OIDCClient,
+    OIDCUser,
+    AuthorizationCode,
+    AccessToken,
+    RefreshToken,
+    IDToken,
+    AuthorizationRequest,
+    TokenRequest,
+    TokenResponse,
+    OIDCError,
+    DiscoveryDocument,
+    UserSession,
+    LoginCredentials,
+    PasswordValidator,
+} from './types';
+
+// 存储适配器接口和示例实现
+export type { StorageAdapter } from './storage';
+export { RedisStorageAdapter } from './storage';
+
+// Hono中间件
+export {
+    createOIDCProvider,
+    oidcProvider,
+    getOIDCProvider
+} from './middleware/hono';
+
+// 导出中间件配置类型
+export type {
+    OIDCHonoOptions
+} from './middleware/hono';
+
+// 工具类
+export { JWTUtils } from './utils/jwt';
+export { PKCEUtils } from './utils/pkce';
+export { ValidationUtils } from './utils/validation';
+
+// 认证模块
+export {
+    AuthManager,
+    PasswordAuthStrategy,
+    CookieUtils,
+    HtmlTemplates,
+    SessionManager,
+    TokenManager
+} from './auth';
+
+export type {
+    AuthManagerConfig,
+    PasswordAuthConfig,
+    AuthenticationResult,
+    CookieConfig,
+    PageConfig
+} from './auth'; 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/middleware/hono.ts b/packages/oidc-provider/src/middleware/hono.ts
new file mode 100644
index 0000000..d4b2293
--- /dev/null
+++ b/packages/oidc-provider/src/middleware/hono.ts
@@ -0,0 +1,335 @@
+import { Hono } from 'hono';
+import type { Context, Next } from 'hono';
+import { OIDCProvider } from '../provider';
+import type { OIDCProviderConfig, AuthorizationRequest, TokenRequest } from '../types';
+import { AuthManager, type PasswordValidator } from '../auth';
+
+/**
+ * OIDC Provider配置选项
+ */
+export interface OIDCHonoOptions {
+    /** OIDC Provider配置 */
+    config: OIDCProviderConfig;
+    /** 密码验证器 - 用于验证用户名和密码 */
+    passwordValidator: PasswordValidator;
+    /** 认证配置选项 */
+    authConfig?: {
+        /** 会话TTL（秒） */
+        sessionTTL?: number;
+        /** 登录页面标题 */
+        loginPageTitle?: string;
+        /** 品牌名称 */
+        brandName?: string;
+        /** 品牌Logo URL */
+        logoUrl?: string;
+    };
+}
+
+/**
+ * 创建OIDC Provider Hono应用
+ */
+export function createOIDCProvider(options: OIDCHonoOptions): Hono {
+    const { config, passwordValidator, authConfig = {} } = options;
+
+    // 创建认证管理器
+    const authManager = new AuthManager(
+        config,
+        passwordValidator,
+        {
+            sessionTTL: authConfig.sessionTTL,
+            pageConfig: {
+                title: authConfig.loginPageTitle,
+                brandName: authConfig.brandName,
+                logoUrl: authConfig.logoUrl
+            }
+        }
+    );
+
+    const app = new Hono();
+    const provider = new OIDCProvider(config);
+
+    // 登录端点
+    app.post('/login', async (c: Context) => {
+        // 从表单中提取授权参数
+        const formData = await c.req.formData();
+        const authRequest = {
+            response_type: formData.get('response_type')?.toString() || '',
+            client_id: formData.get('client_id')?.toString() || '',
+            redirect_uri: formData.get('redirect_uri')?.toString() || '',
+            scope: formData.get('scope')?.toString() || '',
+            state: formData.get('state')?.toString(),
+            nonce: formData.get('nonce')?.toString(),
+            code_challenge: formData.get('code_challenge')?.toString(),
+            code_challenge_method: formData.get('code_challenge_method')?.toString() as 'plain' | 'S256' | undefined,
+        };
+
+        return await authManager.handleLogin(c, authRequest);
+    });
+
+    // 登出端点
+    app.get('/logout', async (c: Context) => {
+        return await authManager.logout(c);
+    });
+
+    app.post('/logout', async (c: Context) => {
+        return await authManager.logout(c);
+    });
+
+    // 发现文档端点
+    app.get('/.well-known/openid-configuration', async (c: Context) => {
+        const discovery = provider.getDiscoveryDocument();
+        return c.json(discovery);
+    });
+
+    // JWKS端点
+    app.get('/.well-known/jwks.json', async (c: Context) => {
+        const jwks = await provider.getJWKS();
+        return c.json(jwks);
+    });
+
+    // 授权端点 - 使用认证管理器
+    app.get('/auth', async (c: Context) => {
+        const query = c.req.query();
+
+        const authRequest: AuthorizationRequest = {
+            response_type: query.response_type || '',
+            client_id: query.client_id || '',
+            redirect_uri: query.redirect_uri || '',
+            scope: query.scope || '',
+            state: query.state,
+            nonce: query.nonce,
+            code_challenge: query.code_challenge,
+            code_challenge_method: query.code_challenge_method as 'plain' | 'S256' | undefined,
+            prompt: query.prompt,
+            max_age: query.max_age ? parseInt(query.max_age) : undefined,
+            id_token_hint: query.id_token_hint,
+            login_hint: query.login_hint,
+            acr_values: query.acr_values,
+        };
+
+        // 检查用户认证状态
+        const userId = await authManager.getCurrentUser(c);
+        if (!userId) {
+            // 用户未认证，显示登录页面
+            return await authManager.handleAuthenticationRequired(c, authRequest);
+        }
+
+        // 用户已认证，处理授权请求
+        const result = await provider.handleAuthorizationRequest(authRequest, userId);
+
+        if (!result.success) {
+            const error = result.error;
+            const errorParams = new URLSearchParams({
+                error: error.error,
+                ...(error.error_description && { error_description: error.error_description }),
+                ...(error.error_uri && { error_uri: error.error_uri }),
+                ...(error.state && { state: error.state }),
+            });
+
+            const redirectUri = result.redirectUri || query.redirect_uri;
+            if (redirectUri) {
+                return c.redirect(`${redirectUri}?${errorParams.toString()}`);
+            } else {
+                c.status(400);
+                return c.json({
+                    error: error.error,
+                    error_description: error.error_description,
+                });
+            }
+        }
+
+        // 成功生成授权码，重定向回客户端
+        const params = new URLSearchParams({
+            code: result.code,
+            ...(query.state && { state: query.state }),
+        });
+
+        return c.redirect(`${result.redirectUri}?${params.toString()}`);
+    });
+
+    // 令牌端点
+    app.post('/token', async (c: Context) => {
+        const body = await c.req.formData();
+        // 将可选字段的类型处理为可选的而不是undefined
+        const clientId = body.get('client_id')?.toString();
+        const tokenRequest: TokenRequest = {
+            grant_type: body.get('grant_type')?.toString() || '',
+            client_id: clientId || '',
+        };
+        // 可选参数，只有存在时才添加
+        const code = body.get('code')?.toString();
+        if (code) tokenRequest.code = code;
+
+        const redirectUri = body.get('redirect_uri')?.toString();
+        if (redirectUri) tokenRequest.redirect_uri = redirectUri;
+
+        const clientSecret = body.get('client_secret')?.toString();
+        if (clientSecret) tokenRequest.client_secret = clientSecret;
+
+        const refreshToken = body.get('refresh_token')?.toString();
+        if (refreshToken) tokenRequest.refresh_token = refreshToken;
+
+        const codeVerifier = body.get('code_verifier')?.toString();
+        if (codeVerifier) tokenRequest.code_verifier = codeVerifier;
+
+        const scope = body.get('scope')?.toString();
+        if (scope) tokenRequest.scope = scope;
+
+        // 客户端认证
+        const authHeader = c.req.header('Authorization');
+        if (authHeader?.startsWith('Basic ')) {
+            const decoded = atob(authHeader.substring(6));
+            const [headerClientId, headerClientSecret] = decoded.split(':');
+            if (headerClientId) {
+                tokenRequest.client_id = headerClientId;
+            }
+            if (headerClientSecret) {
+                tokenRequest.client_secret = headerClientSecret;
+            }
+        }
+
+        // 请求令牌
+        const result = await provider.handleTokenRequest(tokenRequest);
+
+        if (!result.success) {
+            c.status(400);
+            return c.json({
+                error: result.error.error,
+                error_description: result.error.error_description,
+            });
+        }
+
+        return c.json(result.response);
+    });
+
+    // 用户信息端点
+    app.get('/userinfo', async (c: Context) => {
+        const authHeader = c.req.header('Authorization');
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            c.status(401);
+            c.header('WWW-Authenticate', 'Bearer');
+            return c.json({
+                error: 'invalid_token',
+                error_description: '无效的访问令牌',
+            });
+        }
+
+        const accessToken = authHeader.substring(7);
+        const result = await provider.getUserInfo(accessToken);
+
+        if (!result.success) {
+            c.status(401);
+            c.header('WWW-Authenticate', `Bearer error="${result.error.error}"`);
+            return c.json({
+                error: result.error.error,
+                error_description: result.error.error_description,
+            });
+        }
+
+        return c.json(result.user);
+    });
+
+    // 令牌撤销端点
+    app.post('/revoke', async (c: Context) => {
+        const body = await c.req.formData();
+
+        const token = body.get('token')?.toString() || '';
+        const tokenTypeHint = body.get('token_type_hint')?.toString();
+        const clientId = body.get('client_id')?.toString();
+        const clientSecret = body.get('client_secret')?.toString();
+
+        if (!token) {
+            c.status(400);
+            return c.json({
+                error: 'invalid_request',
+                error_description: '缺少token参数',
+            });
+        }
+
+        // 客户端认证
+        let authClientId = clientId;
+        let authClientSecret = clientSecret;
+
+        const authHeader = c.req.header('Authorization');
+        if (authHeader?.startsWith('Basic ')) {
+            const decoded = atob(authHeader.substring(6));
+            const [id, secret] = decoded.split(':');
+            authClientId = id;
+            authClientSecret = secret;
+        }
+
+        // 撤销令牌
+        const result = await provider.revokeToken(token, tokenTypeHint);
+
+        if (!result.success && result.error) {
+            c.status(400);
+            return c.json({
+                error: result.error.error,
+                error_description: result.error.error_description,
+            });
+        }
+
+        // 撤销成功
+        c.status(200);
+        return c.body(null);
+    });
+
+    // 令牌内省端点
+    app.post('/introspect', async (c: Context) => {
+        const body = await c.req.formData();
+
+        const token = body.get('token')?.toString() || '';
+        const tokenTypeHint = body.get('token_type_hint')?.toString();
+        const clientId = body.get('client_id')?.toString();
+        const clientSecret = body.get('client_secret')?.toString();
+
+        if (!token) {
+            c.status(400);
+            return c.json({
+                error: 'invalid_request',
+                error_description: '缺少token参数',
+            });
+        }
+
+        // 客户端认证
+        let authClientId = clientId;
+        let authClientSecret = clientSecret;
+
+        const authHeader = c.req.header('Authorization');
+        if (authHeader?.startsWith('Basic ')) {
+            const decoded = atob(authHeader.substring(6));
+            const [id, secret] = decoded.split(':');
+            authClientId = id;
+            authClientSecret = secret;
+        }
+
+        // 内省令牌
+        const result = await provider.introspectToken(token);
+
+        // 返回内省结果
+        return c.json(result);
+    });
+
+    // 返回应用实例
+    return app;
+}
+
+/**
+ * OIDC Provider中间件
+ */
+export function oidcProvider(config: OIDCProviderConfig) {
+    const provider = new OIDCProvider(config);
+
+    return (c: Context, next: Next) => {
+        c.set('oidc:provider', provider);
+        return next();
+    };
+}
+
+/**
+ * 获取OIDC Provider实例
+ */
+export function getOIDCProvider(c: Context): OIDCProvider {
+    return c.get('oidc:provider');
+}
+
diff --git a/packages/oidc-provider/src/provider.ts b/packages/oidc-provider/src/provider.ts
new file mode 100644
index 0000000..dfc99cf
--- /dev/null
+++ b/packages/oidc-provider/src/provider.ts
@@ -0,0 +1,932 @@
+import { nanoid } from 'nanoid';
+import type {
+    OIDCProviderConfig,
+    OIDCClient,
+    OIDCUser,
+    AuthorizationCode,
+    AccessToken,
+    RefreshToken,
+    IDToken,
+    AuthorizationRequest,
+    TokenRequest,
+    TokenResponse,
+    OIDCError,
+    DiscoveryDocument,
+} from './types';
+import type { StorageAdapter } from './storage/adapter';
+import { TokenManager } from './auth/token-manager';
+import { JWTUtils } from './utils/jwt';
+import { PKCEUtils } from './utils/pkce';
+import { ValidationUtils } from './utils/validation';
+
+/**
+ * OIDC Provider核心类
+ */
+export class OIDCProvider {
+    private config: OIDCProviderConfig & {
+        tokenTTL: {
+            accessToken: number;
+            refreshToken: number;
+            authorizationCode: number;
+            idToken: number;
+        };
+        responseTypes: string[];
+        grantTypes: string[];
+        scopes: string[];
+        claims: string[];
+        enablePKCE: boolean;
+        requirePKCE: boolean;
+        rotateRefreshTokens: boolean;
+    };
+    private storage: StorageAdapter;
+    private tokenManager: TokenManager;
+    private jwtUtils: JWTUtils;
+    private findUser: (userId: string) => Promise<OIDCUser | null>;
+    private findClient: (clientId: string) => Promise<OIDCClient | null>;
+
+    constructor(config: OIDCProviderConfig) {
+        // 设置默认配置
+        const defaultTokenTTL = {
+            accessToken: 3600, // 1小时
+            refreshToken: 30 * 24 * 3600, // 30天
+            authorizationCode: 600, // 10分钟
+            idToken: 3600, // 1小时
+        };
+
+        this.config = {
+            ...config,
+            tokenTTL: {
+                ...defaultTokenTTL,
+                ...config.tokenTTL,
+            },
+            responseTypes: config.responseTypes || ['code', 'id_token', 'token', 'code id_token', 'code token', 'id_token token', 'code id_token token'],
+            grantTypes: config.grantTypes || ['authorization_code', 'refresh_token', 'implicit'],
+            scopes: config.scopes || ['openid', 'profile', 'email', 'phone', 'address'],
+            claims: config.claims || [
+                'sub', 'name', 'given_name', 'family_name', 'middle_name', 'nickname',
+                'preferred_username', 'profile', 'picture', 'website', 'email',
+                'email_verified', 'gender', 'birthdate', 'zoneinfo', 'locale',
+                'phone_number', 'phone_number_verified', 'address', 'updated_at'
+            ],
+            enablePKCE: config.enablePKCE ?? true,
+            requirePKCE: config.requirePKCE ?? false,
+            rotateRefreshTokens: config.rotateRefreshTokens ?? true,
+        };
+
+        this.storage = config.storage;
+        this.tokenManager = new TokenManager(config.storage);
+        this.findUser = config.findUser;
+        this.findClient = config.findClient;
+        this.jwtUtils = new JWTUtils(config.signingKey, config.signingAlgorithm);
+    }
+
+    /**
+     * 获取发现文档
+     */
+    getDiscoveryDocument(): DiscoveryDocument {
+        const baseUrl = this.config.issuer;
+
+        return {
+            issuer: this.config.issuer,
+            authorization_endpoint: `${baseUrl}/auth`,
+            token_endpoint: `${baseUrl}/token`,
+            userinfo_endpoint: `${baseUrl}/userinfo`,
+            jwks_uri: `${baseUrl}/.well-known/jwks.json`,
+            registration_endpoint: `${baseUrl}/register`,
+            revocation_endpoint: `${baseUrl}/revoke`,
+            introspection_endpoint: `${baseUrl}/introspect`,
+            end_session_endpoint: `${baseUrl}/logout`,
+            response_types_supported: this.config.responseTypes,
+            grant_types_supported: this.config.grantTypes,
+            scopes_supported: this.config.scopes,
+            claims_supported: this.config.claims,
+            token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'none'],
+            id_token_signing_alg_values_supported: ['HS256', 'RS256', 'ES256'],
+            subject_types_supported: ['public'],
+            code_challenge_methods_supported: this.config.enablePKCE ? ['plain', 'S256'] : undefined,
+            response_modes_supported: ['query', 'fragment', 'form_post'],
+            claims_parameter_supported: false,
+            request_parameter_supported: false,
+            request_uri_parameter_supported: false,
+            require_request_uri_registration: false,
+        };
+    }
+
+    /**
+     * 处理授权请求
+     */
+    async handleAuthorizationRequest(
+        request: Partial<AuthorizationRequest>,
+        userId?: string
+    ): Promise<{ success: true; code: string; redirectUri: string } | { success: false; error: OIDCError; redirectUri?: string }> {
+        try {
+            // 获取客户端信息
+            if (!request.client_id) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_request',
+                        error_description: 'Missing client_id parameter',
+                        state: request.state,
+                    },
+                };
+            }
+
+            const client = await this.findClient(request.client_id);
+            if (!client) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_client',
+                        error_description: 'Invalid client_id',
+                        state: request.state,
+                    },
+                };
+            }
+
+            // 验证请求
+            const validation = ValidationUtils.validateAuthorizationRequest(
+                request,
+                client,
+                this.config.scopes,
+                this.config.responseTypes
+            );
+
+            if (!validation.valid) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_request',
+                        error_description: validation.errors.join(', '),
+                        state: request.state,
+                    },
+                    redirectUri: request.redirect_uri,
+                };
+            }
+
+            // 检查是否需要用户认证
+            if (!userId) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'login_required',
+                        error_description: 'User authentication is required',
+                        state: request.state,
+                    },
+                    redirectUri: request.redirect_uri,
+                };
+            }
+
+            // 强制PKCE检查
+            if (this.config.requirePKCE && client.client_type === 'public' && !request.code_challenge) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_request',
+                        error_description: 'PKCE is required for public clients',
+                        state: request.state,
+                    },
+                    redirectUri: request.redirect_uri,
+                };
+            }
+
+            // 验证PKCE（如果启用且提供了代码挑战）
+            if (this.config.enablePKCE && request.code_challenge) {
+                if (!request.code_challenge_method) {
+                    return {
+                        success: false,
+                        error: {
+                            error: 'invalid_request',
+                            error_description: 'Missing code_challenge_method',
+                            state: request.state,
+                        },
+                        redirectUri: request.redirect_uri,
+                    };
+                }
+
+                if (!PKCEUtils.isSupportedMethod(request.code_challenge_method)) {
+                    return {
+                        success: false,
+                        error: {
+                            error: 'invalid_request',
+                            error_description: 'Unsupported code_challenge_method',
+                            state: request.state,
+                        },
+                        redirectUri: request.redirect_uri,
+                    };
+                }
+
+                if (!PKCEUtils.isValidCodeChallenge(request.code_challenge, request.code_challenge_method)) {
+                    return {
+                        success: false,
+                        error: {
+                            error: 'invalid_request',
+                            error_description: 'Invalid code_challenge',
+                            state: request.state,
+                        },
+                        redirectUri: request.redirect_uri,
+                    };
+                }
+            }
+
+            // 生成授权码
+            const code = nanoid(32);
+            const now = new Date();
+            const expiresAt = new Date(now.getTime() + this.config.tokenTTL.authorizationCode * 1000);
+
+            const authCode: AuthorizationCode = {
+                code,
+                client_id: request.client_id,
+                user_id: userId,
+                redirect_uri: request.redirect_uri!,
+                scope: request.scope!,
+                code_challenge: request.code_challenge,
+                code_challenge_method: request.code_challenge_method,
+                nonce: request.nonce,
+                state: request.state,
+                expires_at: expiresAt,
+                created_at: now,
+            };
+
+            await this.tokenManager.storeAuthorizationCode(authCode);
+
+            return {
+                success: true,
+                code,
+                redirectUri: request.redirect_uri!,
+            };
+        } catch (error) {
+            return {
+                success: false,
+                error: {
+                    error: 'server_error',
+                    error_description: 'Internal server error',
+                    state: request.state,
+                },
+                redirectUri: request.redirect_uri,
+            };
+        }
+    }
+
+    /**
+     * 处理令牌请求
+     */
+    async handleTokenRequest(
+        request: Partial<TokenRequest>
+    ): Promise<{ success: true; response: TokenResponse } | { success: false; error: OIDCError }> {
+        try {
+            // 获取客户端信息
+            if (!request.client_id) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_request',
+                        error_description: 'Missing client_id parameter',
+                    },
+                };
+            }
+
+            const client = await this.findClient(request.client_id);
+            if (!client) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_client',
+                        error_description: 'Invalid client_id',
+                    },
+                };
+            }
+
+            // 验证客户端认证（如果需要）
+            if (client.client_type === 'confidential') {
+                if (!request.client_secret) {
+                    return {
+                        success: false,
+                        error: {
+                            error: 'invalid_client',
+                            error_description: 'Client authentication required',
+                        },
+                    };
+                }
+
+                if (request.client_secret !== client.client_secret) {
+                    return {
+                        success: false,
+                        error: {
+                            error: 'invalid_client',
+                            error_description: 'Invalid client credentials',
+                        },
+                    };
+                }
+            }
+
+            // 验证请求
+            const validation = ValidationUtils.validateTokenRequest(
+                request,
+                client,
+                this.config.grantTypes
+            );
+
+            if (!validation.valid) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_request',
+                        error_description: validation.errors.join(', '),
+                    },
+                };
+            }
+
+            if (request.grant_type === 'authorization_code') {
+                return await this.handleAuthorizationCodeGrant(request, client);
+            } else if (request.grant_type === 'refresh_token') {
+                return await this.handleRefreshTokenGrant(request, client);
+            } else {
+                return {
+                    success: false,
+                    error: {
+                        error: 'unsupported_grant_type',
+                        error_description: 'Grant type not supported',
+                    },
+                };
+            }
+        } catch (error) {
+            return {
+                success: false,
+                error: {
+                    error: 'server_error',
+                    error_description: 'Internal server error',
+                },
+            };
+        }
+    }
+
+    /**
+     * 处理授权码授权类型
+     */
+    private async handleAuthorizationCodeGrant(
+        request: Partial<TokenRequest>,
+        client: OIDCClient
+    ): Promise<{ success: true; response: TokenResponse } | { success: false; error: OIDCError }> {
+        if (!request.code) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_request',
+                    error_description: 'Missing authorization code',
+                },
+            };
+        }
+
+        // 获取授权码
+        const authCode = await this.tokenManager.getAuthorizationCode(request.code);
+        if (!authCode) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Invalid authorization code',
+                },
+            };
+        }
+
+        // 检查授权码是否过期
+        if (authCode.expires_at < new Date()) {
+            await this.tokenManager.deleteAuthorizationCode(request.code);
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Authorization code expired',
+                },
+            };
+        }
+
+        // 验证客户端ID
+        if (authCode.client_id !== request.client_id) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Authorization code was not issued to this client',
+                },
+            };
+        }
+
+        // 验证重定向URI
+        if (authCode.redirect_uri !== request.redirect_uri) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Redirect URI mismatch',
+                },
+            };
+        }
+
+        // 验证PKCE（如果使用）
+        if (authCode.code_challenge) {
+            if (!request.code_verifier) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_request',
+                        error_description: 'Missing code_verifier',
+                    },
+                };
+            }
+
+            const isValidPKCE = PKCEUtils.verifyCodeChallenge(
+                request.code_verifier,
+                authCode.code_challenge,
+                authCode.code_challenge_method || 'plain'
+            );
+
+            if (!isValidPKCE) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_grant',
+                        error_description: 'Invalid code_verifier',
+                    },
+                };
+            }
+        }
+
+        // 获取用户信息
+        const user = await this.findUser(authCode.user_id);
+        if (!user) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'User not found',
+                },
+            };
+        }
+
+        // 生成令牌
+        const now = new Date();
+        const accessTokenExpiry = new Date(now.getTime() + this.config.tokenTTL.accessToken * 1000);
+        const refreshTokenExpiry = new Date(now.getTime() + this.config.tokenTTL.refreshToken * 1000);
+        const idTokenExpiry = new Date(now.getTime() + this.config.tokenTTL.idToken * 1000);
+
+        // 生成访问令牌
+        const accessTokenJWT = await this.jwtUtils.generateAccessToken({
+            issuer: this.config.issuer,
+            subject: user.sub,
+            audience: request.client_id!,
+            clientId: request.client_id!,
+            scope: authCode.scope,
+            expiresIn: this.config.tokenTTL.accessToken,
+        });
+
+        const accessToken: AccessToken = {
+            token: accessTokenJWT,
+            client_id: request.client_id!,
+            user_id: user.sub,
+            scope: authCode.scope,
+            expires_at: accessTokenExpiry,
+            created_at: now,
+        };
+
+        // 生成刷新令牌
+        const refreshTokenValue = nanoid(64);
+        const refreshToken: RefreshToken = {
+            token: refreshTokenValue,
+            client_id: request.client_id!,
+            user_id: user.sub,
+            scope: authCode.scope,
+            expires_at: refreshTokenExpiry,
+            created_at: now,
+        };
+
+        // 生成ID令牌（如果请求了openid作用域）
+        let idTokenJWT: string | undefined;
+        if (authCode.scope.includes('openid')) {
+            const requestedClaims = this.getRequestedClaims(authCode.scope);
+
+            idTokenJWT = await this.jwtUtils.generateIDToken({
+                issuer: this.config.issuer,
+                subject: user.sub,
+                audience: request.client_id!,
+                user,
+                authTime: Math.floor(now.getTime() / 1000),
+                nonce: authCode.nonce,
+                expiresIn: this.config.tokenTTL.idToken,
+                requestedClaims,
+            });
+
+            const idToken: IDToken = {
+                token: idTokenJWT,
+                client_id: request.client_id!,
+                user_id: user.sub,
+                nonce: authCode.nonce,
+                expires_at: idTokenExpiry,
+                created_at: now,
+            };
+
+            await this.tokenManager.storeIDToken(idToken);
+        }
+
+        // 存储令牌
+        await this.tokenManager.storeAccessToken(accessToken);
+        await this.tokenManager.storeRefreshToken(refreshToken);
+
+        // 删除已使用的授权码
+        await this.tokenManager.deleteAuthorizationCode(request.code);
+
+        const response: TokenResponse = {
+            access_token: accessTokenJWT,
+            token_type: 'Bearer',
+            expires_in: this.config.tokenTTL.accessToken,
+            refresh_token: refreshTokenValue,
+            scope: authCode.scope,
+        };
+
+        if (idTokenJWT) {
+            response.id_token = idTokenJWT;
+        }
+
+        return {
+            success: true,
+            response,
+        };
+    }
+
+    /**
+     * 处理刷新令牌授权类型 - 修复以符合OIDC规范
+     */
+    private async handleRefreshTokenGrant(
+        request: Partial<TokenRequest>,
+        client: OIDCClient
+    ): Promise<{ success: true; response: TokenResponse } | { success: false; error: OIDCError }> {
+        if (!request.refresh_token) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_request',
+                    error_description: 'Missing refresh_token',
+                },
+            };
+        }
+
+        // 获取刷新令牌
+        const refreshToken = await this.tokenManager.getRefreshToken(request.refresh_token);
+        if (!refreshToken) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Invalid refresh_token',
+                },
+            };
+        }
+
+        // 检查刷新令牌是否过期
+        if (refreshToken.expires_at < new Date()) {
+            await this.tokenManager.deleteRefreshToken(request.refresh_token);
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Refresh token expired',
+                },
+            };
+        }
+
+        // 验证客户端ID
+        if (refreshToken.client_id !== request.client_id) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'Refresh token was not issued to this client',
+                },
+            };
+        }
+
+        // 获取用户信息
+        const user = await this.findUser(refreshToken.user_id);
+        if (!user) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_grant',
+                    error_description: 'User not found',
+                },
+            };
+        }
+
+        // 确定作用域（使用请求的作用域或原始作用域）
+        let scope = refreshToken.scope;
+        if (request.scope) {
+            const requestedScopes = request.scope.split(' ');
+            const originalScopes = refreshToken.scope.split(' ');
+
+            // 请求的作用域不能超过原始作用域
+            if (!requestedScopes.every(s => originalScopes.includes(s))) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_scope',
+                        error_description: 'Requested scope exceeds original scope',
+                    },
+                };
+            }
+            scope = request.scope;
+        }
+
+        // 生成新的访问令牌
+        const now = new Date();
+        const accessTokenExpiry = new Date(now.getTime() + this.config.tokenTTL.accessToken * 1000);
+
+        const accessTokenJWT = await this.jwtUtils.generateAccessToken({
+            issuer: this.config.issuer,
+            subject: user.sub,
+            audience: request.client_id!,
+            clientId: request.client_id!,
+            scope,
+            expiresIn: this.config.tokenTTL.accessToken,
+        });
+
+        const accessToken: AccessToken = {
+            token: accessTokenJWT,
+            client_id: request.client_id!,
+            user_id: user.sub,
+            scope,
+            expires_at: accessTokenExpiry,
+            created_at: now,
+        };
+
+        await this.tokenManager.storeAccessToken(accessToken);
+
+        // 可选：生成新的刷新令牌（刷新令牌轮换）
+        let newRefreshToken: string | undefined;
+        if (this.config.rotateRefreshTokens !== false) { // 默认启用刷新令牌轮换
+            const refreshTokenExpiry = new Date(now.getTime() + this.config.tokenTTL.refreshToken * 1000);
+            newRefreshToken = nanoid(64);
+
+            const newRefreshTokenRecord: RefreshToken = {
+                token: newRefreshToken,
+                client_id: request.client_id!,
+                user_id: user.sub,
+                scope,
+                expires_at: refreshTokenExpiry,
+                created_at: now,
+            };
+
+            await this.tokenManager.storeRefreshToken(newRefreshTokenRecord);
+            // 删除旧的刷新令牌
+            await this.tokenManager.deleteRefreshToken(request.refresh_token);
+        }
+
+        const response: TokenResponse = {
+            access_token: accessTokenJWT,
+            token_type: 'Bearer',
+            expires_in: this.config.tokenTTL.accessToken,
+            scope,
+        };
+
+        if (newRefreshToken) {
+            response.refresh_token = newRefreshToken;
+        }
+
+        return {
+            success: true,
+            response,
+        };
+    }
+
+    /**
+     * 获取用户信息
+     */
+    async getUserInfo(accessToken: string): Promise<{ success: true; user: Partial<OIDCUser> } | { success: false; error: OIDCError }> {
+        try {
+            // 验证访问令牌
+            const payload = await this.jwtUtils.verifyToken(accessToken);
+
+            // 检查令牌类型
+            if ((payload as any).token_type !== 'access_token') {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_token',
+                        error_description: 'Invalid token type',
+                    },
+                };
+            }
+
+            // 获取令牌数据
+            const tokenData = await this.tokenManager.getAccessToken(accessToken);
+            if (!tokenData) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_token',
+                        error_description: 'Token not found',
+                    },
+                };
+            }
+
+            // 检查令牌是否过期
+            if (tokenData.expires_at < new Date()) {
+                await this.tokenManager.deleteAccessToken(accessToken);
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_token',
+                        error_description: 'Token expired',
+                    },
+                };
+            }
+
+            // 获取用户信息
+            const user = await this.findUser(tokenData.user_id);
+            if (!user) {
+                return {
+                    success: false,
+                    error: {
+                        error: 'invalid_token',
+                        error_description: 'User not found',
+                    },
+                };
+            }
+
+            // 获取请求的声明
+            const requestedClaims = this.getRequestedClaims(tokenData.scope);
+            const filteredUser = this.filterUserClaims(user, requestedClaims);
+
+            return {
+                success: true,
+                user: filteredUser,
+            };
+        } catch (error) {
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_token',
+                    error_description: 'Invalid token',
+                },
+            };
+        }
+    }
+
+    /**
+     * 根据作用域获取请求的声明
+     */
+    private getRequestedClaims(scope: string): string[] {
+        const scopes = scope.split(' ');
+        const claims: string[] = ['sub']; // 总是包含sub
+
+        if (scopes.includes('profile')) {
+            claims.push(
+                'name', 'family_name', 'given_name', 'middle_name', 'nickname',
+                'preferred_username', 'profile', 'picture', 'website', 'gender',
+                'birthdate', 'zoneinfo', 'locale', 'updated_at'
+            );
+        }
+
+        if (scopes.includes('email')) {
+            claims.push('email', 'email_verified');
+        }
+
+        if (scopes.includes('phone')) {
+            claims.push('phone_number', 'phone_number_verified');
+        }
+
+        if (scopes.includes('address')) {
+            claims.push('address');
+        }
+
+        return claims;
+    }
+
+    /**
+     * 根据请求的声明过滤用户信息
+     */
+    private filterUserClaims(user: OIDCUser, requestedClaims: string[]): Partial<OIDCUser> {
+        const filtered: Partial<OIDCUser> = {};
+
+        for (const claim of requestedClaims) {
+            if (claim in user && user[claim as keyof OIDCUser] !== undefined) {
+                (filtered as any)[claim] = user[claim as keyof OIDCUser];
+            }
+        }
+
+        return filtered;
+    }
+
+    /**
+     * 撤销令牌
+     */
+    async revokeToken(token: string, tokenTypeHint?: string): Promise<{ success: boolean; error?: OIDCError }> {
+        try {
+            // 尝试作为访问令牌撤销
+            const accessToken = await this.tokenManager.getAccessToken(token);
+            if (accessToken) {
+                await this.tokenManager.deleteAccessToken(token);
+                return { success: true };
+            }
+
+            // 尝试作为刷新令牌撤销
+            const refreshToken = await this.tokenManager.getRefreshToken(token);
+            if (refreshToken) {
+                await this.tokenManager.deleteRefreshToken(token);
+                // 同时撤销相关的访问令牌
+                await this.tokenManager.deleteAccessTokensByUserAndClient(refreshToken.user_id, refreshToken.client_id);
+                return { success: true };
+            }
+
+            // 令牌不存在，根据RFC 7009，这应该返回成功
+            return { success: true };
+        } catch (error) {
+            return {
+                success: false,
+                error: {
+                    error: 'server_error',
+                    error_description: 'Internal server error',
+                },
+            };
+        }
+    }
+
+    /**
+     * 内省令牌
+     */
+    async introspectToken(token: string): Promise<{
+        active: boolean;
+        scope?: string;
+        client_id?: string;
+        username?: string;
+        token_type?: string;
+        exp?: number;
+        iat?: number;
+        sub?: string;
+        aud?: string;
+        iss?: string;
+    }> {
+        try {
+            // 尝试作为访问令牌内省
+            const accessToken = await this.tokenManager.getAccessToken(token);
+            if (accessToken) {
+                const isExpired = accessToken.expires_at < new Date();
+                if (isExpired) {
+                    await this.tokenManager.deleteAccessToken(token);
+                    return { active: false };
+                }
+
+                const user = await this.findUser(accessToken.user_id);
+
+                return {
+                    active: true,
+                    scope: accessToken.scope,
+                    client_id: accessToken.client_id,
+                    username: user?.username,
+                    token_type: 'Bearer',
+                    exp: Math.floor(accessToken.expires_at.getTime() / 1000),
+                    iat: Math.floor(accessToken.created_at.getTime() / 1000),
+                    sub: accessToken.user_id,
+                    aud: accessToken.client_id,
+                    iss: this.config.issuer,
+                };
+            }
+
+            // 尝试作为刷新令牌内省
+            const refreshToken = await this.tokenManager.getRefreshToken(token);
+            if (refreshToken) {
+                const isExpired = refreshToken.expires_at < new Date();
+                if (isExpired) {
+                    await this.tokenManager.deleteRefreshToken(token);
+                    return { active: false };
+                }
+
+                const user = await this.findUser(refreshToken.user_id);
+
+                return {
+                    active: true,
+                    scope: refreshToken.scope,
+                    client_id: refreshToken.client_id,
+                    username: user?.username,
+                    token_type: 'refresh_token',
+                    exp: Math.floor(refreshToken.expires_at.getTime() / 1000),
+                    iat: Math.floor(refreshToken.created_at.getTime() / 1000),
+                    sub: refreshToken.user_id,
+                    aud: refreshToken.client_id,
+                    iss: this.config.issuer,
+                };
+            }
+
+            return { active: false };
+        } catch (error) {
+            return { active: false };
+        }
+    }
+
+    /**
+     * 获取JWKS
+     */
+    async getJWKS(): Promise<{ keys: any[] }> {
+        return await this.jwtUtils.generateJWKS();
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/storage/adapter.ts b/packages/oidc-provider/src/storage/adapter.ts
new file mode 100644
index 0000000..75fed24
--- /dev/null
+++ b/packages/oidc-provider/src/storage/adapter.ts
@@ -0,0 +1,44 @@
+/**
+ * 通用存储适配器接口
+ * 使用简单的key-value存储模式支持所有OIDC存储需求
+ */
+export interface StorageAdapter {
+    /**
+     * 存储数据
+     * @param key 存储键
+     * @param value 存储值
+     * @param ttl 过期时间（秒），可选
+     */
+    set(key: string, value: any, ttl?: number): Promise<void>;
+
+    /**
+     * 获取数据
+     * @param key 存储键
+     */
+    get<T = any>(key: string): Promise<T | null>;
+
+    /**
+     * 删除数据
+     * @param key 存储键
+     */
+    delete(key: string): Promise<void>;
+
+    /**
+     * 批量删除匹配模式的键
+     * @param pattern 键模式（支持通配符）
+     */
+    deletePattern(pattern: string): Promise<void>;
+
+    /**
+     * 检查键是否存在
+     * @param key 存储键
+     */
+    exists(key: string): Promise<boolean>;
+
+    /**
+     * 设置键的过期时间
+     * @param key 存储键
+     * @param ttl 过期时间（秒）
+     */
+    expire(key: string, ttl: number): Promise<void>;
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/storage/index.ts b/packages/oidc-provider/src/storage/index.ts
new file mode 100644
index 0000000..42f0fc3
--- /dev/null
+++ b/packages/oidc-provider/src/storage/index.ts
@@ -0,0 +1,2 @@
+export type { StorageAdapter } from './adapter';
+export { RedisStorageAdapter } from './redis-adapter'; 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/storage/redis-adapter.ts b/packages/oidc-provider/src/storage/redis-adapter.ts
new file mode 100644
index 0000000..4444de8
--- /dev/null
+++ b/packages/oidc-provider/src/storage/redis-adapter.ts
@@ -0,0 +1,69 @@
+import type { Redis } from 'ioredis';
+import type { StorageAdapter } from './adapter';
+
+/**
+ * Redis存储适配器实现
+ * 使用Redis作为通用key-value存储
+ */
+export class RedisStorageAdapter implements StorageAdapter {
+    private redis: Redis;
+    private keyPrefix: string;
+
+    constructor(redis: Redis, keyPrefix = 'oidc:') {
+        this.redis = redis;
+        this.keyPrefix = keyPrefix;
+    }
+
+    private getKey(key: string): string {
+        return `${this.keyPrefix}${key}`;
+    }
+
+    async set(key: string, value: any, ttl?: number): Promise<void> {
+        const redisKey = this.getKey(key);
+        const serializedValue = JSON.stringify(value);
+
+        if (ttl) {
+            await this.redis.setex(redisKey, ttl, serializedValue);
+        } else {
+            await this.redis.set(redisKey, serializedValue);
+        }
+    }
+
+    async get<T = any>(key: string): Promise<T | null> {
+        const redisKey = this.getKey(key);
+        const data = await this.redis.get(redisKey);
+
+        if (!data) return null;
+
+        try {
+            return JSON.parse(data);
+        } catch {
+            return data as T;
+        }
+    }
+
+    async delete(key: string): Promise<void> {
+        const redisKey = this.getKey(key);
+        await this.redis.del(redisKey);
+    }
+
+    async deletePattern(pattern: string): Promise<void> {
+        const redisPattern = this.getKey(pattern);
+        const keys = await this.redis.keys(redisPattern);
+
+        if (keys.length > 0) {
+            await this.redis.del(...keys);
+        }
+    }
+
+    async exists(key: string): Promise<boolean> {
+        const redisKey = this.getKey(key);
+        const result = await this.redis.exists(redisKey);
+        return result === 1;
+    }
+
+    async expire(key: string, ttl: number): Promise<void> {
+        const redisKey = this.getKey(key);
+        await this.redis.expire(redisKey, ttl);
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/types/index.ts b/packages/oidc-provider/src/types/index.ts
new file mode 100644
index 0000000..7432a09
--- /dev/null
+++ b/packages/oidc-provider/src/types/index.ts
@@ -0,0 +1,342 @@
+import type { StorageAdapter } from '../storage/adapter';
+
+export interface OIDCProviderConfig {
+    /** 发行者标识符 */
+    issuer: string;
+    /** 签名密钥 */
+    signingKey: string;
+    /** 签名算法 */
+    signingAlgorithm?: 'HS256' | 'RS256' | 'ES256';
+    /** 存储适配器实例（仅用于令牌存储） */
+    storage: StorageAdapter;
+    /** 查找用户的回调函数 */
+    findUser: (userId: string) => Promise<OIDCUser | null>;
+    /** 获取客户端的回调函数 */
+    findClient: (clientId: string) => Promise<OIDCClient | null>;
+    /** 令牌过期时间配置 */
+    tokenTTL?: {
+        accessToken?: number; // 默认 3600 秒
+        refreshToken?: number; // 默认 30 天
+        authorizationCode?: number; // 默认 600 秒
+        idToken?: number; // 默认 3600 秒
+    };
+    /** 支持的响应类型 */
+    responseTypes?: string[];
+    /** 支持的授权类型 */
+    grantTypes?: string[];
+    /** 支持的作用域 */
+    scopes?: string[];
+    /** 支持的声明 */
+    claims?: string[];
+    /** 是否启用PKCE */
+    enablePKCE?: boolean;
+    /** 是否强制要求PKCE（针对public客户端） */
+    requirePKCE?: boolean;
+    /** 是否启用刷新令牌轮换 */
+    rotateRefreshTokens?: boolean;
+}
+
+export interface OIDCClient {
+    /** 客户端ID */
+    client_id: string;
+    /** 客户端密钥 */
+    client_secret?: string;
+    /** 重定向URI列表 */
+    redirect_uris: string[];
+    /** 客户端名称 */
+    client_name?: string;
+    /** 客户端类型 */
+    client_type: 'public' | 'confidential';
+    /** 支持的授权类型 */
+    grant_types: string[];
+    /** 支持的响应类型 */
+    response_types: string[];
+    /** 支持的作用域 */
+    scopes: string[];
+    /** 令牌端点认证方法 */
+    token_endpoint_auth_method?: string;
+    /** 创建时间 */
+    created_at: Date;
+    /** 更新时间 */
+    updated_at: Date;
+}
+
+export interface OIDCUser {
+    /** 用户ID */
+    sub: string;
+    /** 用户名 */
+    username?: string;
+    /** 邮箱 */
+    email?: string;
+    /** 邮箱是否已验证 */
+    email_verified?: boolean;
+    /** 姓名 */
+    name?: string;
+    /** 名字 */
+    given_name?: string;
+    /** 姓氏 */
+    family_name?: string;
+    /** 头像 */
+    picture?: string;
+    /** 个人资料 */
+    profile?: string;
+    /** 网站 */
+    website?: string;
+    /** 性别 */
+    gender?: string;
+    /** 生日 */
+    birthdate?: string;
+    /** 时区 */
+    zoneinfo?: string;
+    /** 语言 */
+    locale?: string;
+    /** 电话号码 */
+    phone_number?: string;
+    /** 电话号码是否已验证 */
+    phone_number_verified?: boolean;
+    /** 地址 */
+    address?: {
+        formatted?: string;
+        street_address?: string;
+        locality?: string;
+        region?: string;
+        postal_code?: string;
+        country?: string;
+    };
+    /** 更新时间 */
+    updated_at?: number;
+    /** 自定义声明 */
+    [key: string]: any;
+}
+
+export interface AuthorizationCode {
+    /** 授权码 */
+    code: string;
+    /** 客户端ID */
+    client_id: string;
+    /** 用户ID */
+    user_id: string;
+    /** 重定向URI */
+    redirect_uri: string;
+    /** 作用域 */
+    scope: string;
+    /** PKCE代码挑战 */
+    code_challenge?: string;
+    /** PKCE代码挑战方法 */
+    code_challenge_method?: string;
+    /** 随机数 */
+    nonce?: string;
+    /** 状态 */
+    state?: string;
+    /** 过期时间 */
+    expires_at: Date;
+    /** 创建时间 */
+    created_at: Date;
+}
+
+export interface AccessToken {
+    /** 访问令牌 */
+    token: string;
+    /** 客户端ID */
+    client_id: string;
+    /** 用户ID */
+    user_id: string;
+    /** 作用域 */
+    scope: string;
+    /** 过期时间 */
+    expires_at: Date;
+    /** 创建时间 */
+    created_at: Date;
+}
+
+export interface RefreshToken {
+    /** 刷新令牌 */
+    token: string;
+    /** 客户端ID */
+    client_id: string;
+    /** 用户ID */
+    user_id: string;
+    /** 作用域 */
+    scope: string;
+    /** 过期时间 */
+    expires_at: Date;
+    /** 创建时间 */
+    created_at: Date;
+}
+
+export interface IDToken {
+    /** ID令牌 */
+    token: string;
+    /** 客户端ID */
+    client_id: string;
+    /** 用户ID */
+    user_id: string;
+    /** 随机数 */
+    nonce?: string;
+    /** 过期时间 */
+    expires_at: Date;
+    /** 创建时间 */
+    created_at: Date;
+}
+
+export interface AuthorizationRequest {
+    /** 响应类型 */
+    response_type: string;
+    /** 客户端ID */
+    client_id: string;
+    /** 重定向URI */
+    redirect_uri: string;
+    /** 作用域 */
+    scope: string;
+    /** 状态 */
+    state?: string;
+    /** 随机数 */
+    nonce?: string;
+    /** PKCE代码挑战 */
+    code_challenge?: string;
+    /** PKCE代码挑战方法 */
+    code_challenge_method?: 'plain' | 'S256';
+    /** 提示 */
+    prompt?: string;
+    /** 最大年龄 */
+    max_age?: number;
+    /** ID令牌提示 */
+    id_token_hint?: string;
+    /** 登录提示 */
+    login_hint?: string;
+    /** ACR值 */
+    acr_values?: string;
+}
+
+export interface TokenRequest {
+    /** 授权类型 */
+    grant_type: string;
+    /** 授权码 */
+    code?: string;
+    /** 重定向URI */
+    redirect_uri?: string;
+    /** 客户端ID */
+    client_id: string;
+    /** 客户端密钥 */
+    client_secret?: string;
+    /** 刷新令牌 */
+    refresh_token?: string;
+    /** 作用域 */
+    scope?: string;
+    /** PKCE代码验证器 */
+    code_verifier?: string;
+}
+
+export interface TokenResponse {
+    /** 访问令牌 */
+    access_token: string;
+    /** 令牌类型 */
+    token_type: string;
+    /** 过期时间（秒） */
+    expires_in: number;
+    /** 刷新令牌 */
+    refresh_token?: string;
+    /** ID令牌 */
+    id_token?: string;
+    /** 作用域 */
+    scope?: string;
+}
+
+export interface OIDCError {
+    /** 错误代码 */
+    error: string;
+    /** 错误描述 */
+    error_description?: string;
+    /** 错误URI */
+    error_uri?: string;
+    /** 状态 */
+    state?: string;
+}
+
+export interface DiscoveryDocument {
+    /** 发行者 */
+    issuer: string;
+    /** 授权端点 */
+    authorization_endpoint: string;
+    /** 令牌端点 */
+    token_endpoint: string;
+    /** 用户信息端点 */
+    userinfo_endpoint: string;
+    /** JWKS URI */
+    jwks_uri: string;
+    /** 注册端点 */
+    registration_endpoint?: string;
+    /** 撤销端点 */
+    revocation_endpoint?: string;
+    /** 内省端点 */
+    introspection_endpoint?: string;
+    /** 结束会话端点 */
+    end_session_endpoint?: string;
+    /** 支持的响应类型 */
+    response_types_supported: string[];
+    /** 支持的授权类型 */
+    grant_types_supported: string[];
+    /** 支持的作用域 */
+    scopes_supported: string[];
+    /** 支持的声明 */
+    claims_supported: string[];
+    /** 支持的令牌端点认证方法 */
+    token_endpoint_auth_methods_supported: string[];
+    /** 支持的签名算法 */
+    id_token_signing_alg_values_supported: string[];
+    /** 支持的主题类型 */
+    subject_types_supported: string[];
+    /** 支持的代码挑战方法 */
+    code_challenge_methods_supported?: string[];
+    /** 支持的响应模式 */
+    response_modes_supported?: string[];
+    /** 是否支持claims参数 */
+    claims_parameter_supported?: boolean;
+    /** 是否支持request参数 */
+    request_parameter_supported?: boolean;
+    /** 是否支持request_uri参数 */
+    request_uri_parameter_supported?: boolean;
+    /** 是否要求注册request_uri */
+    require_request_uri_registration?: boolean;
+}
+
+/**
+ * 用户会话接口
+ */
+export interface UserSession {
+    /** 会话ID */
+    session_id: string;
+    /** 用户ID */
+    user_id: string;
+    /** 客户端ID */
+    client_id?: string;
+    /** 认证时间 */
+    auth_time: number;
+    /** 认证上下文类引用 */
+    acr?: string;
+    /** 认证方法引用 */
+    amr?: string[];
+    /** 过期时间 */
+    expires_at: Date;
+    /** 创建时间 */
+    created_at: Date;
+    /** 授权参数（用于重定向） */
+    authorization_params?: AuthorizationRequest;
+}
+
+/**
+ * 登录凭据接口
+ */
+export interface LoginCredentials {
+    /** 用户名 */
+    username: string;
+    /** 密码 */
+    password: string;
+    /** 记住我 */
+    remember_me?: boolean;
+}
+
+/**
+ * 密码验证函数类型
+ */
+export type PasswordValidator = (username: string, password: string) => Promise<string | null>; 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/utils/jwt.ts b/packages/oidc-provider/src/utils/jwt.ts
new file mode 100644
index 0000000..b70793f
--- /dev/null
+++ b/packages/oidc-provider/src/utils/jwt.ts
@@ -0,0 +1,252 @@
+import { SignJWT, jwtVerify, importJWK, exportJWK, generateKeyPair } from 'jose';
+import type { OIDCUser } from '../types';
+
+export interface JWTPayload {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    auth_time?: number;
+    nonce?: string;
+    acr?: string;
+    amr?: string[];
+    azp?: string;
+    [key: string]: any;
+}
+
+export interface AccessTokenPayload extends JWTPayload {
+    scope: string;
+    client_id: string;
+    token_type: 'access_token';
+}
+
+export interface IDTokenPayload extends JWTPayload {
+    nonce?: string;
+    auth_time: number;
+    [key: string]: any;
+}
+
+/**
+ * JWT工具类
+ */
+export class JWTUtils {
+    private signingKey: string;
+    private algorithm: 'HS256' | 'RS256' | 'ES256' = 'HS256';
+
+    constructor(signingKey: string, algorithm?: 'HS256' | 'RS256' | 'ES256') {
+        this.signingKey = signingKey;
+        this.algorithm = algorithm || 'HS256';
+    }
+
+    /**
+     * 生成访问令牌
+     */
+    async generateAccessToken(payload: {
+        issuer: string;
+        subject: string;
+        audience: string;
+        clientId: string;
+        scope: string;
+        expiresIn: number;
+    }): Promise<string> {
+        const now = Math.floor(Date.now() / 1000);
+
+        const jwtPayload: AccessTokenPayload = {
+            iss: payload.issuer,
+            sub: payload.subject,
+            aud: payload.audience,
+            exp: now + payload.expiresIn,
+            iat: now,
+            scope: payload.scope,
+            client_id: payload.clientId,
+            token_type: 'access_token',
+        };
+
+        return await new SignJWT(jwtPayload)
+            .setProtectedHeader({ alg: this.algorithm })
+            .sign(new TextEncoder().encode(this.signingKey));
+    }
+
+    /**
+     * 生成ID令牌
+     */
+    async generateIDToken(payload: {
+        issuer: string;
+        subject: string;
+        audience: string;
+        user: OIDCUser;
+        authTime: number;
+        nonce?: string;
+        expiresIn: number;
+        requestedClaims?: string[];
+    }): Promise<string> {
+        const now = Math.floor(Date.now() / 1000);
+
+        const jwtPayload: IDTokenPayload = {
+            iss: payload.issuer,
+            sub: payload.subject,
+            aud: payload.audience,
+            exp: now + payload.expiresIn,
+            iat: now,
+            auth_time: payload.authTime,
+        };
+
+        // 添加nonce（如果提供）
+        if (payload.nonce) {
+            jwtPayload.nonce = payload.nonce;
+        }
+
+        // 添加用户声明
+        this.addUserClaims(jwtPayload, payload.user, payload.requestedClaims);
+
+        return await new SignJWT(jwtPayload)
+            .setProtectedHeader({ alg: this.algorithm })
+            .sign(new TextEncoder().encode(this.signingKey));
+    }
+
+    /**
+     * 验证JWT令牌
+     */
+    async verifyToken(token: string): Promise<JWTPayload> {
+        try {
+            const { payload } = await jwtVerify(
+                token,
+                new TextEncoder().encode(this.signingKey)
+            );
+            return payload as JWTPayload;
+        } catch (error) {
+            throw new Error(`Invalid token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+
+    /**
+     * 解码JWT令牌（不验证签名）
+     */
+    decodeToken(token: string): JWTPayload {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                throw new Error('Invalid token format');
+            }
+
+            const payloadPart = parts[1];
+            if (!payloadPart) {
+                throw new Error('Invalid token payload');
+            }
+
+            const payload = JSON.parse(
+                Buffer.from(payloadPart, 'base64url').toString('utf-8')
+            );
+            return payload;
+        } catch (error) {
+            throw new Error(`Failed to decode token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+
+    /**
+     * 检查令牌是否过期
+     */
+    isTokenExpired(token: string): boolean {
+        try {
+            const payload = this.decodeToken(token);
+            const now = Math.floor(Date.now() / 1000);
+            return payload.exp < now;
+        } catch {
+            return true;
+        }
+    }
+
+    /**
+     * 获取令牌剩余有效时间（秒）
+     */
+    getTokenTTL(token: string): number {
+        try {
+            const payload = this.decodeToken(token);
+            const now = Math.floor(Date.now() / 1000);
+            return Math.max(0, payload.exp - now);
+        } catch {
+            return 0;
+        }
+    }
+
+    /**
+     * 添加用户声明到JWT载荷
+     */
+    private addUserClaims(
+        payload: IDTokenPayload,
+        user: OIDCUser,
+        requestedClaims?: string[]
+    ): void {
+        // 标准声明映射
+        const standardClaims = {
+            name: user.name,
+            given_name: user.given_name,
+            family_name: user.family_name,
+            preferred_username: user.username,
+            profile: user.profile,
+            picture: user.picture,
+            website: user.website,
+            email: user.email,
+            email_verified: user.email_verified,
+            gender: user.gender,
+            birthdate: user.birthdate,
+            zoneinfo: user.zoneinfo,
+            locale: user.locale,
+            phone_number: user.phone_number,
+            phone_number_verified: user.phone_number_verified,
+            address: user.address,
+            updated_at: user.updated_at,
+        };
+
+        // 如果指定了请求的声明，只添加这些声明
+        if (requestedClaims && requestedClaims.length > 0) {
+            for (const claim of requestedClaims) {
+                if (claim in standardClaims && standardClaims[claim as keyof typeof standardClaims] !== undefined) {
+                    payload[claim] = standardClaims[claim as keyof typeof standardClaims];
+                } else if (claim in user && user[claim] !== undefined) {
+                    payload[claim] = user[claim];
+                }
+            }
+        } else {
+            // 添加所有可用的标准声明
+            for (const [claim, value] of Object.entries(standardClaims)) {
+                if (value !== undefined) {
+                    payload[claim] = value;
+                }
+            }
+        }
+    }
+
+    /**
+     * 生成JWKS（JSON Web Key Set）
+     */
+    async generateJWKS(): Promise<{ keys: any[] }> {
+        // 对于HMAC算法，我们不暴露密钥
+        // 这里返回空的JWKS，实际应用中可能需要使用RSA或ECDSA
+        return { keys: [] };
+    }
+
+    /**
+     * 生成RSA密钥对（用于生产环境）
+     */
+    static async generateRSAKeyPair(): Promise<{
+        privateKey: string;
+        publicKey: string;
+        jwk: any;
+    }> {
+        const { privateKey, publicKey } = await generateKeyPair('RS256');
+        const jwk = await exportJWK(publicKey);
+
+        return {
+            privateKey: JSON.stringify(await exportJWK(privateKey)),
+            publicKey: JSON.stringify(jwk),
+            jwk: {
+                ...jwk,
+                alg: 'RS256',
+                use: 'sig',
+                kid: 'default',
+            },
+        };
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/utils/pkce.ts b/packages/oidc-provider/src/utils/pkce.ts
new file mode 100644
index 0000000..5778de7
--- /dev/null
+++ b/packages/oidc-provider/src/utils/pkce.ts
@@ -0,0 +1,153 @@
+import { createHash } from 'crypto';
+
+/**
+ * PKCE工具类
+ * 实现RFC 7636 - Proof Key for Code Exchange
+ */
+export class PKCEUtils {
+    /**
+     * 支持的代码挑战方法
+     */
+    static readonly SUPPORTED_METHODS = ['plain', 'S256'] as const;
+
+    /**
+     * 验证代码挑战方法是否支持
+     */
+    static isSupportedMethod(method: string): method is typeof PKCEUtils.SUPPORTED_METHODS[number] {
+        return PKCEUtils.SUPPORTED_METHODS.includes(method as any);
+    }
+
+    /**
+     * 验证代码验证器格式
+     * 根据RFC 7636，代码验证器必须是43-128个字符的字符串
+     * 只能包含 [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"
+     */
+    static isValidCodeVerifier(codeVerifier: string): boolean {
+        if (!codeVerifier || typeof codeVerifier !== 'string') {
+            return false;
+        }
+
+        // 检查长度
+        if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+            return false;
+        }
+
+        // 检查字符集
+        const validChars = /^[A-Za-z0-9\-._~]+$/;
+        return validChars.test(codeVerifier);
+    }
+
+    /**
+     * 验证代码挑战格式
+     * 代码挑战的格式取决于使用的方法
+     */
+    static isValidCodeChallenge(codeChallenge: string, method: string): boolean {
+        if (!codeChallenge || typeof codeChallenge !== 'string') {
+            return false;
+        }
+
+        switch (method) {
+            case 'plain':
+                // plain方法下，代码挑战就是代码验证器
+                return PKCEUtils.isValidCodeVerifier(codeChallenge);
+
+            case 'S256':
+                // S256方法下，代码挑战是base64url编码的SHA256哈希
+                // 长度应该是43个字符（256位哈希的base64url编码）
+                if (codeChallenge.length !== 43) {
+                    return false;
+                }
+                // 检查是否是有效的base64url字符
+                const base64urlChars = /^[A-Za-z0-9\-_]+$/;
+                return base64urlChars.test(codeChallenge);
+
+            default:
+                return false;
+        }
+    }
+
+    /**
+     * 生成代码挑战
+     * 根据代码验证器和方法生成代码挑战
+     */
+    static generateCodeChallenge(codeVerifier: string, method: string): string {
+        if (!PKCEUtils.isValidCodeVerifier(codeVerifier)) {
+            throw new Error('Invalid code verifier');
+        }
+
+        if (!PKCEUtils.isSupportedMethod(method)) {
+            throw new Error(`Unsupported code challenge method: ${method}`);
+        }
+
+        switch (method) {
+            case 'plain':
+                return codeVerifier;
+
+            case 'S256':
+                const hash = createHash('sha256').update(codeVerifier).digest();
+                return hash.toString('base64url');
+
+            default:
+                throw new Error(`Unsupported code challenge method: ${method}`);
+        }
+    }
+
+    /**
+     * 验证代码验证器和代码挑战是否匹配
+     */
+    static verifyCodeChallenge(
+        codeVerifier: string,
+        codeChallenge: string,
+        method: string
+    ): boolean {
+        try {
+            if (!PKCEUtils.isValidCodeVerifier(codeVerifier)) {
+                return false;
+            }
+
+            if (!PKCEUtils.isValidCodeChallenge(codeChallenge, method)) {
+                return false;
+            }
+
+            const expectedChallenge = PKCEUtils.generateCodeChallenge(codeVerifier, method);
+            return expectedChallenge === codeChallenge;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * 生成随机的代码验证器
+     * 用于测试或客户端SDK
+     */
+    static generateCodeVerifier(): string {
+        const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+        const length = 128; // 使用最大长度
+        let result = '';
+
+        for (let i = 0; i < length; i++) {
+            result += chars.charAt(Math.floor(Math.random() * chars.length));
+        }
+
+        return result;
+    }
+
+    /**
+     * 生成代码挑战对（验证器和挑战）
+     * 用于测试或客户端SDK
+     */
+    static generateCodeChallengePair(method: string = 'S256'): {
+        codeVerifier: string;
+        codeChallenge: string;
+        codeChallengeMethod: string;
+    } {
+        const codeVerifier = PKCEUtils.generateCodeVerifier();
+        const codeChallenge = PKCEUtils.generateCodeChallenge(codeVerifier, method);
+
+        return {
+            codeVerifier,
+            codeChallenge,
+            codeChallengeMethod: method,
+        };
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/src/utils/validation.ts b/packages/oidc-provider/src/utils/validation.ts
new file mode 100644
index 0000000..de1cb64
--- /dev/null
+++ b/packages/oidc-provider/src/utils/validation.ts
@@ -0,0 +1,314 @@
+import { z } from 'zod';
+import type { AuthorizationRequest, TokenRequest, OIDCClient } from '../types';
+
+/**
+ * OIDC验证工具类
+ */
+export class ValidationUtils {
+    /**
+     * 验证重定向URI
+     */
+    static isValidRedirectUri(uri: string): boolean {
+        try {
+            const url = new URL(uri);
+            // 不允许fragment
+            if (url.hash) {
+                return false;
+            }
+            // 必须是HTTPS（除了localhost）
+            if (url.protocol !== 'https:' && url.hostname !== 'localhost' && url.hostname !== '127.0.0.1') {
+                return false;
+            }
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * 验证作用域
+     */
+    static isValidScope(scope: string, supportedScopes: string[]): boolean {
+        if (!scope || typeof scope !== 'string') {
+            return false;
+        }
+
+        const requestedScopes = scope.split(' ').filter(s => s.length > 0);
+
+        // 必须包含openid作用域
+        if (!requestedScopes.includes('openid')) {
+            return false;
+        }
+
+        // 检查所有请求的作用域是否都被支持
+        return requestedScopes.every(s => supportedScopes.includes(s));
+    }
+
+    /**
+     * 验证响应类型
+     */
+    static isValidResponseType(responseType: string, supportedTypes: string[]): boolean {
+        if (!responseType || typeof responseType !== 'string') {
+            return false;
+        }
+
+        return supportedTypes.includes(responseType);
+    }
+
+    /**
+     * 验证授权类型
+     */
+    static isValidGrantType(grantType: string, supportedTypes: string[]): boolean {
+        if (!grantType || typeof grantType !== 'string') {
+            return false;
+        }
+
+        return supportedTypes.includes(grantType);
+    }
+
+    /**
+     * 验证客户端ID格式
+     */
+    static isValidClientId(clientId: string): boolean {
+        if (!clientId || typeof clientId !== 'string') {
+            return false;
+        }
+
+        // 客户端ID应该是非空字符串，长度在3-128之间
+        return clientId.length >= 3 && clientId.length <= 128;
+    }
+
+    /**
+     * 验证状态参数
+     */
+    static isValidState(state: string): boolean {
+        if (!state || typeof state !== 'string') {
+            return false;
+        }
+
+        // 状态参数应该是非空字符串，长度不超过512
+        return state.length > 0 && state.length <= 512;
+    }
+
+    /**
+     * 验证随机数
+     */
+    static isValidNonce(nonce: string): boolean {
+        if (!nonce || typeof nonce !== 'string') {
+            return false;
+        }
+
+        // 随机数应该是非空字符串，长度不超过512
+        return nonce.length > 0 && nonce.length <= 512;
+    }
+
+    /**
+     * 验证授权请求
+     */
+    static validateAuthorizationRequest(
+        request: Partial<AuthorizationRequest>,
+        client: OIDCClient,
+        supportedScopes: string[],
+        supportedResponseTypes: string[]
+    ): { valid: boolean; errors: string[] } {
+        const errors: string[] = [];
+
+        // 验证响应类型
+        if (!request.response_type) {
+            errors.push('Missing response_type parameter');
+        } else if (!ValidationUtils.isValidResponseType(request.response_type, supportedResponseTypes)) {
+            errors.push('Invalid or unsupported response_type');
+        } else if (!client.response_types.includes(request.response_type)) {
+            errors.push('Response type not allowed for this client');
+        }
+
+        // 验证客户端ID
+        if (!request.client_id) {
+            errors.push('Missing client_id parameter');
+        } else if (request.client_id !== client.client_id) {
+            errors.push('Invalid client_id');
+        }
+
+        // 验证重定向URI
+        if (!request.redirect_uri) {
+            errors.push('Missing redirect_uri parameter');
+        } else if (!ValidationUtils.isValidRedirectUri(request.redirect_uri)) {
+            errors.push('Invalid redirect_uri format');
+        } else if (!client.redirect_uris.includes(request.redirect_uri)) {
+            errors.push('Redirect URI not registered for this client');
+        }
+
+        // 验证作用域
+        if (!request.scope) {
+            errors.push('Missing scope parameter');
+        } else if (!ValidationUtils.isValidScope(request.scope, supportedScopes)) {
+            errors.push('Invalid or unsupported scope');
+        } else {
+            const requestedScopes = request.scope.split(' ');
+            const allowedScopes = client.scopes;
+            if (!requestedScopes.every(s => allowedScopes.includes(s))) {
+                errors.push('Scope not allowed for this client');
+            }
+        }
+
+        // 验证状态（可选）
+        if (request.state && !ValidationUtils.isValidState(request.state)) {
+            errors.push('Invalid state parameter');
+        }
+
+        // 验证随机数（可选）
+        if (request.nonce && !ValidationUtils.isValidNonce(request.nonce)) {
+            errors.push('Invalid nonce parameter');
+        }
+
+        // 验证PKCE参数（如果提供）
+        if (request.code_challenge) {
+            if (!request.code_challenge_method) {
+                errors.push('Missing code_challenge_method when code_challenge is provided');
+            } else if (!['plain', 'S256'].includes(request.code_challenge_method)) {
+                errors.push('Unsupported code_challenge_method');
+            }
+        }
+
+        return {
+            valid: errors.length === 0,
+            errors,
+        };
+    }
+
+    /**
+     * 验证令牌请求
+     */
+    static validateTokenRequest(
+        request: Partial<TokenRequest>,
+        client: OIDCClient,
+        supportedGrantTypes: string[]
+    ): { valid: boolean; errors: string[] } {
+        const errors: string[] = [];
+
+        // 验证授权类型
+        if (!request.grant_type) {
+            errors.push('Missing grant_type parameter');
+        } else if (!ValidationUtils.isValidGrantType(request.grant_type, supportedGrantTypes)) {
+            errors.push('Invalid or unsupported grant_type');
+        } else if (!client.grant_types.includes(request.grant_type)) {
+            errors.push('Grant type not allowed for this client');
+        }
+
+        // 验证客户端ID
+        if (!request.client_id) {
+            errors.push('Missing client_id parameter');
+        } else if (request.client_id !== client.client_id) {
+            errors.push('Invalid client_id');
+        }
+
+        // 根据授权类型进行特定验证
+        if (request.grant_type === 'authorization_code') {
+            if (!request.code) {
+                errors.push('Missing code parameter for authorization_code grant');
+            }
+            if (!request.redirect_uri) {
+                errors.push('Missing redirect_uri parameter for authorization_code grant');
+            }
+        } else if (request.grant_type === 'refresh_token') {
+            if (!request.refresh_token) {
+                errors.push('Missing refresh_token parameter for refresh_token grant');
+            }
+        }
+
+        return {
+            valid: errors.length === 0,
+            errors,
+        };
+    }
+
+    /**
+     * 验证用户信息请求的访问令牌
+     */
+    static validateBearerToken(authorizationHeader: string | undefined): string | null {
+        if (!authorizationHeader) {
+            return null;
+        }
+
+        const parts = authorizationHeader.split(' ');
+        if (parts.length !== 2 || parts[0]?.toLowerCase() !== 'bearer') {
+            return null;
+        }
+
+        const token = parts[1];
+        if (!token || token.length === 0) {
+            return null;
+        }
+
+        return token;
+    }
+
+    /**
+     * 验证邮箱格式
+     */
+    static isValidEmail(email: string): boolean {
+        const emailSchema = z.string().email();
+        try {
+            emailSchema.parse(email);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * 验证URL格式
+     */
+    static isValidUrl(url: string): boolean {
+        try {
+            new URL(url);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * 验证电话号码格式（简单验证）
+     */
+    static isValidPhoneNumber(phone: string): boolean {
+        // 简单的电话号码验证，支持国际格式
+        const phoneRegex = /^\+?[1-9]\d{1,14}$/;
+        return phoneRegex.test(phone);
+    }
+
+    /**
+     * 验证日期格式（YYYY-MM-DD）
+     */
+    static isValidBirthdate(birthdate: string): boolean {
+        const dateRegex = /^\d{4}-\d{2}-\d{2}$/;
+        if (!dateRegex.test(birthdate)) {
+            return false;
+        }
+
+        const date = new Date(birthdate);
+        return !isNaN(date.getTime());
+    }
+
+    /**
+     * 验证时区格式
+     */
+    static isValidZoneinfo(zoneinfo: string): boolean {
+        try {
+            // 尝试使用Intl.DateTimeFormat验证时区
+            Intl.DateTimeFormat(undefined, { timeZone: zoneinfo });
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * 验证语言标签格式
+     */
+    static isValidLocale(locale: string): boolean {
+        // 简单的语言标签验证（如：en, en-US, zh-CN）
+        const localeRegex = /^[a-z]{2,3}(-[A-Z]{2})?$/;
+        return localeRegex.test(locale);
+    }
+} 
\ No newline at end of file
diff --git a/packages/oidc-provider/tsconfig.json b/packages/oidc-provider/tsconfig.json
new file mode 100644
index 0000000..3a8900e
--- /dev/null
+++ b/packages/oidc-provider/tsconfig.json
@@ -0,0 +1,29 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "isolatedModules": true,
+    "noEmitOnError": false
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "dist",
+    "node_modules",
+    "**/*.test.ts",
+    "**/*.spec.ts"
+  ]
+} 
\ No newline at end of file
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 5833cd6..37ff540 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -14,8 +14,12 @@
     "lint": "eslint . --max-warnings 0"
   },
   "dependencies": {
+    "@radix-ui/react-avatar": "^1.1.10",
+    "@radix-ui/react-dialog": "^1.1.14",
     "@radix-ui/react-dropdown-menu": "^2.1.14",
-    "@radix-ui/react-slot": "^1.2.2",
+    "@radix-ui/react-label": "^2.1.7",
+    "@radix-ui/react-separator": "^1.1.7",
+    "@radix-ui/react-slot": "^1.2.3",
     "clsx": "^2.1.1",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
@@ -23,13 +27,13 @@
     "zod": "^3.24.4"
   },
   "devDependencies": {
+    "@repo/eslint-config": "workspace:*",
+    "@repo/typescript-config": "workspace:*",
     "@tailwindcss/postcss": "^4",
     "@turbo/gen": "^2.5.3",
     "@types/node": "^20",
     "@types/react": "^19.1.4",
     "@types/react-dom": "^19.1.5",
-    "@repo/eslint-config": "workspace:*",
-    "@repo/typescript-config": "workspace:*",
     "class-variance-authority": "^0.7.1",
     "lucide-react": "0.511.0",
     "tailwindcss": "^4",
diff --git a/packages/ui/src/components/alert.tsx b/packages/ui/src/components/alert.tsx
new file mode 100644
index 0000000..4b121f2
--- /dev/null
+++ b/packages/ui/src/components/alert.tsx
@@ -0,0 +1,66 @@
+import * as React from "react"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@repo/ui/lib/utils"
+
+const alertVariants = cva(
+  "relative w-full rounded-lg border px-4 py-3 text-sm grid has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] grid-cols-[0_1fr] has-[>svg]:gap-x-3 gap-y-0.5 items-start [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",
+  {
+    variants: {
+      variant: {
+        default: "bg-card text-card-foreground",
+        destructive:
+          "text-destructive bg-card [&>svg]:text-current *:data-[slot=alert-description]:text-destructive/90",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  }
+)
+
+function Alert({
+  className,
+  variant,
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof alertVariants>) {
+  return (
+    <div
+      data-slot="alert"
+      role="alert"
+      className={cn(alertVariants({ variant }), className)}
+      {...props}
+    />
+  )
+}
+
+function AlertTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-title"
+      className={cn(
+        "col-start-2 line-clamp-1 min-h-4 font-medium tracking-tight",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function AlertDescription({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-description"
+      className={cn(
+        "text-muted-foreground col-start-2 grid justify-items-start gap-1 text-sm [&_p]:leading-relaxed",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Alert, AlertTitle, AlertDescription }
diff --git a/packages/ui/src/components/avatar.tsx b/packages/ui/src/components/avatar.tsx
new file mode 100644
index 0000000..c59a619
--- /dev/null
+++ b/packages/ui/src/components/avatar.tsx
@@ -0,0 +1,53 @@
+"use client"
+
+import * as React from "react"
+import * as AvatarPrimitive from "@radix-ui/react-avatar"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Avatar({
+  className,
+  ...props
+}: React.ComponentProps<typeof AvatarPrimitive.Root>) {
+  return (
+    <AvatarPrimitive.Root
+      data-slot="avatar"
+      className={cn(
+        "relative flex size-8 shrink-0 overflow-hidden rounded-full",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function AvatarImage({
+  className,
+  ...props
+}: React.ComponentProps<typeof AvatarPrimitive.Image>) {
+  return (
+    <AvatarPrimitive.Image
+      data-slot="avatar-image"
+      className={cn("aspect-square size-full", className)}
+      {...props}
+    />
+  )
+}
+
+function AvatarFallback({
+  className,
+  ...props
+}: React.ComponentProps<typeof AvatarPrimitive.Fallback>) {
+  return (
+    <AvatarPrimitive.Fallback
+      data-slot="avatar-fallback"
+      className={cn(
+        "bg-muted flex size-full items-center justify-center rounded-full",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Avatar, AvatarImage, AvatarFallback }
diff --git a/packages/ui/src/components/badge.tsx b/packages/ui/src/components/badge.tsx
new file mode 100644
index 0000000..006d0f4
--- /dev/null
+++ b/packages/ui/src/components/badge.tsx
@@ -0,0 +1,46 @@
+import * as React from "react"
+import { Slot } from "@radix-ui/react-slot"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@repo/ui/lib/utils"
+
+const badgeVariants = cva(
+  "inline-flex items-center justify-center rounded-md border px-2 py-0.5 text-xs font-medium w-fit whitespace-nowrap shrink-0 [&>svg]:size-3 gap-1 [&>svg]:pointer-events-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive transition-[color,box-shadow] overflow-hidden",
+  {
+    variants: {
+      variant: {
+        default:
+          "border-transparent bg-primary text-primary-foreground [a&]:hover:bg-primary/90",
+        secondary:
+          "border-transparent bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90",
+        destructive:
+          "border-transparent bg-destructive text-white [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60",
+        outline:
+          "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  }
+)
+
+function Badge({
+  className,
+  variant,
+  asChild = false,
+  ...props
+}: React.ComponentProps<"span"> &
+  VariantProps<typeof badgeVariants> & { asChild?: boolean }) {
+  const Comp = asChild ? Slot : "span"
+
+  return (
+    <Comp
+      data-slot="badge"
+      className={cn(badgeVariants({ variant }), className)}
+      {...props}
+    />
+  )
+}
+
+export { Badge, badgeVariants }
diff --git a/packages/ui/src/components/breadcrumb.tsx b/packages/ui/src/components/breadcrumb.tsx
new file mode 100644
index 0000000..8f7aa07
--- /dev/null
+++ b/packages/ui/src/components/breadcrumb.tsx
@@ -0,0 +1,109 @@
+import * as React from "react"
+import { Slot } from "@radix-ui/react-slot"
+import { ChevronRight, MoreHorizontal } from "lucide-react"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Breadcrumb({ ...props }: React.ComponentProps<"nav">) {
+  return <nav aria-label="breadcrumb" data-slot="breadcrumb" {...props} />
+}
+
+function BreadcrumbList({ className, ...props }: React.ComponentProps<"ol">) {
+  return (
+    <ol
+      data-slot="breadcrumb-list"
+      className={cn(
+        "text-muted-foreground flex flex-wrap items-center gap-1.5 text-sm break-words sm:gap-2.5",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function BreadcrumbItem({ className, ...props }: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="breadcrumb-item"
+      className={cn("inline-flex items-center gap-1.5", className)}
+      {...props}
+    />
+  )
+}
+
+function BreadcrumbLink({
+  asChild,
+  className,
+  ...props
+}: React.ComponentProps<"a"> & {
+  asChild?: boolean
+}) {
+  const Comp = asChild ? Slot : "a"
+
+  return (
+    <Comp
+      data-slot="breadcrumb-link"
+      className={cn("hover:text-foreground transition-colors", className)}
+      {...props}
+    />
+  )
+}
+
+function BreadcrumbPage({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="breadcrumb-page"
+      role="link"
+      aria-disabled="true"
+      aria-current="page"
+      className={cn("text-foreground font-normal", className)}
+      {...props}
+    />
+  )
+}
+
+function BreadcrumbSeparator({
+  children,
+  className,
+  ...props
+}: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="breadcrumb-separator"
+      role="presentation"
+      aria-hidden="true"
+      className={cn("[&>svg]:size-3.5", className)}
+      {...props}
+    >
+      {children ?? <ChevronRight />}
+    </li>
+  )
+}
+
+function BreadcrumbEllipsis({
+  className,
+  ...props
+}: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="breadcrumb-ellipsis"
+      role="presentation"
+      aria-hidden="true"
+      className={cn("flex size-9 items-center justify-center", className)}
+      {...props}
+    >
+      <MoreHorizontal className="size-4" />
+      <span className="sr-only">More</span>
+    </span>
+  )
+}
+
+export {
+  Breadcrumb,
+  BreadcrumbList,
+  BreadcrumbItem,
+  BreadcrumbLink,
+  BreadcrumbPage,
+  BreadcrumbSeparator,
+  BreadcrumbEllipsis,
+}
diff --git a/packages/ui/src/components/button.tsx b/packages/ui/src/components/button.tsx
index 5ca0207..094bca6 100644
--- a/packages/ui/src/components/button.tsx
+++ b/packages/ui/src/components/button.tsx
@@ -1,48 +1,59 @@
-import type * as React from 'react';
-import { Slot } from '@radix-ui/react-slot';
-import { cva, type VariantProps } from 'class-variance-authority';
+import * as React from "react"
+import { Slot } from "@radix-ui/react-slot"
+import { cva, type VariantProps } from "class-variance-authority"
 
-import { cn } from '@repo/ui/lib/utils';
+import { cn } from "@repo/ui/lib/utils"
 
 const buttonVariants = cva(
-	"inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-[color,box-shadow] disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 [&_svg]:shrink-0 ring-ring/10 dark:ring-ring/20 dark:outline-ring/40 outline-ring/50 focus-visible:ring-4 focus-visible:outline-1 aria-invalid:focus-visible:ring-0",
-	{
-		variants: {
-			variant: {
-				default: 'bg-primary text-primary-foreground shadow-sm hover:bg-primary/90',
-				destructive: 'bg-destructive text-destructive-foreground shadow-xs hover:bg-destructive/90',
-				outline: 'border border-input bg-background shadow-xs hover:bg-accent hover:text-accent-foreground',
-				secondary: 'bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80',
-				ghost: 'hover:bg-accent hover:text-accent-foreground',
-				link: 'text-primary underline-offset-4 hover:underline',
-			},
-			size: {
-				default: 'h-9 px-4 py-2 has-[>svg]:px-3',
-				sm: 'h-8 rounded-md px-3 has-[>svg]:px-2.5',
-				lg: 'h-10 rounded-md px-6 has-[>svg]:px-4',
-				icon: 'size-9',
-			},
-		},
-		defaultVariants: {
-			variant: 'default',
-			size: 'default',
-		},
-	},
-);
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive",
+  {
+    variants: {
+      variant: {
+        default:
+          "bg-primary text-primary-foreground shadow-xs hover:bg-primary/90",
+        destructive:
+          "bg-destructive text-white shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60",
+        outline:
+          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50",
+        secondary:
+          "bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80",
+        ghost:
+          "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
+        link: "text-primary underline-offset-4 hover:underline",
+      },
+      size: {
+        default: "h-9 px-4 py-2 has-[>svg]:px-3",
+        sm: "h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5",
+        lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
+        icon: "size-9",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
 
 function Button({
-	className,
-	variant,
-	size,
-	asChild = false,
-	...props
-}: React.ComponentProps<'button'> &
-	VariantProps<typeof buttonVariants> & {
-		asChild?: boolean;
-	}) {
-	const Comp = asChild ? Slot : 'button';
+  className,
+  variant,
+  size,
+  asChild = false,
+  ...props
+}: React.ComponentProps<"button"> &
+  VariantProps<typeof buttonVariants> & {
+    asChild?: boolean
+  }) {
+  const Comp = asChild ? Slot : "button"
 
-	return <Comp data-slot="button" className={cn(buttonVariants({ variant, size, className }))} {...props} />;
+  return (
+    <Comp
+      data-slot="button"
+      className={cn(buttonVariants({ variant, size, className }))}
+      {...props}
+    />
+  )
 }
 
-export { Button, buttonVariants };
+export { Button, buttonVariants }
diff --git a/packages/ui/src/components/card.tsx b/packages/ui/src/components/card.tsx
new file mode 100644
index 0000000..4768e35
--- /dev/null
+++ b/packages/ui/src/components/card.tsx
@@ -0,0 +1,92 @@
+import * as React from "react"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Card({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card"
+      className={cn(
+        "bg-card text-card-foreground flex flex-col gap-6 rounded-xl border py-6 shadow-sm",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-header"
+      className={cn(
+        "@container/card-header grid auto-rows-min grid-rows-[auto_auto] items-start gap-1.5 px-6 has-data-[slot=card-action]:grid-cols-[1fr_auto] [.border-b]:pb-6",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-title"
+      className={cn("leading-none font-semibold", className)}
+      {...props}
+    />
+  )
+}
+
+function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-description"
+      className={cn("text-muted-foreground text-sm", className)}
+      {...props}
+    />
+  )
+}
+
+function CardAction({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-action"
+      className={cn(
+        "col-start-2 row-span-2 row-start-1 self-start justify-self-end",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-content"
+      className={cn("px-6", className)}
+      {...props}
+    />
+  )
+}
+
+function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-footer"
+      className={cn("flex items-center px-6 [.border-t]:pt-6", className)}
+      {...props}
+    />
+  )
+}
+
+export {
+  Card,
+  CardHeader,
+  CardFooter,
+  CardTitle,
+  CardAction,
+  CardDescription,
+  CardContent,
+}
diff --git a/packages/ui/src/components/dialog.tsx b/packages/ui/src/components/dialog.tsx
new file mode 100644
index 0000000..292015a
--- /dev/null
+++ b/packages/ui/src/components/dialog.tsx
@@ -0,0 +1,135 @@
+"use client"
+
+import * as React from "react"
+import * as DialogPrimitive from "@radix-ui/react-dialog"
+import { XIcon } from "lucide-react"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Dialog({
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Root>) {
+  return <DialogPrimitive.Root data-slot="dialog" {...props} />
+}
+
+function DialogTrigger({
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Trigger>) {
+  return <DialogPrimitive.Trigger data-slot="dialog-trigger" {...props} />
+}
+
+function DialogPortal({
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Portal>) {
+  return <DialogPrimitive.Portal data-slot="dialog-portal" {...props} />
+}
+
+function DialogClose({
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Close>) {
+  return <DialogPrimitive.Close data-slot="dialog-close" {...props} />
+}
+
+function DialogOverlay({
+  className,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Overlay>) {
+  return (
+    <DialogPrimitive.Overlay
+      data-slot="dialog-overlay"
+      className={cn(
+        "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function DialogContent({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Content>) {
+  return (
+    <DialogPortal data-slot="dialog-portal">
+      <DialogOverlay />
+      <DialogPrimitive.Content
+        data-slot="dialog-content"
+        className={cn(
+          "bg-background data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg duration-200 sm:max-w-lg",
+          className
+        )}
+        {...props}
+      >
+        {children}
+        <DialogPrimitive.Close className="ring-offset-background focus:ring-ring data-[state=open]:bg-accent data-[state=open]:text-muted-foreground absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4">
+          <XIcon />
+          <span className="sr-only">Close</span>
+        </DialogPrimitive.Close>
+      </DialogPrimitive.Content>
+    </DialogPortal>
+  )
+}
+
+function DialogHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="dialog-header"
+      className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
+      {...props}
+    />
+  )
+}
+
+function DialogFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="dialog-footer"
+      className={cn(
+        "flex flex-col-reverse gap-2 sm:flex-row sm:justify-end",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function DialogTitle({
+  className,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Title>) {
+  return (
+    <DialogPrimitive.Title
+      data-slot="dialog-title"
+      className={cn("text-lg leading-none font-semibold", className)}
+      {...props}
+    />
+  )
+}
+
+function DialogDescription({
+  className,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Description>) {
+  return (
+    <DialogPrimitive.Description
+      data-slot="dialog-description"
+      className={cn("text-muted-foreground text-sm", className)}
+      {...props}
+    />
+  )
+}
+
+export {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogOverlay,
+  DialogPortal,
+  DialogTitle,
+  DialogTrigger,
+}
diff --git a/packages/ui/src/components/input.tsx b/packages/ui/src/components/input.tsx
new file mode 100644
index 0000000..c58f90a
--- /dev/null
+++ b/packages/ui/src/components/input.tsx
@@ -0,0 +1,21 @@
+import * as React from "react"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+  return (
+    <input
+      type={type}
+      data-slot="input"
+      className={cn(
+        "file:text-foreground placeholder:text-muted-foreground selection:bg-primary selection:text-primary-foreground dark:bg-input/30 border-input flex h-9 w-full min-w-0 rounded-md border bg-transparent px-3 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+        "focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]",
+        "aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Input }
diff --git a/packages/ui/src/components/label.tsx b/packages/ui/src/components/label.tsx
new file mode 100644
index 0000000..bbf396f
--- /dev/null
+++ b/packages/ui/src/components/label.tsx
@@ -0,0 +1,24 @@
+"use client"
+
+import * as React from "react"
+import * as LabelPrimitive from "@radix-ui/react-label"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Label({
+  className,
+  ...props
+}: React.ComponentProps<typeof LabelPrimitive.Root>) {
+  return (
+    <LabelPrimitive.Root
+      data-slot="label"
+      className={cn(
+        "flex items-center gap-2 text-sm leading-none font-medium select-none group-data-[disabled=true]:pointer-events-none group-data-[disabled=true]:opacity-50 peer-disabled:cursor-not-allowed peer-disabled:opacity-50",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Label }
diff --git a/packages/ui/src/components/separator.tsx b/packages/ui/src/components/separator.tsx
new file mode 100644
index 0000000..df56a18
--- /dev/null
+++ b/packages/ui/src/components/separator.tsx
@@ -0,0 +1,28 @@
+"use client"
+
+import * as React from "react"
+import * as SeparatorPrimitive from "@radix-ui/react-separator"
+
+import { cn } from "@repo/ui/lib/utils"
+
+function Separator({
+  className,
+  orientation = "horizontal",
+  decorative = true,
+  ...props
+}: React.ComponentProps<typeof SeparatorPrimitive.Root>) {
+  return (
+    <SeparatorPrimitive.Root
+      data-slot="separator-root"
+      decorative={decorative}
+      orientation={orientation}
+      className={cn(
+        "bg-border shrink-0 data-[orientation=horizontal]:h-px data-[orientation=horizontal]:w-full data-[orientation=vertical]:h-full data-[orientation=vertical]:w-px",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Separator }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 90a6a98..b55278a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -32,6 +32,9 @@ importers:
       '@elastic/elasticsearch':
         specifier: ^9.0.2
         version: 9.0.2
+      '@hono/node-server':
+        specifier: ^1.14.3
+        version: 1.14.3(hono@4.7.10)
       '@hono/trpc-server':
         specifier: ^0.3.4
         version: 0.3.4(@trpc/server@11.1.2(typescript@5.8.3))(hono@4.7.10)
@@ -41,21 +44,12 @@ importers:
       '@repo/db':
         specifier: workspace:*
         version: link:../../packages/db
-      '@repo/tus':
+      '@repo/oidc-provider':
         specifier: workspace:*
-        version: link:../../packages/tus
+        version: link:../../packages/oidc-provider
       '@trpc/server':
         specifier: 11.1.2
         version: 11.1.2(typescript@5.8.3)
-      '@types/oidc-provider':
-        specifier: ^9.1.0
-        version: 9.1.0
-      dayjs:
-        specifier: ^1.11.13
-        version: 1.11.13
-      dotenv:
-        specifier: ^16.4.7
-        version: 16.5.0
       hono:
         specifier: ^4.7.10
         version: 4.7.10
@@ -83,9 +77,9 @@ importers:
       superjson:
         specifier: ^2.2.2
         version: 2.2.2
-      transliteration:
-        specifier: ^2.3.5
-        version: 2.3.5
+      valibot:
+        specifier: ^1.1.0
+        version: 1.1.0(typescript@5.8.3)
       zod:
         specifier: ^3.25.23
         version: 3.25.23
@@ -96,9 +90,30 @@ importers:
       '@types/node':
         specifier: ^22.15.21
         version: 22.15.21
+      '@types/oidc-provider':
+        specifier: ^9.1.0
+        version: 9.1.0
+      supertest:
+        specifier: ^7.1.1
+        version: 7.1.1
+      vitest:
+        specifier: ^3.1.4
+        version: 3.1.4(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0)
 
   apps/web:
     dependencies:
+      '@radix-ui/react-avatar':
+        specifier: ^1.1.10
+        version: 1.1.10(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-label':
+        specifier: ^2.1.7
+        version: 2.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-separator':
+        specifier: ^1.1.7
+        version: 1.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-slot':
+        specifier: ^1.2.3
+        version: 1.2.3(@types/react@19.1.5)(react@19.1.0)
       '@repo/client':
         specifier: workspace:*
         version: link:../../packages/client
@@ -138,6 +153,9 @@ importers:
       next-themes:
         specifier: ^0.4.6
         version: 0.4.6(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      oidc-client-ts:
+        specifier: ^3.2.1
+        version: 3.2.1
       react:
         specifier: ^19.1.0
         version: 19.1.0
@@ -147,9 +165,9 @@ importers:
       superjson:
         specifier: ^2.2.2
         version: 2.2.2
-      tus-js-client:
-        specifier: ^4.1.0
-        version: 4.3.1
+      valibot:
+        specifier: ^1.1.0
+        version: 1.1.0(typescript@5.8.3)
     devDependencies:
       '@repo/eslint-config':
         specifier: workspace:*
@@ -353,6 +371,34 @@ importers:
         specifier: 5.4.3
         version: 5.4.3
 
+  packages/oidc-provider:
+    dependencies:
+      '@hono/zod-validator':
+        specifier: ^0.5.0
+        version: 0.5.0(hono@4.7.10)(zod@3.25.23)
+      hono:
+        specifier: ^4.7.10
+        version: 4.7.10
+      ioredis:
+        specifier: 5.4.1
+        version: 5.4.1
+      jose:
+        specifier: ^6.0.11
+        version: 6.0.11
+      nanoid:
+        specifier: ^5.1.5
+        version: 5.1.5
+      zod:
+        specifier: ^3.25.23
+        version: 3.25.23
+    devDependencies:
+      '@types/node':
+        specifier: ^22.15.21
+        version: 22.15.21
+      typescript:
+        specifier: ^5.0.0
+        version: 5.8.3
+
   packages/openapi:
     dependencies:
       '@asteasolutions/zod-to-openapi':
@@ -449,11 +495,23 @@ importers:
 
   packages/ui:
     dependencies:
+      '@radix-ui/react-avatar':
+        specifier: ^1.1.10
+        version: 1.1.10(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-dialog':
+        specifier: ^1.1.14
+        version: 1.1.14(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
       '@radix-ui/react-dropdown-menu':
         specifier: ^2.1.14
         version: 2.1.15(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-label':
+        specifier: ^2.1.7
+        version: 2.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-separator':
+        specifier: ^1.1.7
+        version: 1.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
       '@radix-ui/react-slot':
-        specifier: ^1.2.2
+        specifier: ^1.2.3
         version: 1.2.3(@types/react@19.1.5)(react@19.1.0)
       clsx:
         specifier: ^2.1.1
@@ -1109,6 +1167,12 @@ packages:
   '@floating-ui/utils@0.2.9':
     resolution: {integrity: sha512-MDWhGtE+eHw5JW7lq4qhc5yRLS11ERl1c7Z6Xd0a58DozHES6EnNNwUWbMiG4J9Cgj053Bhk8zvlhFYKVhULwg==}
 
+  '@hono/node-server@1.14.3':
+    resolution: {integrity: sha512-KuDMwwghtFYSmIpr4WrKs1VpelTrptvJ+6x6mbUcZnFcc213cumTF5BdqfHyW93B19TNI4Vaev14vOI2a0Ie3w==}
+    engines: {node: '>=18.14.1'}
+    peerDependencies:
+      hono: ^4
+
   '@hono/trpc-server@0.3.4':
     resolution: {integrity: sha512-xFOPjUPnII70FgicDzOJy1ufIoBTu8eF578zGiDOrYOrYN8CJe140s9buzuPkX+SwJRYK8LjEBHywqZtxdm8aA==}
     engines: {node: '>=16.0.0'}
@@ -1361,6 +1425,10 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@noble/hashes@1.8.0':
+    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
+    engines: {node: ^14.21.3 || >=16}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -1381,6 +1449,9 @@ packages:
     resolution: {integrity: sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==}
     engines: {node: '>=8.0.0'}
 
+  '@paralleldrive/cuid2@2.2.2':
+    resolution: {integrity: sha512-ZOBkgDwEdoYVlSeRbYYXs0S9MejQofiVYoTbKzy/6GQa39/q5tQU2IX46+shYnUkpEl3wc+J6wRlar7r2EK2xA==}
+
   '@pkgjs/parseargs@0.11.0':
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
     engines: {node: '>=14'}
@@ -1431,6 +1502,19 @@ packages:
       '@types/react-dom':
         optional: true
 
+  '@radix-ui/react-avatar@1.1.10':
+    resolution: {integrity: sha512-V8piFfWapM5OmNCXTzVQY+E1rDa53zY+MQ4Y7356v4fFz6vqCyUtIz2rUD44ZEdwg78/jKmMJHj07+C/Z/rcog==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
   '@radix-ui/react-collection@1.1.7':
     resolution: {integrity: sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw==}
     peerDependencies:
@@ -1462,6 +1546,19 @@ packages:
       '@types/react':
         optional: true
 
+  '@radix-ui/react-dialog@1.1.14':
+    resolution: {integrity: sha512-+CpweKjqpzTmwRwcYECQcNYbI8V9VSQt0SNFKeEBLgfucbsLssU6Ppq7wUdNXEGb573bMjFhVjKVll8rmV6zMw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
   '@radix-ui/react-direction@1.1.1':
     resolution: {integrity: sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw==}
     peerDependencies:
@@ -1528,6 +1625,19 @@ packages:
       '@types/react':
         optional: true
 
+  '@radix-ui/react-label@2.1.7':
+    resolution: {integrity: sha512-YT1GqPSL8kJn20djelMX7/cTRp/Y9w5IZHvfxQTVHrOqa2yMl7i/UfMqKRU5V7mEyKTrUVgJXhNQPVCG8PBLoQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
   '@radix-ui/react-menu@2.1.15':
     resolution: {integrity: sha512-tVlmA3Vb9n8SZSd+YSbuFR66l87Wiy4du+YE+0hzKQEANA+7cWKH1WgqcEX4pXqxUFQKrWQGHdvEfw00TjFiew==}
     peerDependencies:
@@ -1606,6 +1716,19 @@ packages:
       '@types/react-dom':
         optional: true
 
+  '@radix-ui/react-separator@1.1.7':
+    resolution: {integrity: sha512-0HEb8R9E8A+jZjvmFCy/J4xhbXy3TV+9XSnGJ3KvTtjlIUy/YQ/p6UYZvi7YbeoeXdyU9+Y3scizK6hkY37baA==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
   '@radix-ui/react-slot@1.2.3':
     resolution: {integrity: sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==}
     peerDependencies:
@@ -1651,6 +1774,15 @@ packages:
       '@types/react':
         optional: true
 
+  '@radix-ui/react-use-is-hydrated@0.1.0':
+    resolution: {integrity: sha512-U+UORVEq+cTnRIaostJv9AGdV3G6Y+zbVd+12e18jQ5A3c0xL03IhnHuiU4UV69wolOQp5GfR58NW/EgdQhwOA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
   '@radix-ui/react-use-layout-effect@1.1.1':
     resolution: {integrity: sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==}
     peerDependencies:
@@ -2504,6 +2636,35 @@ packages:
   '@ungap/structured-clone@1.3.0':
     resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
 
+  '@vitest/expect@3.1.4':
+    resolution: {integrity: sha512-xkD/ljeliyaClDYqHPNCiJ0plY5YIcM0OlRiZizLhlPmpXWpxnGMyTZXOHFhFeG7w9P5PBeL4IdtJ/HeQwTbQA==}
+
+  '@vitest/mocker@3.1.4':
+    resolution: {integrity: sha512-8IJ3CvwtSw/EFXqWFL8aCMu+YyYXG2WUSrQbViOZkWTKTVicVwZ/YiEZDSqD00kX+v/+W+OnxhNWoeVKorHygA==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^5.0.0 || ^6.0.0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/pretty-format@3.1.4':
+    resolution: {integrity: sha512-cqv9H9GvAEoTaoq+cYqUTCGscUjKqlJZC7PRwY5FMySVj5J+xOm1KQcCiYHJOEzOKRUhLH4R2pTwvFlWCEScsg==}
+
+  '@vitest/runner@3.1.4':
+    resolution: {integrity: sha512-djTeF1/vt985I/wpKVFBMWUlk/I7mb5hmD5oP8K9ACRmVXgKTae3TUOtXAEBfslNKPzUQvnKhNd34nnRSYgLNQ==}
+
+  '@vitest/snapshot@3.1.4':
+    resolution: {integrity: sha512-JPHf68DvuO7vilmvwdPr9TS0SuuIzHvxeaCkxYcCD4jTk67XwL45ZhEHFKIuCm8CYstgI6LZ4XbwD6ANrwMpFg==}
+
+  '@vitest/spy@3.1.4':
+    resolution: {integrity: sha512-Xg1bXhu+vtPXIodYN369M86K8shGLouNjoVI78g8iAq2rFoHFdajNvJJ5A/9bPMFcfQqdaCpOgWKEoMQg/s0Yg==}
+
+  '@vitest/utils@3.1.4':
+    resolution: {integrity: sha512-yriMuO1cfFhmiGc8ataN51+9ooHRuURdfAZfwFd3usWynjzpLslZdYnRegTv32qdgtJTsj15FoeZe2g15fY1gg==}
+
   '@zxing/text-encoding@0.9.0':
     resolution: {integrity: sha512-U/4aVJ2mxI0aDNI8Uq0wEhMgY+u4CNtEb0om3+y3+niDAsoTCOB33UF0sxpzqzdqXLqmvc+vZyAt4O8pPdfkwA==}
 
@@ -2617,6 +2778,13 @@ packages:
     resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
     engines: {node: '>= 0.4'}
 
+  asap@2.0.6:
+    resolution: {integrity: sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==}
+
+  assertion-error@2.0.1:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
   ast-types@0.13.4:
     resolution: {integrity: sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w==}
     engines: {node: '>=4'}
@@ -2751,6 +2919,10 @@ packages:
   caniuse-lite@1.0.30001718:
     resolution: {integrity: sha512-AflseV1ahcSunK53NfEs9gFWgOEmzr0f+kaMFA4xiLZlr9Hzt7HxcSpIFcnNCUkz6R6dWKa54rUz3HUmI3nVcw==}
 
+  chai@5.2.0:
+    resolution: {integrity: sha512-mCuXncKXk5iCLhfhwTc0izo0gtEmpz5CtG2y8GiOINBlMVS6v8TMRc5TaLWKS6692m9+dVVfzgeVxR5UxWHTYw==}
+    engines: {node: '>=12'}
+
   chalk-template@0.4.0:
     resolution: {integrity: sha512-/ghrgmhfY8RaSdeo43hNXxpoHAtxdbskUHjPpfqUWGttFgycUhYPGx3YZBCnUCvOa7Doivn1IZec3DEGFoMgLg==}
     engines: {node: '>=12'}
@@ -2777,6 +2949,10 @@ packages:
   chardet@0.7.0:
     resolution: {integrity: sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==}
 
+  check-error@2.1.1:
+    resolution: {integrity: sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw==}
+    engines: {node: '>= 16'}
+
   chokidar@3.6.0:
     resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
     engines: {node: '>= 8.10.0'}
@@ -2879,6 +3055,9 @@ packages:
     resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==}
     engines: {node: '>= 10'}
 
+  component-emitter@1.3.1:
+    resolution: {integrity: sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==}
+
   concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
@@ -2908,6 +3087,9 @@ packages:
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
+  cookiejar@2.1.4:
+    resolution: {integrity: sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==}
+
   cookies@0.9.1:
     resolution: {integrity: sha512-TG2hpqe4ELx54QER/S3HQ9SRVnQnGBtKUz5bLQWtYAQ+o6GpgMs6sYUvaiJjVxb+UXwhRhAEP3m7LbsIZ77Hmw==}
     engines: {node: '>= 0.8'}
@@ -2996,6 +3178,10 @@ packages:
     resolution: {integrity: sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==}
     engines: {node: '>=0.10'}
 
+  deep-eql@5.0.2:
+    resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
+    engines: {node: '>=6'}
+
   deep-equal@1.0.1:
     resolution: {integrity: sha512-bHtC0iYvWhyaTzvV3CZgPeZQqCOBGyGsVV7v4eevpdkLHfiSrXUdBG+qAuSz4RI70sszvjQ1QSZ98An1yNwpSw==}
 
@@ -3059,6 +3245,9 @@ packages:
   detect-node-es@1.1.0:
     resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
 
+  dezalgo@1.0.4:
+    resolution: {integrity: sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==}
+
   diff@4.0.2:
     resolution: {integrity: sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==}
     engines: {node: '>=0.3.1'}
@@ -3156,6 +3345,9 @@ packages:
     resolution: {integrity: sha512-uDn+FE1yrDzyC0pCo961B2IHbdM8y/ACZsKD4dG6WqrjV53BADjwa7D+1aom2rsNVfLyDgU/eigvlJGJ08OQ4w==}
     engines: {node: '>= 0.4'}
 
+  es-module-lexer@1.7.0:
+    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+
   es-object-atoms@1.1.1:
     resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
     engines: {node: '>= 0.4'}
@@ -3287,6 +3479,9 @@ packages:
     resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
     engines: {node: '>=4.0'}
 
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
   esutils@2.0.3:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
@@ -3299,6 +3494,10 @@ packages:
     resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
     engines: {node: '>=10'}
 
+  expect-type@1.2.1:
+    resolution: {integrity: sha512-/kP8CAwxzLVEeFrMm4kMmy4CCDlpipyA7MYLVrdJIkV0fYF0UaigQHRsxHiuY/GEea+bh4KSv3TIlgr+2UL6bw==}
+    engines: {node: '>=12.0.0'}
+
   external-editor@3.1.0:
     resolution: {integrity: sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==}
     engines: {node: '>=4'}
@@ -3320,9 +3519,8 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-xml-parser@4.4.1:
-    resolution: {integrity: sha512-xkjOecfnKGkSsOwtZ5Pz7Us/T6mrbPQrq0nh+aCO5V9nk5NLWmasAHumTKjiPJPWANe+kAZ84Jc8ooJkzZ88Sw==}
-    hasBin: true
+  fast-safe-stringify@2.1.1:
+    resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
 
   fast-xml-parser@4.5.3:
     resolution: {integrity: sha512-RKihhV+SHsIUGXObeVy9AXiBbFwkVk7Syp8XgwN5U3JV416+Gwp/GO9i0JYKmikykgz/UHRrrV4ROuZEo/T0ig==}
@@ -3421,6 +3619,10 @@ packages:
     resolution: {integrity: sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==}
     engines: {node: '>= 12.20'}
 
+  formidable@3.5.4:
+    resolution: {integrity: sha512-YikH+7CUTOtP44ZTnUhR7Ic2UASBPOqmaRkRKxRbywPTe5VxF7RRCck4af9wutiZ/QKM5nME9Bie2fFaPz5Gug==}
+    engines: {node: '>=14.0.0'}
+
   fresh@0.5.2:
     resolution: {integrity: sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==}
     engines: {node: '>= 0.6'}
@@ -3932,6 +4134,10 @@ packages:
     resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
     engines: {node: '>=4.0'}
 
+  jwt-decode@4.0.0:
+    resolution: {integrity: sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==}
+    engines: {node: '>=18'}
+
   keygrip@1.1.0:
     resolution: {integrity: sha512-iYSchDJ+liQ8iwbSI2QqsQOvqv58eJCEanyJPJi+Khyu8smkcKSFUCbPwzFcL7YVtZ6eONjqRX/38caJ7QjRAQ==}
     engines: {node: '>= 0.6'}
@@ -4087,6 +4293,9 @@ packages:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
 
+  loupe@3.1.3:
+    resolution: {integrity: sha512-kkIp7XSkP78ZxJEsSxW3712C6teJVoeHHwgo9zJ380de7IYyJ2ISlxojcH2pC5OFLewESmnRi/+XCDIEEVyoug==}
+
   lower-case-first@1.0.2:
     resolution: {integrity: sha512-UuxaYakO7XeONbKrZf5FEgkantPf5DUqDayzP5VXZrtRPdH86s4kN47I8B3TW10S4QKiE3ziHNf3kRN//okHjA==}
 
@@ -4142,6 +4351,10 @@ packages:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
 
+  methods@1.1.2:
+    resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==}
+    engines: {node: '>= 0.6'}
+
   micromatch@4.0.8:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
@@ -4162,6 +4375,11 @@ packages:
     resolution: {integrity: sha512-xRc4oEhT6eaBpU1XF7AjpOFD+xQmXNB5OVKwp4tqCuBpHLS/ZbBDrc07mYTDqVMg6PfxUjjNp85O6Cd2Z/5HWA==}
     engines: {node: '>= 0.6'}
 
+  mime@2.6.0:
+    resolution: {integrity: sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==}
+    engines: {node: '>=4.0.0'}
+    hasBin: true
+
   mimic-fn@2.1.0:
     resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==}
     engines: {node: '>=6'}
@@ -4331,6 +4549,10 @@ packages:
     resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
     engines: {node: '>= 0.4'}
 
+  oidc-client-ts@3.2.1:
+    resolution: {integrity: sha512-hS5AJ5s/x4bXhHvNJT1v+GGvzHUwdRWqNQQbSrp10L1IRmzfRGKQ3VWN3dstJb+oF3WtAyKezwD2+dTEIyBiAA==}
+    engines: {node: '>=18'}
+
   oidc-provider@9.1.1:
     resolution: {integrity: sha512-kkH1yWjjEUKVe2pbWS7vvE3ibRae/yjCcRq1Q8PKu5eGOg4MWlmino7A1Hm1bDYm+bLAdHIVcMdb2i9nbeUTeA==}
 
@@ -4452,6 +4674,10 @@ packages:
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
+  pathval@2.0.0:
+    resolution: {integrity: sha512-vE7JKRyES09KiunauX7nd2Q9/L7lhok4smP9RZTDeD4MVs72Dp2qNFVz39Nz5a0FVEW0BJR6C0DYrq6unoziZA==}
+    engines: {node: '>= 14.16'}
+
   picocolors@1.0.1:
     resolution: {integrity: sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==}
 
@@ -4556,6 +4782,10 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
+  qs@6.14.0:
+    resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==}
+    engines: {node: '>=0.6'}
+
   query-string@7.1.3:
     resolution: {integrity: sha512-hh2WYhq4fi8+b+/2Kg9CEge4fDPvHS534aOOvOZeQ3+Vf2mCFsaFBYj0i+iXcAq6I9Vzp5fjMFBlONvayDC1qg==}
     engines: {node: '>=6'}
@@ -4837,6 +5067,9 @@ packages:
     resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
     engines: {node: '>= 0.4'}
 
+  siginfo@2.0.0:
+    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
   signal-exit@3.0.7:
     resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
 
@@ -4891,6 +5124,9 @@ packages:
   sprintf-js@1.1.3:
     resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==}
 
+  stackback@0.0.2:
+    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
   standard-as-callback@2.1.0:
     resolution: {integrity: sha512-qoRRSyROncaz1z0mvYqIE4lCd9p2R90i6GxW3uZv5ucSu8tU7B5HXUP1gG8pVZsYNVaXjk8ClXHPttLyxAL48A==}
 
@@ -4902,6 +5138,9 @@ packages:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
 
+  std-env@3.9.0:
+    resolution: {integrity: sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==}
+
   streamsearch@1.1.0:
     resolution: {integrity: sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==}
     engines: {node: '>=10.0.0'}
@@ -4985,10 +5224,18 @@ packages:
     engines: {node: '>=16 || 14 >=14.17'}
     hasBin: true
 
+  superagent@10.2.1:
+    resolution: {integrity: sha512-O+PCv11lgTNJUzy49teNAWLjBZfc+A1enOwTpLlH6/rsvKcTwcdTT8m9azGkVqM7HBl5jpyZ7KTPhHweokBcdg==}
+    engines: {node: '>=14.18.0'}
+
   superjson@2.2.2:
     resolution: {integrity: sha512-5JRxVqC8I8NuOUjzBbvVJAKNM8qoVuH0O77h4WInc/qC2q5IreqKxYwgkga3PfA22OayK2ikceb/B26dztPl+Q==}
     engines: {node: '>=16'}
 
+  supertest@7.1.1:
+    resolution: {integrity: sha512-aI59HBTlG9e2wTjxGJV+DygfNLgnWbGdZxiA/sgrnNNikIW8lbDvCtF6RnhZoJ82nU7qv7ZLjrvWqCEm52fAmw==}
+    engines: {node: '>=14.18.0'}
+
   supports-color@5.5.0:
     resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
     engines: {node: '>=4'}
@@ -5050,6 +5297,9 @@ packages:
   through@2.3.8:
     resolution: {integrity: sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==}
 
+  tinybench@2.9.0:
+    resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
   tinycolor2@1.6.0:
     resolution: {integrity: sha512-XPaBkWQJdsf3pLKJV9p4qN/S+fm2Oj8AIPo1BTUhg5oxkvm9+SVEGFdhyOz7tTdUTfvxMiAs4sp6/eZO2Ew+pw==}
 
@@ -5063,6 +5313,18 @@ packages:
   tinygradient@1.1.5:
     resolution: {integrity: sha512-8nIfc2vgQ4TeLnk2lFj4tRLvvJwEfQuabdsmvDdQPT0xlk9TaNtpGd6nNRxXoK6vQhN6RSzj+Cnp5tTQmpxmbw==}
 
+  tinypool@1.0.2:
+    resolution: {integrity: sha512-al6n+QEANGFOMf/dmUMsuS5/r9B06uwlyNjZZql/zv8J7ybHCgoihBNORZCY2mzUuAnomQa2JdhyHKzZxPCrFA==}
+    engines: {node: ^18.0.0 || >=20.0.0}
+
+  tinyrainbow@2.0.0:
+    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
+    engines: {node: '>=14.0.0'}
+
+  tinyspy@3.0.2:
+    resolution: {integrity: sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==}
+    engines: {node: '>=14.0.0'}
+
   title-case@2.1.1:
     resolution: {integrity: sha512-EkJoZ2O3zdCz3zJsYCsxyq2OC5hrxR9mfdd5I+w8h/tmFfeOxJ+vvkxsKxdmN0WtS9zLdHEgfgVOiMVgv+Po4Q==}
 
@@ -5332,6 +5594,11 @@ packages:
       '@types/react':
         optional: true
 
+  use-sync-external-store@1.5.0:
+    resolution: {integrity: sha512-Rb46I4cGGVBmjamjphe8L/UnvJD+uPPtTkNvX5mZgqdbavhI4EbgIWJiIHXJ8bc/i9EQGPRh4DwEURJ552Do0A==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
@@ -5345,6 +5612,14 @@ packages:
   v8-compile-cache-lib@3.0.1:
     resolution: {integrity: sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==}
 
+  valibot@1.1.0:
+    resolution: {integrity: sha512-Nk8lX30Qhu+9txPYTwM0cFlWLdPFsFr6LblzqIySfbZph9+BFsAHsNvHOymEviUepeIW6KFHzpX8TKhbptBXXw==}
+    peerDependencies:
+      typescript: '>=5'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
   validate-npm-package-name@5.0.1:
     resolution: {integrity: sha512-OljLrQ9SQdOUqTaQxqL5dEfZWrXExyyWsozYlAWFawPVNuD83igl7uJD2RTkNMbniIYgt8l81eCJGIdQF7avLQ==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
@@ -5353,6 +5628,79 @@ packages:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
 
+  vite-node@3.1.4:
+    resolution: {integrity: sha512-6enNwYnpyDo4hEgytbmc6mYWHXDHYEn0D1/rw4Q+tnHUGtKTJsn8T1YkX6Q18wI5LCrS8CTYlBaiCqxOy2kvUA==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+
+  vite@6.3.5:
+    resolution: {integrity: sha512-cZn6NDFE7wdTpINgs++ZJ4N49W2vRp8LCKrn3Ob1kYNtOo21vfDoaV5GzBfLU4MovSAB8uNRm4jgzVQZ+mBzPQ==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vitest@3.1.4:
+    resolution: {integrity: sha512-Ta56rT7uWxCSJXlBtKgIlApJnT6e6IGmTYxYcmxjJ4ujuZDI59GUQgVDObXXJujOmPDBYXHK1qmaGtneu6TNIQ==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@types/debug': ^4.1.12
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      '@vitest/browser': 3.1.4
+      '@vitest/ui': 3.1.4
+      happy-dom: '*'
+      jsdom: '*'
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@types/debug':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
   wcwidth@1.0.1:
     resolution: {integrity: sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==}
 
@@ -5390,6 +5738,11 @@ packages:
     engines: {node: '>= 8'}
     hasBin: true
 
+  why-is-node-running@2.3.0:
+    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+    engines: {node: '>=8'}
+    hasBin: true
+
   word-wrap@1.2.5:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
@@ -6302,6 +6655,10 @@ snapshots:
 
   '@floating-ui/utils@0.2.9': {}
 
+  '@hono/node-server@1.14.3(hono@4.7.10)':
+    dependencies:
+      hono: 4.7.10
+
   '@hono/trpc-server@0.3.4(@trpc/server@11.1.2(typescript@5.8.3))(hono@4.7.10)':
     dependencies:
       '@trpc/server': 11.1.2(typescript@5.8.3)
@@ -6493,6 +6850,8 @@ snapshots:
   '@next/swc-win32-x64-msvc@15.3.2':
     optional: true
 
+  '@noble/hashes@1.8.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -6510,6 +6869,10 @@ snapshots:
   '@opentelemetry/api@1.9.0':
     optional: true
 
+  '@paralleldrive/cuid2@2.2.2':
+    dependencies:
+      '@noble/hashes': 1.8.0
+
   '@pkgjs/parseargs@0.11.0':
     optional: true
 
@@ -6554,6 +6917,19 @@ snapshots:
       '@types/react': 19.1.5
       '@types/react-dom': 19.1.5(@types/react@19.1.5)
 
+  '@radix-ui/react-avatar@1.1.10(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
+    dependencies:
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.5)(react@19.1.0)
+      react: 19.1.0
+      react-dom: 19.1.0(react@19.1.0)
+    optionalDependencies:
+      '@types/react': 19.1.5
+      '@types/react-dom': 19.1.5(@types/react@19.1.5)
+
   '@radix-ui/react-collection@1.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.5)(react@19.1.0)
@@ -6578,6 +6954,28 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.5
 
+  '@radix-ui/react-dialog@1.1.14(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.2
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.5)(react@19.1.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.5)(react@19.1.0)
+      aria-hidden: 1.2.6
+      react: 19.1.0
+      react-dom: 19.1.0(react@19.1.0)
+      react-remove-scroll: 2.7.0(@types/react@19.1.5)(react@19.1.0)
+    optionalDependencies:
+      '@types/react': 19.1.5
+      '@types/react-dom': 19.1.5(@types/react@19.1.5)
+
   '@radix-ui/react-direction@1.1.1(@types/react@19.1.5)(react@19.1.0)':
     dependencies:
       react: 19.1.0
@@ -6636,6 +7034,15 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.5
 
+  '@radix-ui/react-label@2.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      react: 19.1.0
+      react-dom: 19.1.0(react@19.1.0)
+    optionalDependencies:
+      '@types/react': 19.1.5
+      '@types/react-dom': 19.1.5(@types/react@19.1.5)
+
   '@radix-ui/react-menu@2.1.15(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
@@ -6726,6 +7133,15 @@ snapshots:
       '@types/react': 19.1.5
       '@types/react-dom': 19.1.5(@types/react@19.1.5)
 
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.5(@types/react@19.1.5))(@types/react@19.1.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      react: 19.1.0
+      react-dom: 19.1.0(react@19.1.0)
+    optionalDependencies:
+      '@types/react': 19.1.5
+      '@types/react-dom': 19.1.5(@types/react@19.1.5)
+
   '@radix-ui/react-slot@1.2.3(@types/react@19.1.5)(react@19.1.0)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.5)(react@19.1.0)
@@ -6761,6 +7177,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.5
 
+  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.1.5)(react@19.1.0)':
+    dependencies:
+      react: 19.1.0
+      use-sync-external-store: 1.5.0(react@19.1.0)
+    optionalDependencies:
+      '@types/react': 19.1.5
+
   '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.1.5)(react@19.1.0)':
     dependencies:
       react: 19.1.0
@@ -7732,6 +8155,46 @@ snapshots:
 
   '@ungap/structured-clone@1.3.0': {}
 
+  '@vitest/expect@3.1.4':
+    dependencies:
+      '@vitest/spy': 3.1.4
+      '@vitest/utils': 3.1.4
+      chai: 5.2.0
+      tinyrainbow: 2.0.0
+
+  '@vitest/mocker@3.1.4(vite@6.3.5(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0))':
+    dependencies:
+      '@vitest/spy': 3.1.4
+      estree-walker: 3.0.3
+      magic-string: 0.30.17
+    optionalDependencies:
+      vite: 6.3.5(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0)
+
+  '@vitest/pretty-format@3.1.4':
+    dependencies:
+      tinyrainbow: 2.0.0
+
+  '@vitest/runner@3.1.4':
+    dependencies:
+      '@vitest/utils': 3.1.4
+      pathe: 2.0.3
+
+  '@vitest/snapshot@3.1.4':
+    dependencies:
+      '@vitest/pretty-format': 3.1.4
+      magic-string: 0.30.17
+      pathe: 2.0.3
+
+  '@vitest/spy@3.1.4':
+    dependencies:
+      tinyspy: 3.0.2
+
+  '@vitest/utils@3.1.4':
+    dependencies:
+      '@vitest/pretty-format': 3.1.4
+      loupe: 3.1.3
+      tinyrainbow: 2.0.0
+
   '@zxing/text-encoding@0.9.0':
     optional: true
 
@@ -7870,6 +8333,10 @@ snapshots:
       get-intrinsic: 1.3.0
       is-array-buffer: 3.0.5
 
+  asap@2.0.6: {}
+
+  assertion-error@2.0.1: {}
+
   ast-types@0.13.4:
     dependencies:
       tslib: 2.8.1
@@ -8006,6 +8473,14 @@ snapshots:
 
   caniuse-lite@1.0.30001718: {}
 
+  chai@5.2.0:
+    dependencies:
+      assertion-error: 2.0.1
+      check-error: 2.1.1
+      deep-eql: 5.0.2
+      loupe: 3.1.3
+      pathval: 2.0.0
+
   chalk-template@0.4.0:
     dependencies:
       chalk: 4.1.2
@@ -8051,6 +8526,8 @@ snapshots:
 
   chardet@0.7.0: {}
 
+  check-error@2.1.1: {}
+
   chokidar@3.6.0:
     dependencies:
       anymatch: 3.1.3
@@ -8150,6 +8627,8 @@ snapshots:
 
   commander@7.2.0: {}
 
+  component-emitter@1.3.1: {}
+
   concat-map@0.0.1: {}
 
   concurrently@8.2.2:
@@ -8181,6 +8660,8 @@ snapshots:
 
   convert-source-map@2.0.0: {}
 
+  cookiejar@2.1.4: {}
+
   cookies@0.9.1:
     dependencies:
       depd: 2.0.0
@@ -8269,6 +8750,8 @@ snapshots:
 
   decode-uri-component@0.2.2: {}
 
+  deep-eql@5.0.2: {}
+
   deep-equal@1.0.1: {}
 
   deep-extend@0.6.0: {}
@@ -8326,6 +8809,11 @@ snapshots:
 
   detect-node-es@1.1.0: {}
 
+  dezalgo@1.0.4:
+    dependencies:
+      asap: 2.0.6
+      wrappy: 1.0.2
+
   diff@4.0.2: {}
 
   dir-glob@3.0.1:
@@ -8479,6 +8967,8 @@ snapshots:
       iterator.prototype: 1.1.5
       safe-array-concat: 1.1.3
 
+  es-module-lexer@1.7.0: {}
+
   es-object-atoms@1.1.1:
     dependencies:
       es-errors: 1.3.0
@@ -8731,6 +9221,10 @@ snapshots:
 
   estraverse@5.3.0: {}
 
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.7
+
   esutils@2.0.3: {}
 
   eta@3.5.0: {}
@@ -8747,6 +9241,8 @@ snapshots:
       signal-exit: 3.0.7
       strip-final-newline: 2.0.0
 
+  expect-type@1.2.1: {}
+
   external-editor@3.1.0:
     dependencies:
       chardet: 0.7.0
@@ -8775,9 +9271,7 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-xml-parser@4.4.1:
-    dependencies:
-      strnum: 1.1.2
+  fast-safe-stringify@2.1.1: {}
 
   fast-xml-parser@4.5.3:
     dependencies:
@@ -8868,6 +9362,12 @@ snapshots:
       node-domexception: 1.0.0
       web-streams-polyfill: 4.0.0-beta.3
 
+  formidable@3.5.4:
+    dependencies:
+      '@paralleldrive/cuid2': 2.2.2
+      dezalgo: 1.0.4
+      once: 1.4.0
+
   fresh@0.5.2: {}
 
   fs-extra@10.1.0:
@@ -9426,6 +9926,8 @@ snapshots:
       object.assign: 4.1.7
       object.values: 1.2.1
 
+  jwt-decode@4.0.0: {}
+
   keygrip@1.1.0:
     dependencies:
       tsscmp: 1.0.6
@@ -9573,6 +10075,8 @@ snapshots:
     dependencies:
       js-tokens: 4.0.0
 
+  loupe@3.1.3: {}
+
   lower-case-first@1.0.2:
     dependencies:
       lower-case: 1.1.4
@@ -9615,6 +10119,8 @@ snapshots:
 
   merge2@1.4.1: {}
 
+  methods@1.1.2: {}
+
   micromatch@4.0.8:
     dependencies:
       braces: 3.0.3
@@ -9632,6 +10138,8 @@ snapshots:
     dependencies:
       mime-db: 1.54.0
 
+  mime@2.6.0: {}
+
   mimic-fn@2.1.0: {}
 
   minimatch@10.0.1:
@@ -9821,6 +10329,10 @@ snapshots:
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
 
+  oidc-client-ts@3.2.1:
+    dependencies:
+      jwt-decode: 4.0.0
+
   oidc-provider@9.1.1:
     dependencies:
       '@koa/cors': 5.0.0
@@ -9982,6 +10494,8 @@ snapshots:
 
   pathe@2.0.3: {}
 
+  pathval@2.0.0: {}
+
   picocolors@1.0.1: {}
 
   picocolors@1.1.1: {}
@@ -10071,6 +10585,10 @@ snapshots:
 
   punycode@2.3.1: {}
 
+  qs@6.14.0:
+    dependencies:
+      side-channel: 1.1.0
+
   query-string@7.1.3:
     dependencies:
       decode-uri-component: 0.2.2
@@ -10420,6 +10938,8 @@ snapshots:
       side-channel-map: 1.0.1
       side-channel-weakmap: 1.0.2
 
+  siginfo@2.0.0: {}
+
   signal-exit@3.0.7: {}
 
   signal-exit@4.1.0: {}
@@ -10469,12 +10989,16 @@ snapshots:
 
   sprintf-js@1.1.3: {}
 
+  stackback@0.0.2: {}
+
   standard-as-callback@2.1.0: {}
 
   statuses@1.5.0: {}
 
   statuses@2.0.1: {}
 
+  std-env@3.9.0: {}
+
   streamsearch@1.1.0: {}
 
   strict-uri-encode@2.0.0: {}
@@ -10576,10 +11100,31 @@ snapshots:
       pirates: 4.0.7
       ts-interface-checker: 0.1.13
 
+  superagent@10.2.1:
+    dependencies:
+      component-emitter: 1.3.1
+      cookiejar: 2.1.4
+      debug: 4.4.1
+      fast-safe-stringify: 2.1.1
+      form-data: 4.0.2
+      formidable: 3.5.4
+      methods: 1.1.2
+      mime: 2.6.0
+      qs: 6.14.0
+    transitivePeerDependencies:
+      - supports-color
+
   superjson@2.2.2:
     dependencies:
       copy-anything: 3.0.5
 
+  supertest@7.1.1:
+    dependencies:
+      methods: 1.1.2
+      superagent: 10.2.1
+    transitivePeerDependencies:
+      - supports-color
+
   supports-color@5.5.0:
     dependencies:
       has-flag: 3.0.0
@@ -10647,6 +11192,8 @@ snapshots:
 
   through@2.3.8: {}
 
+  tinybench@2.9.0: {}
+
   tinycolor2@1.6.0: {}
 
   tinyexec@0.3.2: {}
@@ -10661,6 +11208,12 @@ snapshots:
       '@types/tinycolor2': 1.4.6
       tinycolor2: 1.6.0
 
+  tinypool@1.0.2: {}
+
+  tinyrainbow@2.0.0: {}
+
+  tinyspy@3.0.2: {}
+
   title-case@2.1.1:
     dependencies:
       no-case: 2.3.2
@@ -10945,6 +11498,10 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.5
 
+  use-sync-external-store@1.5.0(react@19.1.0):
+    dependencies:
+      react: 19.1.0
+
   util-deprecate@1.0.2: {}
 
   util@0.12.5:
@@ -10959,10 +11516,90 @@ snapshots:
 
   v8-compile-cache-lib@3.0.1: {}
 
+  valibot@1.1.0(typescript@5.8.3):
+    optionalDependencies:
+      typescript: 5.8.3
+
   validate-npm-package-name@5.0.1: {}
 
   vary@1.1.2: {}
 
+  vite-node@3.1.4(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0):
+    dependencies:
+      cac: 6.7.14
+      debug: 4.4.1
+      es-module-lexer: 1.7.0
+      pathe: 2.0.3
+      vite: 6.3.5(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0)
+    transitivePeerDependencies:
+      - '@types/node'
+      - jiti
+      - less
+      - lightningcss
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+      - tsx
+      - yaml
+
+  vite@6.3.5(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0):
+    dependencies:
+      esbuild: 0.25.4
+      fdir: 6.4.4(picomatch@4.0.2)
+      picomatch: 4.0.2
+      postcss: 8.5.3
+      rollup: 4.41.0
+      tinyglobby: 0.2.13
+    optionalDependencies:
+      '@types/node': 22.15.21
+      fsevents: 2.3.3
+      jiti: 2.4.2
+      lightningcss: 1.30.1
+      tsx: 4.19.4
+      yaml: 2.8.0
+
+  vitest@3.1.4(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0):
+    dependencies:
+      '@vitest/expect': 3.1.4
+      '@vitest/mocker': 3.1.4(vite@6.3.5(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0))
+      '@vitest/pretty-format': 3.1.4
+      '@vitest/runner': 3.1.4
+      '@vitest/snapshot': 3.1.4
+      '@vitest/spy': 3.1.4
+      '@vitest/utils': 3.1.4
+      chai: 5.2.0
+      debug: 4.4.1
+      expect-type: 1.2.1
+      magic-string: 0.30.17
+      pathe: 2.0.3
+      std-env: 3.9.0
+      tinybench: 2.9.0
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.13
+      tinypool: 1.0.2
+      tinyrainbow: 2.0.0
+      vite: 6.3.5(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0)
+      vite-node: 3.1.4(@types/node@22.15.21)(jiti@2.4.2)(lightningcss@1.30.1)(tsx@4.19.4)(yaml@2.8.0)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 22.15.21
+    transitivePeerDependencies:
+      - jiti
+      - less
+      - lightningcss
+      - msw
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+      - tsx
+      - yaml
+
   wcwidth@1.0.1:
     dependencies:
       defaults: 1.0.4
@@ -11028,6 +11665,11 @@ snapshots:
     dependencies:
       isexe: 2.0.0
 
+  why-is-node-running@2.3.0:
+    dependencies:
+      siginfo: 2.0.0
+      stackback: 0.0.2
+
   word-wrap@1.2.5: {}
 
   wordwrap@1.0.0: {}
diff --git a/test-oidc.ts b/test-oidc.ts
new file mode 100644
index 0000000..0519ecb
--- /dev/null
+++ b/test-oidc.ts
@@ -0,0 +1 @@
+ 
\ No newline at end of file