@finueva/auth 0.33.0 → 0.34.0

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { $ as OrganizationTeam, C as CreatedOrganizationTeam, Dt as SocialIdTokenProvider, Et as SocialIdTokenInput, Ft as UpdateOrganizationDisplayInput, G as OrganizationMemberAuthority, Gt as AuthErrorStatus, H as OrganizationInvitation, It as UpdateOrganizationTeamDisplayInput, J as OrganizationMemberPageInput, K as OrganizationMemberAuthorityV2, Kt as UserApiCredential, Lt as UpdateProfileInput, Mt as TwoFactorStatus, O as DriveCredential, S as CreatedOrganizationMemberInvitation, U as OrganizationInvitationPage, Ut as AuthError, V as OrganizationDisplay, W as OrganizationMember, Wt as AuthErrorCode, X as OrganizationPageInput, Y as OrganizationPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, et as OrganizationTeamDisplay, ht as ReceivedOrganizationInvitationPage, i as AuthOrganization, it as PasskeyInventory, k as DriveCredentialInput, m as CeremonyHandoffInput, mt as ReceivedOrganizationInvitation, nt as OrganizationTeamPage, p as CeremonyHandoff, q as OrganizationMemberPage, qt as UserApiCredentialInput, s as AuthSession, tt as OrganizationTeamMemberPage, x as CreatedOrganization } from "./types-BU8vZrhF.js";
+import { $ as OrganizationPage, At as SocialIdTokenInput, Bt as UpdateOrganizationTeamDisplayInput, D as CreatedOrganizationTeam, E as CreatedOrganizationMemberInvitation, G as OrganizationDisplay, It as TwoFactorStatus, J as OrganizationMember, Jt as AuthErrorAccountDeletion, K as OrganizationInvitation, M as DriveCredential, N as DriveCredentialInput, Q as OrganizationMemberPageInput, Qt as UserApiCredentialInput, T as CreatedOrganization, Vt as UpdateProfileInput, X as OrganizationMemberAuthorityV2, Xt as AuthErrorStatus, Y as OrganizationMemberAuthority, Yt as AuthErrorCode, Z as OrganizationMemberPage, Zt as UserApiCredential, _ as CeremonyHandoff, a as AccountDeletionStartRequest, at as OrganizationTeamMemberPage, c as AuthOrganization, ct as PasskeyInventory, d as AuthSession, et as OrganizationPageInput, f as AuthSessionInventory, i as AccountDeletionRestoreInput, it as OrganizationTeamDisplay, jt as SocialIdTokenProvider, n as AccountDeletionEligibility, ot as OrganizationTeamPage, q as OrganizationInvitationPage, qt as AuthError, r as AccountDeletionOrganization, rt as OrganizationTeam, v as CeremonyHandoffInput, vt as ReceivedOrganizationInvitation, w as CreateOrganizationMemberInvitationInput, yt as ReceivedOrganizationInvitationPage, zt as UpdateOrganizationDisplayInput } from "./types-QJnXZXYY.js";
 //#region src/device.d.ts
 export type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 export declare class DeviceAuthorizationError extends Error {
@@ -80,6 +80,10 @@ export interface DeviceAuthClient {
    * browser. The device never runs WebAuthn for the Auth Relying Party itself.
    */
   createCeremonyHandoff(input: CeremonyHandoffInput): Promise<CeremonyHandoff>;
+  /** Reads whether this device's User can delete the account now. The read changes nothing. */
+  getAccountDeletionEligibility(): Promise<AccountDeletionEligibility>;
+  /** Restores an account that is scheduled for deletion. It needs no session and creates none. */
+  restoreAccount(input: AccountDeletionRestoreInput): Promise<void>;
   listPasskeys(): Promise<PasskeyInventory>;
   renamePasskey(passkeyId: string, name: string): Promise<void>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<AuthSession>;
@@ -92,4 +96,4 @@ export interface DeviceAuthClient {
 }
 export declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput };
+export { type AccountDeletionEligibility, type AccountDeletionOrganization, type AccountDeletionRestoreInput, type AccountDeletionStartRequest, AuthError, type AuthErrorAccountDeletion, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput };

package/dist/device.js

@@ -1,3 +1,182 @@
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
+	password_reset_invalid: "The password reset request is invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change.",
+	account_deletion_pending: "This account is scheduled for deletion.",
+	account_restore_unavailable: "The restore ticket or link is used or expired, or the account is not scheduled for deletion."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	accountDeletion;
+	constructor(code, status, retryAfterSeconds, details) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+		if (details?.accountDeletion) this.accountDeletion = details.accountDeletion;
+	}
+};
+//#endregion
+//#region src/account-deletion.ts
+function isObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authorityUnavailable$1() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+const idPattern$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const tokenPattern = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+const idempotencyPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\s\S])/;
+const MAX_SOLE_ORGANIZATIONS = 20;
+const MAX_BLOCKING_ORGANIZATIONS = 100;
+const organizationBlockers = new Set(["owner_with_members", "enterprise_connection"]);
+const accountBlockers = new Set(["managed_account", "platform_role"]);
+const stepUps = new Set([
+	"recent_sign_in",
+	"password",
+	"sign_in_again"
+]);
+function exact$3(value, keys) {
+	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
+}
+function isoDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable$1();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable$1();
+	return parsed;
+}
+function organization(value, keys) {
+	if (!exact$3(value, keys) || typeof value.id !== "string" || !idPattern$2.test(value.id) || typeof value.name !== "string" || value.name.length === 0 || value.name.length > 255 || value.slug !== null && (typeof value.slug !== "string" || value.slug.length === 0 || value.slug.length > 255)) throw authorityUnavailable$1();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
+function normalizeAccountDeletionStartRequest(value) {
+	if (!isObject$1(value) || typeof value.idempotencyKey !== "string" || !idempotencyPattern.test(value.idempotencyKey)) throw new TypeError("idempotencyKey is invalid");
+	const ids = value.soleOrganizationIds;
+	if (!Array.isArray(ids) || ids.length > MAX_SOLE_ORGANIZATIONS || !ids.every((id) => {
+		return typeof id === "string" && idPattern$2.test(id);
+	})) throw new TypeError("soleOrganizationIds is invalid");
+	return {
+		idempotencyKey: value.idempotencyKey,
+		soleOrganizationIds: [...ids]
+	};
+}
+function normalizeAccountDeletionEligibility(value) {
+	if (!exact$3(value, [
+		"accountBlocker",
+		"blockingOrganizations",
+		"deleteAfter",
+		"eligible",
+		"soleOrganizations",
+		"stepUp"
+	]) || typeof value.eligible !== "boolean" || value.accountBlocker !== null && !accountBlockers.has(value.accountBlocker) || !Array.isArray(value.blockingOrganizations) || value.blockingOrganizations.length > MAX_BLOCKING_ORGANIZATIONS || !Array.isArray(value.soleOrganizations) || value.soleOrganizations.length > MAX_SOLE_ORGANIZATIONS || !stepUps.has(value.stepUp)) throw authorityUnavailable$1();
+	const blockingOrganizations = value.blockingOrganizations.map((entry) => {
+		const summary = organization(entry, [
+			"id",
+			"name",
+			"reason",
+			"slug"
+		]);
+		const reason = entry.reason;
+		if (!organizationBlockers.has(reason)) throw authorityUnavailable$1();
+		return {
+			...summary,
+			reason
+		};
+	});
+	return {
+		eligible: value.eligible,
+		accountBlocker: value.accountBlocker,
+		blockingOrganizations,
+		soleOrganizations: value.soleOrganizations.map((entry) => {
+			return organization(entry, [
+				"id",
+				"name",
+				"slug"
+			]);
+		}),
+		stepUp: value.stepUp,
+		deleteAfter: isoDate(value.deleteAfter)
+	};
+}
+function normalizeAccountDeletionRestoreInput(value) {
+	if (exact$3(value, ["restoreTicket"]) && typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket)) return { restoreTicket: value.restoreTicket };
+	if (exact$3(value, ["restoreLinkToken"]) && typeof value.restoreLinkToken === "string" && tokenPattern.test(value.restoreLinkToken)) return { restoreLinkToken: value.restoreLinkToken };
+	throw new TypeError("restore input is invalid");
+}
+function normalizeAccountDeletionRestore(value) {
+	if (!exact$3(value, ["status"]) || value.status !== "restored") throw authorityUnavailable$1();
+}
+function accountDeletionPending(value, status) {
+	if (status !== 403 || !isObject$1(value) || value.code !== "ACCOUNT_DELETION_PENDING") return null;
+	let deleteAfter;
+	try {
+		deleteAfter = isoDate(value.deleteAfter);
+	} catch {
+		return null;
+	}
+	const restoreTicket = typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket) ? value.restoreTicket : null;
+	return {
+		deleteAfter,
+		restoreTicket
+	};
+}
+function fromAccountDeletionError(value, status) {
+	const code = isObject$1(value) ? value.code : void 0;
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 && code === "RESTORE_UNAVAILABLE") return new AuthError("account_restore_unavailable", 404);
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	return authorityUnavailable$1();
+}
 String.fromCharCode;
 const HASH_RE = /#/g;
 const AMPERSAND_RE = /&/g;
@@ -173,64 +352,6 @@ function stringifyParsedURL(parsed) {
 	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
 //#endregion
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	invalid_auth_input: "The authentication input is invalid.",
-	account_conflict: "The account is not available.",
-	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
-	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
-	google_recovery_not_required: "Google account recovery is not required.",
-	google_recovery_invalid: "The Google account recovery request is invalid.",
-	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
-	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
-	password_reset_invalid: "The password reset request is invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_request: "The request is invalid.",
-	invalid_invitation: "The invitation is invalid.",
-	invitation_unavailable: "The invitation is not available.",
-	recipient_unavailable: "The recipient is unavailable.",
-	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
-	invitation_recovery_required: "Invitation administration requires separate recovery.",
-	membership_removal_recovery_required: "Membership removal requires separate recovery.",
-	email_verification_required: "Email verification is required.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	organization_context_too_large: "The organization context is too large.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	auth_request_rate_limited: "Authentication requests are temporarily limited.",
-	organization_slug_unavailable: "The organization address is unavailable.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	platform_target_unavailable: "The platform administration target is unavailable.",
-	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
-	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable.",
-	two_factor_required: "A second authentication factor is required.",
-	two_factor_code_invalid: "The verification code is invalid.",
-	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
-	two_factor_locked: "Second-factor verification is temporarily locked.",
-	recent_sign_in_required: "A recent sign-in is required.",
-	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
-	recent_authentication_required: "A ready recent-authentication action is required.",
-	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
-	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
-	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
@@ -701,6 +822,8 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	const pendingDeletion = accountDeletionPending(value, status);
+	if (pendingDeletion) return new AuthError("account_deletion_pending", 403, void 0, { accountDeletion: pendingDeletion });
 	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
 	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
 	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
@@ -1577,6 +1700,11 @@ function normalizeCeremonyHandoffInput(value) {
 			}
 			throw new TypeError("request action is invalid");
 		}
+		case "user_closure": return {
+			purpose: input.purpose,
+			...base,
+			request: normalizeAccountDeletionStartRequest(input.request)
+		};
 		default: throw new TypeError("purpose is invalid");
 	}
 }
@@ -1640,6 +1768,7 @@ function fromCeremonyHandoffError(value, status, retryAfter) {
 	if (status === 403) return new AuthError("request_origin_denied", 403);
 	if (status === 404) return new AuthError("state_conflict", 409);
 	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409 && code === "RECENT_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	return authorityUnavailable();
@@ -1891,6 +2020,22 @@ function createDeviceAuth(options) {
 			mapError: fromCeremonyHandoffError
 		})).value);
 	}
+	async function accountDeletionRequest(method, path, body, normalize, bearer) {
+		const current = bearer ? await readToken() : void 0;
+		if (bearer && !current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/user/closure", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method,
+			credentials: "omit",
+			headers: {
+				...current ? { authorization: `Bearer ${current.accessToken}` } : {},
+				...body ? { "content-type": "application/json" } : {}
+			},
+			...body ? { body } : {},
+			mapError: fromAccountDeletionError
+		})).value);
+	}
 	async function revoke(path) {
 		const current = await readToken();
 		if (!current) return;
@@ -2379,6 +2524,14 @@ function createDeviceAuth(options) {
 				return ceremonyRequest("POST", "ceremony-handoffs", body, normalizeCeremonyHandoff);
 			});
 		},
+		getAccountDeletionEligibility() {
+			return serializeAuthority(() => {
+				return accountDeletionRequest("GET", "eligibility", void 0, normalizeAccountDeletionEligibility, true);
+			});
+		},
+		async restoreAccount(input) {
+			await accountDeletionRequest("POST", "restore", normalizeAccountDeletionRestoreInput(input), normalizeAccountDeletionRestore, false);
+		},
 		listPasskeys() {
 			return serializeAuthority(() => {
 				return ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory);

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as OrganizationTeam, A as EnterpriseConnection, At as SuspendedOrganizationMemberStatus, B as OrganizationDeparture, Bt as RegisterOrganizationApplicationInput, C as CreatedOrganizationTeam, Ct as ScimCredentialState, D as DepartedOrganizationMemberPage, Dt as SocialIdTokenProvider, E as DepartedOrganizationMember, Et as SocialIdTokenInput, F as InvitationAcceptance, Ft as UpdateOrganizationDisplayInput, G as OrganizationMemberAuthority, Gt as AuthErrorStatus, H as OrganizationInvitation, I as InvitationDecline, It as UpdateOrganizationTeamDisplayInput, J as OrganizationMemberPageInput, K as OrganizationMemberAuthorityV2, Kt as UserApiCredential, L as OrganizationClosure, Lt as UpdateProfileInput, M as EnterpriseConnectionDomain, Mt as TwoFactorStatus, N as EnterpriseConnectionSetup, Nt as TwoFactorStepUpInput, O as DriveCredential, Ot as SuspendedOrganizationMember, P as FinuevaAuthClient, Pt as UpdateEnterpriseConnectionInput, Q as OrganizationSignInStates, R as OrganizationClosureCancelInput, Rt as WorkspaceSelection, S as CreatedOrganizationMemberInvitation, St as ScimCredentialIssuance, T as DeletedOrganizationTeam, Tt as SignInInput, U as OrganizationInvitationPage, Ut as AuthError, V as OrganizationDisplay, Vt as RegisteredOrganizationApplication, W as OrganizationMember, Wt as AuthErrorCode, X as OrganizationPageInput, Y as OrganizationPage, Z as OrganizationSignInState, _ as ClosingOrganization, _t as RemovedOrganizationMember, a as AuthPersistence, at as PasskeySummary, b as CreateOrganizationMemberInvitationInput, bt as RestoredOrganizationMember, c as AuthSessionInventory, ct as PlatformRole, d as AuthUser, dt as PlatformRoleChangeRecentAuthenticationInput, et as OrganizationTeamDisplay, f as CanceledOrganizationInvitation, ft as PlatformRoleFirstApproval, g as CeremonyReturnInput, gt as RecentAuthenticationStatus, h as CeremonyRecentAuthenticationRequest, ht as ReceivedOrganizationInvitationPage, i as AuthOrganization, it as PasskeyInventory, j as EnterpriseConnectionAction, jt as TwoFactorEnrollment, k as DriveCredentialInput, kt as SuspendedOrganizationMemberPage, l as AuthSessionSummary, lt as PlatformRoleApplied, m as CeremonyHandoffInput, mt as ReceivedOrganizationInvitation, n as AddedOrganizationTeamMember, nt as OrganizationTeamPage, o as AuthPersistenceDriver, ot as PersonalWorkspaceSelection, p as CeremonyHandoff, pt as PlatformStatus, q as OrganizationMemberPage, qt as UserApiCredentialInput, r as AuthClientOptions, rt as OrganizationWorkspaceSelection, s as AuthSession, st as PlatformBootstrapRoleChangeInput, t as AcceptInvitationInput, tt as OrganizationTeamMemberPage, u as AuthState, ut as PlatformRoleApproval, v as ClosingOrganizationList, vt as RemovedOrganizationTeamMember, w as DeclineInvitationInput, wt as SendVerificationEmailInput, x as CreatedOrganization, xt as RotateScimCredentialInput, y as CreateEnterpriseConnectionInput, yt as ResentOrganizationInvitation, z as OrganizationClosureStartInput, zt as OrganizationApplicationRegistration } from "./types-BU8vZrhF.js";
+import { $ as OrganizationPage, A as DepartedOrganizationMember, At as SocialIdTokenInput, B as InvitationDecline, Bt as UpdateOrganizationTeamDisplayInput, C as CreateEnterpriseConnectionInput, Ct as ResentOrganizationInvitation, D as CreatedOrganizationTeam, Dt as ScimCredentialState, E as CreatedOrganizationMemberInvitation, Et as ScimCredentialIssuance, F as EnterpriseConnectionAction, Ft as TwoFactorEnrollment, G as OrganizationDisplay, Gt as RegisteredOrganizationApplication, H as OrganizationClosureCancelInput, Ht as WorkspaceSelection, I as EnterpriseConnectionDomain, It as TwoFactorStatus, J as OrganizationMember, Jt as AuthErrorAccountDeletion, K as OrganizationInvitation, L as EnterpriseConnectionSetup, Lt as TwoFactorStepUpInput, M as DriveCredential, Mt as SuspendedOrganizationMember, N as DriveCredentialInput, Nt as SuspendedOrganizationMemberPage, O as DeclineInvitationInput, Ot as SendVerificationEmailInput, P as EnterpriseConnection, Pt as SuspendedOrganizationMemberStatus, Q as OrganizationMemberPageInput, Qt as UserApiCredentialInput, R as FinuevaAuthClient, Rt as UpdateEnterpriseConnectionInput, S as ClosingOrganizationList, St as RemovedOrganizationTeamMember, T as CreatedOrganization, Tt as RotateScimCredentialInput, U as OrganizationClosureStartInput, Ut as OrganizationApplicationRegistration, V as OrganizationClosure, Vt as UpdateProfileInput, W as OrganizationDeparture, Wt as RegisterOrganizationApplicationInput, X as OrganizationMemberAuthorityV2, Xt as AuthErrorStatus, Y as OrganizationMemberAuthority, Yt as AuthErrorCode, Z as OrganizationMemberPage, Zt as UserApiCredential, _ as CeremonyHandoff, _t as PlatformStatus, a as AccountDeletionStartRequest, at as OrganizationTeamMemberPage, b as CeremonyReturnInput, bt as RecentAuthenticationStatus, c as AuthOrganization, ct as PasskeyInventory, d as AuthSession, dt as PlatformBootstrapRoleChangeInput, et as OrganizationPageInput, f as AuthSessionInventory, ft as PlatformRole, g as CanceledOrganizationInvitation, gt as PlatformRoleFirstApproval, h as AuthUser, ht as PlatformRoleChangeRecentAuthenticationInput, i as AccountDeletionRestoreInput, it as OrganizationTeamDisplay, j as DepartedOrganizationMemberPage, jt as SocialIdTokenProvider, k as DeletedOrganizationTeam, kt as SignInInput, l as AuthPersistence, lt as PasskeySummary, m as AuthState, mt as PlatformRoleApproval, n as AccountDeletionEligibility, nt as OrganizationSignInStates, o as AddedOrganizationTeamMember, ot as OrganizationTeamPage, p as AuthSessionSummary, pt as PlatformRoleApplied, q as OrganizationInvitationPage, qt as AuthError, r as AccountDeletionOrganization, rt as OrganizationTeam, s as AuthClientOptions, st as OrganizationWorkspaceSelection, t as AcceptInvitationInput, tt as OrganizationSignInState, u as AuthPersistenceDriver, ut as PersonalWorkspaceSelection, v as CeremonyHandoffInput, vt as ReceivedOrganizationInvitation, w as CreateOrganizationMemberInvitationInput, wt as RestoredOrganizationMember, x as ClosingOrganization, xt as RemovedOrganizationMember, y as CeremonyRecentAuthenticationRequest, yt as ReceivedOrganizationInvitationPage, z as InvitationAcceptance, zt as UpdateOrganizationDisplayInput } from "./types-QJnXZXYY.js";
 //#region src/client.d.ts
 export declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionDomain, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationApplicationRegistration, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationSignInState, type OrganizationSignInStates, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection };
+export { type AcceptInvitationInput, type AccountDeletionEligibility, type AccountDeletionOrganization, type AccountDeletionRestoreInput, type AccountDeletionStartRequest, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorAccountDeletion, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionDomain, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationApplicationRegistration, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationSignInState, type OrganizationSignInStates, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection };

package/dist/index.js

@@ -61,21 +61,143 @@ const messages = {
 	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
 	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
 	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
+	password_sign_in_required: "A password sign-in method is required for this passkey change.",
+	account_deletion_pending: "This account is scheduled for deletion.",
+	account_restore_unavailable: "The restore ticket or link is used or expired, or the account is not scheduled for deletion."
 };
 var AuthError = class extends Error {
 	code;
 	status;
 	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
+	accountDeletion;
+	constructor(code, status, retryAfterSeconds, details) {
 		super(messages[code]);
 		this.name = "AuthError";
 		this.code = code;
 		this.status = status;
 		this.retryAfterSeconds = retryAfterSeconds;
+		if (details?.accountDeletion) this.accountDeletion = details.accountDeletion;
 	}
 };
 //#endregion
+//#region src/account-deletion.ts
+function isObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authorityUnavailable$1() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+const idPattern$3 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const tokenPattern = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+const idempotencyPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\s\S])/;
+const MAX_SOLE_ORGANIZATIONS = 20;
+const MAX_BLOCKING_ORGANIZATIONS = 100;
+const organizationBlockers = new Set(["owner_with_members", "enterprise_connection"]);
+const accountBlockers = new Set(["managed_account", "platform_role"]);
+const stepUps = new Set([
+	"recent_sign_in",
+	"password",
+	"sign_in_again"
+]);
+function exact$5(value, keys) {
+	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
+}
+function isoDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable$1();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable$1();
+	return parsed;
+}
+function organization(value, keys) {
+	if (!exact$5(value, keys) || typeof value.id !== "string" || !idPattern$3.test(value.id) || typeof value.name !== "string" || value.name.length === 0 || value.name.length > 255 || value.slug !== null && (typeof value.slug !== "string" || value.slug.length === 0 || value.slug.length > 255)) throw authorityUnavailable$1();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
+function normalizeAccountDeletionStartRequest(value) {
+	if (!isObject$1(value) || typeof value.idempotencyKey !== "string" || !idempotencyPattern.test(value.idempotencyKey)) throw new TypeError("idempotencyKey is invalid");
+	const ids = value.soleOrganizationIds;
+	if (!Array.isArray(ids) || ids.length > MAX_SOLE_ORGANIZATIONS || !ids.every((id) => {
+		return typeof id === "string" && idPattern$3.test(id);
+	})) throw new TypeError("soleOrganizationIds is invalid");
+	return {
+		idempotencyKey: value.idempotencyKey,
+		soleOrganizationIds: [...ids]
+	};
+}
+function normalizeAccountDeletionEligibility(value) {
+	if (!exact$5(value, [
+		"accountBlocker",
+		"blockingOrganizations",
+		"deleteAfter",
+		"eligible",
+		"soleOrganizations",
+		"stepUp"
+	]) || typeof value.eligible !== "boolean" || value.accountBlocker !== null && !accountBlockers.has(value.accountBlocker) || !Array.isArray(value.blockingOrganizations) || value.blockingOrganizations.length > MAX_BLOCKING_ORGANIZATIONS || !Array.isArray(value.soleOrganizations) || value.soleOrganizations.length > MAX_SOLE_ORGANIZATIONS || !stepUps.has(value.stepUp)) throw authorityUnavailable$1();
+	const blockingOrganizations = value.blockingOrganizations.map((entry) => {
+		const summary = organization(entry, [
+			"id",
+			"name",
+			"reason",
+			"slug"
+		]);
+		const reason = entry.reason;
+		if (!organizationBlockers.has(reason)) throw authorityUnavailable$1();
+		return {
+			...summary,
+			reason
+		};
+	});
+	return {
+		eligible: value.eligible,
+		accountBlocker: value.accountBlocker,
+		blockingOrganizations,
+		soleOrganizations: value.soleOrganizations.map((entry) => {
+			return organization(entry, [
+				"id",
+				"name",
+				"slug"
+			]);
+		}),
+		stepUp: value.stepUp,
+		deleteAfter: isoDate(value.deleteAfter)
+	};
+}
+function normalizeAccountDeletionRestoreInput(value) {
+	if (exact$5(value, ["restoreTicket"]) && typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket)) return { restoreTicket: value.restoreTicket };
+	if (exact$5(value, ["restoreLinkToken"]) && typeof value.restoreLinkToken === "string" && tokenPattern.test(value.restoreLinkToken)) return { restoreLinkToken: value.restoreLinkToken };
+	throw new TypeError("restore input is invalid");
+}
+function normalizeAccountDeletionRestore(value) {
+	if (!exact$5(value, ["status"]) || value.status !== "restored") throw authorityUnavailable$1();
+}
+function accountDeletionPending(value, status) {
+	if (status !== 403 || !isObject$1(value) || value.code !== "ACCOUNT_DELETION_PENDING") return null;
+	let deleteAfter;
+	try {
+		deleteAfter = isoDate(value.deleteAfter);
+	} catch {
+		return null;
+	}
+	const restoreTicket = typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket) ? value.restoreTicket : null;
+	return {
+		deleteAfter,
+		restoreTicket
+	};
+}
+function fromAccountDeletionError(value, status) {
+	const code = isObject$1(value) ? value.code : void 0;
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 && code === "RESTORE_UNAVAILABLE") return new AuthError("account_restore_unavailable", 404);
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	return authorityUnavailable$1();
+}
+//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
@@ -713,6 +835,8 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	const pendingDeletion = accountDeletionPending(value, status);
+	if (pendingDeletion) return new AuthError("account_deletion_pending", 403, void 0, { accountDeletion: pendingDeletion });
 	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
 	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
 	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
@@ -5083,6 +5207,11 @@ function normalizeCeremonyHandoffInput(value) {
 			}
 			throw new TypeError("request action is invalid");
 		}
+		case "user_closure": return {
+			purpose: input.purpose,
+			...base,
+			request: normalizeAccountDeletionStartRequest(input.request)
+		};
 		default: throw new TypeError("purpose is invalid");
 	}
 }
@@ -5146,6 +5275,7 @@ function fromCeremonyHandoffError(value, status, retryAfter) {
 	if (status === 403) return new AuthError("request_origin_denied", 403);
 	if (status === 404) return new AuthError("state_conflict", 409);
 	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409 && code === "RECENT_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	return authorityUnavailable();
@@ -5934,6 +6064,18 @@ function createAuthClient(options) {
 		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 		return normalize(value);
 	}
+	async function accountDeletionRequest(method, path, body, normalize) {
+		return normalize(await requestJson(joinURL(authOrigin, "api/v1/auth/user/closure", path), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method,
+			...body ? {
+				headers: { "content-type": "application/json" },
+				body
+			} : {},
+			mapError: fromAccountDeletionError
+		}));
+	}
 	async function ceremonyRequest(method, path, body, normalize) {
 		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
 		const generation = authorityGeneration;
@@ -6707,6 +6849,12 @@ function createAuthClient(options) {
 		async listPasskeys() {
 			return ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory);
 		},
+		async getAccountDeletionEligibility() {
+			return accountDeletionRequest("GET", "eligibility", void 0, normalizeAccountDeletionEligibility);
+		},
+		async restoreAccount(input) {
+			await accountDeletionRequest("POST", "restore", normalizeAccountDeletionRestoreInput(input), normalizeAccountDeletionRestore);
+		},
 		async renamePasskey(passkeyId, name) {
 			const id = normalizePasskeyId(passkeyId);
 			const body = { name: normalizePasskeyName(name) };

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { $ as OrganizationTeam, B as OrganizationDeparture, Bt as RegisterOrganizationApplicationInput, C as CreatedOrganizationTeam, Dt as SocialIdTokenProvider, Et as SocialIdTokenInput, F as InvitationAcceptance, Ft as UpdateOrganizationDisplayInput, G as OrganizationMemberAuthority, Gt as AuthErrorStatus, H as OrganizationInvitation, Ht as OrganizationDirectoryEntry, I as InvitationDecline, It as UpdateOrganizationTeamDisplayInput, J as OrganizationMemberPageInput, K as OrganizationMemberAuthorityV2, Kt as UserApiCredential, O as DriveCredential, Q as OrganizationSignInStates, Rt as WorkspaceSelection, S as CreatedOrganizationMemberInvitation, T as DeletedOrganizationTeam, U as OrganizationInvitationPage, Ut as AuthError, V as OrganizationDisplay, Vt as RegisteredOrganizationApplication, W as OrganizationMember, Wt as AuthErrorCode, X as OrganizationPageInput, Y as OrganizationPage, Z as OrganizationSignInState, _t as RemovedOrganizationMember, b as CreateOrganizationMemberInvitationInput, d as AuthUser, et as OrganizationTeamDisplay, f as CanceledOrganizationInvitation, ht as ReceivedOrganizationInvitationPage, i as AuthOrganization, k as DriveCredentialInput, mt as ReceivedOrganizationInvitation, n as AddedOrganizationTeamMember, nt as OrganizationTeamPage, ot as PersonalWorkspaceSelection, q as OrganizationMemberPage, qt as UserApiCredentialInput, rt as OrganizationWorkspaceSelection, s as AuthSession, t as AcceptInvitationInput, tt as OrganizationTeamMemberPage, vt as RemovedOrganizationTeamMember, w as DeclineInvitationInput, x as CreatedOrganization, yt as ResentOrganizationInvitation, zt as OrganizationApplicationRegistration } from "./types-BU8vZrhF.js";
+import { $ as OrganizationPage, At as SocialIdTokenInput, B as InvitationDecline, Bt as UpdateOrganizationTeamDisplayInput, Ct as ResentOrganizationInvitation, D as CreatedOrganizationTeam, E as CreatedOrganizationMemberInvitation, G as OrganizationDisplay, Gt as RegisteredOrganizationApplication, Ht as WorkspaceSelection, J as OrganizationMember, K as OrganizationInvitation, Kt as OrganizationDirectoryEntry, M as DriveCredential, N as DriveCredentialInput, O as DeclineInvitationInput, Q as OrganizationMemberPageInput, Qt as UserApiCredentialInput, St as RemovedOrganizationTeamMember, T as CreatedOrganization, Ut as OrganizationApplicationRegistration, W as OrganizationDeparture, Wt as RegisterOrganizationApplicationInput, X as OrganizationMemberAuthorityV2, Xt as AuthErrorStatus, Y as OrganizationMemberAuthority, Yt as AuthErrorCode, Z as OrganizationMemberPage, Zt as UserApiCredential, at as OrganizationTeamMemberPage, c as AuthOrganization, d as AuthSession, et as OrganizationPageInput, g as CanceledOrganizationInvitation, h as AuthUser, it as OrganizationTeamDisplay, jt as SocialIdTokenProvider, k as DeletedOrganizationTeam, nt as OrganizationSignInStates, o as AddedOrganizationTeamMember, ot as OrganizationTeamPage, q as OrganizationInvitationPage, qt as AuthError, rt as OrganizationTeam, st as OrganizationWorkspaceSelection, t as AcceptInvitationInput, tt as OrganizationSignInState, ut as PersonalWorkspaceSelection, vt as ReceivedOrganizationInvitation, w as CreateOrganizationMemberInvitationInput, xt as RemovedOrganizationMember, yt as ReceivedOrganizationInvitationPage, z as InvitationAcceptance, zt as UpdateOrganizationDisplayInput } from "./types-QJnXZXYY.js";
 //#region src/organization-directory/service.d.ts
 interface OrganizationDirectoryLookupInput {
   organizationId: string;

package/dist/server.js

@@ -41,21 +41,54 @@ const messages = {
 	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
 	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
 	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
+	password_sign_in_required: "A password sign-in method is required for this passkey change.",
+	account_deletion_pending: "This account is scheduled for deletion.",
+	account_restore_unavailable: "The restore ticket or link is used or expired, or the account is not scheduled for deletion."
 };
 var AuthError = class extends Error {
 	code;
 	status;
 	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
+	accountDeletion;
+	constructor(code, status, retryAfterSeconds, details) {
 		super(messages[code]);
 		this.name = "AuthError";
 		this.code = code;
 		this.status = status;
 		this.retryAfterSeconds = retryAfterSeconds;
+		if (details?.accountDeletion) this.accountDeletion = details.accountDeletion;
 	}
 };
 //#endregion
+//#region src/account-deletion.ts
+function isObject$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authorityUnavailable$1() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+const tokenPattern = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+function isoDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable$1();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable$1();
+	return parsed;
+}
+function accountDeletionPending(value, status) {
+	if (status !== 403 || !isObject$2(value) || value.code !== "ACCOUNT_DELETION_PENDING") return null;
+	let deleteAfter;
+	try {
+		deleteAfter = isoDate(value.deleteAfter);
+	} catch {
+		return null;
+	}
+	const restoreTicket = typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket) ? value.restoreTicket : null;
+	return {
+		deleteAfter,
+		restoreTicket
+	};
+}
+//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id$3 = /^[A-Za-z0-9_-]{1,128}$/;
@@ -564,6 +597,8 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
 	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
+	const pendingDeletion = accountDeletionPending(value, status);
+	if (pendingDeletion) return new AuthError("account_deletion_pending", 403, void 0, { accountDeletion: pendingDeletion });
 	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
 	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
 	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);

package/dist/{types-BU8vZrhF.d.ts → types-QJnXZXYY.d.ts}

@@ -10,13 +10,27 @@ interface UserApiCredential {
 }
 //#endregion
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "social_signup_required" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "organization_slug_unavailable" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "social_signup_required" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "organization_slug_unavailable" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required" | "account_deletion_pending" | "account_restore_unavailable";
 type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 410 | 413 | 415 | 422 | 429 | 503;
+/** What a sign-in refusal says about an account that is scheduled for deletion. */
+interface AuthErrorAccountDeletion {
+  /** When Auth deletes the account unless it is restored first. */
+  deleteAfter: Date;
+  /**
+   * A single-use, 15-minute ticket that restores the account without another sign-in. It is null when Auth could not
+   * issue one; the emailed restore link still works. Keep it in memory only.
+   */
+  restoreTicket: string | null;
+}
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;
   readonly retryAfterSeconds?: number;
-  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
+  /** Present only on `account_deletion_pending`. */
+  readonly accountDeletion?: AuthErrorAccountDeletion;
+  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number, details?: {
+    accountDeletion?: AuthErrorAccountDeletion;
+  });
 }
 //#endregion
 //#region src/organization-directory/contract.d.ts
@@ -337,6 +351,16 @@ type CeremonyRecentAuthenticationRequest = ({
   action: "organization_closure_cancel";
   organizationId: string;
 } & OrganizationClosureCancelInput);
+/** What the person confirmed before deleting the account. */
+interface AccountDeletionStartRequest {
+  /** One key for one confirmation. A retry with the same key returns the same deletion. */
+  idempotencyKey: string;
+  /**
+   * The organizations that close with the account, exactly as `getAccountDeletionEligibility` listed them in
+   * `soleOrganizations`. Auth refuses the start when its own list differs, for example after a member joined.
+   */
+  soleOrganizationIds: string[];
+}
 type CeremonyHandoffInput = CeremonyReturnInput & ({
   purpose: "passkey_enrollment";
 } | {
@@ -345,7 +369,43 @@ type CeremonyHandoffInput = CeremonyReturnInput & ({
 } | {
   purpose: "recent_authentication";
   request: CeremonyRecentAuthenticationRequest;
+} | {
+  purpose: "user_closure";
+  request: AccountDeletionStartRequest;
 });
+interface AccountDeletionOrganization {
+  id: string;
+  name: string;
+  slug: string | null;
+}
+/** Whether the current User can delete the account now, and what the deletion includes. */
+interface AccountDeletionEligibility {
+  eligible: boolean;
+  /** `managed_account`: an organization's identity provider manages the account. `platform_role`: a Finueva platform role. */
+  accountBlocker: "managed_account" | "platform_role" | null;
+  /**
+   * Organizations that stop the deletion: the User owns one that has other members (`owner_with_members`), or a
+   * sole-member organization has an enterprise connection (`enterprise_connection`).
+   */
+  blockingOrganizations: (AccountDeletionOrganization & {
+    reason: "owner_with_members" | "enterprise_connection";
+  })[];
+  /** Organizations where the User is the only member. They close with the account. */
+  soleOrganizations: AccountDeletionOrganization[];
+  /**
+   * What the deletion ceremony asks for: nothing more after a sign-in in the last ten minutes (`recent_sign_in`), the
+   * password (`password`), or a new sign-in first (`sign_in_again`, an account without a password).
+   */
+  stepUp: "recent_sign_in" | "password" | "sign_in_again";
+  /** The deletion date if the deletion started now. */
+  deleteAfter: Date;
+}
+/** The single-use secret that restores an account during its 30-day deletion window. */
+type AccountDeletionRestoreInput = {
+  restoreTicket: string;
+} | {
+  restoreLinkToken: string;
+};
 /** An Auth-Origin ceremony address. The fragment carries a single-use code that expires at `expiresAt`. */
 interface CeremonyHandoff {
   url: string;
@@ -718,10 +778,18 @@ interface FinuevaAuthClient {
     revoked: number;
   }>;
   /**
-   * Starts one Auth-Origin ceremony for the current session: passkey enrollment, passkey removal, or one
-   * organization recent-authentication action. Open the returned address in a top-level browser context.
+   * Starts one Auth-Origin ceremony for the current session: passkey enrollment, passkey removal, one
+   * organization recent-authentication action, or the deletion of the account. Open the returned address in a
+   * top-level browser context.
    */
   createCeremonyHandoff(input: CeremonyHandoffInput): Promise<CeremonyHandoff>;
+  /** Reads whether the current User can delete the account now. The read changes nothing. */
+  getAccountDeletionEligibility(): Promise<AccountDeletionEligibility>;
+  /**
+   * Restores an account that is scheduled for deletion, with the ticket from an `account_deletion_pending` sign-in
+   * refusal or the token of the emailed restore link. It needs no session and creates none: sign in afterwards.
+   */
+  restoreAccount(input: AccountDeletionRestoreInput): Promise<void>;
   listPasskeys(): Promise<PasskeyInventory>;
   renamePasskey(passkeyId: string, name: string): Promise<void>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<AuthSession>;
@@ -736,4 +804,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { OrganizationTeam as $, EnterpriseConnection as A, SuspendedOrganizationMemberStatus as At, OrganizationDeparture as B, RegisterOrganizationApplicationInput as Bt, CreatedOrganizationTeam as C, ScimCredentialState as Ct, DepartedOrganizationMemberPage as D, SocialIdTokenProvider as Dt, DepartedOrganizationMember as E, SocialIdTokenInput as Et, InvitationAcceptance as F, UpdateOrganizationDisplayInput as Ft, OrganizationMemberAuthority as G, AuthErrorStatus as Gt, OrganizationInvitation as H, OrganizationDirectoryEntry as Ht, InvitationDecline as I, UpdateOrganizationTeamDisplayInput as It, OrganizationMemberPageInput as J, OrganizationMemberAuthorityV2 as K, UserApiCredential as Kt, OrganizationClosure as L, UpdateProfileInput as Lt, EnterpriseConnectionDomain as M, TwoFactorStatus as Mt, EnterpriseConnectionSetup as N, TwoFactorStepUpInput as Nt, DriveCredential as O, SuspendedOrganizationMember as Ot, FinuevaAuthClient as P, UpdateEnterpriseConnectionInput as Pt, OrganizationSignInStates as Q, OrganizationClosureCancelInput as R, WorkspaceSelection as Rt, CreatedOrganizationMemberInvitation as S, ScimCredentialIssuance as St, DeletedOrganizationTeam as T, SignInInput as Tt, OrganizationInvitationPage as U, AuthError as Ut, OrganizationDisplay as V, RegisteredOrganizationApplication as Vt, OrganizationMember as W, AuthErrorCode as Wt, OrganizationPageInput as X, OrganizationPage as Y, OrganizationSignInState as Z, ClosingOrganization as _, RemovedOrganizationMember as _t, AuthPersistence as a, PasskeySummary as at, CreateOrganizationMemberInvitationInput as b, RestoredOrganizationMember as bt, AuthSessionInventory as c, PlatformRole as ct, AuthUser as d, PlatformRoleChangeRecentAuthenticationInput as dt, OrganizationTeamDisplay as et, CanceledOrganizationInvitation as f, PlatformRoleFirstApproval as ft, CeremonyReturnInput as g, RecentAuthenticationStatus as gt, CeremonyRecentAuthenticationRequest as h, ReceivedOrganizationInvitationPage as ht, AuthOrganization as i, PasskeyInventory as it, EnterpriseConnectionAction as j, TwoFactorEnrollment as jt, DriveCredentialInput as k, SuspendedOrganizationMemberPage as kt, AuthSessionSummary as l, PlatformRoleApplied as lt, CeremonyHandoffInput as m, ReceivedOrganizationInvitation as mt, AddedOrganizationTeamMember as n, OrganizationTeamPage as nt, AuthPersistenceDriver as o, PersonalWorkspaceSelection as ot, CeremonyHandoff as p, PlatformStatus as pt, OrganizationMemberPage as q, UserApiCredentialInput as qt, AuthClientOptions as r, OrganizationWorkspaceSelection as rt, AuthSession as s, PlatformBootstrapRoleChangeInput as st, AcceptInvitationInput as t, OrganizationTeamMemberPage as tt, AuthState as u, PlatformRoleApproval as ut, ClosingOrganizationList as v, RemovedOrganizationTeamMember as vt, DeclineInvitationInput as w, SendVerificationEmailInput as wt, CreatedOrganization as x, RotateScimCredentialInput as xt, CreateEnterpriseConnectionInput as y, ResentOrganizationInvitation as yt, OrganizationClosureStartInput as z, OrganizationApplicationRegistration as zt };
+export { OrganizationPage as $, DepartedOrganizationMember as A, SocialIdTokenInput as At, InvitationDecline as B, UpdateOrganizationTeamDisplayInput as Bt, CreateEnterpriseConnectionInput as C, ResentOrganizationInvitation as Ct, CreatedOrganizationTeam as D, ScimCredentialState as Dt, CreatedOrganizationMemberInvitation as E, ScimCredentialIssuance as Et, EnterpriseConnectionAction as F, TwoFactorEnrollment as Ft, OrganizationDisplay as G, RegisteredOrganizationApplication as Gt, OrganizationClosureCancelInput as H, WorkspaceSelection as Ht, EnterpriseConnectionDomain as I, TwoFactorStatus as It, OrganizationMember as J, AuthErrorAccountDeletion as Jt, OrganizationInvitation as K, OrganizationDirectoryEntry as Kt, EnterpriseConnectionSetup as L, TwoFactorStepUpInput as Lt, DriveCredential as M, SuspendedOrganizationMember as Mt, DriveCredentialInput as N, SuspendedOrganizationMemberPage as Nt, DeclineInvitationInput as O, SendVerificationEmailInput as Ot, EnterpriseConnection as P, SuspendedOrganizationMemberStatus as Pt, OrganizationMemberPageInput as Q, UserApiCredentialInput as Qt, FinuevaAuthClient as R, UpdateEnterpriseConnectionInput as Rt, ClosingOrganizationList as S, RemovedOrganizationTeamMember as St, CreatedOrganization as T, RotateScimCredentialInput as Tt, OrganizationClosureStartInput as U, OrganizationApplicationRegistration as Ut, OrganizationClosure as V, UpdateProfileInput as Vt, OrganizationDeparture as W, RegisterOrganizationApplicationInput as Wt, OrganizationMemberAuthorityV2 as X, AuthErrorStatus as Xt, OrganizationMemberAuthority as Y, AuthErrorCode as Yt, OrganizationMemberPage as Z, UserApiCredential as Zt, CeremonyHandoff as _, PlatformStatus as _t, AccountDeletionStartRequest as a, OrganizationTeamMemberPage as at, CeremonyReturnInput as b, RecentAuthenticationStatus as bt, AuthOrganization as c, PasskeyInventory as ct, AuthSession as d, PlatformBootstrapRoleChangeInput as dt, OrganizationPageInput as et, AuthSessionInventory as f, PlatformRole as ft, CanceledOrganizationInvitation as g, PlatformRoleFirstApproval as gt, AuthUser as h, PlatformRoleChangeRecentAuthenticationInput as ht, AccountDeletionRestoreInput as i, OrganizationTeamDisplay as it, DepartedOrganizationMemberPage as j, SocialIdTokenProvider as jt, DeletedOrganizationTeam as k, SignInInput as kt, AuthPersistence as l, PasskeySummary as lt, AuthState as m, PlatformRoleApproval as mt, AccountDeletionEligibility as n, OrganizationSignInStates as nt, AddedOrganizationTeamMember as o, OrganizationTeamPage as ot, AuthSessionSummary as p, PlatformRoleApplied as pt, OrganizationInvitationPage as q, AuthError as qt, AccountDeletionOrganization as r, OrganizationTeam as rt, AuthClientOptions as s, OrganizationWorkspaceSelection as st, AcceptInvitationInput as t, OrganizationSignInState as tt, AuthPersistenceDriver as u, PersonalWorkspaceSelection as ut, CeremonyHandoffInput as v, ReceivedOrganizationInvitation as vt, CreateOrganizationMemberInvitationInput as w, RestoredOrganizationMember as wt, ClosingOrganization as x, RemovedOrganizationMember as xt, CeremonyRecentAuthenticationRequest as y, ReceivedOrganizationInvitationPage as yt, InvitationAcceptance as z, UpdateOrganizationDisplayInput as zt };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,