@spfn/auth 0.2.0-beta.74 → 0.2.0-beta.80

package/dist/server.js

@@ -897,8 +897,8 @@ var init_array2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs
-function Argument(index11) {
-  return CreateType({ [Kind]: "Argument", index: index11 });
+function Argument(index12) {
+  return CreateType({ [Kind]: "Argument", index: index12 });
 }
 var init_argument = __esm({
   "../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs"() {
@@ -1136,28 +1136,28 @@ var init_union2 = __esm({
 function Unescape(pattern) {
   return pattern.replace(/\\\$/g, "$").replace(/\\\*/g, "*").replace(/\\\^/g, "^").replace(/\\\|/g, "|").replace(/\\\(/g, "(").replace(/\\\)/g, ")");
 }
-function IsNonEscaped(pattern, index11, char) {
-  return pattern[index11] === char && pattern.charCodeAt(index11 - 1) !== 92;
+function IsNonEscaped(pattern, index12, char) {
+  return pattern[index12] === char && pattern.charCodeAt(index12 - 1) !== 92;
 }
-function IsOpenParen(pattern, index11) {
-  return IsNonEscaped(pattern, index11, "(");
+function IsOpenParen(pattern, index12) {
+  return IsNonEscaped(pattern, index12, "(");
 }
-function IsCloseParen(pattern, index11) {
-  return IsNonEscaped(pattern, index11, ")");
+function IsCloseParen(pattern, index12) {
+  return IsNonEscaped(pattern, index12, ")");
 }
-function IsSeparator(pattern, index11) {
-  return IsNonEscaped(pattern, index11, "|");
+function IsSeparator(pattern, index12) {
+  return IsNonEscaped(pattern, index12, "|");
 }
 function IsGroup(pattern) {
   if (!(IsOpenParen(pattern, 0) && IsCloseParen(pattern, pattern.length - 1)))
     return false;
   let count = 0;
-  for (let index11 = 0; index11 < pattern.length; index11++) {
-    if (IsOpenParen(pattern, index11))
+  for (let index12 = 0; index12 < pattern.length; index12++) {
+    if (IsOpenParen(pattern, index12))
       count += 1;
-    if (IsCloseParen(pattern, index11))
+    if (IsCloseParen(pattern, index12))
       count -= 1;
-    if (count === 0 && index11 !== pattern.length - 1)
+    if (count === 0 && index12 !== pattern.length - 1)
       return false;
   }
   return true;
@@ -1167,19 +1167,19 @@ function InGroup(pattern) {
 }
 function IsPrecedenceOr(pattern) {
   let count = 0;
-  for (let index11 = 0; index11 < pattern.length; index11++) {
-    if (IsOpenParen(pattern, index11))
+  for (let index12 = 0; index12 < pattern.length; index12++) {
+    if (IsOpenParen(pattern, index12))
       count += 1;
-    if (IsCloseParen(pattern, index11))
+    if (IsCloseParen(pattern, index12))
       count -= 1;
-    if (IsSeparator(pattern, index11) && count === 0)
+    if (IsSeparator(pattern, index12) && count === 0)
       return true;
   }
   return false;
 }
 function IsPrecedenceAnd(pattern) {
-  for (let index11 = 0; index11 < pattern.length; index11++) {
-    if (IsOpenParen(pattern, index11))
+  for (let index12 = 0; index12 < pattern.length; index12++) {
+    if (IsOpenParen(pattern, index12))
       return true;
   }
   return false;
@@ -1187,16 +1187,16 @@ function IsPrecedenceAnd(pattern) {
 function Or(pattern) {
   let [count, start] = [0, 0];
   const expressions = [];
-  for (let index11 = 0; index11 < pattern.length; index11++) {
-    if (IsOpenParen(pattern, index11))
+  for (let index12 = 0; index12 < pattern.length; index12++) {
+    if (IsOpenParen(pattern, index12))
       count += 1;
-    if (IsCloseParen(pattern, index11))
+    if (IsCloseParen(pattern, index12))
       count -= 1;
-    if (IsSeparator(pattern, index11) && count === 0) {
-      const range2 = pattern.slice(start, index11);
+    if (IsSeparator(pattern, index12) && count === 0) {
+      const range2 = pattern.slice(start, index12);
       if (range2.length > 0)
         expressions.push(TemplateLiteralParse(range2));
-      start = index11 + 1;
+      start = index12 + 1;
     }
   }
   const range = pattern.slice(start);
@@ -1209,40 +1209,40 @@ function Or(pattern) {
   return { type: "or", expr: expressions };
 }
 function And(pattern) {
-  function Group(value, index11) {
-    if (!IsOpenParen(value, index11))
+  function Group(value, index12) {
+    if (!IsOpenParen(value, index12))
       throw new TemplateLiteralParserError(`TemplateLiteralParser: Index must point to open parens`);
     let count = 0;
-    for (let scan = index11; scan < value.length; scan++) {
+    for (let scan = index12; scan < value.length; scan++) {
       if (IsOpenParen(value, scan))
         count += 1;
       if (IsCloseParen(value, scan))
         count -= 1;
       if (count === 0)
-        return [index11, scan];
+        return [index12, scan];
     }
     throw new TemplateLiteralParserError(`TemplateLiteralParser: Unclosed group parens in expression`);
   }
-  function Range(pattern2, index11) {
-    for (let scan = index11; scan < pattern2.length; scan++) {
+  function Range(pattern2, index12) {
+    for (let scan = index12; scan < pattern2.length; scan++) {
       if (IsOpenParen(pattern2, scan))
-        return [index11, scan];
+        return [index12, scan];
     }
-    return [index11, pattern2.length];
+    return [index12, pattern2.length];
   }
   const expressions = [];
-  for (let index11 = 0; index11 < pattern.length; index11++) {
-    if (IsOpenParen(pattern, index11)) {
-      const [start, end] = Group(pattern, index11);
+  for (let index12 = 0; index12 < pattern.length; index12++) {
+    if (IsOpenParen(pattern, index12)) {
+      const [start, end] = Group(pattern, index12);
       const range = pattern.slice(start, end + 1);
       expressions.push(TemplateLiteralParse(range));
-      index11 = end;
+      index12 = end;
     } else {
-      const [start, end] = Range(pattern, index11);
+      const [start, end] = Range(pattern, index12);
       const range = pattern.slice(start, end);
       if (range.length > 0)
         expressions.push(TemplateLiteralParse(range));
-      index11 = end - 1;
+      index12 = end - 1;
     }
   }
   return expressions.length === 0 ? { type: "const", const: "" } : expressions.length === 1 ? expressions[0] : { type: "and", expr: expressions };
@@ -2577,13 +2577,13 @@ function FromBoolean(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsBoolean(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromConstructor(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index11) => IntoBooleanResult(Visit3(right.parameters[index11], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index12) => IntoBooleanResult(Visit3(right.parameters[index12], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromDate(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsDate(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromFunction(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index11) => IntoBooleanResult(Visit3(right.parameters[index11], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index12) => IntoBooleanResult(Visit3(right.parameters[index12], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromIntegerRight(left, right) {
   return type_exports.IsLiteral(left) && value_exports.IsNumber(left.const) ? ExtendsResult.True : type_exports.IsNumber(left) || type_exports.IsInteger(left) ? ExtendsResult.True : ExtendsResult.False;
@@ -2743,7 +2743,7 @@ function FromTupleRight(left, right) {
   return type_exports.IsNever(left) ? ExtendsResult.True : type_exports.IsUnknown(left) ? ExtendsResult.False : type_exports.IsAny(left) ? ExtendsResult.Union : ExtendsResult.False;
 }
 function FromTuple3(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index11) => Visit3(schema, right.items[index11]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index12) => Visit3(schema, right.items[index12]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromUint8Array(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsUint8Array(right) ? ExtendsResult.True : ExtendsResult.False;
@@ -4486,23 +4486,27 @@ var init_schema3 = __esm({
       Type.Literal("login"),
       Type.Literal("password_reset"),
       Type.Literal("email_change"),
-      Type.Literal("phone_change")
+      Type.Literal("phone_change"),
+      Type.Literal("account_deletion")
     ], {
       description: "Purpose of verification"
     });
-    VERIFICATION_PURPOSES = ["registration", "login", "password_reset", "email_change", "phone_change"];
+    VERIFICATION_PURPOSES = ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
   }
 });
 
 // src/server/types.ts
-var KEY_ALGORITHM, INVITATION_STATUSES, USER_STATUSES, SOCIAL_PROVIDERS;
+var KEY_ALGORITHM, INVITATION_STATUSES, USER_STATUSES, SOCIAL_PROVIDERS, ACCOUNT_DELETION_REQUEST_STATUSES, ACCOUNT_DELETION_REQUESTED_BY, PURGE_STRATEGIES;
 var init_types = __esm({
   "src/server/types.ts"() {
     "use strict";
     KEY_ALGORITHM = ["ES256", "RS256"];
     INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
-    USER_STATUSES = ["active", "inactive", "suspended"];
+    USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
     SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
+    ACCOUNT_DELETION_REQUEST_STATUSES = ["pending", "cancelled", "completed"];
+    ACCOUNT_DELETION_REQUESTED_BY = ["self", "admin"];
+    PURGE_STRATEGIES = ["anonymize", "hard-delete"];
   }
 });
 
@@ -4565,9 +4569,8 @@ var init_roles = __esm({
 });
 
 // src/server/entities/users.ts
-import { text as text2, check, boolean as boolean2, index as index2, uuid } from "drizzle-orm/pg-core";
-import { id as id2, timestamps as timestamps2, enumText, utcTimestamp, foreignKey } from "@spfn/core/db";
-import { sql } from "drizzle-orm";
+import { text as text2, boolean as boolean2, index as index2, uuid } from "drizzle-orm/pg-core";
+import { id as id2, timestamps as timestamps2, enumText, utcTimestamp, foreignKey, softDelete } from "@spfn/core/db";
 var users;
 var init_users = __esm({
   "src/server/entities/users.ts"() {
@@ -4609,6 +4612,8 @@ var init_users = __esm({
         // - active: Normal operation (default)
         // - inactive: Deactivated (user request, dormant)
         // - suspended: Locked (security incident, ToS violation)
+        // - pending_deletion: Deletion requested, within the grace period (recoverable)
+        // - deleted: Grace period elapsed and the account was purged (anonymize mode)
         status: enumText("status", USER_STATUSES).default("active").notNull(),
         // Verification timestamps
         // null = unverified, timestamp = verified at this time
@@ -4620,15 +4625,13 @@ var init_users = __esm({
         // Last successful login timestamp
         // Used for: security auditing, dormant account detection
         lastLoginAt: utcTimestamp("last_login_at"),
-        ...timestamps2()
+        ...timestamps2(),
+        // Soft delete (deletedAt / deletedBy) — set when the account deletion purge job
+        // anonymizes the row (status -> 'deleted'). Hard-delete mode removes the row
+        // instead, so these stay null for that strategy.
+        ...softDelete()
       },
       (table) => [
-        // Database constraints
-        // Ensure at least one identifier exists (email OR phone)
-        check(
-          "email_or_phone_check",
-          sql`${table.email} IS NOT NULL OR ${table.phone} IS NOT NULL`
-        ),
         // Indexes for query optimization
         index2("users_public_id_idx").on(table.publicId),
         index2("users_email_idx").on(table.email),
@@ -4858,9 +4861,9 @@ var init_user_social_accounts = __esm({
 });
 
 // src/server/entities/verification-codes.ts
-import { text as text6, index as index6, integer as integer2, check as check2 } from "drizzle-orm/pg-core";
+import { text as text6, index as index6, integer as integer2, check } from "drizzle-orm/pg-core";
 import { id as id6, timestamps as timestamps5, enumText as enumText4, utcTimestamp as utcTimestamp4 } from "@spfn/core/db";
-import { sql as sql2 } from "drizzle-orm";
+import { sql } from "drizzle-orm";
 var verificationCodes;
 var init_verification_codes = __esm({
   "src/server/entities/verification-codes.ts"() {
@@ -4900,7 +4903,7 @@ var init_verification_codes = __esm({
       (table) => [
         // Database constraints
         // Limit verification attempts to prevent brute force attacks
-        check2("attempts_limit_check", sql2`${table.attempts} >= 0 AND ${table.attempts} <= 10`),
+        check("attempts_limit_check", sql`${table.attempts} >= 0 AND ${table.attempts} <= 10`),
         // Index for quick lookup by target and purpose
         index6("target_purpose_idx").on(table.target, table.purpose, table.expiresAt)
       ]
@@ -4980,6 +4983,59 @@ var init_user_invitations = __esm({
   }
 });
 
+// src/server/entities/account-deletion-requests.ts
+import { text as text8, index as index8, uniqueIndex as uniqueIndex2 } from "drizzle-orm/pg-core";
+import { sql as sql2 } from "drizzle-orm";
+import { id as id8, timestamps as timestamps7, enumText as enumText6, utcTimestamp as utcTimestamp6, optionalForeignKey } from "@spfn/core/db";
+var accountDeletionRequests;
+var init_account_deletion_requests = __esm({
+  "src/server/entities/account-deletion-requests.ts"() {
+    "use strict";
+    init_types();
+    init_users();
+    init_schema4();
+    accountDeletionRequests = authSchema.table(
+      "account_deletion_requests",
+      {
+        id: id8(),
+        // Foreign key to users table. `set null` (optionalForeignKey default) so this
+        // row survives a hard-delete purge of the user it refers to.
+        userId: optionalForeignKey("user", () => users.id),
+        // Snapshot of the user's public UUID at request time — stays readable even
+        // after userId is nulled out or the account is anonymized.
+        userPublicId: text8("user_public_id").notNull(),
+        // When the deletion was requested
+        requestedAt: utcTimestamp6("requested_at").notNull().defaultNow(),
+        // When the purge job is allowed to run (requestedAt + grace period; equals
+        // requestedAt itself for immediate/zero-grace deletions)
+        purgeScheduledAt: utcTimestamp6("purge_scheduled_at").notNull(),
+        // Request lifecycle status
+        // - pending: awaiting purgeScheduledAt (or immediate purge)
+        // - cancelled: recovered before purge
+        // - completed: purge ran
+        status: enumText6("status", ACCOUNT_DELETION_REQUEST_STATUSES).default("pending").notNull(),
+        // Who initiated the request
+        requestedBy: enumText6("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
+        // Optional free-text reason (self-service UI, admin note, DSR reference, ...)
+        reason: text8("reason"),
+        cancelledAt: utcTimestamp6("cancelled_at"),
+        completedAt: utcTimestamp6("completed_at"),
+        // Purge strategy actually executed (set on completion; null while pending)
+        purgeStrategy: enumText6("purge_strategy", PURGE_STRATEGIES),
+        ...timestamps7()
+      },
+      (table) => [
+        index8("account_deletion_requests_user_id_idx").on(table.userId),
+        index8("account_deletion_requests_status_idx").on(table.status),
+        index8("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
+        index8("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
+        // Partial unique index: at most one pending request per user at a time.
+        uniqueIndex2("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
+      ]
+    );
+  }
+});
+
 // src/server/rbac/types.ts
 var PERMISSION_CATEGORIES;
 var init_types2 = __esm({
@@ -5126,8 +5182,8 @@ var init_rbac = __esm({
 });
 
 // src/server/entities/permissions.ts
-import { text as text8, boolean as boolean4, index as index8 } from "drizzle-orm/pg-core";
-import { id as id8, timestamps as timestamps7, enumText as enumText6, typedJsonb as typedJsonb3 } from "@spfn/core/db";
+import { text as text9, boolean as boolean4, index as index9 } from "drizzle-orm/pg-core";
+import { id as id9, timestamps as timestamps8, enumText as enumText7, typedJsonb as typedJsonb3 } from "@spfn/core/db";
 var permissions;
 var init_permissions = __esm({
   "src/server/entities/permissions.ts"() {
@@ -5138,7 +5194,7 @@ var init_permissions = __esm({
       "permissions",
       {
         // Primary key
-        id: id8(),
+        id: id9(),
         // Permission identifier
         // Format: resource:action or namespace:resource:action
         // Examples:
@@ -5146,20 +5202,20 @@ var init_permissions = __esm({
         // - Namespaced: 'auth:user:delete', 'cms:post:publish'
         // Must be unique across all permissions
         // Used in: permission checks, role assignments, API guards
-        name: text8("name").notNull().unique(),
+        name: text9("name").notNull().unique(),
         // Display name for UI
         // Human-readable name shown in admin panels
         // Example: "Delete Users", "Publish Posts"
-        displayName: text8("display_name").notNull(),
+        displayName: text9("display_name").notNull(),
         // Permission description
         // Detailed explanation of what this permission allows
         // Example: "Allows deletion of user accounts from the system"
-        description: text8("description"),
+        description: text9("description"),
         // Category for grouping
         // Used for: organizing permissions in UI, filtering
         // Built-in categories: auth, user, rbac, system
         // Custom categories: any app-specific category
-        category: enumText6("category", PERMISSION_CATEGORIES),
+        category: enumText7("category", PERMISSION_CATEGORIES),
         // Built-in permission flag
         // true: Core package permissions (auth:*, user:*, rbac:*)
         //       - Cannot be deleted or modified
@@ -5190,22 +5246,22 @@ var init_permissions = __esm({
         // - Audit: { createdBy: 123, source: 'migration', version: '1.0.0' }
         // Example: { icon: 'trash', color: 'red', requiresMfa: true }
         metadata: typedJsonb3("metadata"),
-        ...timestamps7()
+        ...timestamps8()
       },
       (table) => [
-        index8("permissions_name_idx").on(table.name),
-        index8("permissions_category_idx").on(table.category),
-        index8("permissions_is_system_idx").on(table.isSystem),
-        index8("permissions_is_active_idx").on(table.isActive),
-        index8("permissions_is_builtin_idx").on(table.isBuiltin)
+        index9("permissions_name_idx").on(table.name),
+        index9("permissions_category_idx").on(table.category),
+        index9("permissions_is_system_idx").on(table.isSystem),
+        index9("permissions_is_active_idx").on(table.isActive),
+        index9("permissions_is_builtin_idx").on(table.isBuiltin)
       ]
     );
   }
 });
 
 // src/server/entities/role-permissions.ts
-import { index as index9, unique } from "drizzle-orm/pg-core";
-import { id as id9, timestamps as timestamps8, foreignKey as foreignKey6 } from "@spfn/core/db";
+import { index as index10, unique } from "drizzle-orm/pg-core";
+import { id as id10, timestamps as timestamps9, foreignKey as foreignKey6 } from "@spfn/core/db";
 var rolePermissions;
 var init_role_permissions = __esm({
   "src/server/entities/role-permissions.ts"() {
@@ -5217,7 +5273,7 @@ var init_role_permissions = __esm({
       "role_permissions",
       {
         // Primary key
-        id: id9(),
+        id: id10(),
         // Role reference
         // Foreign key to roles table
         // Cascade delete: when role is deleted, all role-permission mappings are removed
@@ -5230,12 +5286,12 @@ var init_role_permissions = __esm({
         // Used for: granting permissions to roles
         // Example: user:delete permission → [Admin, Superadmin]
         permissionId: foreignKey6("permission", () => permissions.id, { onDelete: "cascade" }),
-        ...timestamps8()
+        ...timestamps9()
       },
       (table) => [
         // Indexes for query performance
-        index9("role_permissions_role_id_idx").on(table.roleId),
-        index9("role_permissions_permission_id_idx").on(table.permissionId),
+        index10("role_permissions_role_id_idx").on(table.roleId),
+        index10("role_permissions_permission_id_idx").on(table.permissionId),
         // Unique constraint: one role-permission pair only
         unique("role_permissions_unique").on(table.roleId, table.permissionId)
       ]
@@ -5244,8 +5300,8 @@ var init_role_permissions = __esm({
 });
 
 // src/server/entities/user-permissions.ts
-import { boolean as boolean5, text as text9, index as index10, unique as unique2 } from "drizzle-orm/pg-core";
-import { id as id10, timestamps as timestamps9, utcTimestamp as utcTimestamp6, foreignKey as foreignKey7 } from "@spfn/core/db";
+import { boolean as boolean5, text as text10, index as index11, unique as unique2 } from "drizzle-orm/pg-core";
+import { id as id11, timestamps as timestamps10, utcTimestamp as utcTimestamp7, foreignKey as foreignKey7 } from "@spfn/core/db";
 var userPermissions;
 var init_user_permissions = __esm({
   "src/server/entities/user-permissions.ts"() {
@@ -5257,7 +5313,7 @@ var init_user_permissions = __esm({
       "user_permissions",
       {
         // Primary key
-        id: id10(),
+        id: id11(),
         // User reference
         // Foreign key to users table
         // Cascade delete: when user is deleted, all overrides are removed
@@ -5280,19 +5336,19 @@ var init_user_permissions = __esm({
         // Reason for grant/revocation
         // Used for: audit trail, compliance documentation
         // Example: "Temporary access for project X", "Security incident - restricted"
-        reason: text9("reason"),
+        reason: text10("reason"),
         // Expiration timestamp (optional)
         // null: Permanent override (remains until manually removed)
         // timestamp: Permission expires at this time (auto-revoked by background job)
         // Use case: Time-limited elevated access, temporary restrictions
-        expiresAt: utcTimestamp6("expires_at"),
-        ...timestamps9()
+        expiresAt: utcTimestamp7("expires_at"),
+        ...timestamps10()
       },
       (table) => [
         // Indexes for query performance
-        index10("user_permissions_user_id_idx").on(table.userId),
-        index10("user_permissions_permission_id_idx").on(table.permissionId),
-        index10("user_permissions_expires_at_idx").on(table.expiresAt),
+        index11("user_permissions_user_id_idx").on(table.userId),
+        index11("user_permissions_permission_id_idx").on(table.permissionId),
+        index11("user_permissions_expires_at_idx").on(table.expiresAt),
         // Unique constraint: one user-permission pair only
         unique2("user_permissions_unique").on(table.userId, table.permissionId)
       ]
@@ -5301,7 +5357,7 @@ var init_user_permissions = __esm({
 });
 
 // src/server/entities/auth-metadata.ts
-import { text as text10, timestamp } from "drizzle-orm/pg-core";
+import { text as text11, timestamp } from "drizzle-orm/pg-core";
 var authMetadata;
 var init_auth_metadata = __esm({
   "src/server/entities/auth-metadata.ts"() {
@@ -5311,9 +5367,9 @@ var init_auth_metadata = __esm({
       "auth_metadata",
       {
         // Metadata key (primary key)
-        key: text10("key").primaryKey(),
+        key: text11("key").primaryKey(),
         // Metadata value
-        value: text10("value").notNull(),
+        value: text11("value").notNull(),
         // Last updated timestamp
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
       }
@@ -5332,6 +5388,7 @@ var init_entities = __esm({
     init_user_social_accounts();
     init_verification_codes();
     init_user_invitations();
+    init_account_deletion_requests();
     init_roles();
     init_permissions();
     init_role_permissions();
@@ -5354,8 +5411,19 @@ var init_users_repository = __esm({
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id11) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id11)).limit(1);
+      async findById(id12) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id12)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * ID로 사용자 조회 — Write primary에서 직접 읽는다.
+       *
+       * 복제 지연 창에서 status 전이(예: 삭제 요청으로 pending_deletion 전환)를 놓치면
+       * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
+       * 계속 사용할 것.
+       */
+      async findByIdOnPrimary(id12) {
+        const result = await this.db.select().from(users).where(eq(users.id, id12)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5408,13 +5476,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id11) {
+      async findByIdWithRole(id12) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id11)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id12)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -5439,15 +5507,33 @@ var init_users_repository = __esm({
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id11, data) {
-        const result = await this.db.update(users).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(users.id, id11)).returning();
+      async updateById(id12, data) {
+        const result = await this.db.update(users).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(users.id, id12)).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * 계정 삭제 취소(복구) — `WHERE status = 'pending_deletion'` 조건부 UPDATE.
+       *
+       * cancelAccountDeletionService가 account_deletion_requests claim(조건부
+       * markCancelled)에 성공한 **이후에만** 호출한다. 그 claim이 이미 purge와의
+       * 경합을 해결하므로 이 조건은 방어적 이중 안전장치 — 0 row 매치(= 이미
+       * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
+       * Write primary 사용
+       */
+      async reactivateFromPendingDeletion(id12) {
+        const result = await this.db.update(users).set({ status: "active", updatedAt: /* @__PURE__ */ new Date() }).where(
+          and(
+            eq(users.id, id12),
+            eq(users.status, "pending_deletion")
+          )
+        ).returning();
         return result[0] ?? null;
       }
       /**
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id11, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id12, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash,
           updatedAt: /* @__PURE__ */ new Date()
@@ -5455,26 +5541,26 @@ var init_users_repository = __esm({
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id11)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id11) {
+      async updateLastLogin(id12) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date(),
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id11)).returning();
+        }).where(eq(users.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id11) {
-        const result = await this.db.delete(users).where(eq(users.id, id11)).returning();
+      async deleteById(id12) {
+        const result = await this.db.delete(users).where(eq(users.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5690,6 +5776,17 @@ var init_keys_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /**
+       * 사용자의 모든 공개키 삭제 (계정 익명화 파기용)
+       *
+       * hard-delete는 FK cascade로 자동 처리되지만, anonymize 모드는 users row를
+       * 남기므로 자식 row를 직접 지워야 한다.
+       * Write primary 사용
+       */
+      async deleteAllByUserId(userId) {
+        const result = await this.db.delete(userPublicKeys).where(eq2(userPublicKeys.userId, userId)).returning();
+        return result.length;
+      }
       /**
        * 마지막 사용 시간 업데이트
        * Write primary 사용
@@ -5727,12 +5824,12 @@ var init_keys_repository = __esm({
        * throttle lives in the WHERE clause — atomic, no read-then-write race. No
        * RETURNING (callers fire-and-forget and discard the row).
        */
-      async updateLastUsedById(id11) {
+      async updateLastUsedById(id12) {
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
         await this.db.update(userPublicKeys).set({
           lastUsedAt: /* @__PURE__ */ new Date()
         }).where(and2(
-          eq2(userPublicKeys.id, id11),
+          eq2(userPublicKeys.id, id12),
           or(
             isNull(userPublicKeys.lastUsedAt),
             lt(userPublicKeys.lastUsedAt, staleBefore)
@@ -5774,8 +5871,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id11) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id11)).limit(1);
+      async findById(id12) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id12)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5793,24 +5890,24 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id11) {
+      async markAsUsed(id12) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date(),
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id11)).returning();
+        }).where(eq3(verificationCodes.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id11) {
-        const code = await this.findById(id11);
+      async incrementAttempts(id12) {
+        const code = await this.findById(id12);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1,
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id11)).returning();
+        }).where(eq3(verificationCodes.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5822,6 +5919,17 @@ var init_verification_codes_repository = __esm({
         const result = await this.db.delete(verificationCodes).where(lt2(verificationCodes.expiresAt, now)).returning();
         return result.length;
       }
+      /**
+       * Target(email/phone)의 모든 인증 코드 삭제 (계정 파기용)
+       *
+       * verificationCodes는 userId FK가 없고 target 텍스트로만 연결되므로, 파기 시
+       * 원래 email/phone을 이 메서드로 직접 정리해야 한다.
+       * Write primary 사용
+       */
+      async deleteByTarget(target) {
+        const result = await this.db.delete(verificationCodes).where(eq3(verificationCodes.target, target)).returning();
+        return result.length;
+      }
       /**
        * Target의 모든 이전 코드 무효화 (새 코드 발급 시)
        * Write primary 사용
@@ -5856,8 +5964,8 @@ var init_roles_repository = __esm({
       /**
        * ID로 역할 조회
        */
-      async findById(id11) {
-        const result = await this.readDb.select().from(roles).where(eq4(roles.id, id11)).limit(1);
+      async findById(id12) {
+        const result = await this.readDb.select().from(roles).where(eq4(roles.id, id12)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5892,15 +6000,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id11, data) {
-        const result = await this.db.update(roles).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq4(roles.id, id11)).returning();
+      async updateById(id12, data) {
+        const result = await this.db.update(roles).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq4(roles.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id11) {
-        const result = await this.db.delete(roles).where(eq4(roles.id, id11)).returning();
+      async deleteById(id12) {
+        const result = await this.db.delete(roles).where(eq4(roles.id, id12)).returning();
         return result[0] ?? null;
       }
     };
@@ -5920,8 +6028,8 @@ var init_permissions_repository = __esm({
       /**
        * ID로 권한 조회
        */
-      async findById(id11) {
-        const result = await this.readDb.select().from(permissions).where(eq5(permissions.id, id11)).limit(1);
+      async findById(id12) {
+        const result = await this.readDb.select().from(permissions).where(eq5(permissions.id, id12)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5982,15 +6090,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id11, data) {
-        const result = await this.db.update(permissions).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq5(permissions.id, id11)).returning();
+      async updateById(id12, data) {
+        const result = await this.db.update(permissions).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq5(permissions.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id11) {
-        const result = await this.db.delete(permissions).where(eq5(permissions.id, id11)).returning();
+      async deleteById(id12) {
+        const result = await this.db.delete(permissions).where(eq5(permissions.id, id12)).returning();
         return result[0] ?? null;
       }
     };
@@ -6134,8 +6242,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id11, data) {
-        const result = await this.db.update(userPermissions).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq7(userPermissions.id, id11)).returning();
+      async updateById(id12, data) {
+        const result = await this.db.update(userPermissions).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq7(userPermissions.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6187,8 +6295,8 @@ var init_user_profiles_repository = __esm({
       /**
        * ID로 프로필 조회
        */
-      async findById(id11) {
-        const result = await this.readDb.select().from(userProfiles).where(eq8(userProfiles.id, id11)).limit(1);
+      async findById(id12) {
+        const result = await this.readDb.select().from(userProfiles).where(eq8(userProfiles.id, id12)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6218,8 +6326,8 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id11, data) {
-        const result = await this.db.update(userProfiles).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq8(userProfiles.id, id11)).returning();
+      async updateById(id12, data) {
+        const result = await this.db.update(userProfiles).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq8(userProfiles.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6232,8 +6340,8 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id11) {
-        const result = await this.db.delete(userProfiles).where(eq8(userProfiles.id, id11)).returning();
+      async deleteById(id12) {
+        const result = await this.db.delete(userProfiles).where(eq8(userProfiles.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6323,8 +6431,8 @@ var init_invitations_repository = __esm({
       /**
        * ID로 초대 조회
        */
-      async findById(id11) {
-        const result = await this.readDb.select().from(userInvitations).where(eq9(userInvitations.id, id11)).limit(1);
+      async findById(id12) {
+        const result = await this.readDb.select().from(userInvitations).where(eq9(userInvitations.id, id12)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6371,7 +6479,7 @@ var init_invitations_repository = __esm({
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id11, status, timestamp2) {
+      async updateStatus(id12, status, timestamp2) {
         const updates = {
           status,
           updatedAt: /* @__PURE__ */ new Date()
@@ -6383,14 +6491,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq9(userInvitations.id, id11)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq9(userInvitations.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id11) {
-        const result = await this.db.delete(userInvitations).where(eq9(userInvitations.id, id11)).returning();
+      async deleteById(id12) {
+        const result = await this.db.delete(userInvitations).where(eq9(userInvitations.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6488,35 +6596,35 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id11, data) {
+      async updateById(id12, data) {
         const result = await this.db.update(userInvitations).set({
           ...data,
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq9(userInvitations.id, id11)).returning();
+        }).where(eq9(userInvitations.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id11, newExpiresAt) {
+      async resend(id12, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt,
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq9(userInvitations.id, id11)).returning();
+        }).where(eq9(userInvitations.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id11, cancelledBy, reason, currentMetadata) {
+      async cancel(id12, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata,
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq9(userInvitations.id, id11)).returning();
+        }).where(eq9(userInvitations.id, id12)).returning();
         return result[0] ?? null;
       }
     };
@@ -6524,47 +6632,556 @@ var init_invitations_repository = __esm({
   }
 });
 
+// src/config/schema.ts
+import {
+  defineEnvSchema,
+  envString,
+  envNumber,
+  envBoolean,
+  createSecureSecretParser,
+  createPasswordParser as createPasswordParser2
+} from "@spfn/core/env";
+var authEnvSchema;
+var init_schema5 = __esm({
+  "src/config/schema.ts"() {
+    "use strict";
+    authEnvSchema = defineEnvSchema({
+      // ============================================================================
+      // Session Configuration
+      // ============================================================================
+      SPFN_AUTH_SESSION_SECRET: {
+        ...envString({
+          description: "Session encryption secret (minimum 32 characters for AES-256)",
+          required: true,
+          fallbackKeys: ["SESSION_SECRET"],
+          validator: createSecureSecretParser({
+            minLength: 32,
+            minUniqueChars: 16,
+            minEntropy: 3.5
+          }),
+          sensitive: true,
+          nextjs: true,
+          // Required for Next.js RSC session validation
+          examples: [
+            "my-super-secret-session-key-at-least-32-chars-long",
+            "use-a-cryptographically-secure-random-string-here"
+          ]
+        })
+      },
+      SPFN_AUTH_SESSION_TTL: {
+        ...envString({
+          description: "Session TTL (time to live) - supports duration strings like '7d', '12h', '45m'",
+          default: "7d",
+          required: false,
+          nextjs: true,
+          // May be needed for session validation in Next.js RSC
+          examples: ["7d", "30d", "12h", "45m", "3600"]
+        })
+      },
+      // ============================================================================
+      // JWT Configuration
+      // ============================================================================
+      SPFN_AUTH_JWT_SECRET: {
+        ...envString({
+          description: "JWT signing secret for server-signed tokens (legacy mode)",
+          default: "dev-secret-key-change-in-production",
+          required: false,
+          examples: [
+            "your-jwt-secret-key-here",
+            "use-different-from-session-secret"
+          ]
+        })
+      },
+      SPFN_AUTH_JWT_EXPIRES_IN: {
+        ...envString({
+          description: "JWT token expiration time (e.g., '7d', '24h', '1h')",
+          default: "7d",
+          required: false,
+          examples: ["7d", "24h", "1h", "30m"]
+        })
+      },
+      // ============================================================================
+      // Security Configuration
+      // ============================================================================
+      SPFN_AUTH_COOKIE_SECURE: {
+        ...envBoolean({
+          description: 'Override cookie Secure flag. Defaults to NODE_ENV === "production". Set to false for HTTP-only environments (e.g. bastion over plain HTTP).',
+          required: false,
+          nextjs: true,
+          examples: [true, false]
+        })
+      },
+      SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
+        ...envNumber({
+          description: "Bcrypt salt rounds (cost factor, higher = more secure but slower)",
+          default: 12,
+          required: false,
+          examples: [10, 12, 14]
+        }),
+        key: "SPFN_AUTH_BCRYPT_SALT_ROUNDS"
+      },
+      SPFN_AUTH_VERIFICATION_TOKEN_SECRET: {
+        ...envString({
+          description: "Verification token secret for email verification, password reset, etc.",
+          required: true,
+          examples: [
+            "your-verification-token-secret",
+            "can-be-different-from-jwt-secret"
+          ]
+        })
+      },
+      SPFN_AUTH_TOKEN_ENCRYPTION_KEYS: {
+        ...envString({
+          description: "Backend-only OAuth token encryption keyring. Comma-separated <keyId>:<base64-encoded 32-byte key> entries; the first key encrypts new values and remaining keys decrypt during rotation.",
+          required: false,
+          sensitive: true,
+          examples: [
+            "v2:<base64-encoded-32-byte-key>,v1:<previous-base64-encoded-32-byte-key>"
+          ]
+        })
+      },
+      // ============================================================================
+      // Admin Account Configuration
+      // ============================================================================
+      SPFN_AUTH_ADMIN_ACCOUNTS: {
+        ...envString({
+          description: "JSON array of admin accounts (recommended for multiple admins)",
+          required: false,
+          examples: [
+            '[{"email":"admin@example.com","password":"secure-pass","role":"admin"}]',
+            '[{"email":"super@example.com","password":"pass1","role":"superadmin"},{"email":"admin@example.com","password":"pass2","role":"admin"}]'
+          ]
+        })
+      },
+      SPFN_AUTH_ADMIN_EMAILS: {
+        ...envString({
+          description: "Comma-separated list of admin emails (legacy CSV format)",
+          required: false,
+          examples: [
+            "admin@example.com,user@example.com",
+            "super@example.com,admin@example.com,user@example.com"
+          ]
+        })
+      },
+      SPFN_AUTH_ADMIN_PASSWORDS: {
+        ...envString({
+          description: "Comma-separated list of admin passwords (legacy CSV format)",
+          required: false,
+          examples: [
+            "admin-pass,user-pass",
+            "super-pass,admin-pass,user-pass"
+          ]
+        })
+      },
+      SPFN_AUTH_ADMIN_ROLES: {
+        ...envString({
+          description: "Comma-separated list of admin roles (legacy CSV format)",
+          required: false,
+          examples: [
+            "admin,user",
+            "superadmin,admin,user"
+          ]
+        })
+      },
+      SPFN_AUTH_ADMIN_EMAIL: {
+        ...envString({
+          description: "Single admin email (simplest format)",
+          required: false,
+          examples: ["admin@example.com"]
+        })
+      },
+      SPFN_AUTH_ADMIN_PASSWORD: {
+        ...envString({
+          description: "Single admin password (simplest format)",
+          required: false,
+          validator: createPasswordParser2({
+            minLength: 8,
+            requireUppercase: true,
+            requireLowercase: true,
+            requireNumber: true,
+            requireSpecial: true
+          }),
+          sensitive: true,
+          examples: ["SecureAdmin123!"]
+        })
+      },
+      // ============================================================================
+      // Username Configuration
+      // ============================================================================
+      SPFN_AUTH_RESERVED_USERNAMES: {
+        ...envString({
+          description: "Comma-separated list of reserved usernames that cannot be registered",
+          required: false,
+          default: "admin,root,system,support,help,moderator,superadmin",
+          examples: [
+            "admin,root,system,support,help",
+            "admin,root,system,support,help,moderator,superadmin,operator"
+          ]
+        })
+      },
+      SPFN_AUTH_USERNAME_MIN_LENGTH: {
+        ...envNumber({
+          description: "Minimum username length",
+          default: 3,
+          required: false,
+          examples: [2, 3, 4]
+        })
+      },
+      SPFN_AUTH_USERNAME_MAX_LENGTH: {
+        ...envNumber({
+          description: "Maximum username length",
+          default: 30,
+          required: false,
+          examples: [20, 30, 50]
+        })
+      },
+      // ============================================================================
+      // API Configuration
+      // ============================================================================
+      SPFN_API_URL: {
+        ...envString({
+          description: "Internal API URL for server-to-server communication",
+          default: "http://localhost:8790",
+          required: false,
+          examples: [
+            "https://api.example.com",
+            "http://localhost:8790"
+          ]
+        })
+      },
+      NEXT_PUBLIC_SPFN_API_URL: {
+        ...envString({
+          description: "Public-facing API URL used for browser-facing redirects. Falls back to SPFN_API_URL if not set.",
+          required: false,
+          examples: [
+            "https://api.example.com",
+            "http://localhost:8790"
+          ]
+        })
+      },
+      SPFN_APP_URL: {
+        ...envString({
+          description: "Next.js application URL (internal). Used for server-to-server communication.",
+          default: "http://localhost:3000",
+          required: false,
+          examples: [
+            "https://app.example.com",
+            "http://localhost:3000"
+          ]
+        })
+      },
+      NEXT_PUBLIC_SPFN_APP_URL: {
+        ...envString({
+          description: "Public-facing Next.js app URL for browser redirects (e.g. OAuth redirect). Falls back to SPFN_APP_URL if not set.",
+          required: false,
+          examples: [
+            "https://app.example.com",
+            "http://localhost:3000"
+          ]
+        })
+      },
+      // ============================================================================
+      // OAuth Configuration - Google
+      // ============================================================================
+      SPFN_AUTH_GOOGLE_CLIENT_ID: {
+        ...envString({
+          description: "Google OAuth 2.0 Client ID. When set, Google OAuth routes are automatically enabled.",
+          required: false,
+          examples: ["123456789-abc123.apps.googleusercontent.com"]
+        })
+      },
+      SPFN_AUTH_GOOGLE_CLIENT_SECRET: {
+        ...envString({
+          description: "Google OAuth 2.0 Client Secret",
+          required: false,
+          sensitive: true,
+          examples: ["GOCSPX-abcdefghijklmnop"]
+        })
+      },
+      SPFN_AUTH_GOOGLE_SCOPES: {
+        ...envString({
+          description: 'Comma-separated Google OAuth scopes. Defaults to "email,profile" if not set.',
+          required: false,
+          examples: [
+            "email,profile",
+            "email,profile,https://www.googleapis.com/auth/gmail.readonly",
+            "email,profile,https://www.googleapis.com/auth/calendar.readonly"
+          ]
+        })
+      },
+      SPFN_AUTH_GOOGLE_REDIRECT_URI: {
+        ...envString({
+          description: "Google OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/google/callback \u2014 the callback must return to the web app origin that set the oauth_csrf cookie (the app rewrites /_auth/:path* to the API). Set this explicitly only when the callback should hit a different host (e.g. the API host for the direct oauthStart flow).",
+          required: false,
+          examples: [
+            "https://app.example.com/_auth/oauth/google/callback",
+            "http://localhost:3000/_auth/oauth/google/callback"
+          ]
+        })
+      },
+      // ============================================================================
+      // OAuth Configuration - Kakao
+      // ============================================================================
+      SPFN_AUTH_KAKAO_CLIENT_ID: {
+        ...envString({
+          description: "Kakao Login REST API key. Used as the OAuth client_id.",
+          required: false,
+          examples: ["your-kakao-rest-api-key"]
+        })
+      },
+      SPFN_AUTH_KAKAO_CLIENT_SECRET: {
+        ...envString({
+          description: "Kakao Login client secret. Required when the Kakao client-secret feature is enabled.",
+          required: false,
+          sensitive: true,
+          examples: ["your-kakao-client-secret"]
+        })
+      },
+      SPFN_AUTH_KAKAO_SCOPES: {
+        ...envString({
+          description: "Comma-separated Kakao consent scopes. Defaults to account_email.",
+          required: false,
+          examples: ["account_email"]
+        })
+      },
+      SPFN_AUTH_KAKAO_REDIRECT_URI: {
+        ...envString({
+          description: "Kakao OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/kakao/callback.",
+          required: false,
+          examples: ["https://app.example.com/_auth/oauth/kakao/callback"]
+        })
+      },
+      // ============================================================================
+      // OAuth Configuration - Naver
+      // ============================================================================
+      SPFN_AUTH_NAVER_CLIENT_ID: {
+        ...envString({
+          description: "Naver Login OAuth client ID.",
+          required: false,
+          examples: ["your-naver-client-id"]
+        })
+      },
+      SPFN_AUTH_NAVER_CLIENT_SECRET: {
+        ...envString({
+          description: "Naver Login OAuth client secret.",
+          required: false,
+          sensitive: true,
+          examples: ["your-naver-client-secret"]
+        })
+      },
+      SPFN_AUTH_NAVER_REDIRECT_URI: {
+        ...envString({
+          description: "Naver OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/naver/callback.",
+          required: false,
+          examples: ["https://app.example.com/_auth/oauth/naver/callback"]
+        })
+      },
+      // ============================================================================
+      // Native Social Login (mobile/web id_token verification)
+      //
+      // 네이티브 SDK가 받은 id_token을 서버가 JWKS로 검증하는 경로 전용 설정.
+      // authorization code 교환을 하지 않으므로 client secret이 필요 없다.
+      // audience(aud)로 허용할 client id 목록만 지정한다.
+      // ============================================================================
+      SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS: {
+        ...envString({
+          description: "Comma-separated Google client IDs accepted as id_token audience for native sign-in (iOS, Android, web). When set, Google native sign-in is enabled. SPFN_AUTH_GOOGLE_CLIENT_ID is also accepted automatically.",
+          required: false,
+          examples: [
+            "123-ios.apps.googleusercontent.com,123-android.apps.googleusercontent.com"
+          ]
+        })
+      },
+      SPFN_AUTH_APPLE_CLIENT_IDS: {
+        ...envString({
+          description: "Comma-separated Apple client IDs accepted as id_token audience for native sign-in (iOS bundle ID, web/Android Services ID). When set, Apple native sign-in is enabled.",
+          required: false,
+          examples: [
+            "com.example.app,com.example.app.service"
+          ]
+        })
+      },
+      SPFN_AUTH_OAUTH_SUCCESS_URL: {
+        ...envString({
+          description: "OAuth callback page URL. This page should use OAuthCallback component to finalize session.",
+          required: false,
+          default: "/auth/callback",
+          examples: [
+            "/auth/callback",
+            "https://app.example.com/auth/callback"
+          ]
+        })
+      },
+      SPFN_AUTH_OAUTH_ERROR_URL: {
+        ...envString({
+          description: "URL to redirect after OAuth error. Use {error} placeholder for error message.",
+          required: false,
+          default: "/auth/error?error={error}",
+          examples: [
+            "https://app.example.com/auth/error?error={error}",
+            "http://localhost:3000/auth/error?error={error}"
+          ]
+        })
+      }
+    });
+  }
+});
+
+// src/config/index.ts
+import { createEnvRegistry } from "@spfn/core/env";
+var registry, env3;
+var init_config = __esm({
+  "src/config/index.ts"() {
+    "use strict";
+    init_schema5();
+    init_schema5();
+    registry = createEnvRegistry(authEnvSchema);
+    env3 = registry.validate();
+  }
+});
+
 // src/server/lib/oauth/token-cipher.ts
 import crypto3 from "crypto";
-import { env as env3 } from "@spfn/auth/config";
-function getTokenKey() {
-  return crypto3.createHash("sha256").update(`social-token:${env3.SPFN_AUTH_SESSION_SECRET}`).digest();
+function getTokenKeys() {
+  const raw = env3.SPFN_AUTH_TOKEN_ENCRYPTION_KEYS;
+  if (!raw) {
+    return [];
+  }
+  const keys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of raw.split(",")) {
+    const trimmed = entry.trim();
+    const separator = trimmed.indexOf(":");
+    if (separator <= 0 || separator === trimmed.length - 1) {
+      throw new Error("Invalid SPFN_AUTH_TOKEN_ENCRYPTION_KEYS entry; expected <keyId>:<base64-key>");
+    }
+    const keyId = trimmed.slice(0, separator);
+    const encoded = trimmed.slice(separator + 1);
+    if (!KEY_ID_PATTERN.test(keyId)) {
+      throw new Error("Invalid token encryption key ID; use 1-64 letters, digits, dot, underscore, or hyphen");
+    }
+    if (seen.has(keyId)) {
+      throw new Error("Duplicate token encryption key ID");
+    }
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 !== 0) {
+      throw new Error("Invalid token encryption key encoding; expected canonical base64");
+    }
+    const key = Buffer.from(encoded, "base64");
+    if (key.length !== KEY_BYTES || key.toString("base64") !== encoded) {
+      throw new Error("Invalid token encryption key length; expected exactly 32 bytes");
+    }
+    seen.add(keyId);
+    keys.push({ keyId, key });
+  }
+  return keys;
 }
-function isEncrypted(value) {
-  return value.startsWith(ENC_PREFIX);
-}
-function encryptToken(plain) {
-  if (isEncrypted(plain)) {
-    return plain;
-  }
-  const iv = crypto3.randomBytes(IV_BYTES);
-  const cipher = crypto3.createCipheriv("aes-256-gcm", getTokenKey(), iv);
-  const ciphertext = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return ENC_PREFIX + Buffer.concat([iv, tag, ciphertext]).toString("base64");
-}
-function decryptToken(stored) {
-  if (!isEncrypted(stored)) {
-    return stored;
-  }
-  const packed = Buffer.from(stored.slice(ENC_PREFIX.length), "base64");
-  if (packed.length < IV_BYTES + TAG_BYTES) {
-    throw new Error("Malformed encrypted token: payload too short");
-  }
-  const iv = packed.subarray(0, IV_BYTES);
-  const tag = packed.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
-  const ciphertext = packed.subarray(IV_BYTES + TAG_BYTES);
-  const decipher = crypto3.createDecipheriv("aes-256-gcm", getTokenKey(), iv);
+function requireTokenKeys() {
+  const keys = getTokenKeys();
+  if (keys.length === 0) {
+    throw new Error(
+      "OAuth token encryption is not configured. Set SPFN_AUTH_TOKEN_ENCRYPTION_KEYS in .env.server."
+    );
+  }
+  return keys;
+}
+function getAad(context) {
+  return Buffer.from([
+    "spfn-auth-social-token:v2",
+    context.provider,
+    context.providerUserId,
+    context.tokenType
+  ].join("\0"), "utf8");
+}
+function unpackCiphertext(payload, encoding) {
+  const packed = Buffer.from(payload, encoding);
+  if (packed.length <= IV_BYTES + TAG_BYTES) {
+    throw new Error("Malformed encrypted token payload");
+  }
+  return {
+    iv: packed.subarray(0, IV_BYTES),
+    tag: packed.subarray(IV_BYTES, IV_BYTES + TAG_BYTES),
+    ciphertext: packed.subarray(IV_BYTES + TAG_BYTES)
+  };
+}
+function decryptAesGcm(payload, encoding, key, aad) {
+  const { iv, tag, ciphertext } = unpackCiphertext(payload, encoding);
+  const decipher = crypto3.createDecipheriv("aes-256-gcm", key, iv);
+  if (aad) {
+    decipher.setAAD(aad);
+  }
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
-var ENC_PREFIX, IV_BYTES, TAG_BYTES;
+function getLegacyV1Key() {
+  return crypto3.createHash("sha256").update(`social-token:${env3.SPFN_AUTH_SESSION_SECRET}`).digest();
+}
+function configureOAuthTokenCipher(cipher) {
+  configuredCipher = cipher;
+}
+function encryptToken(value, context) {
+  return configuredCipher.encrypt(value, context);
+}
+function decryptToken(value, context) {
+  return configuredCipher.decrypt(value, context);
+}
+function isEncrypted(value) {
+  return value.startsWith(ENCRYPTED_PREFIX);
+}
+var V1_PREFIX, V2_PREFIX, ENCRYPTED_PREFIX, IV_BYTES, TAG_BYTES, KEY_BYTES, KEY_ID_PATTERN, EnvironmentKeyringTokenCipher, configuredCipher;
 var init_token_cipher = __esm({
   "src/server/lib/oauth/token-cipher.ts"() {
     "use strict";
-    ENC_PREFIX = "enc:v1:";
+    init_config();
+    V1_PREFIX = "enc:v1:";
+    V2_PREFIX = "enc:v2:";
+    ENCRYPTED_PREFIX = "enc:";
     IV_BYTES = 12;
     TAG_BYTES = 16;
+    KEY_BYTES = 32;
+    KEY_ID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+    EnvironmentKeyringTokenCipher = class {
+      async encrypt(value, context) {
+        const activeKey = requireTokenKeys()[0];
+        const iv = crypto3.randomBytes(IV_BYTES);
+        const cipher = crypto3.createCipheriv("aes-256-gcm", activeKey.key, iv);
+        cipher.setAAD(getAad(context));
+        const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const payload = Buffer.concat([iv, tag, ciphertext]).toString("base64url");
+        return `${V2_PREFIX}${activeKey.keyId}:${payload}`;
+      }
+      async decrypt(value, context) {
+        if (value.startsWith(V2_PREFIX)) {
+          const remainder = value.slice(V2_PREFIX.length);
+          const separator = remainder.indexOf(":");
+          if (separator <= 0 || separator === remainder.length - 1) {
+            throw new Error("Malformed v2 encrypted token");
+          }
+          const keyId = remainder.slice(0, separator);
+          const payload = remainder.slice(separator + 1);
+          const keys = requireTokenKeys();
+          const selected = keys.find((key) => key.keyId === keyId);
+          if (!selected) {
+            throw new Error("Encrypted token references an unavailable key ID");
+          }
+          return {
+            value: decryptAesGcm(payload, "base64url", selected.key, getAad(context)),
+            needsRotation: selected.keyId !== keys[0].keyId
+          };
+        }
+        if (value.startsWith(V1_PREFIX)) {
+          return {
+            value: decryptAesGcm(value.slice(V1_PREFIX.length), "base64", getLegacyV1Key()),
+            needsRotation: true
+          };
+        }
+        if (value.startsWith(ENCRYPTED_PREFIX)) {
+          throw new Error("Unsupported encrypted token version");
+        }
+        return { value, needsRotation: true };
+      }
+    };
+    configuredCipher = new EnvironmentKeyringTokenCipher();
   }
 });
 
@@ -6589,23 +7206,34 @@ var init_social_accounts_repository = __esm({
         if (!account) {
           return account;
         }
+        const context = (tokenType) => ({
+          provider: account.provider,
+          providerUserId: account.providerUserId,
+          tokenType
+        });
+        const access = account.accessToken ? await decryptToken(account.accessToken, context("access")) : null;
+        const refresh = account.refreshToken ? await decryptToken(account.refreshToken, context("refresh")) : null;
         const heal = {};
-        if (account.accessToken && !isEncrypted(account.accessToken)) {
-          heal.accessToken = encryptToken(account.accessToken);
-        }
-        if (account.refreshToken && !isEncrypted(account.refreshToken)) {
-          heal.refreshToken = encryptToken(account.refreshToken);
-        }
-        if (heal.accessToken || heal.refreshToken) {
+        if (access?.needsRotation || refresh?.needsRotation) {
           try {
-            await this.db.update(userSocialAccounts).set(heal).where(eq10(userSocialAccounts.id, account.id));
+            if (access?.needsRotation) {
+              heal.accessToken = await encryptToken(access.value, context("access"));
+            }
+            if (refresh?.needsRotation) {
+              heal.refreshToken = await encryptToken(refresh.value, context("refresh"));
+            }
+            await this.db.update(userSocialAccounts).set(heal).where(and7(
+              eq10(userSocialAccounts.id, account.id),
+              access?.needsRotation && account.accessToken !== null ? eq10(userSocialAccounts.accessToken, account.accessToken) : void 0,
+              refresh?.needsRotation && account.refreshToken !== null ? eq10(userSocialAccounts.refreshToken, account.refreshToken) : void 0
+            ));
           } catch {
           }
         }
         return {
           ...account,
-          accessToken: account.accessToken ? decryptToken(account.accessToken) : account.accessToken,
-          refreshToken: account.refreshToken ? decryptToken(account.refreshToken) : account.refreshToken
+          accessToken: access?.value ?? account.accessToken,
+          refreshToken: refresh?.value ?? account.refreshToken
         };
       }
       /**
@@ -6647,10 +7275,15 @@ var init_social_accounts_repository = __esm({
        * Write primary 사용
        */
       async create(data) {
+        const context = (tokenType) => ({
+          provider: data.provider,
+          providerUserId: data.providerUserId,
+          tokenType
+        });
         const created = await this._create(userSocialAccounts, {
           ...data,
-          accessToken: data.accessToken ? encryptToken(data.accessToken) : data.accessToken,
-          refreshToken: data.refreshToken ? encryptToken(data.refreshToken) : data.refreshToken,
+          accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
+          refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken,
           createdAt: /* @__PURE__ */ new Date(),
           updatedAt: /* @__PURE__ */ new Date()
         });
@@ -6660,21 +7293,34 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id11, data) {
+      async updateTokens(id12, data) {
+        const accounts = await this.db.select({
+          provider: userSocialAccounts.provider,
+          providerUserId: userSocialAccounts.providerUserId
+        }).from(userSocialAccounts).where(eq10(userSocialAccounts.id, id12)).limit(1);
+        const account = accounts[0];
+        if (!account) {
+          return null;
+        }
+        const context = (tokenType) => ({
+          provider: account.provider,
+          providerUserId: account.providerUserId,
+          tokenType
+        });
         const result = await this.db.update(userSocialAccounts).set({
           ...data,
-          accessToken: data.accessToken ? encryptToken(data.accessToken) : data.accessToken,
-          refreshToken: data.refreshToken ? encryptToken(data.refreshToken) : data.refreshToken,
+          accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
+          refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken,
           updatedAt: /* @__PURE__ */ new Date()
-        }).where(eq10(userSocialAccounts.id, id11)).returning();
+        }).where(eq10(userSocialAccounts.id, id12)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id11) {
-        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.id, id11)).returning();
+      async deleteById(id12) {
+        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.id, id12)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6690,6 +7336,17 @@ var init_social_accounts_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /**
+       * 사용자의 모든 소셜 계정 삭제 (계정 익명화 파기용)
+       *
+       * provider unique index(provider, providerUserId)를 해제해 같은 소셜 계정으로
+       * 재가입할 수 있게 한다.
+       * Write primary 사용
+       */
+      async deleteAllByUserId(userId) {
+        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.userId, userId)).returning();
+        return result.length;
+      }
     };
     socialAccountsRepository = new SocialAccountsRepository();
   }
@@ -6732,6 +7389,125 @@ var init_auth_metadata_repository = __esm({
   }
 });
 
+// src/server/repositories/account-deletion-requests.repository.ts
+import { eq as eq12, and as and8, lte } from "drizzle-orm";
+import { BaseRepository as BaseRepository12 } from "@spfn/core/db";
+var AccountDeletionRequestsRepository, accountDeletionRequestsRepository;
+var init_account_deletion_requests_repository = __esm({
+  "src/server/repositories/account-deletion-requests.repository.ts"() {
+    "use strict";
+    init_account_deletion_requests();
+    AccountDeletionRequestsRepository = class extends BaseRepository12 {
+      /**
+       * ID로 요청 조회
+       * Read replica 사용
+       */
+      async findById(id12) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq12(accountDeletionRequests.id, id12)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * User ID로 pending 요청 조회 (유저당 최대 1건, partial unique index로 보장)
+       * Read replica 사용
+       */
+      async findPendingByUserId(userId) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(
+          and8(
+            eq12(accountDeletionRequests.userId, userId),
+            eq12(accountDeletionRequests.status, "pending")
+          )
+        ).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * User ID로 pending 요청 조회 — Write primary에서 직접 읽는다.
+       *
+       * 로그인/OAuth/authenticate 게이트가 pending_deletion 유저의 purgeScheduledAt을
+       * 표시하는 데 쓴다. 이 경로들은 복제 지연이 있으면 방금 커밋된 상태 전이를 놓칠 수
+       * 있어(예: 삭제 요청 직후 OAuth 로그인 시도), replica가 아닌 primary에서 읽는다.
+       */
+      async findPendingByUserIdOnPrimary(userId) {
+        const result = await this.db.select().from(accountDeletionRequests).where(
+          and8(
+            eq12(accountDeletionRequests.userId, userId),
+            eq12(accountDeletionRequests.status, "pending")
+          )
+        ).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * 파기 스윕 대상 조회 — status='pending' AND purgeScheduledAt <= now
+       * Read replica 사용
+       */
+      async findDueForPurge(now) {
+        return this.readDb.select().from(accountDeletionRequests).where(
+          and8(
+            eq12(accountDeletionRequests.status, "pending"),
+            lte(accountDeletionRequests.purgeScheduledAt, now)
+          )
+        );
+      }
+      /**
+       * 요청 생성
+       * Write primary 사용
+       */
+      async create(data) {
+        return await this._create(accountDeletionRequests, {
+          ...data,
+          createdAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+      }
+      /**
+       * 요청 취소 (복구)
+       *
+       * `WHERE status = 'pending'` 조건부 UPDATE — 이미 completed(파기 완료)된 row를
+       * 뒤늦게 도착한 cancel이 덮어쓰지 않도록 한다. 0 row 매치(= 이미 completed거나
+       * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
+       * Write primary 사용
+       */
+      async markCancelled(id12) {
+        const result = await this.db.update(accountDeletionRequests).set({
+          status: "cancelled",
+          cancelledAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        }).where(
+          and8(
+            eq12(accountDeletionRequests.id, id12),
+            eq12(accountDeletionRequests.status, "pending")
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * 요청 완료 처리 (파기 실행 직전에 호출하는 "claim" — 파기 실행 후가 아니다)
+       *
+       * `WHERE status = 'pending'` 조건부 UPDATE. Postgres UPDATE는 매치되는 row에 락을
+       * 걸고 최신 커밋 상태로 WHERE를 재평가하므로, 이 호출 하나로 (1) 동시에 취소된
+       * row를 안전하게 걸러내고 (2) row-level 락으로 동시 파기 시도를 직렬화한다.
+       * 0 row 매치(= 이미 취소되었거나 다른 파기가 먼저 처리함) 시 null을 반환 — 호출자는
+       * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
+       * Write primary 사용
+       */
+      async markCompleted(id12, purgeStrategy) {
+        const result = await this.db.update(accountDeletionRequests).set({
+          status: "completed",
+          completedAt: /* @__PURE__ */ new Date(),
+          purgeStrategy,
+          updatedAt: /* @__PURE__ */ new Date()
+        }).where(
+          and8(
+            eq12(accountDeletionRequests.id, id12),
+            eq12(accountDeletionRequests.status, "pending")
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+    };
+    accountDeletionRequestsRepository = new AccountDeletionRequestsRepository();
+  }
+});
+
 // src/server/repositories/index.ts
 var init_repositories = __esm({
   "src/server/repositories/index.ts"() {
@@ -6747,6 +7523,7 @@ var init_repositories = __esm({
     init_invitations_repository();
     init_social_accounts_repository();
     init_auth_metadata_repository();
+    init_account_deletion_requests_repository();
   }
 });
 
@@ -6838,7 +7615,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id11) => Number(id11));
+  const permissionIdNums = permissionIds.map((id12) => Number(id12));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -6858,7 +7635,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id11) => permissionsRepository.findById(id11))
+    permissionIds.map((id12) => permissionsRepository.findById(id12))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -6873,7 +7650,7 @@ var init_role_service = __esm({
 import "@spfn/auth/config";
 
 // src/server/routes/index.ts
-import { defineRouter as defineRouter5 } from "@spfn/core/route";
+import { defineRouter as defineRouter6 } from "@spfn/core/route";
 
 // src/server/routes/auth/index.ts
 init_schema3();
@@ -6897,6 +7674,13 @@ async function verifyPassword(password, hash2) {
   }
   return bcrypt.verify(password, hash2);
 }
+var dummyHashPromise = null;
+function getDummyPasswordHash() {
+  if (!dummyHashPromise) {
+    dummyHashPromise = hashPassword("spfn-nonexistent-account-timing-equalizer");
+  }
+  return dummyHashPromise;
+}
 var passwordValidator = createPasswordParser({
   minLength: 8,
   requireUppercase: true,
@@ -7049,19 +7833,103 @@ init_types();
 
 // src/server/services/auth.service.ts
 init_repositories();
-import { ValidationError as ValidationError2 } from "@spfn/core/errors";
+import { ValidationError as ValidationError3 } from "@spfn/core/errors";
 import {
-  InvalidCredentialsError,
+  InvalidCredentialsError as InvalidCredentialsError2,
   AccountDisabledError,
+  AccountPendingDeletionError,
   AccountAlreadyExistsError,
-  InvalidVerificationTokenError,
-  VerificationTokenPurposeMismatchError,
-  VerificationTokenTargetMismatchError
+  InvalidVerificationTokenError as InvalidVerificationTokenError2,
+  VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError2,
+  VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError2
 } from "@spfn/auth/errors";
 
+// src/server/lib/config.ts
+import { env as env4 } from "@spfn/auth/config";
+function getCookieSuffix() {
+  const port = process.env.PORT;
+  return port ? `_${port}` : "";
+}
+var COOKIE_NAMES = {
+  /** Encrypted session data (userId, privateKey, keyId, algorithm) */
+  get SESSION() {
+    return `spfn_session${getCookieSuffix()}`;
+  },
+  /** Current key ID (for key rotation) */
+  get SESSION_KEY_ID() {
+    return `spfn_session_key_id${getCookieSuffix()}`;
+  },
+  /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
+  get OAUTH_PENDING() {
+    return `spfn_oauth_pending${getCookieSuffix()}`;
+  },
+  /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+  get OAUTH_CSRF() {
+    return `spfn_oauth_csrf${getCookieSuffix()}`;
+  }
+};
+function matchOAuthCsrfCookies(cookies) {
+  return Object.entries(cookies).filter(([name]) => /^spfn_oauth_csrf(_\d+)?$/.test(name)).map(([name, value]) => ({ name, value }));
+}
+function parseDuration(duration) {
+  if (typeof duration === "number") {
+    return duration;
+  }
+  const match = duration.match(/^(\d+)([dhms]?)$/);
+  if (!match) {
+    throw new Error(`Invalid duration format: ${duration}. Use format like '30d', '12h', '45m', '3600s', or plain number.`);
+  }
+  const value = parseInt(match[1], 10);
+  const unit = match[2] || "s";
+  switch (unit) {
+    case "d":
+      return value * 24 * 60 * 60;
+    case "h":
+      return value * 60 * 60;
+    case "m":
+      return value * 60;
+    case "s":
+      return value;
+    default:
+      throw new Error(`Unknown duration unit: ${unit}`);
+  }
+}
+var globalConfig = {
+  sessionTtl: "7d"
+  // Default: 7 days
+};
+function configureAuth(config2) {
+  globalConfig = {
+    ...globalConfig,
+    ...config2
+  };
+}
+function getAuthConfig() {
+  return { ...globalConfig };
+}
+async function runBeforeRegister(context) {
+  const { beforeRegister } = globalConfig;
+  if (beforeRegister) {
+    await beforeRegister(context);
+  }
+}
+function getSessionTtl(override) {
+  if (override !== void 0) {
+    return parseDuration(override);
+  }
+  if (globalConfig.sessionTtl !== void 0) {
+    return parseDuration(globalConfig.sessionTtl);
+  }
+  const envTtl = env4.SPFN_AUTH_SESSION_TTL;
+  if (envTtl) {
+    return parseDuration(envTtl);
+  }
+  return 7 * 24 * 60 * 60;
+}
+
 // src/server/services/verification.service.ts
 import crypto4 from "crypto";
-import { env as env4 } from "@spfn/auth/config";
+import { env as env5 } from "@spfn/auth/config";
 import { InvalidVerificationCodeError } from "@spfn/auth/errors";
 import jwt2 from "jsonwebtoken";
 import { sendEmail, sendSMS } from "@spfn/notification/server";
@@ -7130,7 +7998,7 @@ async function markCodeAsUsed(codeId) {
   await verificationCodesRepository.markAsUsed(codeId);
 }
 function createVerificationToken(payload) {
-  return jwt2.sign(payload, env4.SPFN_AUTH_VERIFICATION_TOKEN_SECRET, {
+  return jwt2.sign(payload, env5.SPFN_AUTH_VERIFICATION_TOKEN_SECRET, {
     expiresIn: VERIFICATION_TOKEN_EXPIRY,
     issuer: "spfn-auth",
     audience: "spfn-client"
@@ -7138,7 +8006,7 @@ function createVerificationToken(payload) {
 }
 function validateVerificationToken(token) {
   try {
-    const decoded = jwt2.verify(token, env4.SPFN_AUTH_VERIFICATION_TOKEN_SECRET, {
+    const decoded = jwt2.verify(token, env5.SPFN_AUTH_VERIFICATION_TOKEN_SECRET, {
       issuer: "spfn-auth",
       audience: "spfn-client"
     });
@@ -7314,7 +8182,7 @@ async function revokeKeyService(params) {
 init_repositories();
 import { ValidationError } from "@spfn/core/errors";
 import { ReservedUsernameError, UsernameAlreadyTakenError } from "@spfn/auth/errors";
-import { env as env5 } from "@spfn/auth/config";
+import { env as env6 } from "@spfn/auth/config";
 async function getUserByIdService(userId) {
   return await usersRepository.findById(userId);
 }
@@ -7331,7 +8199,7 @@ async function updateUserService(userId, updates) {
   await usersRepository.updateById(userId, updates);
 }
 function getReservedUsernames() {
-  const raw = env5.SPFN_AUTH_RESERVED_USERNAMES ?? "";
+  const raw = env6.SPFN_AUTH_RESERVED_USERNAMES ?? "";
   if (!raw) {
     return /* @__PURE__ */ new Set();
   }
@@ -7343,8 +8211,8 @@ function isReservedUsername(username) {
   return getReservedUsernames().has(username.toLowerCase());
 }
 function validateUsernameLength(username) {
-  const min = env5.SPFN_AUTH_USERNAME_MIN_LENGTH ?? 3;
-  const max = env5.SPFN_AUTH_USERNAME_MAX_LENGTH ?? 30;
+  const min = env6.SPFN_AUTH_USERNAME_MIN_LENGTH ?? 3;
+  const max = env6.SPFN_AUTH_USERNAME_MAX_LENGTH ?? 30;
   if (username.length < min) {
     throw new ValidationError({
       message: `Username must be at least ${min} characters`,
@@ -7381,6 +8249,48 @@ async function updateUsernameService(userId, username) {
   return await usersRepository.updateById(userIdNum, { username });
 }
 
+// src/server/services/account-deletion.service.ts
+init_repositories();
+import { ValidationError as ValidationError2, NotFoundError as NotFoundError2 } from "@spfn/core/errors";
+import { runInTransaction, onAfterCommit } from "@spfn/core/db";
+import { sendEmail as sendEmail2 } from "@spfn/notification/server";
+import {
+  InvalidCredentialsError,
+  InvalidVerificationTokenError,
+  VerificationTokenPurposeMismatchError,
+  VerificationTokenTargetMismatchError,
+  DeletionAlreadyRequestedError,
+  DeletionNotRequestedError,
+  ImmediateDeletionNotAllowedError
+} from "@spfn/auth/errors";
+
+// src/server/lib/deletion-config.ts
+var DEFAULT_DELETION_GRACE_PERIOD_DAYS = 30;
+var DEFAULT_DELETION_PURGE_STRATEGY = "anonymize";
+var DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE = false;
+var DEFAULT_DELETION_PURGE_CRON = "0 4 * * *";
+var DEFAULT_DELETION_SEND_NOTIFICATIONS = true;
+var config = {
+  gracePeriodDays: DEFAULT_DELETION_GRACE_PERIOD_DAYS,
+  purgeStrategy: DEFAULT_DELETION_PURGE_STRATEGY,
+  allowSelfImmediate: DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE,
+  purgeCron: DEFAULT_DELETION_PURGE_CRON,
+  sendNotifications: DEFAULT_DELETION_SEND_NOTIFICATIONS
+};
+function configureDeletion(options) {
+  config = {
+    gracePeriodDays: options?.gracePeriodDays ?? DEFAULT_DELETION_GRACE_PERIOD_DAYS,
+    purgeStrategy: options?.purgeStrategy ?? DEFAULT_DELETION_PURGE_STRATEGY,
+    allowSelfImmediate: options?.allowSelfImmediate ?? DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE,
+    purgeCron: options?.purgeCron ?? DEFAULT_DELETION_PURGE_CRON,
+    sendNotifications: options?.sendNotifications ?? DEFAULT_DELETION_SEND_NOTIFICATIONS,
+    onBeforePurge: options?.onBeforePurge
+  };
+}
+function getDeletionConfig() {
+  return config;
+}
+
 // src/server/events/index.ts
 init_esm();
 init_types();
@@ -7433,37 +8343,335 @@ var invitationAcceptedEvent = defineEvent(
     metadata: Type.Optional(Type.Record(Type.String(), Type.Unknown()))
   })
 );
+var authDeletionRequestedEvent = defineEvent(
+  "auth.deletion.requested",
+  Type.Object({
+    userId: Type.String(),
+    userPublicId: Type.String(),
+    purgeScheduledAt: Type.String(),
+    requestedBy: Type.Union([Type.Literal("self"), Type.Literal("admin")])
+  })
+);
+var authDeletionCancelledEvent = defineEvent(
+  "auth.deletion.cancelled",
+  Type.Object({
+    userId: Type.String(),
+    userPublicId: Type.String()
+  })
+);
+var authDeletionCompletedEvent = defineEvent(
+  "auth.deletion.completed",
+  Type.Object({
+    userPublicId: Type.String(),
+    purgeStrategy: Type.Union([Type.Literal("anonymize"), Type.Literal("hard-delete")])
+  })
+);
 
-// src/server/services/auth.service.ts
-var dummyHashPromise = null;
-function getDummyHash() {
-  if (!dummyHashPromise) {
-    dummyHashPromise = hashPassword("spfn-nonexistent-account-timing-equalizer");
+// src/server/services/account-deletion.service.ts
+var POSTGRES_UNIQUE_VIOLATION = "23505";
+function isUniqueViolation(error) {
+  return typeof error === "object" && error !== null && error.code === POSTGRES_UNIQUE_VIOLATION;
+}
+async function getPendingDeletionInfo(userId) {
+  const request = await accountDeletionRequestsRepository.findPendingByUserIdOnPrimary(userId);
+  return request ? { purgeScheduledAt: request.purgeScheduledAt } : null;
+}
+async function verifyReauthCredential(user, params) {
+  if (user.passwordHash) {
+    if (!params.password) {
+      throw new ValidationError2({ message: "Password is required to confirm this action" });
+    }
+    const valid = await verifyPassword(params.password, user.passwordHash);
+    if (!valid) {
+      throw new InvalidCredentialsError({ message: "Incorrect password" });
+    }
+    return;
+  }
+  if (!params.verificationToken) {
+    throw new ValidationError2({ message: "A verification code is required to confirm this action" });
+  }
+  const payload = validateVerificationToken(params.verificationToken);
+  if (!payload) {
+    throw new InvalidVerificationTokenError();
+  }
+  if (payload.purpose !== "account_deletion") {
+    throw new VerificationTokenPurposeMismatchError({ expected: "account_deletion", actual: payload.purpose });
+  }
+  const target = user.email ?? user.phone;
+  if (!target || payload.target !== target) {
+    throw new VerificationTokenTargetMismatchError();
+  }
+}
+async function sendDeletionEmail(to, subject, text12) {
+  const result = await sendEmail2({ to, subject, text: text12 });
+  if (!result.success) {
+    authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
+  }
+}
+async function notifyDeletionRequested(user, purgeScheduledAt) {
+  if (!getDeletionConfig().sendNotifications || !user.email) {
+    return;
+  }
+  await sendDeletionEmail(
+    user.email,
+    "Account deletion requested",
+    `We received a request to delete your account. It is scheduled for permanent deletion on ${purgeScheduledAt.toISOString()}. If this wasn't you, sign in before that date to cancel it.`
+  );
+}
+async function notifyDeletionCancelled(user) {
+  if (!getDeletionConfig().sendNotifications || !user.email) {
+    return;
+  }
+  await sendDeletionEmail(
+    user.email,
+    "Account deletion cancelled",
+    "Your account deletion request was cancelled and your account is active again."
+  );
+}
+async function notifyPurgeFinal(email) {
+  if (!getDeletionConfig().sendNotifications) {
+    return;
+  }
+  await sendDeletionEmail(
+    email,
+    "Your account has been deleted",
+    "Your account and associated data have now been permanently deleted, as requested."
+  );
+}
+function addDays(date, days) {
+  const result = new Date(date);
+  result.setDate(result.getDate() + days);
+  return result;
+}
+async function requestAccountDeletionService(userId, params) {
+  const { requestedBy, password, verificationToken, reason, immediate } = params;
+  const user = await usersRepository.findById(userId);
+  if (!user) {
+    throw new NotFoundError2({ message: "User not found", resource: "User" });
+  }
+  if (user.status === "pending_deletion" || user.status === "deleted") {
+    throw new DeletionAlreadyRequestedError();
+  }
+  if (requestedBy === "self") {
+    await verifyReauthCredential(user, { password, verificationToken });
+  }
+  const config2 = getDeletionConfig();
+  const wantsImmediate = immediate === true;
+  if (wantsImmediate && requestedBy === "self" && !config2.allowSelfImmediate) {
+    throw new ImmediateDeletionNotAllowedError();
+  }
+  const gracePeriodDays = wantsImmediate ? 0 : config2.gracePeriodDays;
+  const requestedAt = /* @__PURE__ */ new Date();
+  const purgeScheduledAt = addDays(requestedAt, gracePeriodDays);
+  await usersRepository.updateById(user.id, { status: "pending_deletion" });
+  let request;
+  try {
+    request = await accountDeletionRequestsRepository.create({
+      userId: user.id,
+      userPublicId: user.publicId,
+      requestedAt,
+      purgeScheduledAt,
+      status: "pending",
+      requestedBy,
+      reason: reason ?? null
+    });
+  } catch (error) {
+    if (isUniqueViolation(error)) {
+      throw new DeletionAlreadyRequestedError();
+    }
+    throw error;
+  }
+  await keysRepository.revokeAllActiveByUserId(user.id, "Account deletion requested");
+  onAfterCommit(() => authDeletionRequestedEvent.emit({
+    userId: String(user.id),
+    userPublicId: user.publicId,
+    purgeScheduledAt: purgeScheduledAt.toISOString(),
+    requestedBy
+  }));
+  onAfterCommit(() => notifyDeletionRequested(user, purgeScheduledAt));
+  if (gracePeriodDays === 0) {
+    await purgePendingRequest(request);
+  }
+  return { requestId: request.id, purgeScheduledAt };
+}
+async function cancelAccountDeletionService(params) {
+  const { email, phone, password, verificationToken } = params;
+  if (!email && !phone) {
+    throw new ValidationError2({ message: "Either email or phone must be provided" });
+  }
+  const user = await usersRepository.findByEmailOrPhone(email, phone);
+  if (!user) {
+    if (password) {
+      await verifyPassword(password, await getDummyPasswordHash());
+    }
+    throw new InvalidCredentialsError();
+  }
+  if (user.status !== "pending_deletion") {
+    await verifyReauthCredential(user, { password, verificationToken });
+    throw new DeletionNotRequestedError();
+  }
+  await verifyReauthCredential(user, { password, verificationToken });
+  const pendingRequest = await accountDeletionRequestsRepository.findPendingByUserId(user.id);
+  if (!pendingRequest) {
+    throw new DeletionNotRequestedError();
+  }
+  const claimed = await accountDeletionRequestsRepository.markCancelled(pendingRequest.id);
+  if (!claimed) {
+    throw new DeletionNotRequestedError();
+  }
+  await usersRepository.reactivateFromPendingDeletion(user.id);
+  onAfterCommit(() => authDeletionCancelledEvent.emit({
+    userId: String(user.id),
+    userPublicId: user.publicId
+  }));
+  onAfterCommit(() => notifyDeletionCancelled(user));
+  return { userId: String(user.id) };
+}
+async function anonymizeUser(user) {
+  await usersRepository.updateById(user.id, {
+    email: `deleted-${user.publicId}@deleted.invalid`,
+    phone: null,
+    username: null,
+    passwordHash: null,
+    status: "deleted",
+    deletedAt: /* @__PURE__ */ new Date(),
+    deletedBy: "system:auth.deletion.purge"
+  });
+  await socialAccountsRepository.deleteAllByUserId(user.id);
+  await keysRepository.deleteAllByUserId(user.id);
+  await userProfilesRepository.updateByUserId(user.id, {
+    displayName: null,
+    firstName: null,
+    lastName: null,
+    avatarUrl: null,
+    bio: null,
+    dateOfBirth: null,
+    gender: null,
+    website: null,
+    location: null,
+    company: null,
+    jobTitle: null,
+    metadata: null
+  });
+}
+async function purgePendingRequest(request) {
+  if (request.userId === null) {
+    await accountDeletionRequestsRepository.markCompleted(request.id, "hard-delete");
+    return { outcome: "not-found" };
   }
-  return dummyHashPromise;
+  const userId = request.userId;
+  const precheckUser = await usersRepository.findById(userId);
+  if (!precheckUser || precheckUser.status !== "pending_deletion") {
+    return { outcome: "skipped" };
+  }
+  const config2 = getDeletionConfig();
+  if (config2.onBeforePurge) {
+    try {
+      await config2.onBeforePurge({
+        id: precheckUser.id,
+        publicId: precheckUser.publicId,
+        email: precheckUser.email,
+        phone: precheckUser.phone
+      });
+    } catch (error) {
+      authLogger.service.warn("[account-deletion] onBeforePurge threw \u2014 skipping this sweep, will retry", {
+        userId: precheckUser.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return { outcome: "skipped" };
+    }
+  }
+  const purgeStrategy = config2.purgeStrategy;
+  let purgedUser = null;
+  await runInTransaction(async () => {
+    const user = await usersRepository.findById(userId);
+    if (!user || user.status !== "pending_deletion") {
+      return;
+    }
+    const claimed = await accountDeletionRequestsRepository.markCompleted(request.id, purgeStrategy);
+    if (!claimed) {
+      return;
+    }
+    if (purgeStrategy === "hard-delete") {
+      await usersRepository.deleteById(user.id);
+    } else {
+      await anonymizeUser(user);
+    }
+    if (user.email) {
+      await verificationCodesRepository.deleteByTarget(user.email);
+    }
+    if (user.phone) {
+      await verificationCodesRepository.deleteByTarget(user.phone);
+    }
+    purgedUser = user;
+  });
+  if (!purgedUser) {
+    return { outcome: "skipped" };
+  }
+  const { email, publicId } = purgedUser;
+  if (email) {
+    onAfterCommit(() => notifyPurgeFinal(email));
+  }
+  onAfterCommit(() => authDeletionCompletedEvent.emit({
+    userPublicId: publicId,
+    purgeStrategy
+  }));
+  return { outcome: "purged" };
+}
+async function purgeUserService(userId) {
+  const request = await accountDeletionRequestsRepository.findPendingByUserId(userId);
+  if (!request) {
+    throw new DeletionNotRequestedError();
+  }
+  return purgePendingRequest(request);
+}
+async function sweepDuePurges(now = /* @__PURE__ */ new Date()) {
+  const dueRequests = await accountDeletionRequestsRepository.findDueForPurge(now);
+  let purged = 0;
+  let skipped = 0;
+  for (const request of dueRequests) {
+    try {
+      const result = await purgePendingRequest(request);
+      if (result.outcome === "purged") {
+        purged++;
+      } else {
+        skipped++;
+      }
+    } catch (error) {
+      skipped++;
+      authLogger.service.error("[account-deletion] purge failed, will retry next sweep", {
+        requestId: request.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return { processed: dueRequests.length, purged, skipped };
 }
+
+// src/server/services/auth.service.ts
 async function registerService(params) {
   const { email, phone, verificationToken, password, publicKey, keyId, fingerprint, algorithm, metadata } = params;
   const tokenPayload = validateVerificationToken(verificationToken);
   if (!tokenPayload) {
-    throw new InvalidVerificationTokenError();
+    throw new InvalidVerificationTokenError2();
   }
   if (tokenPayload.purpose !== "registration") {
-    throw new VerificationTokenPurposeMismatchError({ expected: "registration", actual: tokenPayload.purpose });
+    throw new VerificationTokenPurposeMismatchError2({ expected: "registration", actual: tokenPayload.purpose });
   }
   const providedTarget = email || phone;
   if (tokenPayload.target !== providedTarget) {
-    throw new VerificationTokenTargetMismatchError();
+    throw new VerificationTokenTargetMismatchError2();
   }
   const providedTargetType = email ? "email" : "phone";
   if (tokenPayload.targetType !== providedTargetType) {
-    throw new VerificationTokenTargetMismatchError();
+    throw new VerificationTokenTargetMismatchError2();
   }
   const existingUser = await usersRepository.findByEmailOrPhone(email, phone);
   if (existingUser) {
     const identifierType = email ? "email" : "phone";
     throw new AccountAlreadyExistsError({ identifier: email || phone, identifierType });
   }
+  await runBeforeRegister({ channel: "credentials", email, phone, metadata });
   const passwordHash = await hashPassword(password);
   const { getRoleByName: getRoleByName3 } = await Promise.resolve().then(() => (init_role_service(), role_service_exports));
   const userRole = await getRoleByName3("user");
@@ -7504,17 +8712,21 @@ async function loginService(params) {
   const { email, phone, password, publicKey, keyId, fingerprint, oldKeyId, algorithm } = params;
   const user = await usersRepository.findByEmailOrPhone(email, phone);
   if (!email && !phone) {
-    throw new ValidationError2({ message: "Either email or phone must be provided" });
+    throw new ValidationError3({ message: "Either email or phone must be provided" });
   }
   if (!user || !user.passwordHash) {
-    await verifyPassword(password, await getDummyHash());
-    throw new InvalidCredentialsError();
+    await verifyPassword(password, await getDummyPasswordHash());
+    throw new InvalidCredentialsError2();
   }
   const isValid = await verifyPassword(password, user.passwordHash);
   if (!isValid) {
-    throw new InvalidCredentialsError();
+    throw new InvalidCredentialsError2();
   }
   if (user.status !== "active") {
+    if (user.status === "pending_deletion") {
+      const pending = await getPendingDeletionInfo(user.id);
+      throw new AccountPendingDeletionError({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
+    }
     throw new AccountDisabledError({ status: user.status });
   }
   if (oldKeyId) {
@@ -7563,17 +8775,17 @@ async function changePasswordService(params) {
   } else {
     const user = await usersRepository.findById(userId);
     if (!user) {
-      throw new ValidationError2({ message: "User not found" });
+      throw new ValidationError3({ message: "User not found" });
     }
     passwordHash = user.passwordHash;
   }
   if (passwordHash) {
     if (!currentPassword) {
-      throw new ValidationError2({ message: "Current password is required" });
+      throw new ValidationError3({ message: "Current password is required" });
     }
     const isValid = await verifyPassword(currentPassword, passwordHash);
     if (!isValid) {
-      throw new InvalidCredentialsError({ message: "Current password is incorrect" });
+      throw new InvalidCredentialsError2({ message: "Current password is incorrect" });
     }
   }
   const newPasswordHash = await hashPassword(newPassword);
@@ -7585,82 +8797,6 @@ async function changePasswordService(params) {
 init_repositories();
 init_rbac();
 import { createHash } from "crypto";
-
-// src/server/lib/config.ts
-import { env as env6 } from "@spfn/auth/config";
-function getCookieSuffix() {
-  const port = process.env.PORT;
-  return port ? `_${port}` : "";
-}
-var COOKIE_NAMES = {
-  /** Encrypted session data (userId, privateKey, keyId, algorithm) */
-  get SESSION() {
-    return `spfn_session${getCookieSuffix()}`;
-  },
-  /** Current key ID (for key rotation) */
-  get SESSION_KEY_ID() {
-    return `spfn_session_key_id${getCookieSuffix()}`;
-  },
-  /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
-  get OAUTH_PENDING() {
-    return `spfn_oauth_pending${getCookieSuffix()}`;
-  },
-  /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
-  get OAUTH_CSRF() {
-    return `spfn_oauth_csrf${getCookieSuffix()}`;
-  }
-};
-function parseDuration(duration) {
-  if (typeof duration === "number") {
-    return duration;
-  }
-  const match = duration.match(/^(\d+)([dhms]?)$/);
-  if (!match) {
-    throw new Error(`Invalid duration format: ${duration}. Use format like '30d', '12h', '45m', '3600s', or plain number.`);
-  }
-  const value = parseInt(match[1], 10);
-  const unit = match[2] || "s";
-  switch (unit) {
-    case "d":
-      return value * 24 * 60 * 60;
-    case "h":
-      return value * 60 * 60;
-    case "m":
-      return value * 60;
-    case "s":
-      return value;
-    default:
-      throw new Error(`Unknown duration unit: ${unit}`);
-  }
-}
-var globalConfig = {
-  sessionTtl: "7d"
-  // Default: 7 days
-};
-function configureAuth(config) {
-  globalConfig = {
-    ...globalConfig,
-    ...config
-  };
-}
-function getAuthConfig() {
-  return { ...globalConfig };
-}
-function getSessionTtl(override) {
-  if (override !== void 0) {
-    return parseDuration(override);
-  }
-  if (globalConfig.sessionTtl !== void 0) {
-    return parseDuration(globalConfig.sessionTtl);
-  }
-  const envTtl = env6.SPFN_AUTH_SESSION_TTL;
-  if (envTtl) {
-    return parseDuration(envTtl);
-  }
-  return 7 * 24 * 60 * 60;
-}
-
-// src/server/services/rbac.service.ts
 var RBAC_HASH_KEY = "rbac_config_hash";
 function computeConfigHash(allRoles, allPermissions, allMappings) {
   const payload = JSON.stringify({
@@ -7729,51 +8865,51 @@ async function initializeAuth(options = {}) {
   authLogger.service.info("\u{1F512} Built-in roles: user, admin, superadmin");
 }
 async function syncRoles(configs, existingByName) {
-  for (const config of configs) {
-    const existing = existingByName.get(config.name);
+  for (const config2 of configs) {
+    const existing = existingByName.get(config2.name);
     if (!existing) {
       await rolesRepository.create({
-        name: config.name,
-        displayName: config.displayName,
-        description: config.description || null,
-        priority: config.priority ?? 10,
-        isSystem: config.isSystem ?? false,
-        isBuiltin: config.isBuiltin ?? false,
+        name: config2.name,
+        displayName: config2.displayName,
+        description: config2.description || null,
+        priority: config2.priority ?? 10,
+        isSystem: config2.isSystem ?? false,
+        isBuiltin: config2.isBuiltin ?? false,
         isActive: true
       });
-      authLogger.service.info(`  \u2705 Created role: ${config.name}`);
+      authLogger.service.info(`  \u2705 Created role: ${config2.name}`);
     } else {
       const updateData = {
-        displayName: config.displayName,
-        description: config.description || null
+        displayName: config2.displayName,
+        description: config2.description || null
       };
       if (!existing.isBuiltin) {
-        updateData.priority = config.priority ?? existing.priority;
+        updateData.priority = config2.priority ?? existing.priority;
       }
       await rolesRepository.updateById(existing.id, updateData);
     }
   }
 }
 async function syncPermissions(configs, existingByName) {
-  for (const config of configs) {
-    const existing = existingByName.get(config.name);
+  for (const config2 of configs) {
+    const existing = existingByName.get(config2.name);
     if (!existing) {
       await permissionsRepository.create({
-        name: config.name,
-        displayName: config.displayName,
-        description: config.description || null,
-        category: config.category || null,
-        isSystem: config.isSystem ?? false,
-        isBuiltin: config.isBuiltin ?? false,
+        name: config2.name,
+        displayName: config2.displayName,
+        description: config2.description || null,
+        category: config2.category || null,
+        isSystem: config2.isSystem ?? false,
+        isBuiltin: config2.isBuiltin ?? false,
         isActive: true,
         metadata: null
       });
-      authLogger.service.info(`  \u2705 Created permission: ${config.name}`);
+      authLogger.service.info(`  \u2705 Created permission: ${config2.name}`);
     } else {
       await permissionsRepository.updateById(existing.id, {
-        displayName: config.displayName,
-        description: config.description || null,
-        category: config.category || null
+        displayName: config2.displayName,
+        description: config2.description || null,
+        category: config2.category || null
       });
     }
   }
@@ -7811,7 +8947,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id11) => permissionsRepository.findById(id11))
+      permIds.map((id12) => permissionsRepository.findById(id12))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -7887,7 +9023,7 @@ init_role_service();
 // src/server/services/invitation.service.ts
 init_repositories();
 import crypto5 from "crypto";
-import { BadRequestError, NotFoundError as NotFoundError2, ConflictError } from "@spfn/core/errors";
+import { BadRequestError, NotFoundError as NotFoundError3, ConflictError } from "@spfn/core/errors";
 function generateInvitationToken() {
   return crypto5.randomUUID();
 }
@@ -7912,11 +9048,11 @@ async function createInvitation(params) {
   }
   const role = await rolesRepository.findById(roleId);
   if (!role) {
-    throw new NotFoundError2({ message: `Role with id ${roleId} not found`, resource: "Role" });
+    throw new NotFoundError3({ message: `Role with id ${roleId} not found`, resource: "Role" });
   }
   const inviter = await usersRepository.findById(invitedBy);
   if (!inviter) {
-    throw new NotFoundError2({ message: `User with id ${invitedBy} not found`, resource: "User" });
+    throw new NotFoundError3({ message: `User with id ${invitedBy} not found`, resource: "User" });
   }
   const token = generateInvitationToken();
   const expiresAt = expiresAtParam ?? calculateExpiresAt(expiresInDays);
@@ -7975,8 +9111,13 @@ async function acceptInvitation(params) {
   const invitation = validation.invitation;
   const role = await rolesRepository.findById(invitation.roleId);
   if (!role) {
-    throw new NotFoundError2({ message: "Role not found", resource: "Role" });
+    throw new NotFoundError3({ message: "Role not found", resource: "Role" });
   }
+  await runBeforeRegister({
+    channel: "invitation",
+    email: invitation.email,
+    metadata: invitation.metadata ?? void 0
+  });
   const passwordHash = await hashPassword(password);
   const newUser = await usersRepository.create({
     email: invitation.email,
@@ -8019,20 +9160,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id11, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id11);
+async function cancelInvitation(id12, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id12);
   if (!invitation) {
-    throw new NotFoundError2({ message: "Invitation not found", resource: "Invitation" });
+    throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id11, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id12, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id11) {
-  await invitationsRepository.deleteById(id11);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id11}`);
+async function deleteInvitation(id12) {
+  await invitationsRepository.deleteById(id12);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id12}`);
 }
 async function expireOldInvitations() {
   const count = await invitationsRepository.updateExpiredInvitations();
@@ -8041,16 +9182,16 @@ async function expireOldInvitations() {
   }
   return count;
 }
-async function resendInvitation(id11, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id11);
+async function resendInvitation(id12, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id12);
   if (!invitation) {
-    throw new NotFoundError2({ message: "Invitation not found", resource: "Invitation" });
+    throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
   if (!["pending", "expired"].includes(invitation.status)) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id11, newExpiresAt);
+  const updated = await invitationsRepository.resend(id12, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -8089,13 +9230,13 @@ async function getAuthSessionService(userId) {
 // src/server/lib/one-time-token.ts
 import { SSETokenManager } from "@spfn/core/event/sse";
 var manager = null;
-function initOneTimeTokenManager(config) {
+function initOneTimeTokenManager(config2) {
   if (manager) {
     manager.destroy();
   }
   manager = new SSETokenManager({
-    ttl: config?.ttl,
-    store: config?.store
+    ttl: config2?.ttl,
+    store: config2?.store
   });
 }
 function getOneTimeTokenManager() {
@@ -8205,7 +9346,8 @@ async function updateUserProfileService(userId, params) {
 // src/server/services/oauth.service.ts
 init_repositories();
 import { env as env11 } from "@spfn/auth/config";
-import { ValidationError as ValidationError5 } from "@spfn/core/errors";
+import { ValidationError as ValidationError8 } from "@spfn/core/errors";
+import { AccountDisabledError as AccountDisabledError2, AccountPendingDeletionError as AccountPendingDeletionError2 } from "@spfn/auth/errors";
 
 // src/server/lib/oauth/google.ts
 import { env as env7 } from "@spfn/auth/config";
@@ -8221,7 +9363,7 @@ function getGoogleOAuthConfig() {
   if (!clientId || !clientSecret) {
     throw new Error("Google OAuth is not configured. Set SPFN_AUTH_GOOGLE_CLIENT_ID and SPFN_AUTH_GOOGLE_CLIENT_SECRET.");
   }
-  const baseUrl = env7.NEXT_PUBLIC_SPFN_API_URL || env7.SPFN_API_URL;
+  const baseUrl = env7.NEXT_PUBLIC_SPFN_APP_URL || env7.SPFN_APP_URL;
   const redirectUri = env7.SPFN_AUTH_GOOGLE_REDIRECT_URI || `${baseUrl}/_auth/oauth/google/callback`;
   return {
     clientId,
@@ -8238,10 +9380,10 @@ function getDefaultScopes() {
 }
 function getGoogleAuthUrl(state, scopes) {
   const resolvedScopes = scopes ?? getDefaultScopes();
-  const config = getGoogleOAuthConfig();
+  const config2 = getGoogleOAuthConfig();
   const params = new URLSearchParams({
-    client_id: config.clientId,
-    redirect_uri: config.redirectUri,
+    client_id: config2.clientId,
+    redirect_uri: config2.redirectUri,
     response_type: "code",
     scope: resolvedScopes.join(" "),
     state,
@@ -8253,16 +9395,16 @@ function getGoogleAuthUrl(state, scopes) {
   return `${GOOGLE_AUTH_URL}?${params.toString()}`;
 }
 async function exchangeCodeForTokens(code) {
-  const config = getGoogleOAuthConfig();
+  const config2 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config.clientId,
-      client_secret: config.clientSecret,
-      redirect_uri: config.redirectUri,
+      client_id: config2.clientId,
+      client_secret: config2.clientSecret,
+      redirect_uri: config2.redirectUri,
       grant_type: "authorization_code",
       code
     })
@@ -8286,15 +9428,15 @@ async function getGoogleUserInfo(accessToken) {
   return response.json();
 }
 async function refreshAccessToken(refreshToken) {
-  const config = getGoogleOAuthConfig();
+  const config2 = getGoogleOAuthConfig();
   const response = await fetch(GOOGLE_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body: new URLSearchParams({
-      client_id: config.clientId,
-      client_secret: config.clientSecret,
+      client_id: config2.clientId,
+      client_secret: config2.clientSecret,
       refresh_token: refreshToken,
       grant_type: "refresh_token"
     })
@@ -8347,15 +9489,15 @@ async function verifyOAuthState(encryptedState) {
 }
 
 // src/server/lib/oauth/provider.ts
-var registry = /* @__PURE__ */ new Map();
+var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
-  registry.set(provider.id, provider);
+  registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id11) {
-  return registry.get(id11);
+function getOAuthProvider(id12) {
+  return registry2.get(id12);
 }
 function getRegisteredProviders() {
-  return [...registry.values()];
+  return [...registry2.values()];
 }
 
 // src/server/lib/oauth/jwks-verify.ts
@@ -8399,9 +9541,12 @@ async function verifySignature(params) {
   }
 }
 
+// src/server/lib/oauth/index.ts
+init_token_cipher();
+
 // src/server/lib/oauth/google-provider.ts
 import { env as env9 } from "@spfn/auth/config";
-import { ValidationError as ValidationError3 } from "@spfn/core/errors";
+import { ValidationError as ValidationError4 } from "@spfn/core/errors";
 var GOOGLE_JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs";
 var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 function getGoogleNativeAudiences() {
@@ -8444,7 +9589,7 @@ var googleProvider = {
   async verifyNativeIdToken(idToken, options) {
     const audiences = getGoogleNativeAudiences();
     if (audiences.length === 0) {
-      throw new ValidationError3({
+      throw new ValidationError4({
         message: "Google native sign-in is not configured. Set SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS."
       });
     }
@@ -8470,7 +9615,7 @@ registerOAuthProvider(googleProvider);
 // src/server/lib/oauth/apple-provider.ts
 import { createHash as createHash2 } from "crypto";
 import { env as env10 } from "@spfn/auth/config";
-import { ValidationError as ValidationError4 } from "@spfn/core/errors";
+import { ValidationError as ValidationError5 } from "@spfn/core/errors";
 var APPLE_JWKS_URI = "https://appleid.apple.com/auth/keys";
 var APPLE_ISSUER = "https://appleid.apple.com";
 function getAppleClientIds() {
@@ -8480,7 +9625,7 @@ function hashNonce(rawNonce) {
   return createHash2("sha256").update(rawNonce).digest("hex");
 }
 function unsupportedWebFlow() {
-  throw new ValidationError4({
+  throw new ValidationError5({
     message: "Apple provider supports native id_token sign-in only. Use POST /_auth/oauth/apple/native."
   });
 }
@@ -8501,7 +9646,7 @@ var appleProvider = {
   async verifyNativeIdToken(idToken, options) {
     const audiences = getAppleClientIds();
     if (audiences.length === 0) {
-      throw new ValidationError4({
+      throw new ValidationError5({
         message: "Apple native sign-in is not configured. Set SPFN_AUTH_APPLE_CLIENT_IDS."
       });
     }
@@ -8522,16 +9667,226 @@ var appleProvider = {
 };
 registerOAuthProvider(appleProvider);
 
+// src/server/lib/oauth/kakao-provider.ts
+init_config();
+import { ValidationError as ValidationError6 } from "@spfn/core/errors";
+var KAKAO_AUTH_URL = "https://kauth.kakao.com/oauth/authorize";
+var KAKAO_TOKEN_URL = "https://kauth.kakao.com/oauth/token";
+var KAKAO_USERINFO_URL = "https://kapi.kakao.com/v2/user/me";
+function getKakaoConfig() {
+  const clientId = env3.SPFN_AUTH_KAKAO_CLIENT_ID;
+  const clientSecret = env3.SPFN_AUTH_KAKAO_CLIENT_SECRET;
+  if (!clientId) {
+    throw new ValidationError6({
+      message: "Kakao OAuth is not configured. Set SPFN_AUTH_KAKAO_CLIENT_ID."
+    });
+  }
+  const baseUrl = env3.NEXT_PUBLIC_SPFN_APP_URL || env3.SPFN_APP_URL;
+  return {
+    clientId,
+    clientSecret,
+    redirectUri: env3.SPFN_AUTH_KAKAO_REDIRECT_URI || `${baseUrl}/_auth/oauth/kakao/callback`
+  };
+}
+function getKakaoScopes() {
+  const configured = env3.SPFN_AUTH_KAKAO_SCOPES;
+  return configured ? configured.split(",").map((scope) => scope.trim()).filter(Boolean) : ["account_email"];
+}
+async function requestKakaoTokens(params) {
+  const response = await fetch(KAKAO_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded;charset=utf-8" },
+    body: params
+  });
+  if (!response.ok) {
+    throw new Error(`Kakao token request failed with status ${response.status}`);
+  }
+  const body = await response.json();
+  const expiresIn = Number(body.expires_in);
+  if (typeof body.access_token !== "string" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Kakao token response is invalid");
+  }
+  return {
+    accessToken: body.access_token,
+    refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+    expiresIn
+  };
+}
+var kakaoProvider = {
+  id: "kakao",
+  isEnabled() {
+    return !!env3.SPFN_AUTH_KAKAO_CLIENT_ID;
+  },
+  getAuthUrl(state, scopes) {
+    const config2 = getKakaoConfig();
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: config2.clientId,
+      redirect_uri: config2.redirectUri,
+      state,
+      scope: (scopes ?? getKakaoScopes()).join(",")
+    });
+    return `${KAKAO_AUTH_URL}?${params.toString()}`;
+  },
+  async exchangeCodeForTokens(code) {
+    const config2 = getKakaoConfig();
+    const params = new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: config2.clientId,
+      redirect_uri: config2.redirectUri,
+      code
+    });
+    if (config2.clientSecret) {
+      params.set("client_secret", config2.clientSecret);
+    }
+    return requestKakaoTokens(params);
+  },
+  async getUserInfo(accessToken) {
+    const response = await fetch(KAKAO_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) {
+      throw new Error(`Kakao user-info request failed with status ${response.status}`);
+    }
+    const body = await response.json();
+    if (typeof body.id !== "number" && typeof body.id !== "string") {
+      throw new Error("Kakao user-info response is missing the provider user ID");
+    }
+    const account = body.kakao_account;
+    const email = typeof account?.email === "string" ? account.email : null;
+    return {
+      providerUserId: String(body.id),
+      email,
+      emailVerified: email !== null && account?.is_email_valid === true && account.is_email_verified === true,
+      name: typeof account?.profile?.nickname === "string" ? account.profile.nickname : void 0,
+      avatar: typeof account?.profile?.profile_image_url === "string" ? account.profile.profile_image_url : void 0
+    };
+  },
+  async refreshTokens(refreshToken) {
+    const config2 = getKakaoConfig();
+    const params = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: config2.clientId,
+      refresh_token: refreshToken
+    });
+    if (config2.clientSecret) {
+      params.set("client_secret", config2.clientSecret);
+    }
+    return requestKakaoTokens(params);
+  }
+};
+registerOAuthProvider(kakaoProvider);
+
+// src/server/lib/oauth/naver-provider.ts
+init_config();
+import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+var NAVER_AUTH_URL = "https://nid.naver.com/oauth2.0/authorize";
+var NAVER_TOKEN_URL = "https://nid.naver.com/oauth2.0/token";
+var NAVER_USERINFO_URL = "https://openapi.naver.com/v1/nid/me";
+function getNaverConfig() {
+  const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
+  const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    throw new ValidationError7({
+      message: "Naver OAuth is not configured. Set SPFN_AUTH_NAVER_CLIENT_ID and SPFN_AUTH_NAVER_CLIENT_SECRET."
+    });
+  }
+  const baseUrl = env3.NEXT_PUBLIC_SPFN_APP_URL || env3.SPFN_APP_URL;
+  return {
+    clientId,
+    clientSecret,
+    redirectUri: env3.SPFN_AUTH_NAVER_REDIRECT_URI || `${baseUrl}/_auth/oauth/naver/callback`
+  };
+}
+async function requestNaverTokens(params) {
+  const response = await fetch(NAVER_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded;charset=utf-8" },
+    body: params
+  });
+  if (!response.ok) {
+    throw new Error(`Naver token request failed with status ${response.status}`);
+  }
+  const body = await response.json();
+  const expiresIn = Number(body.expires_in);
+  if (typeof body.access_token !== "string" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Naver token response is invalid");
+  }
+  return {
+    accessToken: body.access_token,
+    refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+    expiresIn
+  };
+}
+var naverProvider = {
+  id: "naver",
+  isEnabled() {
+    return !!(env3.SPFN_AUTH_NAVER_CLIENT_ID && env3.SPFN_AUTH_NAVER_CLIENT_SECRET);
+  },
+  getAuthUrl(state) {
+    const config2 = getNaverConfig();
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: config2.clientId,
+      redirect_uri: config2.redirectUri,
+      state
+    });
+    return `${NAVER_AUTH_URL}?${params.toString()}`;
+  },
+  async exchangeCodeForTokens(code, options) {
+    const config2 = getNaverConfig();
+    return requestNaverTokens(new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: config2.clientId,
+      client_secret: config2.clientSecret,
+      redirect_uri: config2.redirectUri,
+      code,
+      state: options.state
+    }));
+  },
+  async getUserInfo(accessToken) {
+    const response = await fetch(NAVER_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) {
+      throw new Error(`Naver user-info request failed with status ${response.status}`);
+    }
+    const body = await response.json();
+    const profile = body.response;
+    if (body.resultcode !== "00" || typeof profile?.id !== "string") {
+      throw new Error("Naver user-info response is invalid");
+    }
+    return {
+      providerUserId: profile.id,
+      email: typeof profile.email === "string" ? profile.email : null,
+      // Naver returns an email address but no independently verified-email claim.
+      emailVerified: false,
+      name: typeof profile.name === "string" ? profile.name : typeof profile.nickname === "string" ? profile.nickname : void 0,
+      avatar: typeof profile.profile_image === "string" ? profile.profile_image : void 0
+    };
+  },
+  async refreshTokens(refreshToken) {
+    const config2 = getNaverConfig();
+    return requestNaverTokens(new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: config2.clientId,
+      client_secret: config2.clientSecret,
+      refresh_token: refreshToken
+    }));
+  }
+};
+registerOAuthProvider(naverProvider);
+
 // src/server/services/oauth.service.ts
 function requireEnabledProvider(provider) {
   const oauthProvider = getOAuthProvider(provider);
   if (!oauthProvider) {
-    throw new ValidationError5({
+    throw new ValidationError8({
       message: `Unsupported OAuth provider: ${provider}. No provider is registered for this id.`
     });
   }
   if (!oauthProvider.isEnabled()) {
-    throw new ValidationError5({
+    throw new ValidationError8({
       message: `OAuth provider '${provider}' is registered but not configured. Check its required environment variables.`
     });
   }
@@ -8539,7 +9894,7 @@ function requireEnabledProvider(provider) {
 }
 function tokenExpiryDate(expiresIn) {
   if (!Number.isFinite(expiresIn)) {
-    throw new ValidationError5({
+    throw new ValidationError8({
       message: `Invalid token expiry returned from OAuth provider: ${expiresIn}`
     });
   }
@@ -8563,18 +9918,19 @@ async function oauthStartService(params) {
 async function oauthCallbackService(params) {
   const { provider, code, state, expectedNonce } = params;
   const stateData = await verifyOAuthState(state);
-  if (!expectedNonce || stateData.nonce !== expectedNonce) {
-    throw new ValidationError5({
+  const nonceCandidates = typeof expectedNonce === "string" ? [expectedNonce] : expectedNonce ?? [];
+  if (!stateData.nonce || !nonceCandidates.includes(stateData.nonce)) {
+    throw new ValidationError8({
       message: "OAuth state validation failed"
     });
   }
   if (stateData.provider !== provider) {
-    throw new ValidationError5({
+    throw new ValidationError8({
       message: "OAuth state provider mismatch"
     });
   }
   const oauthProvider = requireEnabledProvider(provider);
-  const tokens = await oauthProvider.exchangeCodeForTokens(code);
+  const tokens = await oauthProvider.exchangeCodeForTokens(code, { state });
   const identity = await oauthProvider.getUserInfo(tokens.accessToken);
   const existingSocialAccount = await socialAccountsRepository.findByProviderAndProviderId(
     provider,
@@ -8590,10 +9946,11 @@ async function oauthCallbackService(params) {
       tokenExpiresAt: tokenExpiryDate(tokens.expiresIn)
     });
   } else {
-    const result = await createOrLinkUser(provider, identity, tokens);
+    const result = await createOrLinkUser(provider, identity, tokens, stateData.metadata);
     userId = result.userId;
     isNewUser = result.isNewUser;
   }
+  await assertActiveForOAuthSession(userId);
   await registerPublicKeyService({
     userId,
     keyId: stateData.keyId,
@@ -8631,13 +9988,27 @@ async function oauthCallbackService(params) {
     isNewUser
   };
 }
-async function createOrLinkUser(provider, identity, tokens) {
+async function assertActiveForOAuthSession(userId) {
+  const user = await usersRepository.findByIdOnPrimary(userId);
+  if (!user) {
+    throw new ValidationError8({ message: "User not found" });
+  }
+  if (user.status === "active") {
+    return;
+  }
+  if (user.status === "pending_deletion") {
+    const pending = await getPendingDeletionInfo(user.id);
+    throw new AccountPendingDeletionError2({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
+  }
+  throw new AccountDisabledError2({ status: user.status });
+}
+async function createOrLinkUser(provider, identity, tokens, metadata) {
   const existingUser = identity.email ? await usersRepository.findByEmail(identity.email) : null;
   let userId;
   let isNewUser = false;
   if (existingUser) {
     if (!identity.emailVerified) {
-      throw new ValidationError5({
+      throw new ValidationError8({
         message: "Cannot link to existing account with unverified email. Please verify your email with the provider first."
       });
     }
@@ -8648,6 +10019,13 @@ async function createOrLinkUser(provider, identity, tokens) {
       });
     }
   } else {
+    await runBeforeRegister({
+      channel: "oauth",
+      provider,
+      email: identity.email ?? void 0,
+      emailVerified: identity.emailVerified,
+      metadata
+    });
     const { getRoleByName: getRoleByName3 } = await Promise.resolve().then(() => (init_role_service(), role_service_exports));
     const userRole = await getRoleByName3("user");
     if (!userRole) {
@@ -8701,7 +10079,7 @@ var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
 async function getGoogleAccessToken(userId) {
   const account = await socialAccountsRepository.findByUserIdAndProvider(userId, "google");
   if (!account) {
-    throw new ValidationError5({
+    throw new ValidationError8({
       message: "No Google account linked. User must sign in with Google first."
     });
   }
@@ -8710,7 +10088,7 @@ async function getGoogleAccessToken(userId) {
     return account.accessToken;
   }
   if (!account.refreshToken) {
-    throw new ValidationError5({
+    throw new ValidationError8({
       message: "Google refresh token not available. User must re-authenticate with Google."
     });
   }
@@ -8725,12 +10103,12 @@ async function getGoogleAccessToken(userId) {
 
 // src/server/services/oauth-native.service.ts
 init_repositories();
-import { ValidationError as ValidationError6 } from "@spfn/core/errors";
-import { runInTransaction, onAfterCommit } from "@spfn/core/db";
+import { ValidationError as ValidationError9 } from "@spfn/core/errors";
+import { runInTransaction as runInTransaction2, onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
 async function oauthNativeService(params) {
   const oauthProvider = getOAuthProvider(params.provider);
   if (!oauthProvider?.verifyNativeIdToken) {
-    throw new ValidationError6({
+    throw new ValidationError9({
       message: `Provider '${params.provider}' does not support native id_token sign-in.`
     });
   }
@@ -8741,7 +10119,7 @@ async function oauthNativeService(params) {
   return persistNativeLogin(identity, params);
 }
 async function persistNativeLogin(identity, params) {
-  return runInTransaction(async () => {
+  return runInTransaction2(async () => {
     const existing = await socialAccountsRepository.findByProviderAndProviderId(
       params.provider,
       identity.providerUserId
@@ -8751,10 +10129,11 @@ async function persistNativeLogin(identity, params) {
     if (existing) {
       userId = existing.userId;
     } else {
-      const result = await createOrLinkUser(params.provider, identity);
+      const result = await createOrLinkUser(params.provider, identity, void 0, params.metadata);
       userId = result.userId;
       isNewUser = result.isNewUser;
     }
+    await assertActiveForOAuthSession(userId);
     await registerPublicKeyService({
       userId,
       keyId: params.keyId,
@@ -8769,7 +10148,7 @@ async function persistNativeLogin(identity, params) {
       email: identity.email || void 0,
       metadata: params.metadata
     };
-    onAfterCommit(() => (isNewUser ? authRegisterEvent : authLoginEvent).emit(eventPayload));
+    onAfterCommit2(() => (isNewUser ? authRegisterEvent : authLoginEvent).emit(eventPayload));
     return { userId: String(userId), keyId: params.keyId, isNewUser };
   }, { context: "auth:oauth-native" });
 }
@@ -8983,12 +10362,13 @@ import { EMAIL_PATTERN as EMAIL_PATTERN2, UUID_PATTERN } from "@spfn/auth";
 // src/server/middleware/authenticate.ts
 import { defineMiddleware } from "@spfn/core/route";
 import { UnauthorizedError } from "@spfn/core/errors";
-import { verifyClientToken as verifyClientToken2, decodeToken as decodeToken2, authLogger as authLogger2, keysRepository as keysRepository2, usersRepository as usersRepository2, userProfilesRepository as userProfilesRepository2 } from "@spfn/auth/server";
+import { verifyClientToken as verifyClientToken2, decodeToken as decodeToken2, authLogger as authLogger2, keysRepository as keysRepository2, usersRepository as usersRepository2, userProfilesRepository as userProfilesRepository2, getPendingDeletionInfo as getPendingDeletionInfo2 } from "@spfn/auth/server";
 import {
   InvalidTokenError,
   TokenExpiredError,
   KeyExpiredError,
-  AccountDisabledError as AccountDisabledError2
+  AccountDisabledError as AccountDisabledError3,
+  AccountPendingDeletionError as AccountPendingDeletionError3
 } from "@spfn/auth/errors";
 var authenticate = defineMiddleware("auth", async (c, next) => {
   const authHeader = c.req.header("Authorization");
@@ -9039,7 +10419,11 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
   }
   const { user, role } = result;
   if (user.status !== "active") {
-    throw new AccountDisabledError2({ status: user.status });
+    if (user.status === "pending_deletion") {
+      const pending = await getPendingDeletionInfo2(user.id);
+      throw new AccountPendingDeletionError3({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
+    }
+    throw new AccountDisabledError3({ status: user.status });
   }
   keysRepository2.updateLastUsedById(keyRecord.id).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
   c.set("auth", {
@@ -9761,7 +11145,7 @@ var deleteCookie = (c, name, opt) => {
 // src/server/routes/oauth/index.ts
 init_types();
 import { Transactional as Transactional3 } from "@spfn/core/db";
-import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { ValidationError as ValidationError10 } from "@spfn/core/errors";
 import { rateLimitPolicy as rateLimitPolicy4 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
@@ -9807,14 +11191,16 @@ var oauthGoogleCallback = route4.get("/_auth/oauth/google/callback").input({
   if (!query.code || !query.state) {
     return c.redirect(buildOAuthErrorUrl("Missing authorization code or state"));
   }
-  const expectedNonce = getCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF);
-  deleteCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, { path: "/" });
+  const csrfCookies = matchOAuthCsrfCookies(getCookie(c.raw));
+  for (const cookie of csrfCookies) {
+    deleteCookie(c.raw, cookie.name, { path: "/" });
+  }
   try {
     const result = await oauthCallbackService({
       provider: "google",
       code: query.code,
       state: query.state,
-      expectedNonce
+      expectedNonce: csrfCookies.map((cookie) => cookie.value)
     });
     return c.redirect(result.redirectUrl);
   } catch (err) {
@@ -9869,6 +11255,9 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
     returnUrl: Type.Optional(Type.String({
       description: "URL to redirect after OAuth success"
     })),
+    metadata: Type.Optional(Type.Record(Type.String(), Type.Unknown(), {
+      description: "Custom signup metadata sealed into OAuth state and passed to beforeRegister"
+    })),
     state: Type.Optional(Type.String({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
@@ -9876,10 +11265,10 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
 }).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
-    throw new ValidationError7({ message: "Google OAuth is not configured" });
+    throw new ValidationError10({ message: "Google OAuth is not configured" });
   }
   if (!body.state) {
-    throw new ValidationError7({
+    throw new ValidationError10({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -9940,14 +11329,16 @@ var oauthProviderCallback = route4.get("/_auth/oauth/:provider/callback").input(
   if (!query.code || !query.state) {
     return c.redirect(buildOAuthErrorUrl("Missing authorization code or state"));
   }
-  const expectedNonce = getCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF);
-  deleteCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, { path: "/" });
+  const csrfCookies = matchOAuthCsrfCookies(getCookie(c.raw));
+  for (const cookie of csrfCookies) {
+    deleteCookie(c.raw, cookie.name, { path: "/" });
+  }
   try {
     const result = await oauthCallbackService({
       provider: params.provider,
       code: query.code,
       state: query.state,
-      expectedNonce
+      expectedNonce: csrfCookies.map((cookie) => cookie.value)
     });
     return c.redirect(result.redirectUrl);
   } catch (err) {
@@ -9961,6 +11352,9 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
     returnUrl: Type.Optional(Type.String({
       description: "URL to redirect after OAuth success"
     })),
+    metadata: Type.Optional(Type.Record(Type.String(), Type.Unknown(), {
+      description: "Custom signup metadata sealed into OAuth state and passed to beforeRegister"
+    })),
     state: Type.Optional(Type.String({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
@@ -9969,7 +11363,7 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
-    throw new ValidationError7({
+    throw new ValidationError10({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -10095,8 +11489,56 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
   return { userId: params.userId, roleId: body.roleId };
 });
 
+// src/server/routes/deletion/index.ts
+init_esm();
+init_schema3();
+import { Transactional as Transactional4 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy5 } from "@spfn/core/middleware";
+import { defineRouter as defineRouter5, route as route6 } from "@spfn/core/route";
+var requestAccountDeletion = route6.post("/_auth/deletion/request").input({
+  body: Type.Object({
+    password: Type.Optional(Type.String({ minLength: 1, description: "Current password, if the account has one" })),
+    verificationToken: Type.Optional(Type.String({ description: "Verification token (purpose: account_deletion), for passwordless/OAuth-only accounts" })),
+    reason: Type.Optional(Type.String({ maxLength: 500, description: "Optional free-text reason" })),
+    immediate: Type.Optional(Type.Boolean({ description: "Skip the grace period \u2014 requires deletion.allowSelfImmediate on the server" }))
+  })
+}).use([rateLimitPolicy5("auth-deletion-request", { limit: 5, windowMs: 6e4 }), Transactional4()]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId } = getAuth(c);
+  const result = await requestAccountDeletionService(Number(userId), {
+    requestedBy: "self",
+    password: body.password,
+    verificationToken: body.verificationToken,
+    reason: body.reason,
+    immediate: body.immediate
+  });
+  return {
+    purgeScheduledAt: result.purgeScheduledAt.toISOString()
+  };
+});
+var cancelAccountDeletion = route6.post("/_auth/deletion/cancel").input({
+  body: Type.Object({
+    email: Type.Optional(EmailSchema),
+    phone: Type.Optional(PhoneSchema),
+    password: Type.Optional(Type.String({ minLength: 1 })),
+    verificationToken: Type.Optional(Type.String({ description: "Verification token (purpose: account_deletion), for passwordless/OAuth-only accounts" }))
+  }, {
+    minProperties: 2,
+    // email/phone + password|verificationToken
+    description: "Email or phone must be provided with password or verificationToken"
+  })
+}).use([rateLimitPolicy5("auth-deletion-cancel", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 50 }) }), Transactional4()]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  await cancelAccountDeletionService(body);
+  return c.noContent();
+});
+var deletionRouter = defineRouter5({
+  requestAccountDeletion,
+  cancelAccountDeletion
+});
+
 // src/server/routes/index.ts
-var mainAuthRouter = defineRouter5({
+var mainAuthRouter = defineRouter6({
   // Auth routes
   sendVerificationCode,
   verifyCode,
@@ -10108,6 +11550,9 @@ var mainAuthRouter = defineRouter5({
   getAuthSession,
   // One-Time Token routes
   issueOneTimeToken,
+  // Account deletion routes
+  requestAccountDeletion,
+  cancelAccountDeletion,
   // OAuth routes
   oauthGoogleStart,
   oauthGoogleCallback,
@@ -10458,6 +11903,7 @@ async function ensureAdminExists() {
 
 // src/server/lifecycle.ts
 function createAuthLifecycle(options = {}) {
+  configureDeletion(options.deletion);
   return {
     /**
      * Initialize auth system after database is ready
@@ -10474,15 +11920,42 @@ function createAuthLifecycle(options = {}) {
     }
   };
 }
+
+// src/server/jobs/deletion-purge.ts
+import { job, defineJobRouter } from "@spfn/core/job";
+function createAuthDeletionPurgeJob(cronExpression = DEFAULT_DELETION_PURGE_CRON) {
+  return job("auth.deletion.purge").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
+    const result = await sweepDuePurges();
+    if (result.processed > 0) {
+      authLogger.service.info("[auth.deletion.purge] sweep complete", result);
+    }
+  });
+}
+function createAuthDeletionJobRouter(options) {
+  return defineJobRouter({
+    deletionPurge: createAuthDeletionPurgeJob(options?.purgeCron)
+  });
+}
+var authJobRouter = createAuthDeletionJobRouter();
 export {
+  ACCOUNT_DELETION_REQUESTED_BY,
+  ACCOUNT_DELETION_REQUEST_STATUSES,
+  AccountDeletionRequestsRepository,
   AuthMetadataRepository,
   AuthProviderSchema,
   COOKIE_NAMES,
+  DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE,
+  DEFAULT_DELETION_GRACE_PERIOD_DAYS,
+  DEFAULT_DELETION_PURGE_CRON,
+  DEFAULT_DELETION_PURGE_STRATEGY,
+  DEFAULT_DELETION_SEND_NOTIFICATIONS,
   EmailSchema,
+  EnvironmentKeyringTokenCipher,
   INVITATION_STATUSES,
   InvitationsRepository,
   KEY_ALGORITHM,
   KeysRepository,
+  PURGE_STRATEGIES,
   PasswordSchema,
   PermissionsRepository,
   PhoneSchema,
@@ -10500,9 +11973,15 @@ export {
   VerificationCodesRepository,
   VerificationPurposeSchema,
   acceptInvitation,
+  accountDeletionRequests,
+  accountDeletionRequestsRepository,
   addPermissionToRole,
   appleProvider,
   assertCanAssignRole,
+  authDeletionCancelledEvent,
+  authDeletionCompletedEvent,
+  authDeletionRequestedEvent,
+  authJobRouter,
   authLogger,
   authLoginEvent,
   authMetadata,
@@ -10512,17 +11991,24 @@ export {
   authSchema,
   authenticate,
   buildOAuthErrorUrl,
+  cancelAccountDeletionService,
   cancelInvitation,
   changePasswordService,
   checkUsernameAvailableService,
   configureAuth,
+  configureDeletion,
+  configureOAuthTokenCipher,
+  createAuthDeletionJobRouter,
+  createAuthDeletionPurgeJob,
   createAuthLifecycle,
   createInvitation,
   createOAuthState,
   createRole,
   decodeToken,
+  decryptToken,
   deleteInvitation,
   deleteRole,
+  encryptToken,
   exchangeCodeForTokens,
   expireOldInvitations,
   generateClientToken,
@@ -10535,6 +12021,8 @@ export {
   getAuth,
   getAuthConfig,
   getAuthSessionService,
+  getDeletionConfig,
+  getDummyPasswordHash,
   getEnabledOAuthProviders,
   getGoogleAccessToken,
   getGoogleAuthUrl,
@@ -10548,6 +12036,7 @@ export {
   getOAuthProvider,
   getOneTimeTokenManager,
   getOptionalAuth,
+  getPendingDeletionInfo,
   getRegisteredProviders,
   getRole,
   getRoleByName,
@@ -10574,13 +12063,17 @@ export {
   invitationAcceptedEvent,
   invitationCreatedEvent,
   invitationsRepository,
+  isEncrypted,
   isGoogleOAuthEnabled,
   isOAuthProviderEnabled,
   issueOneTimeTokenService,
+  kakaoProvider,
   keysRepository,
   listInvitations,
   loginService,
   logoutService,
+  matchOAuthCsrfCookies,
+  naverProvider,
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,
@@ -10589,11 +12082,13 @@ export {
   parseDuration,
   permissions,
   permissionsRepository,
+  purgeUserService,
   refreshAccessToken,
   registerOAuthProvider,
   registerPublicKeyService,
   registerService,
   removePermissionFromRole,
+  requestAccountDeletionService,
   requireAnyPermission,
   requireEnabledProvider,
   requirePermissions,
@@ -10606,12 +12101,14 @@ export {
   roles,
   rolesRepository,
   rotateKeyService,
+  runBeforeRegister,
   sealSession,
   sendVerificationCodeService,
   setRolePermissions,
   shouldRefreshSession,
   shouldRotateKey,
   socialAccountsRepository,
+  sweepDuePurges,
   unsealSession,
   updateLastLoginService,
   updateLocaleService,