@sayren/storefront-sdk 0.5.0 → 0.7.0

package/dist/auth/index.d.mts

@@ -1,5 +1,28 @@
-import { a as AnonymousSession, c as TokenPair, l as WithdrawRequest, o as LoginRequest, s as SignupRequest, t as ApiError, u as WithdrawalBlockedDetails } from "../http-CxqZxTfE.mjs";
+import { a as AnonymousSession, d as SignupRequest, f as SocialProvider, h as WithdrawalBlockedDetails, l as LoginRequest, m as WithdrawRequest, p as TokenPair, t as ApiError, u as MemberIdentities } from "../http-BbFHVGBf.mjs";
 //#region src/auth/index.d.ts
+/** 소셜 로그인 시작 결과 — `codeVerifier`와 `state`는 돌아올 때까지 서버 세션(httpOnly 쿠키 등)에 보관한다 */
+export interface IdpStart {
+  /** 구매자를 보낼 공급자 로그인 주소 */
+  url: string;
+  state: string;
+  codeVerifier: string;
+}
+export interface IdpCallbackInput {
+  /** 돌아온 주소의 `code`(성공) — 실패면 `error`가 온다 */
+  code: string | null;
+  /** 돌아온 주소의 `state` */
+  state: string | null;
+  /** `idp()`가 준 값 — 보관해 둔 것 */
+  expectedState: string;
+  codeVerifier: string;
+  /** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+  cartToken?: string;
+}
+/** 소셜 로그인 실패 — 구매자가 취소했거나(`access_denied`) state가 맞지 않는다 */
+export declare class IdpCallbackError extends Error {
+  readonly reason: "access_denied" | "state_mismatch" | "missing_code" | string;
+  constructor(reason: "access_denied" | "state_mismatch" | "missing_code" | string);
+}
 export interface StorefrontAuthOptions {
   /** 예: https://api.sayren.app/storefront/v1 */
   baseUrl: string;
@@ -8,7 +31,7 @@ export interface StorefrontAuthOptions {
   fetch?: typeof globalThis.fetch;
 }
 /**
- * 구매자 인증 — 화면은 스토어프런트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
+ * 구매자 인증 — 화면은 스토어프론트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
  * 어느 방식으로 로그인해도 결과는 같은 구매자 토큰(`TokenPair`)이고 `/me/*`·장바구니·주문 API에 그대로 쓴다.
  *
  * 토큰 보관은 앱 몫이다. 서버(loader·action)에서 호출하고 httpOnly 쿠키에 두기를 권한다.
@@ -30,6 +53,39 @@ export declare function createStorefrontAuth(options: StorefrontAuthOptions): {
   session(body: LoginRequest): Promise<TokenPair>;
   /** 회원가입 — 가입과 동시에 로그인 토큰을 받는다. `cartToken`을 주면 장바구니를 병합한다 */
   signUp(body: SignupRequest): Promise<TokenPair>;
+  /**
+   * 소셜 로그인 시작 — PKCE(S256)와 state를 만들고 공급자 로그인 주소를 받는다. 반환한 `state`·`codeVerifier`를
+   * 서버 세션에 보관하고 구매자를 `url`로 보낸다. 로그인을 마치면 `redirectUri`로 `?code=&state=`가 붙어 돌아온다.
+   * `redirectUri`는 스토어프론트 도메인 목록 안이어야 한다
+   */
+  idp(provider: SocialProvider, options: {
+    redirectUri: string;
+  }): Promise<IdpStart>;
+  /**
+   * 소셜 로그인 마무리 — 돌아온 `code`를 구매자 토큰으로 바꾼다. state가 다르거나 구매자가 취소했으면
+   * `IdpCallbackError`. code는 1회용이고 1분 안에 바꿔야 한다
+   */
+  idpCallback(input: IdpCallbackInput & {
+    error?: string | null;
+  }): Promise<TokenPair>;
+  /** 로그인 수단 — 비밀번호가 있는지, 어떤 소셜 계정이 연결됐는지 */
+  identities(accessToken: string): Promise<MemberIdentities>;
+  /**
+   * 소셜 계정 연결 시작 — 로그인한 구매자에 공급자 계정을 붙인다. `idp()`처럼 `state`·`codeVerifier`를 보관하고
+   * 구매자를 `url`로 보낸다. 돌아오면 `linkIdpCallback()`으로 마무리한다. 연결은 흐름을 시작한 구매자에게만 된다
+   */
+  linkIdp(accessToken: string, provider: SocialProvider, options: {
+    redirectUri: string;
+  }): Promise<IdpStart>;
+  /**
+   * 소셜 계정 연결 마무리 — state를 비교하고 code를 바꿔 연결한다. 다른 구매자에 이미 연결된 계정이면
+   * 409 `IDENTITY_IN_USE`, 같은 공급자의 다른 계정을 이미 연결했으면 409 `PROVIDER_ALREADY_LINKED`
+   */
+  linkIdpCallback(accessToken: string, provider: SocialProvider, input: Omit<IdpCallbackInput, "cartToken"> & {
+    error?: string | null;
+  }): Promise<MemberIdentities>;
+  /** 소셜 계정 연결 해제 — 마지막 로그인 수단이면 409 `LAST_LOGIN_METHOD` */
+  unlinkIdp(accessToken: string, provider: SocialProvider): Promise<MemberIdentities>;
   /** 토큰 갱신 — refreshToken은 한 번 쓰면 폐기되고 새 쌍이 온다(회전) */
   refresh(refreshToken: string): Promise<TokenPair>;
   /**
@@ -46,4 +102,4 @@ export declare function createStorefrontAuth(options: StorefrontAuthOptions): {
 };
 export type StorefrontAuth = ReturnType<typeof createStorefrontAuth>;
 //#endregion
-export { type AnonymousSession, ApiError, type LoginRequest, type SignupRequest, type TokenPair, type WithdrawRequest, type WithdrawalBlockedDetails };
+export { type AnonymousSession, ApiError, type LoginRequest, type MemberIdentities, type SignupRequest, type SocialProvider, type TokenPair, type WithdrawRequest, type WithdrawalBlockedDetails };

package/dist/auth/index.mjs

@@ -1,7 +1,28 @@
-import { it as ApiError, t as createStorefrontClient } from "../client-D-w3LIU2.mjs";
+import { gt as ApiError, t as createStorefrontClient } from "../client-B1uXGefY.mjs";
 //#region src/auth/index.ts
+/** 소셜 로그인 실패 — 구매자가 취소했거나(`access_denied`) state가 맞지 않는다 */
+var IdpCallbackError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`소셜 로그인을 마치지 못했어요 (${reason})`);
+		this.reason = reason;
+		this.name = "IdpCallbackError";
+	}
+};
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes = 32) {
+	return base64url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function s256(verifier) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return base64url(new Uint8Array(digest));
+}
 /**
-* 구매자 인증 — 화면은 스토어프런트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
+* 구매자 인증 — 화면은 스토어프론트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
 * 어느 방식으로 로그인해도 결과는 같은 구매자 토큰(`TokenPair`)이고 `/me/*`·장바구니·주문 API에 그대로 쓴다.
 *
 * 토큰 보관은 앱 몫이다. 서버(loader·action)에서 호출하고 httpOnly 쿠키에 두기를 권한다.
@@ -36,6 +57,78 @@ function createStorefrontAuth(options) {
 		signUp(body) {
 			return client().auth.signup(body);
 		},
+		/**
+		* 소셜 로그인 시작 — PKCE(S256)와 state를 만들고 공급자 로그인 주소를 받는다. 반환한 `state`·`codeVerifier`를
+		* 서버 세션에 보관하고 구매자를 `url`로 보낸다. 로그인을 마치면 `redirectUri`로 `?code=&state=`가 붙어 돌아온다.
+		* `redirectUri`는 스토어프론트 도메인 목록 안이어야 한다
+		*/
+		async idp(provider, options) {
+			const state = randomToken(24);
+			const codeVerifier = randomToken(32);
+			const { url } = await client().auth.idpAuthorize(provider, {
+				redirectUri: options.redirectUri,
+				codeChallenge: await s256(codeVerifier),
+				state
+			});
+			return {
+				url,
+				state,
+				codeVerifier
+			};
+		},
+		/**
+		* 소셜 로그인 마무리 — 돌아온 `code`를 구매자 토큰으로 바꾼다. state가 다르거나 구매자가 취소했으면
+		* `IdpCallbackError`. code는 1회용이고 1분 안에 바꿔야 한다
+		*/
+		idpCallback(input) {
+			if (input.error) return Promise.reject(new IdpCallbackError(input.error));
+			if (!input.state || input.state !== input.expectedState) return Promise.reject(new IdpCallbackError("state_mismatch"));
+			if (!input.code) return Promise.reject(new IdpCallbackError("missing_code"));
+			return client().auth.idpToken({
+				code: input.code,
+				codeVerifier: input.codeVerifier,
+				cartToken: input.cartToken
+			});
+		},
+		/** 로그인 수단 — 비밀번호가 있는지, 어떤 소셜 계정이 연결됐는지 */
+		identities(accessToken) {
+			return client(accessToken).auth.identities();
+		},
+		/**
+		* 소셜 계정 연결 시작 — 로그인한 구매자에 공급자 계정을 붙인다. `idp()`처럼 `state`·`codeVerifier`를 보관하고
+		* 구매자를 `url`로 보낸다. 돌아오면 `linkIdpCallback()`으로 마무리한다. 연결은 흐름을 시작한 구매자에게만 된다
+		*/
+		async linkIdp(accessToken, provider, options) {
+			const state = randomToken(24);
+			const codeVerifier = randomToken(32);
+			const { url } = await client(accessToken).auth.linkIdentityAuthorize(provider, {
+				redirectUri: options.redirectUri,
+				codeChallenge: await s256(codeVerifier),
+				state
+			});
+			return {
+				url,
+				state,
+				codeVerifier
+			};
+		},
+		/**
+		* 소셜 계정 연결 마무리 — state를 비교하고 code를 바꿔 연결한다. 다른 구매자에 이미 연결된 계정이면
+		* 409 `IDENTITY_IN_USE`, 같은 공급자의 다른 계정을 이미 연결했으면 409 `PROVIDER_ALREADY_LINKED`
+		*/
+		linkIdpCallback(accessToken, provider, input) {
+			if (input.error) return Promise.reject(new IdpCallbackError(input.error));
+			if (!input.state || input.state !== input.expectedState) return Promise.reject(new IdpCallbackError("state_mismatch"));
+			if (!input.code) return Promise.reject(new IdpCallbackError("missing_code"));
+			return client(accessToken).auth.linkIdentity(provider, {
+				code: input.code,
+				codeVerifier: input.codeVerifier
+			});
+		},
+		/** 소셜 계정 연결 해제 — 마지막 로그인 수단이면 409 `LAST_LOGIN_METHOD` */
+		unlinkIdp(accessToken, provider) {
+			return client(accessToken).auth.unlinkIdentity(provider);
+		},
 		/** 토큰 갱신 — refreshToken은 한 번 쓰면 폐기되고 새 쌍이 온다(회전) */
 		refresh(refreshToken) {
 			return client().auth.refresh(refreshToken);
@@ -63,4 +156,4 @@ function createStorefrontAuth(options) {
 	};
 }
 //#endregion
-export { ApiError, createStorefrontAuth };
+export { ApiError, IdpCallbackError, createStorefrontAuth };

package/dist/{client-D-w3LIU2.mjs → client-B1uXGefY.mjs}

@@ -155,7 +155,12 @@ const anonymousSessionSchema = z.object({
 * 진행 중인 주문(결제 대기~배송 중)·클레임·결제가 있으면 409 `WITHDRAWAL_BLOCKED`, 비밀번호가 틀리면
 * 403 `PASSWORD_MISMATCH`다(로그인과 같은 5회 잠금).
 */
-const withdrawRequestSchema = z.object({ password: z.string().min(1) });
+const withdrawRequestSchema = z.object({ 
+/**
+* 비밀번호로 가입한 구매자는 필수. 소셜 로그인으로만 가입한 구매자는 비밀번호가 없어 생략하고, 대신 최근 10분 안에
+* 로그인한 액세스 토큰이어야 한다(아니면 403 `REAUTH_REQUIRED` — 다시 로그인한 뒤 호출)
+*/
+password: z.string().min(1).optional() });
 /** `WITHDRAWAL_BLOCKED`의 `error.details` — 탈퇴를 막는 항목 수 */
 const withdrawalBlockedDetailsSchema = z.object({
 	/** 결제 대기~배송 중인 주문 상품 */
@@ -165,6 +170,48 @@ const withdrawalBlockedDetailsSchema = z.object({
 	/** 승인 중이거나 결제창이 열려 있을 수 있는 결제(결제창은 만료되면 풀린다) */
 	pendingPayments: z.number().int()
 });
+/** 소셜 로그인 공급자 */
+const socialProviderSchema = z.enum([
+	"kakao",
+	"naver",
+	"google"
+]);
+/** `POST /auth/idp/{provider}/authorize` 본문 — PKCE(S256)와 state는 SDK가 만든다 */
+const idpAuthorizeRequestSchema = z.object({
+	/** 로그인을 마치고 돌아올 스토어프론트 주소. 스토어프론트 도메인 목록 안이어야 한다 */
+	redirectUri: z.url(),
+	/** base64url(SHA-256(codeVerifier)) */
+	codeChallenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+	/** 스토어프론트가 만든 값 — 돌아올 때 그대로 붙어 온다. 세션에 저장해 두고 비교한다 */
+	state: z.string().min(16).max(128)
+});
+const idpAuthorizeResponseSchema = z.object({ 
+/** 구매자를 보낼 공급자 로그인 주소 */
+url: z.url() });
+/** `POST /auth/idp/token` 본문 — 돌아온 1회용 code를 구매자 토큰으로 바꾼다 */
+const idpTokenRequestSchema = z.object({
+	code: z.string().min(1),
+	codeVerifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
+	/** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+	cartToken: z.string().optional()
+});
+/** `GET /me/identities` — 구매자의 로그인 수단(비밀번호 여부와 연결된 소셜 계정) */
+const memberIdentitiesSchema = z.object({
+	hasPassword: z.boolean(),
+	/** 셀러 자체 회원 연동(구매자 위임)으로 들어온 구매자 — 그 로그인도 로그인 수단으로 센다 */
+	hasExternalAuth: z.boolean(),
+	identities: z.array(z.object({
+		provider: socialProviderSchema,
+		/** 공급자가 알려 준 이메일(참고값). 없을 수 있다 */
+		email: z.string().nullable(),
+		linkedAt: z.string()
+	}))
+});
+/** `POST /me/identities/{provider}` 본문 — 연결 흐름에서 돌아온 1회용 code와 PKCE verifier */
+const linkIdentityRequestSchema = z.object({
+	code: z.string().min(1),
+	codeVerifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/)
+});
 //#endregion
 //#region src/schemas/cart.ts
 const cartItemSchema = z.object({
@@ -202,6 +249,38 @@ const updateCartItemRequestSchema = z.object({
 	optionId: z.string().optional()
 }).refine((value) => Object.values(value).some((v) => v !== void 0), { message: "최소 1개 필드가 필요합니다" });
 //#endregion
+//#region src/schemas/common.ts
+const pageInfoSchema = z.object({
+	page: z.number().int(),
+	size: z.number().int(),
+	totalElements: z.number().int(),
+	totalPages: z.number().int()
+});
+function pageSchema(item) {
+	return pageInfoSchema.extend({ contents: z.array(item) });
+}
+const orderItemStatusSchema = z.enum([
+	"PAYMENT_WAITING",
+	"PAID",
+	"CONFIRMED",
+	"DISPATCHED",
+	"DELIVERING",
+	"DELIVERED",
+	"PURCHASE_DECIDED",
+	"CANCELED"
+]);
+const claimStatusSchema = z.enum([
+	"REQUESTED",
+	"HELD",
+	"COLLECTING",
+	"COLLECTED",
+	"REDELIVERING",
+	"APPROVED",
+	"REJECTED",
+	"COMPLETED",
+	"WITHDRAWN"
+]);
+//#endregion
 //#region src/schemas/catalog.ts
 const categoryNodeSchema = z.lazy(() => z.object({
 	categoryId: z.string(),
@@ -213,9 +292,9 @@ const productCardSchema = z.object({
 	productId: z.string(),
 	name: z.string(),
 	thumbnailUrl: z.url(),
-	salePrice: z.number().int(),
-	discountedPrice: z.number().int().nullable(),
-	discountRate: z.number().int().nullable(),
+	salePrice: z.number().int().describe("판매가. 원(KRW) 단위 정수"),
+	discountedPrice: z.number().int().nullable().describe("즉시 할인 적용가. 원 단위. 할인이 없으면 null"),
+	discountRate: z.number().int().nullable().describe("할인율(%). 할인이 없으면 null"),
 	freeShipping: z.boolean(),
 	averageRating: z.number(),
 	reviewCount: z.number().int(),
@@ -282,6 +361,8 @@ const productFacetsSchema = z.object({
 		max: z.number().int()
 	}).optional()
 });
+/** `GET /products` 응답 — 상품 카드 페이지와 검색 패싯 */
+const productPageSchema = pageSchema(productCardSchema).extend({ facets: productFacetsSchema.optional() });
 //#endregion
 //#region src/schemas/checkout.ts
 const createCheckoutRequestSchema = z.object({
@@ -390,38 +471,6 @@ const paymentStatusSchema = z.object({
 	expiresAt: z.string().describe("결제 요청 만료 시각")
 });
 //#endregion
-//#region src/schemas/common.ts
-const pageInfoSchema = z.object({
-	page: z.number().int(),
-	size: z.number().int(),
-	totalElements: z.number().int(),
-	totalPages: z.number().int()
-});
-function pageSchema(item) {
-	return pageInfoSchema.extend({ contents: z.array(item) });
-}
-const orderItemStatusSchema = z.enum([
-	"PAYMENT_WAITING",
-	"PAID",
-	"CONFIRMED",
-	"DISPATCHED",
-	"DELIVERING",
-	"DELIVERED",
-	"PURCHASE_DECIDED",
-	"CANCELED"
-]);
-const claimStatusSchema = z.enum([
-	"REQUESTED",
-	"HELD",
-	"COLLECTING",
-	"COLLECTED",
-	"REDELIVERING",
-	"APPROVED",
-	"REJECTED",
-	"COMPLETED",
-	"WITHDRAWN"
-]);
-//#endregion
 //#region src/schemas/claim.ts
 const claimTypeSchema = z.enum([
 	"CANCEL",
@@ -508,11 +557,17 @@ const createInquiryRequestSchema = z.object({
 	content: z.string().min(1).max(1e3),
 	secret: z.boolean().default(false)
 });
+/** `POST /products/{productId}/inquiries` 응답 */
+const createInquiryResultSchema = z.object({
+	inquiryId: z.string(),
+	createdAt: z.string()
+});
 //#endregion
 //#region src/schemas/member.ts
 const memberSchema = z.object({
 	memberId: z.string(),
-	email: z.email(),
+	/** 소셜 가입에서 공급자가 이메일을 주지 않았으면 null */
+	email: z.email().nullable(),
 	name: z.string(),
 	phone: z.string().nullable(),
 	point: z.number().int(),
@@ -543,6 +598,11 @@ const memberAddressRequestSchema = z.object({
 	address2: z.string().optional(),
 	isDefault: z.boolean().default(false)
 });
+/** `POST /me/wishlist` 응답 — 이미 찜한 상품이어도 같은 응답이다 */
+const wishlistAddResultSchema = z.object({
+	productId: z.string(),
+	wished: z.literal(true)
+});
 //#endregion
 //#region src/schemas/order.ts
 const myOrderItemSchema = z.object({
@@ -599,6 +659,12 @@ const deliveryTrackingSchema = z.object({
 		occurredAt: z.string()
 	}))
 });
+/** `POST /me/order-items/{orderItemId}/purchase-decision` 응답 */
+const purchaseDecisionResultSchema = z.object({
+	orderItemId: z.string(),
+	status: z.literal("PURCHASE_DECIDED"),
+	decidedAt: z.string()
+});
 //#endregion
 //#region src/schemas/review.ts
 const publicReviewSchema = z.object({
@@ -641,10 +707,17 @@ const updateReviewRequestSchema = z.object({
 	content: z.string().min(10).max(2e3).optional(),
 	images: z.array(z.url()).max(5).optional()
 }).refine((value) => Object.values(value).some((v) => v !== void 0), { message: "최소 1개 필드가 필요합니다" });
+/** `GET /products/{productId}/reviews` 응답 — 리뷰 페이지와 평점 분포 */
+const reviewPageSchema = pageSchema(publicReviewSchema).extend({ summary: reviewSummarySchema.optional() });
+/** `PUT /me/reviews/{reviewId}` 응답 */
+const updateReviewResultSchema = z.object({
+	reviewId: z.string(),
+	updatedAt: z.string()
+});
 //#endregion
 //#region src/schemas/store.ts
 /**
-* 스토어 공개 설정 — `GET /store`. 스토어프런트가 화면을 그릴 때 읽는 값만 담는다.
+* 스토어 공개 설정 — `GET /store`. 스토어프론트가 화면을 그릴 때 읽는 값만 담는다.
 */
 const storefrontStoreSchema = z.object({
 	storeCode: z.string(),
@@ -656,12 +729,19 @@ const storefrontStoreSchema = z.object({
 	* 비회원 주문 허용. false면 로그인하지 않은 구매자의 주문서 생성·결제 요청이 403 `GUEST_CHECKOUT_DISABLED`다.
 	* 장바구니 담기는 된다 — 주문 버튼을 로그인 안내로 바꾸면 된다
 	*/
-	guestCheckout: z.boolean()
+	guestCheckout: z.boolean(),
+	/**
+	* 켜진 로그인 방법 — 화면에 이 순서대로 버튼을 그리면 된다. `password`가 없으면 이메일·비밀번호 가입·로그인이 꺼져 있다
+	*/
+	loginMethods: z.array(z.enum([
+		"password",
+		"kakao",
+		"naver",
+		"google"
+	]))
 });
 //#endregion
 //#region src/client.ts
-const productPageSchema = pageSchema(productCardSchema).extend({ facets: productFacetsSchema.optional() });
-const reviewPageSchema = pageSchema(publicReviewSchema).extend({ summary: reviewSummarySchema.optional() });
 function createStorefrontClient(options) {
 	const { session } = options;
 	const accessTokenSource = options.accessToken ?? options.auth?.accessToken ?? (session ? () => session.accessToken : void 0);
@@ -712,8 +792,20 @@ function createStorefrontClient(options) {
 			login: (body) => http.request("POST", "/auth/login", tokenPairSchema, { body: loginRequestSchema.parse(body) }),
 			refresh: (refreshToken) => http.request("POST", "/auth/token/refresh", tokenPairSchema, { body: { refreshToken } }),
 			logout: () => http.requestVoid("POST", "/auth/logout"),
+			/** 소셜 로그인 시작 — 공급자 로그인 주소를 받는다. PKCE·state는 `@sayren/storefront-sdk/auth`의 `idp()`가 만든다 */
+			idpAuthorize: (provider, body) => http.request("POST", path`/auth/idp/${provider}/authorize`, idpAuthorizeResponseSchema, { body: idpAuthorizeRequestSchema.parse(body) }),
+			/** 소셜 로그인 마무리 — 돌아온 1회용 code + codeVerifier를 구매자 토큰으로 바꾼다 */
+			idpToken: (body) => http.request("POST", "/auth/idp/token", tokenPairSchema, { body: idpTokenRequestSchema.parse(body) }),
 			/** 구매자 탈퇴 — 로그인 상태(accessToken)에서 비밀번호로 본인 확인. 성공하면 토큰은 모두 무효 */
-			withdraw: (body) => http.requestVoid("POST", "/auth/withdraw", { body: withdrawRequestSchema.parse(body) })
+			withdraw: (body) => http.requestVoid("POST", "/auth/withdraw", { body: withdrawRequestSchema.parse(body) }),
+			/** 로그인 수단 — 비밀번호 여부와 연결된 소셜 계정(로그인 필요) */
+			identities: () => http.request("GET", "/me/identities", memberIdentitiesSchema),
+			/** 소셜 계정 연결 시작(로그인 필요) — 공급자 로그인 주소를 받는다. 본문은 `idpAuthorize`와 같다 */
+			linkIdentityAuthorize: (provider, body) => http.request("POST", path`/me/identities/${provider}/authorize`, idpAuthorizeResponseSchema, { body: idpAuthorizeRequestSchema.parse(body) }),
+			/** 소셜 계정 연결 마무리 — 돌아온 code + codeVerifier로 이 구매자에 연결한다 */
+			linkIdentity: (provider, body) => http.request("POST", path`/me/identities/${provider}`, memberIdentitiesSchema, { body: linkIdentityRequestSchema.parse(body) }),
+			/** 소셜 계정 연결 해제 — 마지막 로그인 수단이면 409 `LAST_LOGIN_METHOD` */
+			unlinkIdentity: (provider) => http.request("DELETE", path`/me/identities/${provider}`, memberIdentitiesSchema)
 		},
 		store: { 
 		/** 스토어 공개 설정 — 이름·고객센터·비회원 주문 허용 여부 */
@@ -810,4 +902,4 @@ getStatus: (paymentId) => http.request("GET", path`/payments/${paymentId}`, paym
 	};
 }
 //#endregion
-export { loginRequestSchema as $, pageSchema as A, pgParamsSchema as B, claimTypeSchema as C, claimStatusSchema as D, myClaimSchema as E, createCheckoutRequestSchema as F, productDetailSchema as G, shippingAddressInputSchema as H, guestInfoSchema as I, addCartItemRequestSchema as J, productFacetsSchema as K, paymentMethodSchema as L, checkoutSessionSchema as M, confirmPaymentRequestSchema as N, orderItemStatusSchema as O, confirmPaymentResultSchema as P, anonymousSessionSchema as Q, paymentParamsSchema as R, claimReasonSchema as S, createClaimResultSchema as T, categoryNodeSchema as U, requestPaymentRequestSchema as V, productCardSchema as W, cartSchema as X, cartItemSchema as Y, updateCartItemRequestSchema as Z, createInquiryRequestSchema as _, publicReviewSchema as a, buildQuery as at, customerInquiryCategorySchema as b, writableReviewSchema as c, myOrderSchema as d, signupRequestSchema as et, orderShippingAddressSchema as f, updateProfileRequestSchema as g, memberSchema as h, createReviewResultSchema as i, ApiError as it, PAYMENT_STATUS_VALUES as j, pageInfoSchema as k, deliveryTrackingSchema as l, memberAddressSchema as m, storefrontStoreSchema as n, withdrawRequestSchema as nt, reviewSummarySchema as o, toApiError as ot, memberAddressRequestSchema as p, productSortSchema as q, createReviewRequestSchema as r, withdrawalBlockedDetailsSchema as rt, updateReviewRequestSchema as s, unwrapData as st, createStorefrontClient as t, tokenPairSchema as tt, myOrderItemSchema as u, publicInquirySchema as v, createClaimRequestSchema as w, customerInquirySchema as x, createCustomerInquiryRequestSchema as y, paymentStatusSchema as z };
+export { pageSchema as $, createClaimResultSchema as A, paymentStatusSchema as B, publicInquirySchema as C, claimReasonSchema as D, customerInquirySchema as E, confirmPaymentResultSchema as F, productCardSchema as G, requestPaymentRequestSchema as H, createCheckoutRequestSchema as I, productPageSchema as J, productDetailSchema as K, guestInfoSchema as L, PAYMENT_STATUS_VALUES as M, checkoutSessionSchema as N, claimTypeSchema as O, confirmPaymentRequestSchema as P, pageInfoSchema as Q, paymentMethodSchema as R, createInquiryResultSchema as S, customerInquiryCategorySchema as T, shippingAddressInputSchema as U, pgParamsSchema as V, categoryNodeSchema as W, claimStatusSchema as X, productSortSchema as Y, orderItemStatusSchema as Z, memberAddressSchema as _, buildQuery as _t, publicReviewSchema as a, idpAuthorizeRequestSchema as at, wishlistAddResultSchema as b, updateReviewRequestSchema as c, linkIdentityRequestSchema as ct, deliveryTrackingSchema as d, signupRequestSchema as dt, addCartItemRequestSchema as et, myOrderItemSchema as f, socialProviderSchema as ft, memberAddressRequestSchema as g, ApiError as gt, purchaseDecisionResultSchema as h, withdrawalBlockedDetailsSchema as ht, createReviewResultSchema as i, anonymousSessionSchema as it, myClaimSchema as j, createClaimRequestSchema as k, updateReviewResultSchema as l, loginRequestSchema as lt, orderShippingAddressSchema as m, withdrawRequestSchema as mt, storefrontStoreSchema as n, cartSchema as nt, reviewPageSchema as o, idpAuthorizeResponseSchema as ot, myOrderSchema as p, tokenPairSchema as pt, productFacetsSchema as q, createReviewRequestSchema as r, updateCartItemRequestSchema as rt, reviewSummarySchema as s, idpTokenRequestSchema as st, createStorefrontClient as t, cartItemSchema as tt, writableReviewSchema as u, memberIdentitiesSchema as ut, memberSchema as v, toApiError as vt, createCustomerInquiryRequestSchema as w, createInquiryRequestSchema as x, updateProfileRequestSchema as y, unwrapData as yt, paymentParamsSchema as z };

package/dist/{http-CxqZxTfE.d.mts → http-BbFHVGBf.d.mts}

@@ -41,7 +41,7 @@ type AnonymousSession = z.infer<typeof anonymousSessionSchema>;
  * 403 `PASSWORD_MISMATCH`다(로그인과 같은 5회 잠금).
  */
 declare const withdrawRequestSchema: z.ZodObject<{
-  password: z.ZodString;
+  password: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type WithdrawRequest = z.infer<typeof withdrawRequestSchema>;
 /** `WITHDRAWAL_BLOCKED`의 `error.details` — 탈퇴를 막는 항목 수 */
@@ -51,6 +51,51 @@ declare const withdrawalBlockedDetailsSchema: z.ZodObject<{
   pendingPayments: z.ZodNumber;
 }, z.core.$strip>;
 type WithdrawalBlockedDetails = z.infer<typeof withdrawalBlockedDetailsSchema>;
+/** 소셜 로그인 공급자 */
+declare const socialProviderSchema: z.ZodEnum<{
+  kakao: "kakao";
+  naver: "naver";
+  google: "google";
+}>;
+type SocialProvider = z.infer<typeof socialProviderSchema>;
+/** `POST /auth/idp/{provider}/authorize` 본문 — PKCE(S256)와 state는 SDK가 만든다 */
+declare const idpAuthorizeRequestSchema: z.ZodObject<{
+  redirectUri: z.ZodURL;
+  codeChallenge: z.ZodString;
+  state: z.ZodString;
+}, z.core.$strip>;
+type IdpAuthorizeRequest = z.infer<typeof idpAuthorizeRequestSchema>;
+declare const idpAuthorizeResponseSchema: z.ZodObject<{
+  url: z.ZodURL;
+}, z.core.$strip>;
+/** `POST /auth/idp/token` 본문 — 돌아온 1회용 code를 구매자 토큰으로 바꾼다 */
+declare const idpTokenRequestSchema: z.ZodObject<{
+  code: z.ZodString;
+  codeVerifier: z.ZodString;
+  cartToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type IdpTokenRequest = z.infer<typeof idpTokenRequestSchema>;
+/** `GET /me/identities` — 구매자의 로그인 수단(비밀번호 여부와 연결된 소셜 계정) */
+declare const memberIdentitiesSchema: z.ZodObject<{
+  hasPassword: z.ZodBoolean;
+  hasExternalAuth: z.ZodBoolean;
+  identities: z.ZodArray<z.ZodObject<{
+    provider: z.ZodEnum<{
+      kakao: "kakao";
+      naver: "naver";
+      google: "google";
+    }>;
+    email: z.ZodNullable<z.ZodString>;
+    linkedAt: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+type MemberIdentities = z.infer<typeof memberIdentitiesSchema>;
+/** `POST /me/identities/{provider}` 본문 — 연결 흐름에서 돌아온 1회용 code와 PKCE verifier */
+declare const linkIdentityRequestSchema: z.ZodObject<{
+  code: z.ZodString;
+  codeVerifier: z.ZodString;
+}, z.core.$strip>;
+type LinkIdentityRequest = z.infer<typeof linkIdentityRequestSchema>;
 //#endregion
 //#region src/http.d.ts
 declare class ApiError extends Error {
@@ -68,4 +113,4 @@ type TokenSource = string | null | undefined | (() => string | null | undefined)
 type Query = Record<string, string | number | boolean | undefined>;
 declare function buildQuery(query?: Query): string;
 //#endregion
-export { AnonymousSession as a, TokenPair as c, anonymousSessionSchema as d, loginRequestSchema as f, withdrawalBlockedDetailsSchema as g, withdrawRequestSchema as h, buildQuery as i, WithdrawRequest as l, tokenPairSchema as m, Query as n, LoginRequest as o, signupRequestSchema as p, TokenSource as r, SignupRequest as s, ApiError as t, WithdrawalBlockedDetails as u };
+export { signupRequestSchema as C, withdrawalBlockedDetailsSchema as D, withdrawRequestSchema as E, memberIdentitiesSchema as S, tokenPairSchema as T, idpAuthorizeRequestSchema as _, AnonymousSession as a, linkIdentityRequestSchema as b, LinkIdentityRequest as c, SignupRequest as d, SocialProvider as f, anonymousSessionSchema as g, WithdrawalBlockedDetails as h, buildQuery as i, LoginRequest as l, WithdrawRequest as m, Query as n, IdpAuthorizeRequest as o, TokenPair as p, TokenSource as r, IdpTokenRequest as s, ApiError as t, MemberIdentities as u, idpAuthorizeResponseSchema as v, socialProviderSchema as w, loginRequestSchema as x, idpTokenRequestSchema as y };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as AnonymousSession, c as TokenPair, d as anonymousSessionSchema, f as loginRequestSchema, g as withdrawalBlockedDetailsSchema, h as withdrawRequestSchema, i as buildQuery, l as WithdrawRequest, m as tokenPairSchema, n as Query, o as LoginRequest, p as signupRequestSchema, r as TokenSource, s as SignupRequest, t as ApiError, u as WithdrawalBlockedDetails } from "./http-CxqZxTfE.mjs";
+import { C as signupRequestSchema, D as withdrawalBlockedDetailsSchema, E as withdrawRequestSchema, S as memberIdentitiesSchema, T as tokenPairSchema, _ as idpAuthorizeRequestSchema, a as AnonymousSession, b as linkIdentityRequestSchema, c as LinkIdentityRequest, d as SignupRequest, f as SocialProvider, g as anonymousSessionSchema, h as WithdrawalBlockedDetails, i as buildQuery, l as LoginRequest, m as WithdrawRequest, n as Query, o as IdpAuthorizeRequest, p as TokenPair, r as TokenSource, s as IdpTokenRequest, t as ApiError, u as MemberIdentities, v as idpAuthorizeResponseSchema, w as socialProviderSchema, x as loginRequestSchema, y as idpTokenRequestSchema } from "./http-BbFHVGBf.mjs";
 import { z } from "zod";
 //#region src/analytics-ids.d.ts
 /**
@@ -213,6 +213,37 @@ export declare const productFacetsSchema: z.ZodObject<{
   }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ProductFacets = z.infer<typeof productFacetsSchema>;
+/** `GET /products` 응답 — 상품 카드 페이지와 검색 패싯 */
+export declare const productPageSchema: z.ZodObject<{
+  page: z.ZodNumber;
+  size: z.ZodNumber;
+  totalElements: z.ZodNumber;
+  totalPages: z.ZodNumber;
+  contents: z.ZodArray<z.ZodObject<{
+    productId: z.ZodString;
+    name: z.ZodString;
+    thumbnailUrl: z.ZodURL;
+    salePrice: z.ZodNumber;
+    discountedPrice: z.ZodNullable<z.ZodNumber>;
+    discountRate: z.ZodNullable<z.ZodNumber>;
+    freeShipping: z.ZodBoolean;
+    averageRating: z.ZodNumber;
+    reviewCount: z.ZodNumber;
+    soldOut: z.ZodBoolean;
+  }, z.core.$strip>>;
+  facets: z.ZodOptional<z.ZodObject<{
+    categories: z.ZodOptional<z.ZodArray<z.ZodObject<{
+      categoryId: z.ZodString;
+      name: z.ZodString;
+      count: z.ZodNumber;
+    }, z.core.$strip>>>;
+    priceRange: z.ZodOptional<z.ZodObject<{
+      min: z.ZodNumber;
+      max: z.ZodNumber;
+    }, z.core.$strip>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ProductPage = z.infer<typeof productPageSchema>;
 //#endregion
 //#region src/schemas/checkout.d.ts
 export declare const createCheckoutRequestSchema: z.ZodObject<{
@@ -485,11 +516,17 @@ export declare const createInquiryRequestSchema: z.ZodObject<{
   secret: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type CreateInquiryRequest = z.infer<typeof createInquiryRequestSchema>;
+/** `POST /products/{productId}/inquiries` 응답 */
+export declare const createInquiryResultSchema: z.ZodObject<{
+  inquiryId: z.ZodString;
+  createdAt: z.ZodString;
+}, z.core.$strip>;
+export type CreateInquiryResult = z.infer<typeof createInquiryResultSchema>;
 //#endregion
 //#region src/schemas/member.d.ts
 export declare const memberSchema: z.ZodObject<{
   memberId: z.ZodString;
-  email: z.ZodEmail;
+  email: z.ZodNullable<z.ZodEmail>;
   name: z.ZodString;
   phone: z.ZodNullable<z.ZodString>;
   point: z.ZodNumber;
@@ -524,6 +561,12 @@ export declare const memberAddressRequestSchema: z.ZodObject<{
   isDefault: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type MemberAddressRequest = z.infer<typeof memberAddressRequestSchema>;
+/** `POST /me/wishlist` 응답 — 이미 찜한 상품이어도 같은 응답이다 */
+export declare const wishlistAddResultSchema: z.ZodObject<{
+  productId: z.ZodString;
+  wished: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type WishlistAddResult = z.infer<typeof wishlistAddResultSchema>;
 //#endregion
 //#region src/schemas/review.d.ts
 export declare const publicReviewSchema: z.ZodObject<{
@@ -572,6 +615,38 @@ export declare const updateReviewRequestSchema: z.ZodObject<{
   images: z.ZodOptional<z.ZodArray<z.ZodURL>>;
 }, z.core.$strip>;
 export type UpdateReviewRequest = z.infer<typeof updateReviewRequestSchema>;
+/** `GET /products/{productId}/reviews` 응답 — 리뷰 페이지와 평점 분포 */
+export declare const reviewPageSchema: z.ZodObject<{
+  page: z.ZodNumber;
+  size: z.ZodNumber;
+  totalElements: z.ZodNumber;
+  totalPages: z.ZodNumber;
+  contents: z.ZodArray<z.ZodObject<{
+    reviewId: z.ZodString;
+    rating: z.ZodNumber;
+    content: z.ZodString;
+    images: z.ZodArray<z.ZodURL>;
+    optionName: z.ZodNullable<z.ZodString>;
+    writerMaskedName: z.ZodString;
+    sellerReply: z.ZodNullable<z.ZodObject<{
+      content: z.ZodString;
+      repliedAt: z.ZodString;
+    }, z.core.$strip>>;
+    createdAt: z.ZodString;
+  }, z.core.$strip>>;
+  summary: z.ZodOptional<z.ZodObject<{
+    averageRating: z.ZodNumber;
+    totalCount: z.ZodNumber;
+    distribution: z.ZodRecord<z.ZodString, z.ZodNumber>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ReviewPage = z.infer<typeof reviewPageSchema>;
+/** `PUT /me/reviews/{reviewId}` 응답 */
+export declare const updateReviewResultSchema: z.ZodObject<{
+  reviewId: z.ZodString;
+  updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type UpdateReviewResult = z.infer<typeof updateReviewResultSchema>;
 //#endregion
 //#region src/session.d.ts
 /**
@@ -672,7 +747,7 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
   /** session.userinfo() 위임 — session 미전달 시 에러 */
   userinfo(): Promise<{
     memberId: string;
-    email: string;
+    email: string | null;
     name: string;
     phone: string | null;
     point: number;
@@ -701,8 +776,52 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
       expiresIn: number;
     }>;
     logout: () => Promise<void>;
+    /** 소셜 로그인 시작 — 공급자 로그인 주소를 받는다. PKCE·state는 `@sayren/storefront-sdk/auth`의 `idp()`가 만든다 */
+    idpAuthorize: (provider: SocialProvider, body: IdpAuthorizeRequest) => Promise<{
+      url: string;
+    }>;
+    /** 소셜 로그인 마무리 — 돌아온 1회용 code + codeVerifier를 구매자 토큰으로 바꾼다 */
+    idpToken: (body: IdpTokenRequest) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      expiresIn: number;
+    }>;
     /** 구매자 탈퇴 — 로그인 상태(accessToken)에서 비밀번호로 본인 확인. 성공하면 토큰은 모두 무효 */
     withdraw: (body: WithdrawRequest) => Promise<void>;
+    /** 로그인 수단 — 비밀번호 여부와 연결된 소셜 계정(로그인 필요) */
+    identities: () => Promise<{
+      hasPassword: boolean;
+      hasExternalAuth: boolean;
+      identities: {
+        provider: "kakao" | "naver" | "google";
+        email: string | null;
+        linkedAt: string;
+      }[];
+    }>;
+    /** 소셜 계정 연결 시작(로그인 필요) — 공급자 로그인 주소를 받는다. 본문은 `idpAuthorize`와 같다 */
+    linkIdentityAuthorize: (provider: SocialProvider, body: IdpAuthorizeRequest) => Promise<{
+      url: string;
+    }>;
+    /** 소셜 계정 연결 마무리 — 돌아온 code + codeVerifier로 이 구매자에 연결한다 */
+    linkIdentity: (provider: SocialProvider, body: LinkIdentityRequest) => Promise<{
+      hasPassword: boolean;
+      hasExternalAuth: boolean;
+      identities: {
+        provider: "kakao" | "naver" | "google";
+        email: string | null;
+        linkedAt: string;
+      }[];
+    }>;
+    /** 소셜 계정 연결 해제 — 마지막 로그인 수단이면 409 `LAST_LOGIN_METHOD` */
+    unlinkIdentity: (provider: SocialProvider) => Promise<{
+      hasPassword: boolean;
+      hasExternalAuth: boolean;
+      identities: {
+        provider: "kakao" | "naver" | "google";
+        email: string | null;
+        linkedAt: string;
+      }[];
+    }>;
   };
   store: {
     /** 스토어 공개 설정 — 이름·고객센터·비회원 주문 허용 여부 */
@@ -713,6 +832,7 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
       customerCenterPhone: string | null;
       businessHours: string | null;
       guestCheckout: boolean;
+      loginMethods: ("password" | "kakao" | "naver" | "google")[];
     }>;
   };
   catalog: {
@@ -1140,7 +1260,7 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
   member: {
     me: () => Promise<{
       memberId: string;
-      email: string;
+      email: string | null;
       name: string;
       phone: string | null;
       point: number;
@@ -1495,10 +1615,17 @@ export declare const deliveryTrackingSchema: z.ZodObject<{
   }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DeliveryTracking = z.infer<typeof deliveryTrackingSchema>;
+/** `POST /me/order-items/{orderItemId}/purchase-decision` 응답 */
+export declare const purchaseDecisionResultSchema: z.ZodObject<{
+  orderItemId: z.ZodString;
+  status: z.ZodLiteral<"PURCHASE_DECIDED">;
+  decidedAt: z.ZodString;
+}, z.core.$strip>;
+export type PurchaseDecisionResult = z.infer<typeof purchaseDecisionResultSchema>;
 //#endregion
 //#region src/schemas/store.d.ts
 /**
- * 스토어 공개 설정 — `GET /store`. 스토어프런트가 화면을 그릴 때 읽는 값만 담는다.
+ * 스토어 공개 설정 — `GET /store`. 스토어프론트가 화면을 그릴 때 읽는 값만 담는다.
  */
 export declare const storefrontStoreSchema: z.ZodObject<{
   storeCode: z.ZodString;
@@ -1507,7 +1634,13 @@ export declare const storefrontStoreSchema: z.ZodObject<{
   customerCenterPhone: z.ZodNullable<z.ZodString>;
   businessHours: z.ZodNullable<z.ZodString>;
   guestCheckout: z.ZodBoolean;
+  loginMethods: z.ZodArray<z.ZodEnum<{
+    password: "password";
+    kakao: "kakao";
+    naver: "naver";
+    google: "google";
+  }>>;
 }, z.core.$strip>;
 export type StorefrontStore = z.infer<typeof storefrontStoreSchema>;
 //#endregion
-export { AnonymousSession, ApiError, LoginRequest, type Query, type SessionStorage, SignupRequest, type StorefrontClient, type StorefrontClientOptions, type StorefrontSession, type StorefrontSessionOptions, TokenPair, type TokenSource, WithdrawRequest, WithdrawalBlockedDetails, anonymousSessionSchema, buildQuery, loginRequestSchema, signupRequestSchema, tokenPairSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema };
+export { AnonymousSession, ApiError, IdpAuthorizeRequest, IdpTokenRequest, LinkIdentityRequest, LoginRequest, MemberIdentities, type Query, type SessionStorage, SignupRequest, SocialProvider, type StorefrontClient, type StorefrontClientOptions, type StorefrontSession, type StorefrontSessionOptions, TokenPair, type TokenSource, WithdrawRequest, WithdrawalBlockedDetails, anonymousSessionSchema, buildQuery, idpAuthorizeRequestSchema, idpAuthorizeResponseSchema, idpTokenRequestSchema, linkIdentityRequestSchema, loginRequestSchema, memberIdentitiesSchema, signupRequestSchema, socialProviderSchema, tokenPairSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema };

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { a as ANALYTICS_VISITOR_HEADER, c as analyticsClientEventSchema, i as ANALYTICS_VISITOR_COOKIE, l as analyticsIdSchema, n as ANALYTICS_SESSION_COOKIE, o as analyticsBatchSchema, r as ANALYTICS_SESSION_HEADER, s as analyticsClientEventNameSchema, t as ANALYTICS_MAX_BATCH_BYTES, u as analyticsServerEventNameSchema } from "./analytics-CgD70OqH.mjs";
 import { t as analyticsIdsFromCookie } from "./analytics-ids-COElZiI3.mjs";
-import { $ as loginRequestSchema, A as pageSchema, B as pgParamsSchema, C as claimTypeSchema, D as claimStatusSchema, E as myClaimSchema, F as createCheckoutRequestSchema, G as productDetailSchema, H as shippingAddressInputSchema, I as guestInfoSchema, J as addCartItemRequestSchema, K as productFacetsSchema, L as paymentMethodSchema, M as checkoutSessionSchema, N as confirmPaymentRequestSchema, O as orderItemStatusSchema, P as confirmPaymentResultSchema, Q as anonymousSessionSchema, R as paymentParamsSchema, S as claimReasonSchema, T as createClaimResultSchema, U as categoryNodeSchema, V as requestPaymentRequestSchema, W as productCardSchema, X as cartSchema, Y as cartItemSchema, Z as updateCartItemRequestSchema, _ as createInquiryRequestSchema, a as publicReviewSchema, at as buildQuery, b as customerInquiryCategorySchema, c as writableReviewSchema, d as myOrderSchema, et as signupRequestSchema, f as orderShippingAddressSchema, g as updateProfileRequestSchema, h as memberSchema, i as createReviewResultSchema, it as ApiError, j as PAYMENT_STATUS_VALUES, k as pageInfoSchema, l as deliveryTrackingSchema, m as memberAddressSchema, n as storefrontStoreSchema, nt as withdrawRequestSchema, o as reviewSummarySchema, ot as toApiError, p as memberAddressRequestSchema, q as productSortSchema, r as createReviewRequestSchema, rt as withdrawalBlockedDetailsSchema, s as updateReviewRequestSchema, st as unwrapData, t as createStorefrontClient, tt as tokenPairSchema, u as myOrderItemSchema, v as publicInquirySchema, w as createClaimRequestSchema, x as customerInquirySchema, y as createCustomerInquiryRequestSchema, z as paymentStatusSchema } from "./client-D-w3LIU2.mjs";
+import { $ as pageSchema, A as createClaimResultSchema, B as paymentStatusSchema, C as publicInquirySchema, D as claimReasonSchema, E as customerInquirySchema, F as confirmPaymentResultSchema, G as productCardSchema, H as requestPaymentRequestSchema, I as createCheckoutRequestSchema, J as productPageSchema, K as productDetailSchema, L as guestInfoSchema, M as PAYMENT_STATUS_VALUES, N as checkoutSessionSchema, O as claimTypeSchema, P as confirmPaymentRequestSchema, Q as pageInfoSchema, R as paymentMethodSchema, S as createInquiryResultSchema, T as customerInquiryCategorySchema, U as shippingAddressInputSchema, V as pgParamsSchema, W as categoryNodeSchema, X as claimStatusSchema, Y as productSortSchema, Z as orderItemStatusSchema, _ as memberAddressSchema, _t as buildQuery, a as publicReviewSchema, at as idpAuthorizeRequestSchema, b as wishlistAddResultSchema, c as updateReviewRequestSchema, ct as linkIdentityRequestSchema, d as deliveryTrackingSchema, dt as signupRequestSchema, et as addCartItemRequestSchema, f as myOrderItemSchema, ft as socialProviderSchema, g as memberAddressRequestSchema, gt as ApiError, h as purchaseDecisionResultSchema, ht as withdrawalBlockedDetailsSchema, i as createReviewResultSchema, it as anonymousSessionSchema, j as myClaimSchema, k as createClaimRequestSchema, l as updateReviewResultSchema, lt as loginRequestSchema, m as orderShippingAddressSchema, mt as withdrawRequestSchema, n as storefrontStoreSchema, nt as cartSchema, o as reviewPageSchema, ot as idpAuthorizeResponseSchema, p as myOrderSchema, pt as tokenPairSchema, q as productFacetsSchema, r as createReviewRequestSchema, rt as updateCartItemRequestSchema, s as reviewSummarySchema, st as idpTokenRequestSchema, t as createStorefrontClient, tt as cartItemSchema, u as writableReviewSchema, ut as memberIdentitiesSchema, v as memberSchema, vt as toApiError, w as createCustomerInquiryRequestSchema, x as createInquiryRequestSchema, y as updateProfileRequestSchema, yt as unwrapData, z as paymentParamsSchema } from "./client-B1uXGefY.mjs";
 //#region src/session.ts
 /** 세션 키 상수 — SDK가 소유한다. store-sdk와 겹치지 않는 별도 네임스페이스. */
 const STOREFRONT_SESSION_KEYS = {
@@ -124,4 +124,4 @@ function createStorefrontSession(options) {
 	};
 }
 //#endregion
-export { ANALYTICS_MAX_BATCH_BYTES, ANALYTICS_SESSION_COOKIE, ANALYTICS_SESSION_HEADER, ANALYTICS_VISITOR_COOKIE, ANALYTICS_VISITOR_HEADER, ApiError, PAYMENT_STATUS_VALUES, STOREFRONT_SESSION_KEYS, addCartItemRequestSchema, analyticsBatchSchema, analyticsClientEventNameSchema, analyticsClientEventSchema, analyticsIdSchema, analyticsIdsFromCookie, analyticsServerEventNameSchema, anonymousSessionSchema, buildQuery, cartItemSchema, cartSchema, categoryNodeSchema, checkoutSessionSchema, claimReasonSchema, claimStatusSchema, claimTypeSchema, confirmPaymentRequestSchema, confirmPaymentResultSchema, createCheckoutRequestSchema, createClaimRequestSchema, createClaimResultSchema, createCustomerInquiryRequestSchema, createInquiryRequestSchema, createReviewRequestSchema, createReviewResultSchema, createStorefrontClient, createStorefrontSession, customerInquiryCategorySchema, customerInquirySchema, deliveryTrackingSchema, guestInfoSchema, loginRequestSchema, memberAddressRequestSchema, memberAddressSchema, memberSchema, myClaimSchema, myOrderItemSchema, myOrderSchema, orderItemStatusSchema, orderShippingAddressSchema, pageInfoSchema, pageSchema, paymentMethodSchema, paymentParamsSchema, paymentStatusSchema, pgParamsSchema, productCardSchema, productDetailSchema, productFacetsSchema, productSortSchema, publicInquirySchema, publicReviewSchema, requestPaymentRequestSchema, reviewSummarySchema, shippingAddressInputSchema, signupRequestSchema, storefrontStoreSchema, tokenPairSchema, updateCartItemRequestSchema, updateProfileRequestSchema, updateReviewRequestSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema, writableReviewSchema };
+export { ANALYTICS_MAX_BATCH_BYTES, ANALYTICS_SESSION_COOKIE, ANALYTICS_SESSION_HEADER, ANALYTICS_VISITOR_COOKIE, ANALYTICS_VISITOR_HEADER, ApiError, PAYMENT_STATUS_VALUES, STOREFRONT_SESSION_KEYS, addCartItemRequestSchema, analyticsBatchSchema, analyticsClientEventNameSchema, analyticsClientEventSchema, analyticsIdSchema, analyticsIdsFromCookie, analyticsServerEventNameSchema, anonymousSessionSchema, buildQuery, cartItemSchema, cartSchema, categoryNodeSchema, checkoutSessionSchema, claimReasonSchema, claimStatusSchema, claimTypeSchema, confirmPaymentRequestSchema, confirmPaymentResultSchema, createCheckoutRequestSchema, createClaimRequestSchema, createClaimResultSchema, createCustomerInquiryRequestSchema, createInquiryRequestSchema, createInquiryResultSchema, createReviewRequestSchema, createReviewResultSchema, createStorefrontClient, createStorefrontSession, customerInquiryCategorySchema, customerInquirySchema, deliveryTrackingSchema, guestInfoSchema, idpAuthorizeRequestSchema, idpAuthorizeResponseSchema, idpTokenRequestSchema, linkIdentityRequestSchema, loginRequestSchema, memberAddressRequestSchema, memberAddressSchema, memberIdentitiesSchema, memberSchema, myClaimSchema, myOrderItemSchema, myOrderSchema, orderItemStatusSchema, orderShippingAddressSchema, pageInfoSchema, pageSchema, paymentMethodSchema, paymentParamsSchema, paymentStatusSchema, pgParamsSchema, productCardSchema, productDetailSchema, productFacetsSchema, productPageSchema, productSortSchema, publicInquirySchema, publicReviewSchema, purchaseDecisionResultSchema, requestPaymentRequestSchema, reviewPageSchema, reviewSummarySchema, shippingAddressInputSchema, signupRequestSchema, socialProviderSchema, storefrontStoreSchema, tokenPairSchema, updateCartItemRequestSchema, updateProfileRequestSchema, updateReviewRequestSchema, updateReviewResultSchema, wishlistAddResultSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema, writableReviewSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sayren/storefront-sdk",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.mts",
   "exports": {

package/src/auth/index.ts

@@ -3,7 +3,9 @@ import { ApiError } from "../http";
 import type {
   AnonymousSession,
   LoginRequest,
+  MemberIdentities,
   SignupRequest,
+  SocialProvider,
   TokenPair,
   WithdrawRequest,
 } from "../schemas/auth";
@@ -13,12 +15,62 @@ export { ApiError } from "../http";
 export type {
   AnonymousSession,
   LoginRequest,
+  MemberIdentities,
   SignupRequest,
+  SocialProvider,
   TokenPair,
   WithdrawalBlockedDetails,
   WithdrawRequest,
 } from "../schemas/auth";
 
+/** 소셜 로그인 시작 결과 — `codeVerifier`와 `state`는 돌아올 때까지 서버 세션(httpOnly 쿠키 등)에 보관한다 */
+export interface IdpStart {
+  /** 구매자를 보낼 공급자 로그인 주소 */
+  url: string;
+  state: string;
+  codeVerifier: string;
+}
+
+export interface IdpCallbackInput {
+  /** 돌아온 주소의 `code`(성공) — 실패면 `error`가 온다 */
+  code: string | null;
+  /** 돌아온 주소의 `state` */
+  state: string | null;
+  /** `idp()`가 준 값 — 보관해 둔 것 */
+  expectedState: string;
+  codeVerifier: string;
+  /** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+  cartToken?: string;
+}
+
+/** 소셜 로그인 실패 — 구매자가 취소했거나(`access_denied`) state가 맞지 않는다 */
+export class IdpCallbackError extends Error {
+  constructor(
+    public readonly reason: "access_denied" | "state_mismatch" | "missing_code" | string,
+  ) {
+    super(`소셜 로그인을 마치지 못했어요 (${reason})`);
+    this.name = "IdpCallbackError";
+  }
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(bytes = 32): string {
+  return base64url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+}
+
+async function s256(verifier: string): Promise<string> {
+  const digest = await globalThis.crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier),
+  );
+  return base64url(new Uint8Array(digest));
+}
+
 export interface StorefrontAuthOptions {
   /** 예: https://api.sayren.app/storefront/v1 */
   baseUrl: string;
@@ -28,7 +80,7 @@ export interface StorefrontAuthOptions {
 }
 
 /**
- * 구매자 인증 — 화면은 스토어프런트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
+ * 구매자 인증 — 화면은 스토어프론트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
  * 어느 방식으로 로그인해도 결과는 같은 구매자 토큰(`TokenPair`)이고 `/me/*`·장바구니·주문 API에 그대로 쓴다.
  *
  * 토큰 보관은 앱 몫이다. 서버(loader·action)에서 호출하고 httpOnly 쿠키에 두기를 권한다.
@@ -65,6 +117,82 @@ export function createStorefrontAuth(options: StorefrontAuthOptions) {
     signUp(body: SignupRequest): Promise<TokenPair> {
       return client().auth.signup(body);
     },
+    /**
+     * 소셜 로그인 시작 — PKCE(S256)와 state를 만들고 공급자 로그인 주소를 받는다. 반환한 `state`·`codeVerifier`를
+     * 서버 세션에 보관하고 구매자를 `url`로 보낸다. 로그인을 마치면 `redirectUri`로 `?code=&state=`가 붙어 돌아온다.
+     * `redirectUri`는 스토어프론트 도메인 목록 안이어야 한다
+     */
+    async idp(provider: SocialProvider, options: { redirectUri: string }): Promise<IdpStart> {
+      const state = randomToken(24);
+      const codeVerifier = randomToken(32);
+      const { url } = await client().auth.idpAuthorize(provider, {
+        redirectUri: options.redirectUri,
+        codeChallenge: await s256(codeVerifier),
+        state,
+      });
+      return { url, state, codeVerifier };
+    },
+    /**
+     * 소셜 로그인 마무리 — 돌아온 `code`를 구매자 토큰으로 바꾼다. state가 다르거나 구매자가 취소했으면
+     * `IdpCallbackError`. code는 1회용이고 1분 안에 바꿔야 한다
+     */
+    idpCallback(input: IdpCallbackInput & { error?: string | null }): Promise<TokenPair> {
+      if (input.error) return Promise.reject(new IdpCallbackError(input.error));
+      if (!input.state || input.state !== input.expectedState) {
+        return Promise.reject(new IdpCallbackError("state_mismatch"));
+      }
+      if (!input.code) return Promise.reject(new IdpCallbackError("missing_code"));
+      return client().auth.idpToken({
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        cartToken: input.cartToken,
+      });
+    },
+    /** 로그인 수단 — 비밀번호가 있는지, 어떤 소셜 계정이 연결됐는지 */
+    identities(accessToken: string): Promise<MemberIdentities> {
+      return client(accessToken).auth.identities();
+    },
+    /**
+     * 소셜 계정 연결 시작 — 로그인한 구매자에 공급자 계정을 붙인다. `idp()`처럼 `state`·`codeVerifier`를 보관하고
+     * 구매자를 `url`로 보낸다. 돌아오면 `linkIdpCallback()`으로 마무리한다. 연결은 흐름을 시작한 구매자에게만 된다
+     */
+    async linkIdp(
+      accessToken: string,
+      provider: SocialProvider,
+      options: { redirectUri: string },
+    ): Promise<IdpStart> {
+      const state = randomToken(24);
+      const codeVerifier = randomToken(32);
+      const { url } = await client(accessToken).auth.linkIdentityAuthorize(provider, {
+        redirectUri: options.redirectUri,
+        codeChallenge: await s256(codeVerifier),
+        state,
+      });
+      return { url, state, codeVerifier };
+    },
+    /**
+     * 소셜 계정 연결 마무리 — state를 비교하고 code를 바꿔 연결한다. 다른 구매자에 이미 연결된 계정이면
+     * 409 `IDENTITY_IN_USE`, 같은 공급자의 다른 계정을 이미 연결했으면 409 `PROVIDER_ALREADY_LINKED`
+     */
+    linkIdpCallback(
+      accessToken: string,
+      provider: SocialProvider,
+      input: Omit<IdpCallbackInput, "cartToken"> & { error?: string | null },
+    ): Promise<MemberIdentities> {
+      if (input.error) return Promise.reject(new IdpCallbackError(input.error));
+      if (!input.state || input.state !== input.expectedState) {
+        return Promise.reject(new IdpCallbackError("state_mismatch"));
+      }
+      if (!input.code) return Promise.reject(new IdpCallbackError("missing_code"));
+      return client(accessToken).auth.linkIdentity(provider, {
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+      });
+    },
+    /** 소셜 계정 연결 해제 — 마지막 로그인 수단이면 409 `LAST_LOGIN_METHOD` */
+    unlinkIdp(accessToken: string, provider: SocialProvider): Promise<MemberIdentities> {
+      return client(accessToken).auth.unlinkIdentity(provider);
+    },
     /** 토큰 갱신 — refreshToken은 한 번 쓰면 폐기되고 새 쌍이 온다(회전) */
     refresh(refreshToken: string): Promise<TokenPair> {
       return client().auth.refresh(refreshToken);

package/src/client.ts

@@ -4,7 +4,16 @@ import { ANALYTICS_SESSION_HEADER, ANALYTICS_VISITOR_HEADER } from "./schemas/an
 import type { LoginRequest, SignupRequest } from "./schemas/auth";
 import {
   anonymousSessionSchema,
+  type IdpAuthorizeRequest,
+  type IdpTokenRequest,
+  idpAuthorizeRequestSchema,
+  idpAuthorizeResponseSchema,
+  idpTokenRequestSchema,
+  type LinkIdentityRequest,
+  linkIdentityRequestSchema,
   loginRequestSchema,
+  memberIdentitiesSchema,
+  type SocialProvider,
   signupRequestSchema,
   tokenPairSchema,
   type WithdrawRequest,
@@ -22,7 +31,7 @@ import {
   type ProductSearchParams,
   productCardSchema,
   productDetailSchema,
-  productFacetsSchema,
+  productPageSchema,
 } from "./schemas/catalog";
 import {
   type CreateCheckoutRequest,
@@ -67,8 +76,7 @@ import {
   type CreateReviewRequest,
   createReviewRequestSchema,
   createReviewResultSchema,
-  publicReviewSchema,
-  reviewSummarySchema,
+  reviewPageSchema,
   type UpdateReviewRequest,
   updateReviewRequestSchema,
   writableReviewSchema,
@@ -111,14 +119,6 @@ export interface StorefrontClientOptions {
   fetch?: typeof globalThis.fetch;
 }
 
-const productPageSchema = pageSchema(productCardSchema).extend({
-  facets: productFacetsSchema.optional(),
-});
-
-const reviewPageSchema = pageSchema(publicReviewSchema).extend({
-  summary: reviewSummarySchema.optional(),
-});
-
 export function createStorefrontClient(options: StorefrontClientOptions) {
   const { session } = options;
 
@@ -184,9 +184,37 @@ export function createStorefrontClient(options: StorefrontClientOptions) {
       refresh: (refreshToken: string) =>
         http.request("POST", "/auth/token/refresh", tokenPairSchema, { body: { refreshToken } }),
       logout: () => http.requestVoid("POST", "/auth/logout"),
+      /** 소셜 로그인 시작 — 공급자 로그인 주소를 받는다. PKCE·state는 `@sayren/storefront-sdk/auth`의 `idp()`가 만든다 */
+      idpAuthorize: (provider: SocialProvider, body: IdpAuthorizeRequest) =>
+        http.request("POST", path`/auth/idp/${provider}/authorize`, idpAuthorizeResponseSchema, {
+          body: idpAuthorizeRequestSchema.parse(body),
+        }),
+      /** 소셜 로그인 마무리 — 돌아온 1회용 code + codeVerifier를 구매자 토큰으로 바꾼다 */
+      idpToken: (body: IdpTokenRequest) =>
+        http.request("POST", "/auth/idp/token", tokenPairSchema, {
+          body: idpTokenRequestSchema.parse(body),
+        }),
       /** 구매자 탈퇴 — 로그인 상태(accessToken)에서 비밀번호로 본인 확인. 성공하면 토큰은 모두 무효 */
       withdraw: (body: WithdrawRequest) =>
         http.requestVoid("POST", "/auth/withdraw", { body: withdrawRequestSchema.parse(body) }),
+      /** 로그인 수단 — 비밀번호 여부와 연결된 소셜 계정(로그인 필요) */
+      identities: () => http.request("GET", "/me/identities", memberIdentitiesSchema),
+      /** 소셜 계정 연결 시작(로그인 필요) — 공급자 로그인 주소를 받는다. 본문은 `idpAuthorize`와 같다 */
+      linkIdentityAuthorize: (provider: SocialProvider, body: IdpAuthorizeRequest) =>
+        http.request(
+          "POST",
+          path`/me/identities/${provider}/authorize`,
+          idpAuthorizeResponseSchema,
+          { body: idpAuthorizeRequestSchema.parse(body) },
+        ),
+      /** 소셜 계정 연결 마무리 — 돌아온 code + codeVerifier로 이 구매자에 연결한다 */
+      linkIdentity: (provider: SocialProvider, body: LinkIdentityRequest) =>
+        http.request("POST", path`/me/identities/${provider}`, memberIdentitiesSchema, {
+          body: linkIdentityRequestSchema.parse(body),
+        }),
+      /** 소셜 계정 연결 해제 — 마지막 로그인 수단이면 409 `LAST_LOGIN_METHOD` */
+      unlinkIdentity: (provider: SocialProvider) =>
+        http.request("DELETE", path`/me/identities/${provider}`, memberIdentitiesSchema),
     },
 
     store: {

package/src/schemas/auth.ts

@@ -61,7 +61,11 @@ export type AnonymousSession = z.infer<typeof anonymousSessionSchema>;
  * 403 `PASSWORD_MISMATCH`다(로그인과 같은 5회 잠금).
  */
 export const withdrawRequestSchema = z.object({
-  password: z.string().min(1),
+  /**
+   * 비밀번호로 가입한 구매자는 필수. 소셜 로그인으로만 가입한 구매자는 비밀번호가 없어 생략하고, 대신 최근 10분 안에
+   * 로그인한 액세스 토큰이어야 한다(아니면 403 `REAUTH_REQUIRED` — 다시 로그인한 뒤 호출)
+   */
+  password: z.string().min(1).optional(),
 });
 
 export type WithdrawRequest = z.infer<typeof withdrawRequestSchema>;
@@ -77,3 +81,55 @@ export const withdrawalBlockedDetailsSchema = z.object({
 });
 
 export type WithdrawalBlockedDetails = z.infer<typeof withdrawalBlockedDetailsSchema>;
+
+/** 소셜 로그인 공급자 */
+export const socialProviderSchema = z.enum(["kakao", "naver", "google"]);
+export type SocialProvider = z.infer<typeof socialProviderSchema>;
+
+/** `POST /auth/idp/{provider}/authorize` 본문 — PKCE(S256)와 state는 SDK가 만든다 */
+export const idpAuthorizeRequestSchema = z.object({
+  /** 로그인을 마치고 돌아올 스토어프론트 주소. 스토어프론트 도메인 목록 안이어야 한다 */
+  redirectUri: z.url(),
+  /** base64url(SHA-256(codeVerifier)) */
+  codeChallenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  /** 스토어프론트가 만든 값 — 돌아올 때 그대로 붙어 온다. 세션에 저장해 두고 비교한다 */
+  state: z.string().min(16).max(128),
+});
+export type IdpAuthorizeRequest = z.infer<typeof idpAuthorizeRequestSchema>;
+
+export const idpAuthorizeResponseSchema = z.object({
+  /** 구매자를 보낼 공급자 로그인 주소 */
+  url: z.url(),
+});
+
+/** `POST /auth/idp/token` 본문 — 돌아온 1회용 code를 구매자 토큰으로 바꾼다 */
+export const idpTokenRequestSchema = z.object({
+  code: z.string().min(1),
+  codeVerifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
+  /** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+  cartToken: z.string().optional(),
+});
+export type IdpTokenRequest = z.infer<typeof idpTokenRequestSchema>;
+
+/** `GET /me/identities` — 구매자의 로그인 수단(비밀번호 여부와 연결된 소셜 계정) */
+export const memberIdentitiesSchema = z.object({
+  hasPassword: z.boolean(),
+  /** 셀러 자체 회원 연동(구매자 위임)으로 들어온 구매자 — 그 로그인도 로그인 수단으로 센다 */
+  hasExternalAuth: z.boolean(),
+  identities: z.array(
+    z.object({
+      provider: socialProviderSchema,
+      /** 공급자가 알려 준 이메일(참고값). 없을 수 있다 */
+      email: z.string().nullable(),
+      linkedAt: z.string(),
+    }),
+  ),
+});
+export type MemberIdentities = z.infer<typeof memberIdentitiesSchema>;
+
+/** `POST /me/identities/{provider}` 본문 — 연결 흐름에서 돌아온 1회용 code와 PKCE verifier */
+export const linkIdentityRequestSchema = z.object({
+  code: z.string().min(1),
+  codeVerifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
+});
+export type LinkIdentityRequest = z.infer<typeof linkIdentityRequestSchema>;

package/src/schemas/catalog.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import type { PageParams } from "./common";
+import { type PageParams, pageSchema } from "./common";
 
 export interface CategoryNode {
   categoryId: string;
@@ -21,9 +21,13 @@ export const productCardSchema = z.object({
   productId: z.string(),
   name: z.string(),
   thumbnailUrl: z.url(),
-  salePrice: z.number().int(),
-  discountedPrice: z.number().int().nullable(),
-  discountRate: z.number().int().nullable(),
+  salePrice: z.number().int().describe("판매가. 원(KRW) 단위 정수"),
+  discountedPrice: z
+    .number()
+    .int()
+    .nullable()
+    .describe("즉시 할인 적용가. 원 단위. 할인이 없으면 null"),
+  discountRate: z.number().int().nullable().describe("할인율(%). 할인이 없으면 null"),
   freeShipping: z.boolean(),
   averageRating: z.number(),
   reviewCount: z.number().int(),
@@ -99,3 +103,10 @@ export const productFacetsSchema = z.object({
 });
 
 export type ProductFacets = z.infer<typeof productFacetsSchema>;
+
+/** `GET /products` 응답 — 상품 카드 페이지와 검색 패싯 */
+export const productPageSchema = pageSchema(productCardSchema).extend({
+  facets: productFacetsSchema.optional(),
+});
+
+export type ProductPage = z.infer<typeof productPageSchema>;

package/src/schemas/inquiry.ts

@@ -23,3 +23,11 @@ export const createInquiryRequestSchema = z.object({
 });
 
 export type CreateInquiryRequest = z.infer<typeof createInquiryRequestSchema>;
+
+/** `POST /products/{productId}/inquiries` 응답 */
+export const createInquiryResultSchema = z.object({
+  inquiryId: z.string(),
+  createdAt: z.string(),
+});
+
+export type CreateInquiryResult = z.infer<typeof createInquiryResultSchema>;

package/src/schemas/member.ts

@@ -2,7 +2,8 @@ import { z } from "zod";
 
 export const memberSchema = z.object({
   memberId: z.string(),
-  email: z.email(),
+  /** 소셜 가입에서 공급자가 이메일을 주지 않았으면 null */
+  email: z.email().nullable(),
   name: z.string(),
   phone: z.string().nullable(),
   point: z.number().int(),
@@ -48,3 +49,11 @@ export const memberAddressRequestSchema = z.object({
 });
 
 export type MemberAddressRequest = z.infer<typeof memberAddressRequestSchema>;
+
+/** `POST /me/wishlist` 응답 — 이미 찜한 상품이어도 같은 응답이다 */
+export const wishlistAddResultSchema = z.object({
+  productId: z.string(),
+  wished: z.literal(true),
+});
+
+export type WishlistAddResult = z.infer<typeof wishlistAddResultSchema>;

package/src/schemas/order.ts

@@ -74,3 +74,12 @@ export const deliveryTrackingSchema = z.object({
 });
 
 export type DeliveryTracking = z.infer<typeof deliveryTrackingSchema>;
+
+/** `POST /me/order-items/{orderItemId}/purchase-decision` 응답 */
+export const purchaseDecisionResultSchema = z.object({
+  orderItemId: z.string(),
+  status: z.literal("PURCHASE_DECIDED"),
+  decidedAt: z.string(),
+});
+
+export type PurchaseDecisionResult = z.infer<typeof purchaseDecisionResultSchema>;

package/src/schemas/review.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { pageSchema } from "./common";
 
 export const publicReviewSchema = z.object({
   reviewId: z.string(),
@@ -63,3 +64,18 @@ export const updateReviewRequestSchema = z
   });
 
 export type UpdateReviewRequest = z.infer<typeof updateReviewRequestSchema>;
+
+/** `GET /products/{productId}/reviews` 응답 — 리뷰 페이지와 평점 분포 */
+export const reviewPageSchema = pageSchema(publicReviewSchema).extend({
+  summary: reviewSummarySchema.optional(),
+});
+
+export type ReviewPage = z.infer<typeof reviewPageSchema>;
+
+/** `PUT /me/reviews/{reviewId}` 응답 */
+export const updateReviewResultSchema = z.object({
+  reviewId: z.string(),
+  updatedAt: z.string(),
+});
+
+export type UpdateReviewResult = z.infer<typeof updateReviewResultSchema>;

package/src/schemas/store.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 
 /**
- * 스토어 공개 설정 — `GET /store`. 스토어프런트가 화면을 그릴 때 읽는 값만 담는다.
+ * 스토어 공개 설정 — `GET /store`. 스토어프론트가 화면을 그릴 때 읽는 값만 담는다.
  */
 export const storefrontStoreSchema = z.object({
   storeCode: z.string(),
@@ -14,6 +14,10 @@ export const storefrontStoreSchema = z.object({
    * 장바구니 담기는 된다 — 주문 버튼을 로그인 안내로 바꾸면 된다
    */
   guestCheckout: z.boolean(),
+  /**
+   * 켜진 로그인 방법 — 화면에 이 순서대로 버튼을 그리면 된다. `password`가 없으면 이메일·비밀번호 가입·로그인이 꺼져 있다
+   */
+  loginMethods: z.array(z.enum(["password", "kakao", "naver", "google"])),
 });
 
 export type StorefrontStore = z.infer<typeof storefrontStoreSchema>;