@spfn/auth 0.2.0-beta.8 → 0.2.0-beta.80

package/dist/server.d.ts

@@ -1,13 +1,20 @@
-import { k as AuthInitOptions, l as KeyAlgorithmType, n as InvitationStatus, f as VerificationPurpose, j as PermissionCategory, q as AuthContext } from './dto-lZmWuObc.js';
-export { B as ChangePasswordParams, w as CheckAccountExistsParams, C as CheckAccountExistsResult, X as EmailSchema, I as INVITATION_STATUSES, K as KEY_ALGORITHM, y as LoginParams, L as LoginResult, z as LogoutParams, Z as PasswordSchema, Y as PhoneSchema, x as RegisterParams, O as RegisterPublicKeyParams, b as RegisterResult, T as RevokeKeyParams, Q as RotateKeyParams, c as RotateKeyResult, e as SOCIAL_PROVIDERS, F as SendVerificationCodeParams, S as SendVerificationCodeResult, p as SocialProvider, _ as TargetTypeSchema, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, $ as VerificationPurposeSchema, V as VerificationTargetType, G as VerifyCodeParams, H as VerifyCodeResult, m as authRouter, W as authenticate, v as changePasswordService, r as checkAccountExistsService, t as loginService, u as logoutService, J as registerPublicKeyService, s as registerService, N as revokeKeyService, M as rotateKeyService, D as sendVerificationCodeService, E as verifyCodeService } from './dto-lZmWuObc.js';
+import { j as AuthInitOptions, k as OAuthProvider, e as VerificationPurpose, i as PermissionCategory, l as AuthContext } from './authenticate-ofdEmk6x.js';
+export { C as ChangePasswordParams, a3 as EmailSchema, I as IssueOneTimeTokenResult, s as LoginParams, L as LoginResult, t as LogoutParams, aa as NativeVerifyOptions, a8 as NormalizedIdentity, Z as OAuthCallbackParams, _ as OAuthCallbackResult, ab as OAuthCodeExchangeOptions, a0 as OAuthNativeParams, c as OAuthNativeResult, Y as OAuthStartParams, O as OAuthStartResult, a9 as OAuthTokens, a5 as PasswordSchema, a4 as PhoneSchema, q as RegisterParams, E as RegisterPublicKeyParams, a as RegisterResult, G as RevokeKeyParams, F as RotateKeyParams, b as RotateKeyResult, w as SendVerificationCodeParams, S as SendVerificationCodeResult, a6 as TargetTypeSchema, g as VERIFICATION_PURPOSES, f as VERIFICATION_TARGET_TYPES, a7 as VerificationPurposeSchema, V as VerificationTargetType, x as VerifyCodeParams, y as VerifyCodeResult, m as authRouter, a1 as authenticate, N as buildOAuthErrorUrl, p as changePasswordService, W as getEnabledOAuthProviders, X as getGoogleAccessToken, ad as getOAuthProvider, ae as getRegisteredProviders, Q as isOAuthProviderEnabled, H as issueOneTimeTokenService, n as loginService, o as logoutService, M as oauthCallbackService, $ as oauthNativeService, K as oauthStartService, a2 as optionalAuth, ac as registerOAuthProvider, z as registerPublicKeyService, r as registerService, T as requireEnabledProvider, D as revokeKeyService, B as rotateKeyService, u as sendVerificationCodeService, v as verifyCodeService, J as verifyOneTimeTokenService } from './authenticate-ofdEmk6x.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
+import { K as KeyAlgorithmType, c as InvitationStatus, e as SocialProvider, g as AccountDeletionRequestedBy, h as PurgeStrategy } from './types-1BMx0OX1.js';
+export { b as ACCOUNT_DELETION_REQUESTED_BY, A as ACCOUNT_DELETION_REQUEST_STATUSES, f as AccountDeletionRequestStatus, I as INVITATION_STATUSES, a as KEY_ALGORITHM, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, d as UserStatus } from './types-1BMx0OX1.js';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
 import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
 import { Algorithm } from 'jsonwebtoken';
+export { S as SessionData, g as getSessionInfo, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-CGxgH3C9.js';
+import { JWTPayload } from 'jose';
+import { SSETokenStore, SSETokenManager } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
-import '@sinclair/typebox';
+import * as _spfn_core_job from '@spfn/core/job';
+import * as _spfn_core_event from '@spfn/core/event';
+import * as _sinclair_typebox from '@sinclair/typebox';
 import '@spfn/auth/server';
 
 /**
@@ -27,6 +34,40 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "users";
     schema: string;
     columns: {
+        deletedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "deleted_at";
+            tableName: "users";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedBy: drizzle_orm_pg_core.PgColumn<{
+            name: "deleted_by";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: drizzle_orm_pg_core.PgColumn<{
             name: "created_at";
             tableName: "users";
@@ -78,6 +119,23 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        publicId: drizzle_orm_pg_core.PgColumn<{
+            name: "public_id";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         email: drizzle_orm_pg_core.PgColumn<{
             name: "email";
             tableName: "users";
@@ -112,6 +170,23 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        username: drizzle_orm_pg_core.PgColumn<{
+            name: "username";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         passwordHash: drizzle_orm_pg_core.PgColumn<{
             name: "password_hash";
             tableName: "users";
@@ -150,11 +225,11 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "users";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -168,14 +243,14 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "users";
             dataType: "string";
             columnType: "PgText";
-            data: "active" | "inactive" | "suspended";
+            data: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
             driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["active", "inactive", "suspended"] & [string, ...string[]];
+            enumValues: ["active", "inactive", "suspended", "pending_deletion", "deleted"] & [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -247,15 +322,19 @@ type NewUser = typeof users.$inferInsert;
  * Get user by ID
  */
 declare function getUserByIdService(userId: number): Promise<{
+    deletedAt: Date | null;
+    deletedBy: string | null;
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
+    username: string | null;
     passwordHash: string | null;
     passwordChangeRequired: boolean;
     roleId: number;
-    status: "active" | "inactive" | "suspended";
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
@@ -264,15 +343,19 @@ declare function getUserByIdService(userId: number): Promise<{
  * Get user by email
  */
 declare function getUserByEmailService(email: string): Promise<{
+    deletedAt: Date | null;
+    deletedBy: string | null;
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
+    username: string | null;
     passwordHash: string | null;
     passwordChangeRequired: boolean;
     roleId: number;
-    status: "active" | "inactive" | "suspended";
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
@@ -281,15 +364,19 @@ declare function getUserByEmailService(email: string): Promise<{
  * Get user by phone
  */
 declare function getUserByPhoneService(phone: string): Promise<{
+    deletedAt: Date | null;
+    deletedBy: string | null;
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
+    username: string | null;
     passwordHash: string | null;
     passwordChangeRequired: boolean;
     roleId: number;
-    status: "active" | "inactive" | "suspended";
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
@@ -302,17 +389,51 @@ declare function updateLastLoginService(userId: number): Promise<void>;
  * Update user data
  */
 declare function updateUserService(userId: number, updates: Partial<NewUser>): Promise<void>;
+/**
+ * Check if username is available
+ *
+ * @returns true if the username is available (not taken and not reserved)
+ */
+declare function checkUsernameAvailableService(username: string): Promise<boolean>;
+/**
+ * Update username with reserved word and duplicate check
+ *
+ * @param userId - User ID (string, number, or bigint)
+ * @param username - New username or null to clear
+ * @throws ReservedUsernameError if username is reserved
+ * @throws UsernameAlreadyTakenError if username is already in use by another user
+ */
+declare function updateUsernameService(userId: string | number | bigint, username: string | null): Promise<{
+    deletedAt: Date | null;
+    deletedBy: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    id: number;
+    publicId: string;
+    email: string | null;
+    phone: string | null;
+    username: string | null;
+    passwordHash: string | null;
+    passwordChangeRequired: boolean;
+    roleId: number;
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+    emailVerifiedAt: Date | null;
+    phoneVerifiedAt: Date | null;
+    lastLoginAt: Date | null;
+}>;
 
 /**
  * @spfn/auth - RBAC Initialization Service
  *
  * Initialize roles, permissions, and their mappings
+ * Uses hash-based change detection to skip unnecessary DB operations
  */
 
 /**
  * Initialize auth package with RBAC system
  *
- * Creates built-in roles, permissions, and custom configurations
+ * Creates built-in roles, permissions, and custom configurations.
+ * Uses hash-based change detection - skips DB operations when config is unchanged.
  *
  * @param options - Initialization options
  *
@@ -442,6 +563,24 @@ declare function hasRole(userId: string | number | bigint, roleName: string): Pr
  * @returns true if user has at least one role
  */
 declare function hasAnyRole(userId: string | number | bigint, roleNames: string[]): Promise<boolean>;
+/**
+ * Assert that the caller is allowed to assign the given role.
+ *
+ * Centralizes the privilege rule shared by direct role assignment and invitation:
+ * a non-superadmin caller may never grant the superadmin role, and may grant the
+ * admin role only when they hold the `admin:promote` permission. Assigning any
+ * lower role is unrestricted (the route's own permission guard still applies).
+ *
+ * @param callerUserId - User performing the assignment
+ * @param targetRoleId - Role being assigned
+ * @throws ForbiddenError when the caller lacks the authority for the target role
+ *
+ * @example
+ * ```typescript
+ * await assertCanAssignRole(auth.userId, body.roleId);
+ * ```
+ */
+declare function assertCanAssignRole(callerUserId: string | number | bigint, targetRoleId: number): Promise<void>;
 
 /**
  * @spfn/auth - Roles Entity
@@ -880,11 +1019,11 @@ declare const userInvitations: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_invitations";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -897,11 +1036,11 @@ declare const userInvitations: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_invitations";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -1032,6 +1171,7 @@ declare function createInvitation(params: {
     roleId: number;
     invitedBy: number;
     expiresInDays?: number;
+    expiresAt?: Date;
     metadata?: Record<string, any>;
 }): Promise<Invitation>;
 /**
@@ -1255,12 +1395,14 @@ declare function getAuthSessionService(userId: string | number | bigint): Promis
         id: number;
         name: string;
         displayName: string;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
     }[];
     userId: number;
+    publicId: string;
     email: string | null;
     emailVerified: boolean;
     phoneVerified: boolean;
+    hasPassword: boolean;
 }>;
 
 /**
@@ -1305,6 +1447,16 @@ interface UpdateProfileParams {
  * ```
  */
 declare function getUserProfileService(userId: string | number | bigint): Promise<UserProfile$1>;
+/**
+ * Update user locale
+ *
+ * @param userId - User ID
+ * @param locale - Locale code (e.g., 'en', 'ko', 'ja')
+ * @returns Updated locale
+ */
+declare function updateLocaleService(userId: string | number | bigint, locale: string): Promise<{
+    locale: string;
+}>;
 /**
  * Update user profile (upsert)
  *
@@ -1327,385 +1479,576 @@ declare function getUserProfileService(userId: string | number | bigint): Promis
 declare function updateUserProfileService(userId: string | number | bigint, params: UpdateProfileParams): Promise<ProfileInfo>;
 
 /**
- * @spfn/auth - Email Template Types
+ * Google OAuth 2.0 Client
  *
- * Type definitions for customizable email templates
- */
-/**
- * Common template result
+ * Authorization Code Flow 구현
+ * - getGoogleAuthUrl: Google 로그인 URL 생성
+ * - exchangeCodeForTokens: Code를 Token으로 교환
+ * - getGoogleUserInfo: 사용자 정보 조회
  */
-interface EmailTemplateResult {
-    subject: string;
-    text: string;
-    html: string;
+interface GoogleTokenResponse {
+    access_token: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope: string;
+    token_type: string;
+    id_token?: string;
 }
-/**
- * Verification code template parameters
- */
-interface VerificationCodeParams {
-    code: string;
-    purpose: 'registration' | 'login' | 'password_reset' | string;
-    expiresInMinutes?: number;
-    appName?: string;
+interface GoogleUserInfo {
+    id: string;
+    email: string;
+    verified_email: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    picture?: string;
+    locale?: string;
 }
 /**
- * Email template provider interface
- *
- * Implement this interface to create custom email templates
- *
- * @example
- * ```typescript
- * import { registerEmailTemplates } from '@spfn/auth/server';
- *
- * registerEmailTemplates({
- *     verificationCode: (params) => ({
- *         subject: 'Your Code',
- *         text: `Code: ${params.code}`,
- *         html: `<h1>Code: ${params.code}</h1>`,
- *     }),
- * });
- * ```
+ * Google OAuth가 활성화되어 있는지 확인
  */
-interface EmailTemplateProvider {
-    /**
-     * Verification code email template
-     */
-    verificationCode?(params: VerificationCodeParams): EmailTemplateResult;
-    /**
-     * Welcome email template (after registration)
-     */
-    welcome?(params: {
-        email: string;
-        appName?: string;
-    }): EmailTemplateResult;
-    /**
-     * Password reset email template
-     */
-    passwordReset?(params: {
-        resetLink: string;
-        expiresInMinutes?: number;
-        appName?: string;
-    }): EmailTemplateResult;
-    /**
-     * Invitation email template
-     */
-    invitation?(params: {
-        inviteLink: string;
-        inviterName?: string;
-        roleName?: string;
-        appName?: string;
-    }): EmailTemplateResult;
-}
-
+declare function isGoogleOAuthEnabled(): boolean;
 /**
- * @spfn/auth - Email Template Registry
- *
- * Manages custom email template registration and fallback to defaults
+ * Google OAuth 설정 가져오기
  */
-
+declare function getGoogleOAuthConfig(): {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+};
 /**
- * Register custom email templates
+ * Google 로그인 URL 생성
  *
- * Templates not provided will fall back to defaults
- *
- * @param templates - Custom template implementations
- *
- * @example
- * ```typescript
- * import { registerEmailTemplates } from '@spfn/auth/server';
- *
- * // Override verification code template with custom design
- * registerEmailTemplates({
- *     verificationCode: ({ code, purpose, expiresInMinutes }) => ({
- *         subject: `[MyApp] Your verification code`,
- *         text: `Your code is: ${code}`,
- *         html: `
- *             <div style="font-family: Arial;">
- *                 <h1>Welcome to MyApp!</h1>
- *                 <p>Your code: <strong>${code}</strong></p>
- *             </div>
- *         `,
- *     }),
- * });
- * ```
+ * @param state - CSRF 방지용 state 파라미터 (암호화된 returnUrl + nonce 포함)
+ * @param scopes - 요청할 OAuth scopes (기본: env 또는 email, profile)
  */
-declare function registerEmailTemplates(templates: Partial<EmailTemplateProvider>): void;
+declare function getGoogleAuthUrl(state: string, scopes?: string[]): string;
 /**
- * Get verification code template
+ * Authorization Code를 Token으로 교환
  *
- * Uses custom template if registered, otherwise falls back to default
- */
-declare function getVerificationCodeTemplate(params: VerificationCodeParams): EmailTemplateResult;
-/**
- * Get welcome template
+ * @param code - Google에서 받은 authorization code
  */
-declare function getWelcomeTemplate(params: {
-    email: string;
-    appName?: string;
-}): EmailTemplateResult;
+declare function exchangeCodeForTokens(code: string): Promise<GoogleTokenResponse>;
 /**
- * Get password reset template
+ * Access Token으로 Google 사용자 정보 조회
+ *
+ * @param accessToken - Google access token
  */
-declare function getPasswordResetTemplate(params: {
-    resetLink: string;
-    expiresInMinutes?: number;
-    appName?: string;
-}): EmailTemplateResult;
+declare function getGoogleUserInfo(accessToken: string): Promise<GoogleUserInfo>;
 /**
- * Get invitation template
+ * Refresh Token으로 새 Access Token 획득
+ *
+ * @param refreshToken - Google refresh token
  */
-declare function getInvitationTemplate(params: {
-    inviteLink: string;
-    inviterName?: string;
-    roleName?: string;
-    appName?: string;
-}): EmailTemplateResult;
+declare function refreshAccessToken(refreshToken: string): Promise<GoogleTokenResponse>;
 
 /**
- * @spfn/auth - Email Service Types
+ * OAuth State Management
  *
- * Type definitions for email sending service
- */
-/**
- * Parameters for sending email
+ * CSRF 방지를 위한 state 파라미터 암호화/복호화
+ * - returnUrl: OAuth 성공 후 리다이렉트할 URL
+ * - nonce: CSRF 방지용 일회용 토큰
+ * - provider: OAuth provider (google, github 등)
+ * - publicKey, keyId, fingerprint, algorithm: 클라이언트 키 정보
+ * - expiresAt: state 만료 시간
  */
-interface SendEmailParams {
-    /**
-     * Recipient email address
-     */
-    to: string;
-    /**
-     * Email subject
-     */
-    subject: string;
-    /**
-     * Plain text content
-     */
-    text?: string;
-    /**
-     * HTML content
-     */
-    html?: string;
-    /**
-     * Purpose of the email (for logging)
-     */
-    purpose?: string;
+
+interface OAuthState {
+    returnUrl: string;
+    nonce: string;
+    provider: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm: KeyAlgorithmType;
+    metadata?: Record<string, unknown>;
 }
 /**
- * Result of sending email
+ * Generate a CSRF nonce for the OAuth flow. The caller passes it to
+ * createOAuthState AND sets it as the oauth_csrf cookie, so the callback can
+ * double-submit-verify the flow was initiated by this same browser.
  */
-interface SendEmailResult {
-    /**
-     * Whether email was sent successfully
-     */
-    success: boolean;
-    /**
-     * Message ID from email provider (if successful)
-     */
-    messageId?: string;
+declare function generateOAuthNonce(): string;
+interface CreateOAuthStateParams {
+    provider: string;
+    returnUrl: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm: KeyAlgorithmType;
+    metadata?: Record<string, unknown>;
     /**
-     * Error message (if failed)
+     * CSRF nonce bound into the state. Pass the same value as the oauth_csrf
+     * cookie. Defaults to a fresh nonce (unbound — legacy/no-CSRF callers).
      */
-    error?: string;
+    nonce?: string;
 }
 /**
- * Email Provider Interface
- *
- * Implement this interface to create custom email providers
- *
- * @example
- * ```typescript
- * import { EmailProvider, registerEmailProvider } from '@spfn/auth/server/services/email';
- *
- * const sendgridProvider: EmailProvider = {
- *     name: 'sendgrid',
- *     sendEmail: async (params) => {
- *         // Your SendGrid implementation
- *         return { success: true, messageId: '...' };
- *     }
- * };
+ * OAuth state 생성 및 암호화
  *
- * registerEmailProvider(sendgridProvider);
- * ```
+ * @param params - state 생성에 필요한 파라미터
+ * @returns 암호화된 state 문자열
  */
-interface EmailProvider {
-    /**
-     * Provider name (e.g., 'aws-ses', 'sendgrid', 'custom')
-     */
-    name: string;
-    /**
-     * Send email via this provider
-     *
-     * @param params - Email parameters
-     * @returns Send result
-     */
-    sendEmail(params: SendEmailParams): Promise<SendEmailResult>;
-}
-
+declare function createOAuthState(params: CreateOAuthStateParams): Promise<string>;
 /**
- * @spfn/auth - Email Provider Management
+ * OAuth state 복호화 및 검증
  *
- * Manages email provider registration and fallback behavior
+ * @param encryptedState - 암호화된 state 문자열
+ * @returns 복호화된 state 객체
+ * @throws Error if state is invalid or expired (JWE exp claim으로 자동 검증)
  */
+declare function verifyOAuthState(encryptedState: string): Promise<OAuthState>;
 
 /**
- * Register a custom email provider
- *
- * @param provider - Custom email provider implementation
- *
- * @example
- * ```typescript
- * import { registerEmailProvider } from '@spfn/auth/server/services/email';
- *
- * const sendgridProvider = {
- *     name: 'sendgrid',
- *     sendEmail: async (params) => {
- *         // SendGrid implementation
- *         return { success: true, messageId: '...' };
- *     }
- * };
- *
- * registerEmailProvider(sendgridProvider);
- * ```
- */
-declare function registerEmailProvider(provider: EmailProvider): void;
-/**
- * Send email using the registered provider
+ * 소셜 provider id_token JWKS 검증
  *
- * Falls back to development mode (console only) if no provider is registered
- *
- * @param params - Email parameters
- * @returns Send result
+ * 네이티브/웹 SDK가 받은 id_token을 provider의 공개키(JWKS)로 검증한다.
+ * authorization code 교환이 없으므로 client secret을 쓰지 않는다.
+ * 서명·issuer·audience·만료는 jose가, nonce는 여기서 직접 대조한다.
  */
-declare function sendEmail(params: SendEmailParams): Promise<SendEmailResult>;
 
-/**
- * @spfn/auth - SMS Service Types
- *
- * Type definitions for SMS sending service
- */
-/**
- * Parameters for sending SMS
- */
-interface SendSMSParams {
-    /**
-     * Phone number in E.164 format (e.g., +821012345678)
-     */
-    phone: string;
-    /**
-     * SMS message content
-     */
-    message: string;
-    /**
-     * Purpose of the SMS (for logging)
-     */
-    purpose?: string;
+interface VerifyIdTokenParams {
+    idToken: string;
+    jwksUri: string;
+    issuer: string | string[];
+    audiences: string[];
+    /** 허용 서명 알고리즘 화이트리스트(alg confusion 방어). Google/Apple은 'RS256'. */
+    algorithms: string[];
+    /** id_token의 nonce claim과 정확히 일치해야 하는 값(provider별로 raw 또는 SHA-256 해시). */
+    expectedNonce: string;
 }
 /**
- * Result of sending SMS
+ * id_token을 검증하고 claims(payload)를 반환한다.
+ *
+ * @throws InvalidSocialTokenError 서명/issuer/audience/만료/알고리즘/nonce/sub 검증 실패 시
  */
-interface SendSMSResult {
-    /**
-     * Whether SMS was sent successfully
-     */
-    success: boolean;
-    /**
-     * Message ID from SMS provider (if successful)
-     */
-    messageId?: string;
-    /**
-     * Error message (if failed)
-     */
-    error?: string;
-}
+declare function verifyIdToken(params: VerifyIdTokenParams): Promise<JWTPayload>;
+
 /**
- * SMS Provider Interface
+ * @spfn/auth - Social Token At-Rest Encryption
  *
- * Implement this interface to create custom SMS providers
+ * OAuth access/refresh tokens are encrypted with a backend-only rotating keyring.
+ * The active key is the first entry in SPFN_AUTH_TOKEN_ENCRYPTION_KEYS; remaining
+ * keys are decrypt-only grace keys. Ciphertext is bound to its provider account
+ * and token type with AES-GCM additional authenticated data (AAD).
  *
- * @example
- * ```typescript
- * import { SMSProvider, registerSMSProvider } from '@spfn/auth/server/services/sms';
- *
- * const twilioProvider: SMSProvider = {
- *     name: 'twilio',
- *     sendSMS: async (params) => {
- *         // Your Twilio implementation
- *         return { success: true, messageId: '...' };
- *     }
- * };
+ * v2 format: enc:v2:<keyId>:<base64url(iv | authTag | ciphertext)>
+ * v1 format: enc:v1:<base64(iv | authTag | ciphertext)> (legacy session-secret key)
  *
- * registerSMSProvider(twilioProvider);
- * ```
+ * Never include token or key material in logs or error messages.
  */
-interface SMSProvider {
-    /**
-     * Provider name (e.g., 'aws-sns', 'twilio', 'custom')
-     */
-    name: string;
-    /**
-     * Send SMS via this provider
-     *
-     * @param params - SMS parameters
-     * @returns Send result
-     */
-    sendSMS(params: SendSMSParams): Promise<SendSMSResult>;
+
+type OAuthTokenType = 'access' | 'refresh';
+interface OAuthTokenContext {
+    provider: SocialProvider;
+    providerUserId: string;
+    tokenType: OAuthTokenType;
 }
+interface DecryptedOAuthToken {
+    value: string;
+    /** True for plaintext, v1, or ciphertext encrypted with a non-active v2 key. */
+    needsRotation: boolean;
+}
+interface OAuthTokenCipher {
+    encrypt(value: string, context: OAuthTokenContext): Promise<string>;
+    decrypt(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
+}
+declare class EnvironmentKeyringTokenCipher implements OAuthTokenCipher {
+    encrypt(value: string, context: OAuthTokenContext): Promise<string>;
+    decrypt(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
+}
+/** Configure an external/KMS-backed cipher before the auth server starts. */
+declare function configureOAuthTokenCipher(cipher: OAuthTokenCipher): void;
+declare function encryptToken(value: string, context: OAuthTokenContext): Promise<string>;
+declare function decryptToken(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
+declare function isEncrypted(value: string): boolean;
 
 /**
- * @spfn/auth - SMS Provider Management
+ * Google OAuthProvider 구현
+ *
+ * 기존 google.ts의 함수를 OAuthProvider 인터페이스로 래핑한다.
+ * google.ts 자체는 그대로 유지(테스트·google 전용 route가 직접 의존).
  *
- * Manages SMS provider registration and fallback behavior
+ * 이 모듈을 import 하는 것만으로 google provider가 registry에 자기 등록된다.
  */
 
+declare const googleProvider: OAuthProvider;
+
 /**
- * Register a custom SMS provider
- *
- * @param provider - Custom SMS provider implementation
- *
- * @example
- * ```typescript
- * import { registerSMSProvider } from '@spfn/auth/server/services/sms';
- *
- * const twilioProvider = {
- *     name: 'twilio',
- *     sendSMS: async (params) => {
- *         // Twilio implementation
- *         return { success: true, messageId: '...' };
- *     }
- * };
+ * Apple OAuthProvider 구현 (native id_token 검증 전용)
  *
- * registerSMSProvider(twilioProvider);
- * ```
- */
-declare function registerSMSProvider(provider: SMSProvider): void;
-/**
- * Send SMS using the registered provider
+ * Apple은 Android·웹에 네이티브 SDK를 제공하지 않으므로, web 흐름(Sign in with Apple JS,
+ * Android Custom Tab)도 결국 id_token을 클라이언트가 받아 서버로 보낸다. 서버는 그 id_token을
+ * Apple JWKS로 검증만 한다(authorization code 교환·client secret 없음).
  *
- * Falls back to development mode (console only) if no provider is registered
+ * 따라서 web 메서드(getAuthUrl/exchangeCodeForTokens/getUserInfo)는 지원하지 않는다.
  *
- * @param params - SMS parameters
- * @returns Send result
+ * 이 모듈을 import 하는 것만으로 apple provider가 registry에 자기 등록된다.
  */
-declare function sendSMS(params: SendSMSParams): Promise<SendSMSResult>;
+
+declare const appleProvider: OAuthProvider;
 
 /**
- * @spfn/auth - Database Schema Definition
- *
- * Defines the 'spfn_auth' PostgreSQL schema for all auth-related tables
+ * Kakao Login OAuthProvider (web authorization-code flow).
  */
+
+declare const kakaoProvider: OAuthProvider;
+
 /**
- * Auth schema for all authentication and authorization tables
- * Tables: users, roles, permissions, user_invitations, etc.
+ * Naver Login OAuthProvider (web authorization-code flow).
  */
-declare const authSchema: drizzle_orm_pg_core.PgSchema<string>;
+
+declare const naverProvider: OAuthProvider;
 
 /**
- * @spfn/auth - User Profiles Entity
- *
- * User profile information (separate from authentication data)
+ * @spfn/auth - Account Deletion Requests Entity
  *
- * Features:
+ * Audit trail for account deletion/recovery. Rows are never deleted — even after
+ * a hard-delete purge — so "who requested/recovered/purged what, when" survives
+ * the user row itself (개인정보보호법 제21조 3항 분리 보존 원칙).
+ */
+declare const accountDeletionRequests: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "account_deletion_requests";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "created_at";
+            tableName: "account_deletion_requests";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "updated_at";
+            tableName: "account_deletion_requests";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        id: drizzle_orm_pg_core.PgColumn<{
+            name: "id";
+            tableName: "account_deletion_requests";
+            dataType: "number";
+            columnType: "PgBigSerial53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: drizzle_orm_pg_core.PgColumn<{
+            name: `${string}_id`;
+            tableName: "account_deletion_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userPublicId: drizzle_orm_pg_core.PgColumn<{
+            name: "user_public_id";
+            tableName: "account_deletion_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestedAt: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        purgeScheduledAt: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: "pending" | "cancelled" | "completed";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["pending", "cancelled", "completed"] & [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestedBy: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: "admin" | "self";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["self", "admin"] & [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reason: drizzle_orm_pg_core.PgColumn<{
+            name: "reason";
+            tableName: "account_deletion_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        cancelledAt: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        completedAt: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        purgeStrategy: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "account_deletion_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: "anonymize" | "hard-delete";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["anonymize", "hard-delete"] & [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+type AccountDeletionRequest = typeof accountDeletionRequests.$inferSelect;
+type NewAccountDeletionRequest = typeof accountDeletionRequests.$inferInsert;
+
+/**
+ * @spfn/auth - Account Deletion Service
+ *
+ * Request / cancel (recovery) / purge for the account deletion lifecycle.
+ *
+ * Lifecycle:
+ *   active --request(reauth)--> pending_deletion --grace expires(cron)--> deleted (anonymize) | row removed (hard-delete)
+ *     ^                              |
+ *     +-------cancel(reauth)---------+          immediate = grace period of 0, same pipeline
+ */
+
+interface PendingDeletionInfo {
+    purgeScheduledAt: Date;
+}
+/**
+ * Look up the pending deletion request's `purgeScheduledAt` for a `pending_deletion`
+ * user, so login/OAuth/authenticate can surface it on `AccountPendingDeletionError`.
+ * Returns null if there is no pending row (shouldn't normally happen for a user in
+ * that status, but the caller falls back to an error without the date).
+ *
+ * Reads from the write primary, not a replica — this backs the same status gates
+ * that decide whether to grant a session, so a replica-lag window must not let a
+ * just-requested deletion go unnoticed.
+ */
+declare function getPendingDeletionInfo(userId: number): Promise<PendingDeletionInfo | null>;
+interface RequestAccountDeletionParams {
+    /** Who initiated this — 'self' requires re-auth via password/verificationToken; 'admin' does not. */
+    requestedBy: AccountDeletionRequestedBy;
+    password?: string;
+    verificationToken?: string;
+    reason?: string;
+    /** Skip the grace period and purge inline. Self-service requires `deletion.allowSelfImmediate`. */
+    immediate?: boolean;
+}
+interface RequestAccountDeletionResult {
+    requestId: number;
+    purgeScheduledAt: Date;
+}
+/**
+ * Request account deletion (self-service re-auth gate, or trusted admin/DSR call).
+ *
+ * Sets status -> 'pending_deletion', records the request, revokes every active
+ * session key, and (after commit) emits `auth.deletion.requested` and sends the
+ * request-received notice. With a zero grace period (explicit `immediate: true`,
+ * gated for self-service by `allowSelfImmediate`), purges inline instead of
+ * waiting for the cron sweep.
+ */
+declare function requestAccountDeletionService(userId: number, params: RequestAccountDeletionParams): Promise<RequestAccountDeletionResult>;
+interface CancelAccountDeletionParams {
+    email?: string;
+    phone?: string;
+    password?: string;
+    verificationToken?: string;
+}
+interface CancelAccountDeletionResult {
+    userId: string;
+}
+/**
+ * Cancel a pending deletion (recovery). All sessions were revoked at request
+ * time, so this is credential-based (no Bearer token) rather than auth-context-based.
+ *
+ * Credential verification always runs before the caller learns whether the
+ * account exists / is pending deletion — otherwise this endpoint could be used
+ * to enumerate accounts or probe deletion status without a valid credential,
+ * the same posture `loginService` takes for missing accounts.
+ *
+ * Claims the `account_deletion_requests` row (conditional `WHERE status =
+ * 'pending'`) before touching `users` — see the comment at that claim below for
+ * why the `users` row must not move until the claim succeeds.
+ */
+declare function cancelAccountDeletionService(params: CancelAccountDeletionParams): Promise<CancelAccountDeletionResult>;
+interface PurgeUserResult {
+    outcome: 'purged' | 'skipped' | 'not-found';
+}
+/**
+ * Purge a user's pending deletion request immediately, ignoring `purgeScheduledAt`.
+ * Admin/GDPR-response entry point — the route (if any) belongs to the app.
+ *
+ * @throws DeletionNotRequestedError if the user has no pending request
+ */
+declare function purgeUserService(userId: number): Promise<PurgeUserResult>;
+interface SweepDuePurgesResult {
+    processed: number;
+    purged: number;
+    skipped: number;
+}
+/**
+ * Sweep every request whose grace period has elapsed and purge it. Called by the
+ * `auth.deletion.purge` cron job. One user's failure (thrown error, not just an
+ * `onBeforePurge` skip) is logged and does not stop the rest of the sweep — it
+ * stays `pending` and is retried on the next tick.
+ */
+declare function sweepDuePurges(now?: Date): Promise<SweepDuePurgesResult>;
+
+/**
+ * @spfn/auth - Database Schema Definition
+ *
+ * Defines the 'spfn_auth' PostgreSQL schema for all auth-related tables
+ */
+/**
+ * Auth schema for all authentication and authorization tables
+ * Tables: users, roles, permissions, user_invitations, etc.
+ */
+declare const authSchema: drizzle_orm_pg_core.PgSchema<string>;
+
+/**
+ * @spfn/auth - User Profiles Entity
+ *
+ * User profile information (separate from authentication data)
+ *
+ * Features:
  * - Display name and personal information
  * - Avatar and bio
  * - Locale and timezone preferences
@@ -1771,11 +2114,11 @@ declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_profiles";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -1791,7 +2134,7 @@ declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2065,11 +2408,11 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_public_keys";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2318,11 +2661,11 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_social_accounts";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2336,14 +2679,14 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "user_social_accounts";
             dataType: "string";
             columnType: "PgText";
-            data: "google" | "github" | "kakao" | "naver";
+            data: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["google", "github", "kakao", "naver"] & [string, ...string[]];
+            enumValues: ["google", "apple", "github", "kakao", "naver", "superself"] & [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -2556,14 +2899,14 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "verification_codes";
             dataType: "string";
             columnType: "PgText";
-            data: "registration" | "login" | "password_reset" | "email_change" | "phone_change";
+            data: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["registration", "login", "password_reset", "email_change", "phone_change"] & [string, ...string[]];
+            enumValues: ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"] & [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -2747,7 +3090,7 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "permissions";
             dataType: "string";
             columnType: "PgText";
-            data: "custom" | "user" | "auth" | "rbac" | "system";
+            data: "auth" | "custom" | "user" | "rbac" | "system";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -2905,11 +3248,11 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "role_permissions";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2922,11 +3265,11 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "role_permissions";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3014,11 +3357,11 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_permissions";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3031,11 +3374,11 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             name: `${string}_id`;
             tableName: "user_permissions";
             dataType: "number";
-            columnType: "PgBigSerial53";
+            columnType: "PgBigInt53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3101,6 +3444,73 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
 type UserPermission = typeof userPermissions.$inferSelect;
 type NewUserPermission = typeof userPermissions.$inferInsert;
 
+/**
+ * @spfn/auth - Auth Metadata Entity
+ *
+ * Key-value store for auth system metadata
+ * Used for storing RBAC config hash and other system-level settings
+ */
+declare const authMetadata: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "auth_metadata";
+    schema: string;
+    columns: {
+        key: drizzle_orm_pg_core.PgColumn<{
+            name: "key";
+            tableName: "auth_metadata";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        value: drizzle_orm_pg_core.PgColumn<{
+            name: "value";
+            tableName: "auth_metadata";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "updated_at";
+            tableName: "auth_metadata";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+type AuthMetadataEntity = typeof authMetadata.$inferSelect;
+type NewAuthMetadataEntity = typeof authMetadata.$inferInsert;
+
 /**
  * Users Repository
  *
@@ -3122,15 +3532,44 @@ declare class UsersRepository extends BaseRepository {
      * Read replica 사용
      */
     findById(id: number): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    /**
+     * ID로 사용자 조회 — Write primary에서 직접 읽는다.
+     *
+     * 복제 지연 창에서 status 전이(예: 삭제 요청으로 pending_deletion 전환)를 놓치면
+     * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
+     * 계속 사용할 것.
+     */
+    findByIdOnPrimary(id: number): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3140,15 +3579,19 @@ declare class UsersRepository extends BaseRepository {
      * Read replica 사용
      */
     findByEmail(email: string): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3158,15 +3601,63 @@ declare class UsersRepository extends BaseRepository {
      * Read replica 사용
      */
     findByPhone(phone: string): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    /**
+     * 사용자명으로 사용자 조회
+     * Read replica 사용
+     */
+    findByUsername(username: string): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    /**
+     * Public ID(UUID)로 사용자 조회
+     * Read replica 사용
+     */
+    findByPublicId(publicId: string): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3176,19 +3667,54 @@ declare class UsersRepository extends BaseRepository {
      * Read replica 사용
      */
     findByEmailOrPhone(email?: string, phone?: string): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
     } | null>;
+    /**
+     * ID로 사용자 + Role 조회 (leftJoin)
+     * Read replica 사용
+     *
+     * roleId가 null인 유저는 role: null 반환
+     */
+    findByIdWithRole(id: number): Promise<{
+        user: {
+            deletedAt: Date | null;
+            deletedBy: string | null;
+            createdAt: Date;
+            updatedAt: Date;
+            id: number;
+            publicId: string;
+            email: string | null;
+            phone: string | null;
+            username: string | null;
+            passwordHash: string | null;
+            passwordChangeRequired: boolean;
+            roleId: number;
+            status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+            emailVerifiedAt: Date | null;
+            phoneVerifiedAt: Date | null;
+            lastLoginAt: Date | null;
+        };
+        role: {
+            name: string;
+            displayName: string;
+            priority: number;
+        } | null;
+    } | null>;
     /**
      * 사용자 생성
      * Write primary 사용
@@ -3196,31 +3722,66 @@ declare class UsersRepository extends BaseRepository {
     create(data: NewUser): Promise<{
         email: string | null;
         phone: string | null;
-        status: "active" | "inactive" | "suspended";
         id: number;
-        createdAt: Date;
-        updatedAt: Date;
+        publicId: string;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
+        createdAt: Date;
+        updatedAt: Date;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
+        deletedAt: Date | null;
+        deletedBy: string | null;
     }>;
     /**
      * 사용자 정보 업데이트
      * Write primary 사용
      */
     updateById(id: number, data: Partial<NewUser>): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    /**
+     * 계정 삭제 취소(복구) — `WHERE status = 'pending_deletion'` 조건부 UPDATE.
+     *
+     * cancelAccountDeletionService가 account_deletion_requests claim(조건부
+     * markCancelled)에 성공한 **이후에만** 호출한다. 그 claim이 이미 purge와의
+     * 경합을 해결하므로 이 조건은 방어적 이중 안전장치 — 0 row 매치(= 이미
+     * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
+     * Write primary 사용
+     */
+    reactivateFromPendingDeletion(id: number): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3230,15 +3791,19 @@ declare class UsersRepository extends BaseRepository {
      * Write primary 사용
      */
     updatePassword(id: number, passwordHash: string, clearPasswordChangeRequired?: boolean): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3248,15 +3813,19 @@ declare class UsersRepository extends BaseRepository {
      * Write primary 사용
      */
     updateLastLogin(id: number): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -3268,16 +3837,20 @@ declare class UsersRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string | null;
         phone: string | null;
-        status: "active" | "inactive" | "suspended";
         id: number;
-        createdAt: Date;
-        updatedAt: Date;
+        publicId: string;
+        username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
+        createdAt: Date;
+        updatedAt: Date;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
+        deletedAt: Date | null;
+        deletedBy: string | null;
     }>;
     /**
      * User의 Role과 Permissions 조회 (JOIN)
@@ -3297,7 +3870,7 @@ declare class UsersRepository extends BaseRepository {
             id: number;
             name: string;
             displayName: string;
-            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
+            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
         }[];
     }>;
     /**
@@ -3309,9 +3882,12 @@ declare class UsersRepository extends BaseRepository {
      */
     fetchMinimalUserData(userId: number): Promise<{
         userId: number;
+        publicId: string;
         email: string | null;
+        username: string | null;
         isEmailVerified: boolean;
         isPhoneVerified: boolean;
+        hasPassword: boolean;
     }>;
     /**
      * Full user data 조회 (user profile용)
@@ -3322,7 +3898,9 @@ declare class UsersRepository extends BaseRepository {
      */
     fetchFullUserData(userId: number): Promise<{
         userId: number;
+        publicId: string;
         email: string | null;
+        username: string | null;
         isEmailVerified: boolean;
         isPhoneVerified: boolean;
         lastLoginAt: Date | null;
@@ -3407,24 +3985,45 @@ declare class KeysRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewUserPublicKey): Promise<{
-        userId: number;
+        publicKey: string;
         keyId: string;
+        fingerprint: string;
+        algorithm: "ES256" | "RS256";
+        userId: number;
         id: number;
         isActive: boolean;
         createdAt: Date;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }>;
+    /**
+     * 공개키 revoke (비활성화)
+     * Write primary 사용
+     */
+    revokeByKeyIdAndUserId(keyId: string, userId: number, reason: string): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        isActive: boolean;
+        createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
         revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
-     * 공개키 revoke (비활성화)
+     * 사용자의 모든 활성 공개키 revoke (비활성화)
+     *
+     * 비번 변경 시 전체 세션 로그아웃에 사용. authenticate는 활성 키만 검증하므로,
+     * revoke된 키로 서명한 기존 세션의 요청은 즉시 401이 된다.
      * Write primary 사용
      */
-    revokeByKeyIdAndUserId(keyId: string, userId: number, reason: string): Promise<{
+    revokeAllActiveByUserId(userId: number, reason: string): Promise<{
         id: number;
         userId: number;
         keyId: string;
@@ -3437,25 +4036,33 @@ declare class KeysRepository extends BaseRepository {
         expiresAt: Date | null;
         revokedAt: Date | null;
         revokedReason: string | null;
-    }>;
+    }[]>;
     /**
      * 공개키 삭제
      * Write primary 사용
      */
     deleteByKeyIdAndUserId(keyId: string, userId: number): Promise<{
-        userId: number;
+        publicKey: string;
         keyId: string;
+        fingerprint: string;
+        algorithm: "ES256" | "RS256";
+        userId: number;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        publicKey: string;
-        algorithm: "ES256" | "RS256";
-        fingerprint: string;
-        lastUsedAt: Date | null;
         expiresAt: Date | null;
+        lastUsedAt: Date | null;
         revokedAt: Date | null;
         revokedReason: string | null;
     }>;
+    /**
+     * 사용자의 모든 공개키 삭제 (계정 익명화 파기용)
+     *
+     * hard-delete는 FK cascade로 자동 처리되지만, anonymize 모드는 users row를
+     * 남기므로 자식 row를 직접 지워야 한다.
+     * Write primary 사용
+     */
+    deleteAllByUserId(userId: number): Promise<number>;
     /**
      * 마지막 사용 시간 업데이트
      * Write primary 사용
@@ -3494,22 +4101,14 @@ declare class KeysRepository extends BaseRepository {
     }>;
     /**
      * Primary key로 마지막 사용 시간 업데이트 (authenticate용)
-     * Write primary 사용
+     * Write primary 사용.
+     *
+     * Throttled: only writes when lastUsedAt is stale (older than
+     * LAST_USED_THROTTLE_MS), so a busy key isn't UPDATEd on every request. The
+     * throttle lives in the WHERE clause — atomic, no read-then-write race. No
+     * RETURNING (callers fire-and-forget and discard the row).
      */
-    updateLastUsedById(id: number): Promise<{
-        id: number;
-        userId: number;
-        keyId: string;
-        publicKey: string;
-        algorithm: "ES256" | "RS256";
-        fingerprint: string;
-        isActive: boolean;
-        createdAt: Date;
-        lastUsedAt: Date | null;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
-        revokedReason: string | null;
-    }>;
+    updateLastUsedById(id: number): Promise<void>;
 }
 declare const keysRepository: KeysRepository;
 
@@ -3541,7 +4140,7 @@ declare class VerificationCodesRepository extends BaseRepository {
         target: string;
         targetType: "email" | "phone";
         code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         expiresAt: Date;
         usedAt: Date | null;
         attempts: number;
@@ -3557,7 +4156,7 @@ declare class VerificationCodesRepository extends BaseRepository {
         target: string;
         targetType: "email" | "phone";
         code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         expiresAt: Date;
         usedAt: Date | null;
         attempts: number;
@@ -3567,14 +4166,14 @@ declare class VerificationCodesRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewVerificationCode): Promise<{
+        target: string;
+        targetType: "email" | "phone";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        code: string;
         id: number;
         createdAt: Date;
         updatedAt: Date;
         expiresAt: Date;
-        target: string;
-        targetType: "email" | "phone";
-        code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change";
         usedAt: Date | null;
         attempts: number;
     }>;
@@ -3589,7 +4188,7 @@ declare class VerificationCodesRepository extends BaseRepository {
         target: string;
         targetType: "email" | "phone";
         code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         expiresAt: Date;
         usedAt: Date | null;
         attempts: number;
@@ -3605,7 +4204,7 @@ declare class VerificationCodesRepository extends BaseRepository {
         target: string;
         targetType: "email" | "phone";
         code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         expiresAt: Date;
         usedAt: Date | null;
         attempts: number;
@@ -3615,6 +4214,14 @@ declare class VerificationCodesRepository extends BaseRepository {
      * Write primary 사용
      */
     deleteExpired(): Promise<number>;
+    /**
+     * Target(email/phone)의 모든 인증 코드 삭제 (계정 파기용)
+     *
+     * verificationCodes는 userId FK가 없고 target 텍스트로만 연결되므로, 파기 시
+     * 원래 email/phone을 이 메서드로 직접 정리해야 한다.
+     * Write primary 사용
+     */
+    deleteByTarget(target: string): Promise<number>;
     /**
      * Target의 모든 이전 코드 무효화 (새 코드 발급 시)
      * Write primary 사용
@@ -3763,7 +4370,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -3779,7 +4386,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -3819,7 +4426,7 @@ declare class PermissionsRepository extends BaseRepository {
         name: string;
         displayName: string;
         description: string | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
         isBuiltin: boolean;
         isSystem: boolean;
         isActive: boolean;
@@ -3830,6 +4437,7 @@ declare class PermissionsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         description: string | null;
+        metadata: Record<string, any> | null;
         id: number;
         name: string;
         displayName: string;
@@ -3838,8 +4446,7 @@ declare class PermissionsRepository extends BaseRepository {
         isActive: boolean;
         createdAt: Date;
         updatedAt: Date;
-        metadata: Record<string, any> | null;
-        category: "custom" | "user" | "auth" | "rbac" | "system" | null;
+        category: "auth" | "custom" | "user" | "rbac" | "system" | null;
     }>;
 }
 declare const permissionsRepository: PermissionsRepository;
@@ -3884,9 +4491,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     createMany(data: NewRolePermission[]): Promise<{
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
         permissionId: number;
     }[]>;
     /**
@@ -3902,9 +4509,9 @@ declare class RolePermissionsRepository extends BaseRepository {
      */
     setPermissionsForRole(roleId: number, permissionIds: number[]): Promise<{
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
         permissionId: number;
     }[]>;
 }
@@ -3969,10 +4576,10 @@ declare class UserPermissionsRepository extends BaseRepository {
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        expiresAt: Date | null;
         permissionId: number;
-        granted: boolean;
         reason: string | null;
+        expiresAt: Date | null;
+        granted: boolean;
     }>;
     /**
      * 사용자 권한 오버라이드 업데이트
@@ -3995,10 +4602,10 @@ declare class UserPermissionsRepository extends BaseRepository {
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        expiresAt: Date | null;
         permissionId: number;
-        granted: boolean;
         reason: string | null;
+        expiresAt: Date | null;
+        granted: boolean;
     }>;
     /**
      * 사용자의 모든 권한 오버라이드 삭제
@@ -4030,7 +4637,7 @@ declare class UserProfilesRepository extends BaseRepository {
         updatedAt: Date;
         id: number;
         userId: number;
-        displayName: string;
+        displayName: string | null;
         firstName: string | null;
         lastName: string | null;
         avatarUrl: string | null;
@@ -4045,6 +4652,10 @@ declare class UserProfilesRepository extends BaseRepository {
         jobTitle: string | null;
         metadata: Record<string, any> | null;
     }>;
+    /**
+     * User ID로 locale만 조회 (경량)
+     */
+    findLocaleByUserId(userId: number): Promise<string>;
     /**
      * User ID로 프로필 조회
      */
@@ -4053,7 +4664,7 @@ declare class UserProfilesRepository extends BaseRepository {
         updatedAt: Date;
         id: number;
         userId: number;
-        displayName: string;
+        displayName: string | null;
         firstName: string | null;
         lastName: string | null;
         avatarUrl: string | null;
@@ -4072,9 +4683,10 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 생성
      */
     create(data: NewUserProfile): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
-        displayName: string;
+        displayName: string | null;
         createdAt: Date;
         updatedAt: Date;
         firstName: string | null;
@@ -4089,7 +4701,6 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 업데이트 (by ID)
@@ -4099,7 +4710,7 @@ declare class UserProfilesRepository extends BaseRepository {
         updatedAt: Date;
         id: number;
         userId: number;
-        displayName: string;
+        displayName: string | null;
         firstName: string | null;
         lastName: string | null;
         avatarUrl: string | null;
@@ -4122,7 +4733,7 @@ declare class UserProfilesRepository extends BaseRepository {
         updatedAt: Date;
         id: number;
         userId: number;
-        displayName: string;
+        displayName: string | null;
         firstName: string | null;
         lastName: string | null;
         avatarUrl: string | null;
@@ -4141,9 +4752,10 @@ declare class UserProfilesRepository extends BaseRepository {
      * 프로필 삭제 (by ID)
      */
     deleteById(id: number): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
-        displayName: string;
+        displayName: string | null;
         createdAt: Date;
         updatedAt: Date;
         firstName: string | null;
@@ -4158,15 +4770,15 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 삭제 (by User ID)
      */
     deleteByUserId(userId: number): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
-        displayName: string;
+        displayName: string | null;
         createdAt: Date;
         updatedAt: Date;
         firstName: string | null;
@@ -4181,7 +4793,6 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * 프로필 Upsert (by User ID)
@@ -4190,9 +4801,10 @@ declare class UserProfilesRepository extends BaseRepository {
      * 새로 생성 시 displayName은 필수 (없으면 'User'로 설정)
      */
     upsertByUserId(userId: number, data: Partial<Omit<NewUserProfile, 'userId'>>): Promise<{
+        metadata: Record<string, any> | null;
         userId: number;
         id: number;
-        displayName: string;
+        displayName: string | null;
         createdAt: Date;
         updatedAt: Date;
         firstName: string | null;
@@ -4207,7 +4819,6 @@ declare class UserProfilesRepository extends BaseRepository {
         location: string | null;
         company: string | null;
         jobTitle: string | null;
-        metadata: Record<string, any> | null;
     }>;
     /**
      * User ID로 프로필 데이터 조회 (formatted)
@@ -4216,7 +4827,7 @@ declare class UserProfilesRepository extends BaseRepository {
      */
     fetchProfileData(userId: number): Promise<{
         profileId: number;
-        displayName: string;
+        displayName: string | null;
         firstName: string | null;
         lastName: string | null;
         avatarUrl: string | null;
@@ -4335,15 +4946,15 @@ declare class InvitationsRepository extends BaseRepository {
      */
     create(data: NewInvitation): Promise<{
         email: string;
-        status: "pending" | "accepted" | "expired" | "cancelled";
+        metadata: Record<string, any> | null;
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
-        metadata: Record<string, any> | null;
-        expiresAt: Date;
+        status: "pending" | "accepted" | "expired" | "cancelled";
         token: string;
         invitedBy: number;
+        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -4369,15 +4980,15 @@ declare class InvitationsRepository extends BaseRepository {
      */
     deleteById(id: number): Promise<{
         email: string;
-        status: "pending" | "accepted" | "expired" | "cancelled";
+        metadata: Record<string, any> | null;
         id: number;
+        roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        roleId: number;
-        metadata: Record<string, any> | null;
-        expiresAt: Date;
+        status: "pending" | "accepted" | "expired" | "cancelled";
         token: string;
         invitedBy: number;
+        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -4480,35 +5091,369 @@ declare class InvitationsRepository extends BaseRepository {
         expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
-        metadata: Record<string, any> | null;
+        metadata: Record<string, any> | null;
+    }>;
+    /**
+     * 초대 취소 (status, metadata 동시 업데이트)
+     */
+    cancel(id: number, cancelledBy: number, reason?: string, currentMetadata?: Record<string, any> | null): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        email: string;
+        token: string;
+        roleId: number;
+        invitedBy: number;
+        status: "pending" | "accepted" | "expired" | "cancelled";
+        expiresAt: Date;
+        acceptedAt: Date | null;
+        cancelledAt: Date | null;
+        metadata: Record<string, any> | null;
+    }>;
+}
+declare const invitationsRepository: InvitationsRepository;
+
+/**
+ * Social Accounts Repository
+ *
+ * OAuth 소셜 계정 데이터 관리를 위한 Repository
+ * BaseRepository를 상속받아 자동 트랜잭션 컨텍스트 지원 및 Read/Write 분리
+ */
+
+/**
+ * Social Accounts Repository 클래스
+ */
+declare class SocialAccountsRepository extends BaseRepository {
+    /**
+     * 저장 row 의 토큰을 평문으로 복호화해 반환한다.
+     *
+     * 레거시 평문(마커 없음)이 감지되면 즉시 재암호화해 저장하는
+     * self-healing 마이그레이션을 수행한다. 호출자에게는 항상 평문이 반환되어
+     * 외부 API 계약(평문 토큰)이 유지된다.
+     */
+    private decryptAccount;
+    /**
+     * provider와 providerUserId로 소셜 계정 조회
+     * Read replica 사용
+     */
+    findByProviderAndProviderId(provider: SocialProvider, providerUserId: string): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        tokenExpiresAt: Date | null;
+    } | null>;
+    /**
+     * userId로 모든 소셜 계정 조회
+     * Read replica 사용
+     */
+    findByUserId(userId: number): Promise<({
+        accessToken: string | null;
+        refreshToken: string | null;
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        tokenExpiresAt: Date | null;
+    } | null)[]>;
+    /**
+     * userId와 provider로 소셜 계정 조회
+     * Read replica 사용
+     */
+    findByUserIdAndProvider(userId: number, provider: SocialProvider): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        tokenExpiresAt: Date | null;
+    } | null>;
+    /**
+     * 소셜 계정 생성
+     * Write primary 사용
+     */
+    create(data: NewUserSocialAccount): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        tokenExpiresAt: Date | null;
+    } | null>;
+    /**
+     * 토큰 정보 업데이트
+     * Write primary 사용
+     */
+    updateTokens(id: number, data: {
+        accessToken?: string | null;
+        refreshToken?: string | null;
+        tokenExpiresAt?: Date | null;
+    }): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        tokenExpiresAt: Date | null;
+    } | null>;
+    /**
+     * 소셜 계정 삭제
+     * Write primary 사용
+     */
+    deleteById(id: number): Promise<{
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        accessToken: string | null;
+        refreshToken: string | null;
+        tokenExpiresAt: Date | null;
+    }>;
+    /**
+     * userId와 provider로 소셜 계정 삭제
+     * Write primary 사용
+     */
+    deleteByUserIdAndProvider(userId: number, provider: SocialProvider): Promise<{
+        userId: number;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+        providerUserId: string;
+        providerEmail: string | null;
+        accessToken: string | null;
+        refreshToken: string | null;
+        tokenExpiresAt: Date | null;
+    }>;
+    /**
+     * 사용자의 모든 소셜 계정 삭제 (계정 익명화 파기용)
+     *
+     * provider unique index(provider, providerUserId)를 해제해 같은 소셜 계정으로
+     * 재가입할 수 있게 한다.
+     * Write primary 사용
+     */
+    deleteAllByUserId(userId: number): Promise<number>;
+}
+declare const socialAccountsRepository: SocialAccountsRepository;
+
+/**
+ * Auth Metadata Repository
+ *
+ * Key-value 기반 시스템 메타데이터 저장소
+ * RBAC 설정 해시 등 시스템 설정값 관리
+ */
+
+declare class AuthMetadataRepository extends BaseRepository {
+    /**
+     * 키로 값 조회
+     */
+    get(key: string): Promise<string | null>;
+    /**
+     * 키-값 저장 (upsert)
+     */
+    set(key: string, value: string): Promise<void>;
+}
+declare const authMetadataRepository: AuthMetadataRepository;
+
+/**
+ * Account Deletion Requests Repository
+ *
+ * 계정 탈퇴 요청/복구/파기 감사 이력 관리를 위한 Repository
+ * BaseRepository를 상속받아 자동 트랜잭션 컨텍스트 지원 및 Read/Write 분리
+ *
+ * Row는 절대 삭제하지 않는다 — status 전이(pending -> cancelled|completed)로만 갱신.
+ */
+
+/**
+ * Account Deletion Requests Repository 클래스
+ */
+declare class AccountDeletionRequestsRepository extends BaseRepository {
+    /**
+     * ID로 요청 조회
+     * Read replica 사용
+     */
+    findById(id: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        userId: number | null;
+        userPublicId: string;
+        requestedAt: Date;
+        purgeScheduledAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        requestedBy: "admin" | "self";
+        reason: string | null;
+        cancelledAt: Date | null;
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
+    }>;
+    /**
+     * User ID로 pending 요청 조회 (유저당 최대 1건, partial unique index로 보장)
+     * Read replica 사용
+     */
+    findPendingByUserId(userId: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        userId: number | null;
+        userPublicId: string;
+        requestedAt: Date;
+        purgeScheduledAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        requestedBy: "admin" | "self";
+        reason: string | null;
+        cancelledAt: Date | null;
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
+    }>;
+    /**
+     * User ID로 pending 요청 조회 — Write primary에서 직접 읽는다.
+     *
+     * 로그인/OAuth/authenticate 게이트가 pending_deletion 유저의 purgeScheduledAt을
+     * 표시하는 데 쓴다. 이 경로들은 복제 지연이 있으면 방금 커밋된 상태 전이를 놓칠 수
+     * 있어(예: 삭제 요청 직후 OAuth 로그인 시도), replica가 아닌 primary에서 읽는다.
+     */
+    findPendingByUserIdOnPrimary(userId: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        userId: number | null;
+        userPublicId: string;
+        requestedAt: Date;
+        purgeScheduledAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        requestedBy: "admin" | "self";
+        reason: string | null;
+        cancelledAt: Date | null;
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
+    }>;
+    /**
+     * 파기 스윕 대상 조회 — status='pending' AND purgeScheduledAt <= now
+     * Read replica 사용
+     */
+    findDueForPurge(now: Date): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        userId: number | null;
+        userPublicId: string;
+        requestedAt: Date;
+        purgeScheduledAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        requestedBy: "admin" | "self";
+        reason: string | null;
+        cancelledAt: Date | null;
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
+    }[]>;
+    /**
+     * 요청 생성
+     * Write primary 사용
+     */
+    create(data: NewAccountDeletionRequest): Promise<{
+        userId: number | null;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        reason: string | null;
+        purgeScheduledAt: Date;
+        cancelledAt: Date | null;
+        userPublicId: string;
+        requestedAt: Date;
+        requestedBy: "admin" | "self";
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
+    }>;
+    /**
+     * 요청 취소 (복구)
+     *
+     * `WHERE status = 'pending'` 조건부 UPDATE — 이미 completed(파기 완료)된 row를
+     * 뒤늦게 도착한 cancel이 덮어쓰지 않도록 한다. 0 row 매치(= 이미 completed거나
+     * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
+     * Write primary 사용
+     */
+    markCancelled(id: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        userId: number | null;
+        userPublicId: string;
+        requestedAt: Date;
+        purgeScheduledAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        requestedBy: "admin" | "self";
+        reason: string | null;
+        cancelledAt: Date | null;
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
     }>;
     /**
-     * 초대 취소 (status, metadata 동시 업데이트)
+     * 요청 완료 처리 (파기 실행 직전에 호출하는 "claim" — 파기 실행 후가 아니다)
+     *
+     * `WHERE status = 'pending'` 조건부 UPDATE. Postgres UPDATE는 매치되는 row에 락을
+     * 걸고 최신 커밋 상태로 WHERE를 재평가하므로, 이 호출 하나로 (1) 동시에 취소된
+     * row를 안전하게 걸러내고 (2) row-level 락으로 동시 파기 시도를 직렬화한다.
+     * 0 row 매치(= 이미 취소되었거나 다른 파기가 먼저 처리함) 시 null을 반환 — 호출자는
+     * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
+     * Write primary 사용
      */
-    cancel(id: number, cancelledBy: number, reason?: string, currentMetadata?: Record<string, any> | null): Promise<{
+    markCompleted(id: number, purgeStrategy: PurgeStrategy): Promise<{
         createdAt: Date;
         updatedAt: Date;
         id: number;
-        email: string;
-        token: string;
-        roleId: number;
-        invitedBy: number;
-        status: "pending" | "accepted" | "expired" | "cancelled";
-        expiresAt: Date;
-        acceptedAt: Date | null;
+        userId: number | null;
+        userPublicId: string;
+        requestedAt: Date;
+        purgeScheduledAt: Date;
+        status: "pending" | "cancelled" | "completed";
+        requestedBy: "admin" | "self";
+        reason: string | null;
         cancelledAt: Date | null;
-        metadata: Record<string, any> | null;
+        completedAt: Date | null;
+        purgeStrategy: "anonymize" | "hard-delete" | null;
     }>;
 }
-declare const invitationsRepository: InvitationsRepository;
+declare const accountDeletionRequestsRepository: AccountDeletionRequestsRepository;
 
 /**
  * @spfn/auth - Password Helpers
  *
- * Password hashing and verification using bcrypt
+ * Password hashing and verification using bcrypt (@node-rs/bcrypt).
+ *
+ * Uses the native (Rust/napi) implementation, which runs the CPU-bound key
+ * derivation on the libuv threadpool instead of the main event loop — so
+ * concurrent logins run in parallel and don't head-of-line-block other requests.
+ * Hashes are standard bcrypt ($2*$) and verify against existing bcryptjs hashes.
+ * For very high concurrent-login load, raise UV_THREADPOOL_SIZE toward the core
+ * count (default pool is 4).
  *
  * Security:
- * - Adaptive hashing (configurable rounds)
+ * - Adaptive hashing (configurable rounds, default 12)
  * - Automatic salt generation (per-password)
  * - Constant-time comparison (timing attack protection)
  * - Rainbow table protection
@@ -4521,10 +5466,10 @@ declare const invitationsRepository: InvitationsRepository;
  * 2. Apply bcrypt key derivation (2^rounds iterations)
  * 3. Return $2b$rounds$[salt][hash] (60 chars)
  *
- * Salt rounds are configured via SPFN_AUTH_BCRYPT_SALT_ROUNDS:
- * - 10 rounds: ~100ms (default, balanced)
- * - 12 rounds: ~400ms (more secure, slower)
- * - 14 rounds: ~1600ms (very secure, too slow for most apps)
+ * Salt rounds are configured via SPFN_AUTH_BCRYPT_SALT_ROUNDS (native timings):
+ * - 12 rounds: ~200ms (default — OWASP-aligned, off the event loop)
+ * - 10 rounds: ~55ms (faster, lower work factor)
+ * - 14 rounds: ~800ms (very secure, heavy)
  *
  * @param password - Plain text password to hash
  * @returns Bcrypt hash string (includes salt)
@@ -4558,6 +5503,7 @@ declare function hashPassword(password: string): Promise<string>;
  * ```
  */
 declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+declare function getDummyPasswordHash(): Promise<string>;
 /**
  * Validate password strength
  *
@@ -4846,6 +5792,29 @@ interface RoleGuardOptions {
  */
 declare const roleGuard: _spfn_core_route.NamedMiddlewareFactory<"roleGuard", [options: RoleGuardOptions]>;
 
+/**
+ * One-Time Token Authentication Middleware
+ *
+ * Authenticates requests using a one-time token instead of JWT.
+ * Extracts token from query parameter `?token=xxx` or `Authorization: OTT xxx` header.
+ *
+ * On success, injects AuthContext identical to the `authenticate` middleware,
+ * making it transparent to downstream handlers using `getAuth(c)`.
+ *
+ * Auto-skips the global 'auth' middleware.
+ *
+ * @example
+ * ```typescript
+ * export const uploadFile = route.post('/files/upload')
+ *     .use([oneTimeTokenAuth])
+ *     .handler(async (c) => {
+ *         const { userId } = getAuth(c);
+ *         // handle file upload...
+ *     });
+ * ```
+ */
+declare const oneTimeTokenAuth: _spfn_core_route.NamedMiddleware<"oneTimeTokenAuth">;
+
 /**
  * Auth Context Helpers
  *
@@ -4872,6 +5841,32 @@ declare const roleGuard: _spfn_core_route.NamedMiddlewareFactory<"roleGuard", [o
 declare function getAuth(c: Context | {
     raw: Context;
 }): AuthContext;
+/**
+ * Get optional auth context from route context
+ *
+ * Returns AuthContext if authenticated, undefined otherwise.
+ * Use with `optionalAuth` middleware for routes that serve both
+ * authenticated and unauthenticated users.
+ *
+ * @example
+ * ```typescript
+ * export const getProducts = route.get('/products')
+ *   .use([optionalAuth])
+ *   .handler(async (c) => {
+ *     const auth = getOptionalAuth(c);
+ *
+ *     if (auth)
+ *     {
+ *       return getPersonalizedProducts(auth.userId);
+ *     }
+ *
+ *     return getPublicProducts();
+ *   });
+ * ```
+ */
+declare function getOptionalAuth(c: Context | {
+    raw: Context;
+}): AuthContext | undefined;
 /**
  * Get authenticated user from route context
  *
@@ -4888,16 +5883,20 @@ declare function getUser(c: Context | {
 }): {
     email: string | null;
     phone: string | null;
-    status: "active" | "inactive" | "suspended";
     id: number;
-    createdAt: Date;
-    updatedAt: Date;
+    publicId: string;
+    username: string | null;
     passwordHash: string | null;
     passwordChangeRequired: boolean;
     roleId: number;
+    createdAt: Date;
+    updatedAt: Date;
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
+    deletedAt: Date | null;
+    deletedBy: string | null;
 };
 /**
  * Get authenticated user ID from route context
@@ -4913,6 +5912,38 @@ declare function getUser(c: Context | {
 declare function getUserId(c: Context | {
     raw: Context;
 }): string;
+/**
+ * Get authenticated user's role from route context
+ *
+ * @returns Role name or null if user has no role
+ *
+ * @example
+ * ```typescript
+ * app.bind(adminContract, [authenticate], async (c) => {
+ *     const role = getRole(c);
+ *     // 'admin' | 'superadmin' | null
+ * });
+ * ```
+ */
+declare function getRole(c: Context | {
+    raw: Context;
+}): string | null;
+/**
+ * Get authenticated user's locale from route context
+ *
+ * @returns Locale string (e.g., 'en', 'ko')
+ *
+ * @example
+ * ```typescript
+ * app.bind(contract, [authenticate], async (c) => {
+ *     const locale = getLocale(c);
+ *     // 'en' | 'ko' | ...
+ * });
+ * ```
+ */
+declare function getLocale(c: Context | {
+    raw: Context;
+}): string;
 /**
  * Get current key ID from route context
  *
@@ -4939,7 +5970,7 @@ declare function getKeyId(c: Context | {
  * - RS256 (RSA 2048):   ~294 bytes (Base64: ~392 chars)
  */
 
-type Unit = "Years" | "Year" | "Yrs" | "Yr" | "Y" | "Weeks" | "Week" | "W" | "Days" | "Day" | "D" | "Hours" | "Hour" | "Hrs" | "Hr" | "H" | "Minutes" | "Minute" | "Mins" | "Min" | "M" | "Seconds" | "Second" | "Secs" | "Sec" | "s" | "Milliseconds" | "Millisecond" | "Msecs" | "Msec" | "Ms";
+type Unit = 'Years' | 'Year' | 'Yrs' | 'Yr' | 'Y' | 'Weeks' | 'Week' | 'W' | 'Days' | 'Day' | 'D' | 'Hours' | 'Hour' | 'Hrs' | 'Hr' | 'H' | 'Minutes' | 'Minute' | 'Mins' | 'Min' | 'M' | 'Seconds' | 'Second' | 'Secs' | 'Sec' | 's' | 'Milliseconds' | 'Millisecond' | 'Msecs' | 'Msec' | 'Ms';
 type UnitAnyCase = Unit | Uppercase<Unit> | Lowercase<Unit>;
 type StringValue = `${number}` | `${number}${UnitAnyCase}` | `${number} ${UnitAnyCase}`;
 interface KeyPair {
@@ -4985,70 +6016,40 @@ declare function shouldRotateKey(createdAt: Date, rotationDays?: number): {
     daysRemaining: number;
 };
 
-/**
- * @spfn/auth - Client Session Management
- *
- * Uses Jose JWE (JSON Web Encryption) to securely store session data in cookies
- * More efficient than Iron Session with better Edge Runtime support
- */
-
-interface SessionData {
-    userId: string;
-    privateKey: string;
-    keyId: string;
-    algorithm: KeyAlgorithmType;
-}
-/**
- * Seal session data into encrypted JWT (JWE)
- *
- * @param data - Session data to encrypt
- * @param ttl - Time to live in seconds (default: 7 days)
- * @returns Encrypted JWT string
- */
-declare function sealSession(data: SessionData, ttl?: number): Promise<string>;
-/**
- * Unseal encrypted JWT (JWE) to session data
- *
- * @param jwt - Encrypted JWT string
- * @returns Session data
- * @throws Error if session is invalid or expired
- */
-declare function unsealSession(jwt: string): Promise<SessionData>;
-/**
- * Get session metadata without decrypting
- *
- * @param jwt - Encrypted JWT string
- * @returns Session metadata or null if invalid
- */
-declare function getSessionInfo(jwt: string): Promise<{
-    issuedAt: Date;
-    expiresAt: Date;
-    issuer: string;
-    audience: string;
-} | null>;
-/**
- * Check if session is about to expire (within threshold)
- *
- * @param jwt - Encrypted JWT string
- * @param thresholdHours - Hours before expiry to trigger refresh (default: 24)
- * @returns True if session should be refreshed
- */
-declare function shouldRefreshSession(jwt: string, thresholdHours?: number): Promise<boolean>;
-
 /**
  * @spfn/auth - Global Configuration
  *
  * Manages global auth configuration including session TTL
  */
+
 /**
  * Cookie names used by SPFN Auth
+ *
+ * Names include a port-based suffix so that multiple dev instances
+ * on different ports don't overwrite each other's cookies.
  */
 declare const COOKIE_NAMES: {
     /** Encrypted session data (userId, privateKey, keyId, algorithm) */
-    readonly SESSION: "spfn_session";
+    readonly SESSION: string;
     /** Current key ID (for key rotation) */
-    readonly SESSION_KEY_ID: "spfn_session_key_id";
+    readonly SESSION_KEY_ID: string;
+    /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
+    readonly OAUTH_PENDING: string;
+    /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+    readonly OAUTH_CSRF: string;
 };
+/**
+ * OAuth CSRF 쿠키를 PORT 접미사와 무관하게 전부 수집한다.
+ *
+ * 쿠키를 심는 쪽은 Next.js 프로세스, 읽는 쪽은 API 프로세스라 분리 배포에서는
+ * 두 프로세스의 PORT가 달라 COOKIE_NAMES.OAUTH_CSRF 정확 일치 조회가 빗나간다.
+ * nonce 자체가 랜덤값이고 암호화된 state의 nonce와 대조되므로, 접미사가 다른
+ * spfn_oauth_csrf* 후보를 모두 대조 대상으로 넘겨도 안전하다.
+ */
+declare function matchOAuthCsrfCookies(cookies: Record<string, string>): {
+    name: string;
+    value: string;
+}[];
 /**
  * Parse duration string to seconds
  *
@@ -5061,6 +6062,36 @@ declare const COOKIE_NAMES: {
  * parseDuration('3600')  // 3600
  */
 declare function parseDuration(duration: string | number): number;
+/**
+ * Registration channel passed to the beforeRegister hook
+ *
+ * - credentials: email/phone + password registration
+ * - oauth: new-user signup through a social provider (web or native flow)
+ * - invitation: invitation acceptance
+ */
+type RegisterChannel = 'credentials' | 'oauth' | 'invitation';
+/**
+ * Context passed to the beforeRegister hook
+ *
+ * Credentials (password, keys) are intentionally excluded — the hook is a
+ * policy gate, not a credential handler.
+ */
+interface BeforeRegisterContext {
+    channel: RegisterChannel;
+    /** Social provider — only set when channel is 'oauth' */
+    provider?: SocialProvider;
+    email?: string;
+    /**
+     * Whether the email is verified — only set when channel is 'oauth'.
+     * OAuth providers may report an unverified (spoofable) email; the created
+     * account stores it as null in that case, so email-based policies must
+     * check this flag. credentials/invitation emails are already verified.
+     */
+    emailVerified?: boolean;
+    phone?: string;
+    /** App-supplied registration metadata (register params / OAuth start params / invitation) */
+    metadata?: Record<string, unknown>;
+}
 /**
  * Auth configuration
  */
@@ -5075,6 +6106,35 @@ interface AuthConfig {
      * @default 7d (7 days)
      */
     sessionTtl?: string | number;
+    /**
+     * App-injected validator that runs before a new user row is created,
+     * on every registration channel (credentials, oauth, invitation).
+     *
+     * Throw to reject the registration — RegistrationRejectedError (403) is
+     * the recommended error; any HttpError subclass keeps its own status.
+     * Runs after built-in checks (verification token, duplicate account),
+     * so existing error precedence is unchanged. Not called for admin
+     * seeding (initializeAuth) or when linking a social account to an
+     * existing user.
+     *
+     * Runs inside the registration DB transaction on every channel — keep it
+     * fast. A slow call (e.g. an external policy API) holds a pooled DB
+     * connection open for its full duration on every signup.
+     *
+     * @example
+     * ```typescript
+     * configureAuth({
+     *     beforeRegister: async ({ channel, metadata }) =>
+     *     {
+     *         if (channel === 'credentials' && !isOldEnough(metadata?.birthDate))
+     *         {
+     *             throw new RegistrationRejectedError({ message: 'Age requirement not met' });
+     *         }
+     *     },
+     * });
+     * ```
+     */
+    beforeRegister?: (context: BeforeRegisterContext) => void | Promise<void>;
 }
 /**
  * Configure global auth settings
@@ -5093,6 +6153,14 @@ declare function configureAuth(config: AuthConfig): void;
  * Get current auth configuration
  */
 declare function getAuthConfig(): AuthConfig;
+/**
+ * Run the app-injected beforeRegister hook if configured — throws to reject.
+ *
+ * Single entry point for every registration channel so a new channel cannot
+ * forget the configured-check. Callers invoke this right before creating the
+ * user row.
+ */
+declare function runBeforeRegister(context: BeforeRegisterContext): Promise<void>;
 /**
  * Get session TTL in seconds
  *
@@ -5104,6 +6172,107 @@ declare function getAuthConfig(): AuthConfig;
  */
 declare function getSessionTtl(override?: string | number): number;
 
+/**
+ * One-Time Token Manager
+ *
+ * Singleton wrapper around SSETokenManager for one-time token authentication.
+ * Used for direct API access (file uploads, SSE streaming, etc.) bypassing RPC proxy.
+ */
+
+/**
+ * Initialize the one-time token manager
+ *
+ * Called during auth lifecycle initialization.
+ * Creates a singleton SSETokenManager instance.
+ *
+ * @param config - Optional configuration
+ * @param config.ttl - Token time-to-live in milliseconds (default: 30000)
+ * @param config.store - Custom token store (e.g., CacheTokenStore for Redis)
+ */
+declare function initOneTimeTokenManager(config?: {
+    ttl?: number;
+    store?: SSETokenStore;
+}): void;
+/**
+ * Get the one-time token manager instance
+ *
+ * @throws Error if initOneTimeTokenManager() has not been called
+ *
+ * @example
+ * ```typescript
+ * import { getOneTimeTokenManager } from '@spfn/auth/server';
+ *
+ * // Use as SSE tokenManager
+ * .eventsConfig({
+ *     auth: {
+ *         enabled: true,
+ *         tokenManager: getOneTimeTokenManager(),
+ *     },
+ * })
+ * ```
+ */
+declare function getOneTimeTokenManager(): SSETokenManager;
+
+/**
+ * Account Deletion Configuration
+ *
+ * Singleton config for the account deletion/recovery lifecycle, mirroring the
+ * one-time-token manager pattern (`lib/one-time-token.ts`): a mutable module-level
+ * value, set once during `createAuthLifecycle()` and read at request/handler time.
+ *
+ * `purgeCron` is the one field this module does NOT make effective on its own —
+ * `job('auth.deletion.purge').cron(expression)` bakes the cron string in at
+ * *module-import* time, which always runs before `createAuthLifecycle()` executes
+ * (ESM evaluates imports before the importing module's own statements). So a
+ * statically-exported job router can never see a `purgeCron` set here. Apps that
+ * need a non-default cron must build the router themselves, after configuring
+ * deletion, with `createAuthDeletionJobRouter({ purgeCron })` — see
+ * `server/jobs/deletion-purge.ts` and the README.
+ */
+
+interface AccountDeletionPurgeUser {
+    id: number;
+    publicId: string;
+    email: string | null;
+    phone: string | null;
+}
+interface AuthDeletionConfig {
+    /** Days between a deletion request and the purge becoming eligible. 0 = immediate. */
+    gracePeriodDays: number;
+    /** How the purge job destroys the account once the grace period elapses. */
+    purgeStrategy: PurgeStrategy;
+    /** Whether a self-service caller may request `immediate: true` (skip the grace period). */
+    allowSelfImmediate: boolean;
+    /**
+     * Cron schedule for the purge sweep. NOT read automatically by the static
+     * `authJobRouter` export — see the module doc comment above.
+     */
+    purgeCron: string;
+    /** Whether to email users (when they have one) at request/recovery/purge time. */
+    sendNotifications: boolean;
+    /**
+     * Synchronous hook invoked immediately before a user is purged. Throw to skip
+     * that user for this sweep (they stay `pending`, retried on the next tick).
+     */
+    onBeforePurge?: (user: AccountDeletionPurgeUser) => Promise<void>;
+}
+declare const DEFAULT_DELETION_GRACE_PERIOD_DAYS = 30;
+declare const DEFAULT_DELETION_PURGE_STRATEGY: PurgeStrategy;
+declare const DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE = false;
+declare const DEFAULT_DELETION_PURGE_CRON = "0 4 * * *";
+declare const DEFAULT_DELETION_SEND_NOTIFICATIONS = true;
+/**
+ * Set the resolved deletion config. Called synchronously from `createAuthLifecycle()`
+ * (not from `afterInfrastructure`) so it takes effect before any route/job handler
+ * that reads `getDeletionConfig()` can run.
+ */
+declare function configureDeletion(options?: Partial<AuthDeletionConfig>): void;
+/**
+ * Read the current deletion config. Safe to call any time — defaults apply even
+ * if `createAuthLifecycle()` was never given a `deletion` block.
+ */
+declare function getDeletionConfig(): AuthDeletionConfig;
+
 /**
  * @spfn/auth - Centralized Logger
  *
@@ -5116,7 +6285,9 @@ declare const authLogger: {
         general: _spfn_core_logger.Logger;
         login: _spfn_core_logger.Logger;
         keyRotation: _spfn_core_logger.Logger;
+        oauth: _spfn_core_logger.Logger;
     };
+    session: _spfn_core_logger.Logger;
     service: _spfn_core_logger.Logger;
     setup: _spfn_core_logger.Logger;
     email: _spfn_core_logger.Logger;
@@ -5197,6 +6368,337 @@ interface AuthLifecycleConfig {
  *   .build();
  * ```
  */
-declare function createAuthLifecycle(options?: AuthInitOptions): AuthLifecycleConfig;
+/**
+ * Options for createAuthLifecycle
+ */
+interface AuthLifecycleOptions extends AuthInitOptions {
+    /**
+     * One-time token configuration
+     *
+     * Enables one-time token issuance for direct API access
+     * (file uploads, SSE streaming, etc.)
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     oneTimeToken: { ttl: 60000 },  // 60 seconds
+     * })
+     * ```
+     */
+    oneTimeToken?: {
+        /**
+         * Token time-to-live in milliseconds
+         * @default 30000
+         */
+        ttl?: number;
+        /**
+         * Custom token store (e.g., CacheTokenStore for Redis/Valkey)
+         *
+         * When provided, tokens are stored in the external store instead of in-memory Map.
+         * Required for multi-instance deployments where token issuance and verification
+         * may happen on different server instances.
+         *
+         * @example
+         * ```typescript
+         * import { CacheTokenStore } from '@spfn/core/event/sse';
+         * import { getCache } from '@spfn/core/cache';
+         *
+         * createAuthLifecycle({
+         *     oneTimeToken: {
+         *         store: new CacheTokenStore(getCache()),
+         *     },
+         * })
+         * ```
+         */
+        store?: SSETokenStore;
+    };
+    /**
+     * Account deletion/recovery lifecycle configuration
+     *
+     * Controls the grace-period request → recover → purge flow exposed by
+     * `POST /_auth/deletion/request` and `POST /_auth/deletion/cancel`.
+     * Registering the purge job itself is a separate step — see `authJobRouter`
+     * (`@spfn/auth/server`) and the README, since job registration happens after
+     * this lifecycle hook runs and can't be triggered from here.
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     deletion: {
+     *         gracePeriodDays: 14,
+     *         purgeStrategy: 'anonymize',
+     *         allowSelfImmediate: false,
+     *         sendNotifications: true,
+     *         onBeforePurge: async (user) => {
+     *             await appDataCleanup(user.id); // throw to skip this user this sweep
+     *         },
+     *     },
+     * })
+     * ```
+     */
+    deletion?: {
+        /**
+         * Days between a deletion request and the purge becoming eligible.
+         * 0 = immediate (still goes through the same request/purge pipeline).
+         * @default 30
+         */
+        gracePeriodDays?: number;
+        /**
+         * How the purge job destroys the account once the grace period elapses.
+         * - 'anonymize': scrub PII, keep the row (status -> 'deleted') — recommended default
+         * - 'hard-delete': physically remove the `users` row (cascades to child rows)
+         * @default 'anonymize'
+         */
+        purgeStrategy?: PurgeStrategy;
+        /**
+         * Whether a self-service caller may pass `immediate: true` on
+         * `POST /_auth/deletion/request` to skip the grace period entirely.
+         * @default false
+         */
+        allowSelfImmediate?: boolean;
+        /**
+         * Cron schedule for the purge sweep. NOTE: this does not reach the static
+         * `authJobRouter` export automatically — job schedules are fixed at
+         * module-import time, before this lifecycle hook runs. For a non-default
+         * cron, build the router yourself after this call with
+         * `createAuthDeletionJobRouter({ purgeCron })` (see `@spfn/auth/server`).
+         * @default '0 4 * * *'
+         */
+        purgeCron?: string;
+        /**
+         * Whether to email users (when they have one on file) at request,
+         * recovery, and final-purge time.
+         * @default true
+         */
+        sendNotifications?: boolean;
+        /**
+         * Invoked immediately before a user is purged (both the immediate inline
+         * path and the cron sweep). Throw to skip that user for this run — they
+         * stay `pending` and are retried on the next sweep.
+         */
+        onBeforePurge?: (user: AccountDeletionPurgeUser) => Promise<void>;
+    };
+}
+declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecycleConfig;
+
+/**
+ * @spfn/auth - Account Deletion Purge Job
+ *
+ * The package's first background job (`@spfn/core/job`). Sweeps
+ * `account_deletion_requests` for rows whose grace period elapsed and purges
+ * each one (see `sweepDuePurges` in `account-deletion.service.ts`).
+ *
+ * Registration is NOT automatic. `createAuthLifecycle()`'s `afterInfrastructure`
+ * hook runs *before* `initBoss`/`registerJobs` in `@spfn/core`'s server startup
+ * (`initializeInfrastructure()`), so the lifecycle has no opportunity to register
+ * jobs itself. Apps must register explicitly:
+ *
+ * ```typescript
+ * import { authJobRouter } from '@spfn/auth/server';
+ *
+ * export default defineServerConfig()
+ *     .lifecycle(createAuthLifecycle())
+ *     .jobs(authJobRouter)
+ *     .routes(appRouter)
+ *     .build();
+ * ```
+ *
+ * Cron schedule caveat: `job(...).cron(expression)` bakes the cron string in at
+ * *module-import* time, which always happens before `createAuthLifecycle()` runs
+ * in the app's own module (ESM evaluates imports before the importing module's
+ * statements). So the static `authJobRouter` export below always uses the default
+ * cron — `deletion.purgeCron` passed to `createAuthLifecycle()` cannot reach it.
+ * To use a custom cron, build the router yourself, after calling
+ * `createAuthLifecycle()`, with `createAuthDeletionJobRouter({ purgeCron })` and
+ * register that instead of the static export.
+ */
+/**
+ * Build the `auth.deletion.purge` job with a given cron schedule.
+ *
+ * @param cronExpression - Defaults to `deletion-config`'s default (daily at 04:00).
+ */
+declare function createAuthDeletionPurgeJob(cronExpression?: string): _spfn_core_job.JobDef<void, void>;
+/**
+ * Build a job router containing only the deletion purge job, with a given cron.
+ * Use this (after calling `createAuthLifecycle({ deletion: { purgeCron } })`) when
+ * you need a non-default schedule — see the module doc comment above for why the
+ * static `authJobRouter` export can't pick up `deletion.purgeCron` automatically.
+ */
+declare function createAuthDeletionJobRouter(options?: {
+    purgeCron?: string;
+}): _spfn_core_job.JobRouter<{
+    deletionPurge: _spfn_core_job.JobDef<void, void>;
+}>;
+/**
+ * Default job router — the default cron (`0 4 * * *`). Register with
+ * `.jobs(authJobRouter)` in `server.config.ts`.
+ */
+declare const authJobRouter: _spfn_core_job.JobRouter<{
+    deletionPurge: _spfn_core_job.JobDef<void, void>;
+}>;
+
+/**
+ * @spfn/auth - Auth Events
+ *
+ * 인증 관련 이벤트 정의
+ * - auth.login: 로그인 성공 시 (기존 사용자만)
+ * - auth.register: 회원가입 성공 시 (OAuth 신규 가입 포함)
+ */
+/**
+ * Auth provider type
+ *
+ * 직접 인증(email/phone) + 등록 가능한 모든 소셜 provider(SOCIAL_PROVIDERS).
+ */
+declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">, ..._sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]]>;
+/**
+ * auth.login - 로그인 성공 이벤트
+ *
+ * 발행 시점:
+ * - 이메일/전화 로그인 성공 시
+ * - OAuth 기존 사용자 로그인 시
+ *
+ * @example
+ * ```typescript
+ * authLoginEvent.subscribe(async (payload) => {
+ *     await analytics.trackLogin(payload.userId, payload.provider);
+ * });
+ * ```
+ */
+declare const authLoginEvent: _spfn_core_event.EventDef<{
+    email?: string | undefined;
+    phone?: string | undefined;
+    userId: string;
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+}>;
+/**
+ * auth.register - 회원가입 성공 이벤트
+ *
+ * 발행 시점:
+ * - 이메일/전화 회원가입 성공 시
+ * - OAuth 신규 사용자 가입 시
+ *
+ * @example
+ * ```typescript
+ * authRegisterEvent.subscribe(async (payload) => {
+ *     await emailService.sendWelcome(payload.email);
+ * });
+ * ```
+ */
+declare const authRegisterEvent: _spfn_core_event.EventDef<{
+    email?: string | undefined;
+    phone?: string | undefined;
+    metadata?: {
+        [x: string]: unknown;
+    } | undefined;
+    userId: string;
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+}>;
+/**
+ * auth.invitation.created - 초대 생성 이벤트
+ *
+ * 발행 시점:
+ * - createInvitation() 성공 시
+ * - resendInvitation() 성공 시
+ *
+ * @example
+ * ```typescript
+ * invitationCreatedEvent.subscribe(async (payload) => {
+ *     const inviteUrl = `${APP_URL}/invite/${payload.token}`;
+ *     await notificationService.send({
+ *         channel: 'email',
+ *         to: payload.email,
+ *         subject: 'You are invited!',
+ *         html: renderInviteEmail({ inviteUrl, ...payload.metadata }),
+ *     });
+ * });
+ * ```
+ */
+declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
+    metadata?: {
+        [x: string]: unknown;
+    } | undefined;
+    email: string;
+    roleId: number;
+    token: string;
+    invitedBy: string;
+    expiresAt: string;
+    invitationId: string;
+    isResend: boolean;
+}>;
+/**
+ * auth.invitation.accepted - 초대 수락 이벤트
+ *
+ * 발행 시점:
+ * - acceptInvitation() 성공 시
+ *
+ * @example
+ * ```typescript
+ * invitationAcceptedEvent.subscribe(async (payload) => {
+ *     await onboardingService.start(payload.userId);
+ * });
+ * ```
+ */
+declare const invitationAcceptedEvent: _spfn_core_event.EventDef<{
+    metadata?: {
+        [x: string]: unknown;
+    } | undefined;
+    email: string;
+    userId: string;
+    roleId: number;
+    invitedBy: string;
+    invitationId: string;
+}>;
+/**
+ * auth.deletion.requested - 계정 탈퇴 요청 이벤트
+ *
+ * 발행 시점:
+ * - requestAccountDeletionService() 성공 시 (self/admin 공통)
+ *
+ * @example
+ * ```typescript
+ * authDeletionRequestedEvent.subscribe(async (payload) => {
+ *     await analytics.trackChurnRisk(payload.userId);
+ * });
+ * ```
+ */
+declare const authDeletionRequestedEvent: _spfn_core_event.EventDef<{
+    userId: string;
+    purgeScheduledAt: string;
+    userPublicId: string;
+    requestedBy: "admin" | "self";
+}>;
+/**
+ * auth.deletion.cancelled - 계정 탈퇴 복구 이벤트
+ *
+ * 발행 시점:
+ * - cancelAccountDeletionService() 성공 시 (유예 기간 내 복구)
+ */
+declare const authDeletionCancelledEvent: _spfn_core_event.EventDef<{
+    userId: string;
+    userPublicId: string;
+}>;
+/**
+ * auth.deletion.completed - 계정 파기 완료 이벤트
+ *
+ * 발행 시점:
+ * - purge job(또는 즉시 파기 경로)이 유저를 파기한 직후
+ *
+ * PII를 담지 않는다 — userId(내부 순번)/email/phone 없이 userPublicId만 실어
+ * 파기 완료 이후에도 구독자가 식별 정보를 다시 축적하지 않도록 한다.
+ */
+declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
+    userPublicId: string;
+    purgeStrategy: "anonymize" | "hard-delete";
+}>;
+/**
+ * Auth event payload types
+ */
+type AuthLoginPayload = typeof authLoginEvent._payload;
+type AuthRegisterPayload = typeof authRegisterEvent._payload;
+type InvitationCreatedPayload = typeof invitationCreatedEvent._payload;
+type InvitationAcceptedPayload = typeof invitationAcceptedEvent._payload;
+type AuthDeletionRequestedPayload = typeof authDeletionRequestedEvent._payload;
+type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
+type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 
-export { type AuthConfig, AuthContext, COOKIE_NAMES, type EmailProvider, type EmailTemplateProvider, type EmailTemplateResult, type Invitation, InvitationStatus, InvitationsRepository, KeyAlgorithmType, type KeyPair, KeysRepository, type NewInvitation, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type Permission, type PermissionEntity, PermissionsRepository, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SMSProvider, type SendEmailParams, type SendEmailResult, type SendSMSParams, type SendSMSResult, type SessionData, type SessionPayload, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, type VerificationCodeParams, VerificationCodesRepository, VerificationPurpose, acceptInvitation, addPermissionToRole, authLogger, authSchema, cancelInvitation, configureAuth, createAuthLifecycle, createInvitation, createRole, decodeToken, deleteInvitation, deleteRole, expireOldInvitations, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getInvitationByToken, getInvitationTemplate, getInvitationWithDetails, getKeyId, getKeySize, getPasswordResetTemplate, getRoleByName, getRolePermissions, getSessionInfo, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, getVerificationCodeTemplate, getWelcomeTemplate, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initializeAuth, invitationsRepository, keysRepository, listInvitations, parseDuration, permissions, permissionsRepository, registerEmailProvider, registerEmailTemplates, registerSMSProvider, removePermissionFromRole, requireAnyPermission, requirePermissions, requireRole, resendInvitation, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, sealSession, sendEmail, sendSMS, setRolePermissions, shouldRefreshSession, shouldRotateKey, unsealSession, updateLastLoginService, updateRole, updateUserProfileService, updateUserService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyKeyFingerprint, verifyPassword, verifyToken };
+export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, KeyAlgorithmType, type KeyPair, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getKeySize, getLocale, getOneTimeTokenManager, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, kakaoProvider, keysRepository, listInvitations, matchOAuthCsrfCookies, naverProvider, oneTimeTokenAuth, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requirePermissions, requireRole, resendInvitation, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, shouldRotateKey, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyPassword, verifyToken };