@finueva/auth 0.32.0 → 0.34.0

package/dist/{types-BU8vZrhF.d.ts → types-QJnXZXYY.d.ts}

@@ -10,13 +10,27 @@ interface UserApiCredential {
 }
 //#endregion
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "social_signup_required" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "organization_slug_unavailable" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "social_signup_required" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "organization_slug_unavailable" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required" | "account_deletion_pending" | "account_restore_unavailable";
 type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 410 | 413 | 415 | 422 | 429 | 503;
+/** What a sign-in refusal says about an account that is scheduled for deletion. */
+interface AuthErrorAccountDeletion {
+  /** When Auth deletes the account unless it is restored first. */
+  deleteAfter: Date;
+  /**
+   * A single-use, 15-minute ticket that restores the account without another sign-in. It is null when Auth could not
+   * issue one; the emailed restore link still works. Keep it in memory only.
+   */
+  restoreTicket: string | null;
+}
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;
   readonly retryAfterSeconds?: number;
-  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
+  /** Present only on `account_deletion_pending`. */
+  readonly accountDeletion?: AuthErrorAccountDeletion;
+  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number, details?: {
+    accountDeletion?: AuthErrorAccountDeletion;
+  });
 }
 //#endregion
 //#region src/organization-directory/contract.d.ts
@@ -337,6 +351,16 @@ type CeremonyRecentAuthenticationRequest = ({
   action: "organization_closure_cancel";
   organizationId: string;
 } & OrganizationClosureCancelInput);
+/** What the person confirmed before deleting the account. */
+interface AccountDeletionStartRequest {
+  /** One key for one confirmation. A retry with the same key returns the same deletion. */
+  idempotencyKey: string;
+  /**
+   * The organizations that close with the account, exactly as `getAccountDeletionEligibility` listed them in
+   * `soleOrganizations`. Auth refuses the start when its own list differs, for example after a member joined.
+   */
+  soleOrganizationIds: string[];
+}
 type CeremonyHandoffInput = CeremonyReturnInput & ({
   purpose: "passkey_enrollment";
 } | {
@@ -345,7 +369,43 @@ type CeremonyHandoffInput = CeremonyReturnInput & ({
 } | {
   purpose: "recent_authentication";
   request: CeremonyRecentAuthenticationRequest;
+} | {
+  purpose: "user_closure";
+  request: AccountDeletionStartRequest;
 });
+interface AccountDeletionOrganization {
+  id: string;
+  name: string;
+  slug: string | null;
+}
+/** Whether the current User can delete the account now, and what the deletion includes. */
+interface AccountDeletionEligibility {
+  eligible: boolean;
+  /** `managed_account`: an organization's identity provider manages the account. `platform_role`: a Finueva platform role. */
+  accountBlocker: "managed_account" | "platform_role" | null;
+  /**
+   * Organizations that stop the deletion: the User owns one that has other members (`owner_with_members`), or a
+   * sole-member organization has an enterprise connection (`enterprise_connection`).
+   */
+  blockingOrganizations: (AccountDeletionOrganization & {
+    reason: "owner_with_members" | "enterprise_connection";
+  })[];
+  /** Organizations where the User is the only member. They close with the account. */
+  soleOrganizations: AccountDeletionOrganization[];
+  /**
+   * What the deletion ceremony asks for: nothing more after a sign-in in the last ten minutes (`recent_sign_in`), the
+   * password (`password`), or a new sign-in first (`sign_in_again`, an account without a password).
+   */
+  stepUp: "recent_sign_in" | "password" | "sign_in_again";
+  /** The deletion date if the deletion started now. */
+  deleteAfter: Date;
+}
+/** The single-use secret that restores an account during its 30-day deletion window. */
+type AccountDeletionRestoreInput = {
+  restoreTicket: string;
+} | {
+  restoreLinkToken: string;
+};
 /** An Auth-Origin ceremony address. The fragment carries a single-use code that expires at `expiresAt`. */
 interface CeremonyHandoff {
   url: string;
@@ -718,10 +778,18 @@ interface FinuevaAuthClient {
     revoked: number;
   }>;
   /**
-   * Starts one Auth-Origin ceremony for the current session: passkey enrollment, passkey removal, or one
-   * organization recent-authentication action. Open the returned address in a top-level browser context.
+   * Starts one Auth-Origin ceremony for the current session: passkey enrollment, passkey removal, one
+   * organization recent-authentication action, or the deletion of the account. Open the returned address in a
+   * top-level browser context.
    */
   createCeremonyHandoff(input: CeremonyHandoffInput): Promise<CeremonyHandoff>;
+  /** Reads whether the current User can delete the account now. The read changes nothing. */
+  getAccountDeletionEligibility(): Promise<AccountDeletionEligibility>;
+  /**
+   * Restores an account that is scheduled for deletion, with the ticket from an `account_deletion_pending` sign-in
+   * refusal or the token of the emailed restore link. It needs no session and creates none: sign in afterwards.
+   */
+  restoreAccount(input: AccountDeletionRestoreInput): Promise<void>;
   listPasskeys(): Promise<PasskeyInventory>;
   renamePasskey(passkeyId: string, name: string): Promise<void>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<AuthSession>;
@@ -736,4 +804,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { OrganizationTeam as $, EnterpriseConnection as A, SuspendedOrganizationMemberStatus as At, OrganizationDeparture as B, RegisterOrganizationApplicationInput as Bt, CreatedOrganizationTeam as C, ScimCredentialState as Ct, DepartedOrganizationMemberPage as D, SocialIdTokenProvider as Dt, DepartedOrganizationMember as E, SocialIdTokenInput as Et, InvitationAcceptance as F, UpdateOrganizationDisplayInput as Ft, OrganizationMemberAuthority as G, AuthErrorStatus as Gt, OrganizationInvitation as H, OrganizationDirectoryEntry as Ht, InvitationDecline as I, UpdateOrganizationTeamDisplayInput as It, OrganizationMemberPageInput as J, OrganizationMemberAuthorityV2 as K, UserApiCredential as Kt, OrganizationClosure as L, UpdateProfileInput as Lt, EnterpriseConnectionDomain as M, TwoFactorStatus as Mt, EnterpriseConnectionSetup as N, TwoFactorStepUpInput as Nt, DriveCredential as O, SuspendedOrganizationMember as Ot, FinuevaAuthClient as P, UpdateEnterpriseConnectionInput as Pt, OrganizationSignInStates as Q, OrganizationClosureCancelInput as R, WorkspaceSelection as Rt, CreatedOrganizationMemberInvitation as S, ScimCredentialIssuance as St, DeletedOrganizationTeam as T, SignInInput as Tt, OrganizationInvitationPage as U, AuthError as Ut, OrganizationDisplay as V, RegisteredOrganizationApplication as Vt, OrganizationMember as W, AuthErrorCode as Wt, OrganizationPageInput as X, OrganizationPage as Y, OrganizationSignInState as Z, ClosingOrganization as _, RemovedOrganizationMember as _t, AuthPersistence as a, PasskeySummary as at, CreateOrganizationMemberInvitationInput as b, RestoredOrganizationMember as bt, AuthSessionInventory as c, PlatformRole as ct, AuthUser as d, PlatformRoleChangeRecentAuthenticationInput as dt, OrganizationTeamDisplay as et, CanceledOrganizationInvitation as f, PlatformRoleFirstApproval as ft, CeremonyReturnInput as g, RecentAuthenticationStatus as gt, CeremonyRecentAuthenticationRequest as h, ReceivedOrganizationInvitationPage as ht, AuthOrganization as i, PasskeyInventory as it, EnterpriseConnectionAction as j, TwoFactorEnrollment as jt, DriveCredentialInput as k, SuspendedOrganizationMemberPage as kt, AuthSessionSummary as l, PlatformRoleApplied as lt, CeremonyHandoffInput as m, ReceivedOrganizationInvitation as mt, AddedOrganizationTeamMember as n, OrganizationTeamPage as nt, AuthPersistenceDriver as o, PersonalWorkspaceSelection as ot, CeremonyHandoff as p, PlatformStatus as pt, OrganizationMemberPage as q, UserApiCredentialInput as qt, AuthClientOptions as r, OrganizationWorkspaceSelection as rt, AuthSession as s, PlatformBootstrapRoleChangeInput as st, AcceptInvitationInput as t, OrganizationTeamMemberPage as tt, AuthState as u, PlatformRoleApproval as ut, ClosingOrganizationList as v, RemovedOrganizationTeamMember as vt, DeclineInvitationInput as w, SendVerificationEmailInput as wt, CreatedOrganization as x, RotateScimCredentialInput as xt, CreateEnterpriseConnectionInput as y, ResentOrganizationInvitation as yt, OrganizationClosureStartInput as z, OrganizationApplicationRegistration as zt };
+export { OrganizationPage as $, DepartedOrganizationMember as A, SocialIdTokenInput as At, InvitationDecline as B, UpdateOrganizationTeamDisplayInput as Bt, CreateEnterpriseConnectionInput as C, ResentOrganizationInvitation as Ct, CreatedOrganizationTeam as D, ScimCredentialState as Dt, CreatedOrganizationMemberInvitation as E, ScimCredentialIssuance as Et, EnterpriseConnectionAction as F, TwoFactorEnrollment as Ft, OrganizationDisplay as G, RegisteredOrganizationApplication as Gt, OrganizationClosureCancelInput as H, WorkspaceSelection as Ht, EnterpriseConnectionDomain as I, TwoFactorStatus as It, OrganizationMember as J, AuthErrorAccountDeletion as Jt, OrganizationInvitation as K, OrganizationDirectoryEntry as Kt, EnterpriseConnectionSetup as L, TwoFactorStepUpInput as Lt, DriveCredential as M, SuspendedOrganizationMember as Mt, DriveCredentialInput as N, SuspendedOrganizationMemberPage as Nt, DeclineInvitationInput as O, SendVerificationEmailInput as Ot, EnterpriseConnection as P, SuspendedOrganizationMemberStatus as Pt, OrganizationMemberPageInput as Q, UserApiCredentialInput as Qt, FinuevaAuthClient as R, UpdateEnterpriseConnectionInput as Rt, ClosingOrganizationList as S, RemovedOrganizationTeamMember as St, CreatedOrganization as T, RotateScimCredentialInput as Tt, OrganizationClosureStartInput as U, OrganizationApplicationRegistration as Ut, OrganizationClosure as V, UpdateProfileInput as Vt, OrganizationDeparture as W, RegisterOrganizationApplicationInput as Wt, OrganizationMemberAuthorityV2 as X, AuthErrorStatus as Xt, OrganizationMemberAuthority as Y, AuthErrorCode as Yt, OrganizationMemberPage as Z, UserApiCredential as Zt, CeremonyHandoff as _, PlatformStatus as _t, AccountDeletionStartRequest as a, OrganizationTeamMemberPage as at, CeremonyReturnInput as b, RecentAuthenticationStatus as bt, AuthOrganization as c, PasskeyInventory as ct, AuthSession as d, PlatformBootstrapRoleChangeInput as dt, OrganizationPageInput as et, AuthSessionInventory as f, PlatformRole as ft, CanceledOrganizationInvitation as g, PlatformRoleFirstApproval as gt, AuthUser as h, PlatformRoleChangeRecentAuthenticationInput as ht, AccountDeletionRestoreInput as i, OrganizationTeamDisplay as it, DepartedOrganizationMemberPage as j, SocialIdTokenProvider as jt, DeletedOrganizationTeam as k, SignInInput as kt, AuthPersistence as l, PasskeySummary as lt, AuthState as m, PlatformRoleApproval as mt, AccountDeletionEligibility as n, OrganizationSignInStates as nt, AddedOrganizationTeamMember as o, OrganizationTeamPage as ot, AuthSessionSummary as p, PlatformRoleApplied as pt, OrganizationInvitationPage as q, AuthError as qt, AccountDeletionOrganization as r, OrganizationTeam as rt, AuthClientOptions as s, OrganizationWorkspaceSelection as st, AcceptInvitationInput as t, OrganizationSignInState as tt, AuthPersistenceDriver as u, PersonalWorkspaceSelection as ut, CeremonyHandoffInput as v, ReceivedOrganizationInvitation as vt, CreateOrganizationMemberInvitationInput as w, RestoredOrganizationMember as wt, ClosingOrganization as x, RemovedOrganizationMember as xt, CeremonyRecentAuthenticationRequest as y, ReceivedOrganizationInvitationPage as yt, InvitationAcceptance as z, UpdateOrganizationDisplayInput as zt };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -53,19 +53,19 @@
     "@better-auth/core": "1.6.22",
     "@better-auth/passkey": "1.6.22",
     "@chiballc/utils": "2.5.1",
-    "@types/node": "24.13.3",
+    "@types/node": "26.6.5",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.10",
     "better-auth": "1.6.22",
-    "jose": "6.2.4",
-    "miniflare": "4.20260722.0",
+    "jose": "6.2.12",
+    "miniflare": "4.20260730.0",
     "ofetch": "1.5.1",
-    "playwright": "1.62.0",
-    "rolldown": "1.2.0",
-    "rolldown-plugin-dts": "0.27.14",
+    "playwright": "1.64.1",
+    "rolldown": "1.2.14",
+    "rolldown-plugin-dts": "0.28.8",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "ufo": "1.6.4",
-    "unstorage": "1.17.5",
+    "unstorage": "1.17.6",
     "vitest": "4.1.10"
   }
 }