@spfn/auth 0.2.0-beta.87 → 0.2.0-beta.88

package/dist/config.js

@@ -406,6 +406,24 @@ var authEnvSchema = defineEnvSchema({
       ]
     })
   },
+  SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS: {
+    ...envString({
+      description: "Comma-separated Kakao app keys accepted as id_token audience for native sign-in (native app key). SPFN_AUTH_KAKAO_CLIENT_ID (REST API key) is also accepted automatically, so native sign-in is available when either variable is set. Requires OpenID Connect to be enabled in the Kakao developer console.",
+      required: false,
+      examples: [
+        "your-kakao-native-app-key"
+      ]
+    })
+  },
+  SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS: {
+    ...envString({
+      description: "Comma-separated Naver client IDs accepted as id_token audience for native sign-in. SPFN_AUTH_NAVER_CLIENT_ID is also accepted automatically, and one Naver application has a single client ID covering web and app environments \u2014 set this only when the app uses a separate application.",
+      required: false,
+      examples: [
+        "your-naver-app-client-id"
+      ]
+    })
+  },
   SPFN_AUTH_OAUTH_SUCCESS_URL: {
     ...envString({
       description: "OAuth callback page URL. This page should use OAuthCallback component to finalize session.",

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config/index.ts","../src/config/schema.ts"],"sourcesContent":["/**\n * Core Package Configuration\n *\n * @example\n * ```typescript\n * import { registry } from '@spfn/core/config';\n *\n * const env = registry.validate();\n * console.log(env.DB_POOL_MAX);\n * ```\n *\n * @module config\n */\n\nimport { createEnvRegistry } from '@spfn/core/env';\nimport { authEnvSchema } from './schema';\n\nexport { authEnvSchema as envSchema } from './schema';\n\n/**\n * Environment registry\n */\nconst registry = createEnvRegistry(authEnvSchema);\nexport const env = registry.validate();\n","/**\n * Auth Environment Variable Schema\n *\n * Centralized schema definition for all environment variables used in @spfn/auth.\n * This provides type safety, validation, and documentation for Auth configuration.\n *\n * @module config/schema\n */\n\nimport {\n    defineEnvSchema,\n    envString,\n    envNumber,\n    envBoolean,\n    createSecureSecretParser,\n    createPasswordParser,\n} from '@spfn/core/env';\n\n/**\n * Auth environment variable schema\n *\n * Defines all Auth environment variables with:\n * - Type information\n * - Default values\n * - Validation rules\n * - Documentation\n *\n * @example\n * ```typescript\n * import { envSchema } from '@spfn/auth/config';\n *\n * // Access schema information\n * console.log(envSchema.SPFN_AUTH_SESSION_SECRET.description);\n * console.log(envSchema.SPFN_AUTH_JWT_EXPIRES_IN.default);\n * ```\n */\nexport const authEnvSchema = defineEnvSchema({\n    // ============================================================================\n    // Session Configuration\n    // ============================================================================\n    SPFN_AUTH_SESSION_SECRET: {\n        ...envString({\n            description: 'Session encryption secret (minimum 32 characters for AES-256)',\n            required: true,\n            fallbackKeys: ['SESSION_SECRET'],\n            validator: createSecureSecretParser({\n                minLength: 32,\n                minUniqueChars: 16,\n                minEntropy: 3.5,\n            }),\n            sensitive: true,\n            nextjs: true, // Required for Next.js RSC session validation\n            examples: [\n                'my-super-secret-session-key-at-least-32-chars-long',\n                'use-a-cryptographically-secure-random-string-here',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_SESSION_TTL: {\n        ...envString({\n            description: 'Session TTL (time to live) - supports duration strings like \\'7d\\', \\'12h\\', \\'45m\\'',\n            default: '7d',\n            required: false,\n            nextjs: true, // May be needed for session validation in Next.js RSC\n            examples: ['7d', '30d', '12h', '45m', '3600'],\n        }),\n    },\n\n    // ============================================================================\n    // JWT Configuration\n    // ============================================================================\n    SPFN_AUTH_JWT_SECRET: {\n        ...envString({\n            description: 'JWT signing secret for server-signed tokens (legacy mode)',\n            default: 'dev-secret-key-change-in-production',\n            required: false,\n            examples: [\n                'your-jwt-secret-key-here',\n                'use-different-from-session-secret',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_JWT_EXPIRES_IN: {\n        ...envString({\n            description: 'JWT token expiration time (e.g., \\'7d\\', \\'24h\\', \\'1h\\')',\n            default: '7d',\n            required: false,\n            examples: ['7d', '24h', '1h', '30m'],\n        }),\n    },\n\n    // ============================================================================\n    // Security Configuration\n    // ============================================================================\n    SPFN_AUTH_COOKIE_SECURE: {\n        ...envBoolean({\n            description: 'Override cookie Secure flag. Defaults to NODE_ENV === \"production\". Set to false for HTTP-only environments (e.g. bastion over plain HTTP).',\n            required: false,\n            nextjs: true,\n            examples: [true, false],\n        }),\n    },\n\n    SPFN_AUTH_BCRYPT_SALT_ROUNDS: {\n        ...envNumber({\n            description: 'Bcrypt salt rounds (cost factor, higher = more secure but slower)',\n            default: 12,\n            required: false,\n            examples: [10, 12, 14],\n        }),\n        key: 'SPFN_AUTH_BCRYPT_SALT_ROUNDS',\n    },\n\n    SPFN_AUTH_VERIFICATION_TOKEN_SECRET: {\n        ...envString({\n            description: 'Verification token secret for email verification, password reset, etc.',\n            required: true,\n            examples: [\n                'your-verification-token-secret',\n                'can-be-different-from-jwt-secret',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_TOKEN_ENCRYPTION_KEYS: {\n        ...envString({\n            description: 'Backend-only OAuth token encryption keyring. Comma-separated <keyId>:<base64-encoded 32-byte key> entries; the first key encrypts new values and remaining keys decrypt during rotation.',\n            required: false,\n            sensitive: true,\n            examples: [\n                'v2:<base64-encoded-32-byte-key>,v1:<previous-base64-encoded-32-byte-key>',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // Admin Account Configuration\n    // ============================================================================\n    SPFN_AUTH_ADMIN_ACCOUNTS: {\n        ...envString({\n            description: 'JSON array of admin accounts (recommended for multiple admins)',\n            required: false,\n            examples: [\n                '[{\"email\":\"admin@example.com\",\"password\":\"secure-pass\",\"role\":\"admin\"}]',\n                '[{\"email\":\"super@example.com\",\"password\":\"pass1\",\"role\":\"superadmin\"},{\"email\":\"admin@example.com\",\"password\":\"pass2\",\"role\":\"admin\"}]',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAILS: {\n        ...envString({\n            description: 'Comma-separated list of admin emails (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin@example.com,user@example.com',\n                'super@example.com,admin@example.com,user@example.com',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORDS: {\n        ...envString({\n            description: 'Comma-separated list of admin passwords (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin-pass,user-pass',\n                'super-pass,admin-pass,user-pass',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_ROLES: {\n        ...envString({\n            description: 'Comma-separated list of admin roles (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin,user',\n                'superadmin,admin,user',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAIL: {\n        ...envString({\n            description: 'Single admin email (simplest format)',\n            required: false,\n            examples: ['admin@example.com'],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORD: {\n        ...envString({\n            description: 'Single admin password (simplest format)',\n            required: false,\n            validator: createPasswordParser({\n                minLength: 8,\n                requireUppercase: true,\n                requireLowercase: true,\n                requireNumber: true,\n                requireSpecial: true,\n            }),\n            sensitive: true,\n            examples: ['SecureAdmin123!'],\n        }),\n    },\n\n    // ============================================================================\n    // Username Configuration\n    // ============================================================================\n    SPFN_AUTH_RESERVED_USERNAMES: {\n        ...envString({\n            description: 'Comma-separated list of reserved usernames that cannot be registered',\n            required: false,\n            default: 'admin,root,system,support,help,moderator,superadmin',\n            examples: [\n                'admin,root,system,support,help',\n                'admin,root,system,support,help,moderator,superadmin,operator',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_USERNAME_MIN_LENGTH: {\n        ...envNumber({\n            description: 'Minimum username length',\n            default: 3,\n            required: false,\n            examples: [2, 3, 4],\n        }),\n    },\n\n    SPFN_AUTH_USERNAME_MAX_LENGTH: {\n        ...envNumber({\n            description: 'Maximum username length',\n            default: 30,\n            required: false,\n            examples: [20, 30, 50],\n        }),\n    },\n\n    // ============================================================================\n    // API Configuration\n    // ============================================================================\n    SPFN_API_URL: {\n        ...envString({\n            description: 'Internal API URL for server-to-server communication',\n            default: 'http://localhost:8790',\n            required: false,\n            examples: [\n                'https://api.example.com',\n                'http://localhost:8790',\n            ],\n        }),\n    },\n\n    NEXT_PUBLIC_SPFN_API_URL: {\n        ...envString({\n            description: 'Public-facing API URL used for browser-facing redirects. Falls back to SPFN_API_URL if not set.',\n            required: false,\n            examples: [\n                'https://api.example.com',\n                'http://localhost:8790',\n            ],\n        }),\n    },\n\n    SPFN_APP_URL: {\n        ...envString({\n            description: 'Next.js application URL (internal). Used for server-to-server communication.',\n            default: 'http://localhost:3000',\n            required: false,\n            examples: [\n                'https://app.example.com',\n                'http://localhost:3000',\n            ],\n        }),\n    },\n\n    NEXT_PUBLIC_SPFN_APP_URL: {\n        ...envString({\n            description: 'Public-facing Next.js app URL for browser redirects (e.g. OAuth redirect). Falls back to SPFN_APP_URL if not set.',\n            required: false,\n            examples: [\n                'https://app.example.com',\n                'http://localhost:3000',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Google\n    // ============================================================================\n    SPFN_AUTH_GOOGLE_CLIENT_ID: {\n        ...envString({\n            description: 'Google OAuth 2.0 Client ID. When set, Google OAuth routes are automatically enabled.',\n            required: false,\n            examples: ['123456789-abc123.apps.googleusercontent.com'],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_CLIENT_SECRET: {\n        ...envString({\n            description: 'Google OAuth 2.0 Client Secret',\n            required: false,\n            sensitive: true,\n            examples: ['GOCSPX-abcdefghijklmnop'],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_SCOPES: {\n        ...envString({\n            description: 'Comma-separated Google OAuth scopes. Defaults to \"email,profile\" if not set.',\n            required: false,\n            examples: [\n                'email,profile',\n                'email,profile,https://www.googleapis.com/auth/gmail.readonly',\n                'email,profile,https://www.googleapis.com/auth/calendar.readonly',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_REDIRECT_URI: {\n        ...envString({\n            description: 'Google OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/google/callback — the callback must return to the web app origin that set the oauth_csrf cookie (the app rewrites /_auth/:path* to the API). Set this explicitly only when the callback should hit a different host (e.g. the API host for the direct oauthStart flow).',\n            required: false,\n            examples: [\n                'https://app.example.com/_auth/oauth/google/callback',\n                'http://localhost:3000/_auth/oauth/google/callback',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Kakao\n    // ============================================================================\n    SPFN_AUTH_KAKAO_CLIENT_ID: {\n        ...envString({\n            description: 'Kakao Login REST API key. Used as the OAuth client_id.',\n            required: false,\n            examples: ['your-kakao-rest-api-key'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_CLIENT_SECRET: {\n        ...envString({\n            description: 'Kakao Login client secret. Required when the Kakao client-secret feature is enabled.',\n            required: false,\n            sensitive: true,\n            examples: ['your-kakao-client-secret'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_ADMIN_KEY: {\n        ...envString({\n            description: 'Kakao app admin key. Required to verify the User Unlinked webhook (Authorization: KakaoAK header).',\n            required: false,\n            sensitive: true,\n            examples: ['your-kakao-admin-key'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_SCOPES: {\n        ...envString({\n            description: 'Comma-separated Kakao consent scopes. Defaults to account_email.',\n            required: false,\n            examples: ['account_email'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_REDIRECT_URI: {\n        ...envString({\n            description: 'Kakao OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/kakao/callback.',\n            required: false,\n            examples: ['https://app.example.com/_auth/oauth/kakao/callback'],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Naver\n    // ============================================================================\n    SPFN_AUTH_NAVER_CLIENT_ID: {\n        ...envString({\n            description: 'Naver Login OAuth client ID.',\n            required: false,\n            examples: ['your-naver-client-id'],\n        }),\n    },\n\n    SPFN_AUTH_NAVER_CLIENT_SECRET: {\n        ...envString({\n            description: 'Naver Login OAuth client secret.',\n            required: false,\n            sensitive: true,\n            examples: ['your-naver-client-secret'],\n        }),\n    },\n\n    SPFN_AUTH_NAVER_REDIRECT_URI: {\n        ...envString({\n            description: 'Naver OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/naver/callback.',\n            required: false,\n            examples: ['https://app.example.com/_auth/oauth/naver/callback'],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - GitHub\n    // ============================================================================\n    SPFN_AUTH_GITHUB_CLIENT_ID: {\n        ...envString({\n            description: 'GitHub OAuth app client ID. When set, GitHub OAuth routes are automatically enabled.',\n            required: false,\n            examples: ['Iv1.abc123def456'],\n        }),\n    },\n\n    SPFN_AUTH_GITHUB_CLIENT_SECRET: {\n        ...envString({\n            description: 'GitHub OAuth app client secret.',\n            required: false,\n            sensitive: true,\n            examples: ['your-github-client-secret'],\n        }),\n    },\n\n    SPFN_AUTH_GITHUB_SCOPES: {\n        ...envString({\n            description: 'Comma-separated GitHub OAuth scopes. Defaults to \"read:user,user:email\".',\n            required: false,\n            examples: ['read:user,user:email'],\n        }),\n    },\n\n    SPFN_AUTH_GITHUB_REDIRECT_URI: {\n        ...envString({\n            description: 'GitHub OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/github/callback.',\n            required: false,\n            examples: ['https://app.example.com/_auth/oauth/github/callback'],\n        }),\n    },\n\n    // ============================================================================\n    // Native Social Login (mobile/web id_token verification)\n    //\n    // 네이티브 SDK가 받은 id_token을 서버가 JWKS로 검증하는 경로 전용 설정.\n    // authorization code 교환을 하지 않으므로 client secret이 필요 없다.\n    // audience(aud)로 허용할 client id 목록만 지정한다.\n    // ============================================================================\n    SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS: {\n        ...envString({\n            description: 'Comma-separated Google client IDs accepted as id_token audience for native sign-in (iOS, Android, web). When set, Google native sign-in is enabled. SPFN_AUTH_GOOGLE_CLIENT_ID is also accepted automatically.',\n            required: false,\n            examples: [\n                '123-ios.apps.googleusercontent.com,123-android.apps.googleusercontent.com',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_APPLE_CLIENT_IDS: {\n        ...envString({\n            description: 'Comma-separated Apple client IDs accepted as id_token audience for native sign-in (iOS bundle ID, web/Android Services ID). When set, Apple native sign-in is enabled.',\n            required: false,\n            examples: [\n                'com.example.app,com.example.app.service',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_OAUTH_SUCCESS_URL: {\n        ...envString({\n            description: 'OAuth callback page URL. This page should use OAuthCallback component to finalize session.',\n            required: false,\n            default: '/auth/callback',\n            examples: [\n                '/auth/callback',\n                'https://app.example.com/auth/callback',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_OAUTH_ERROR_URL: {\n        ...envString({\n            description: 'URL to redirect after OAuth error. Use {error} placeholder for error message.',\n            required: false,\n            default: '/auth/error?error={error}',\n            examples: [\n                'https://app.example.com/auth/error?error={error}',\n                'http://localhost:3000/auth/error?error={error}',\n            ],\n        }),\n    },\n});\n"],"mappings":";AAcA,SAAS,yBAAyB;;;ACLlC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAoBA,IAAM,gBAAgB,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIzC,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,cAAc,CAAC,gBAAgB;AAAA,MAC/B,WAAW,yBAAyB;AAAA,QAChC,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,YAAY;AAAA,MAChB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,MACR,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ;AAAA;AAAA,MACR,UAAU,CAAC,MAAM,OAAO,OAAO,OAAO,MAAM;AAAA,IAChD,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AAAA,IAClB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,MAAM,OAAO,MAAM,KAAK;AAAA,IACvC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,yBAAyB;AAAA,IACrB,GAAG,WAAW;AAAA,MACV,aAAa;AAAA,MACb,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU,CAAC,MAAM,KAAK;AAAA,IAC1B,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,IAAI,IAAI,EAAE;AAAA,IACzB,CAAC;AAAA,IACD,KAAK;AAAA,EACT;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,iCAAiC;AAAA,IAC7B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,wBAAwB;AAAA,IACpB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,mBAAmB;AAAA,IAClC,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW,qBAAqB;AAAA,QAC5B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,gBAAgB;AAAA,MACpB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,UAAU,CAAC,iBAAiB;AAAA,IAChC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,GAAG,GAAG,CAAC;AAAA,IACtB,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,IAAI,IAAI,EAAE;AAAA,IACzB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,6CAA6C;AAAA,IAC5D,CAAC;AAAA,EACL;AAAA,EAEA,gCAAgC;AAAA,IAC5B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,yBAAyB;AAAA,IACxC,CAAC;AAAA,EACL;AAAA,EAEA,yBAAyB;AAAA,IACrB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,yBAAyB;AAAA,IACxC,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0BAA0B;AAAA,IACzC,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,wBAAwB;AAAA,IACpB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,eAAe;AAAA,IAC9B,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,oDAAoD;AAAA,IACnE,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0BAA0B;AAAA,IACzC,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,oDAAoD;AAAA,IACnE,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,kBAAkB;AAAA,IACjC,CAAC;AAAA,EACL;AAAA,EAEA,gCAAgC;AAAA,IAC5B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,2BAA2B;AAAA,IAC1C,CAAC;AAAA,EACL;AAAA,EAEA,yBAAyB;AAAA,IACrB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,qDAAqD;AAAA,IACpE,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oCAAoC;AAAA,IAChC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AACJ,CAAC;;;ADtdD,IAAM,WAAW,kBAAkB,aAAa;AACzC,IAAM,MAAM,SAAS,SAAS;","names":[]}
+{"version":3,"sources":["../src/config/index.ts","../src/config/schema.ts"],"sourcesContent":["/**\n * Core Package Configuration\n *\n * @example\n * ```typescript\n * import { registry } from '@spfn/core/config';\n *\n * const env = registry.validate();\n * console.log(env.DB_POOL_MAX);\n * ```\n *\n * @module config\n */\n\nimport { createEnvRegistry } from '@spfn/core/env';\nimport { authEnvSchema } from './schema';\n\nexport { authEnvSchema as envSchema } from './schema';\n\n/**\n * Environment registry\n */\nconst registry = createEnvRegistry(authEnvSchema);\nexport const env = registry.validate();\n","/**\n * Auth Environment Variable Schema\n *\n * Centralized schema definition for all environment variables used in @spfn/auth.\n * This provides type safety, validation, and documentation for Auth configuration.\n *\n * @module config/schema\n */\n\nimport {\n    defineEnvSchema,\n    envString,\n    envNumber,\n    envBoolean,\n    createSecureSecretParser,\n    createPasswordParser,\n} from '@spfn/core/env';\n\n/**\n * Auth environment variable schema\n *\n * Defines all Auth environment variables with:\n * - Type information\n * - Default values\n * - Validation rules\n * - Documentation\n *\n * @example\n * ```typescript\n * import { envSchema } from '@spfn/auth/config';\n *\n * // Access schema information\n * console.log(envSchema.SPFN_AUTH_SESSION_SECRET.description);\n * console.log(envSchema.SPFN_AUTH_JWT_EXPIRES_IN.default);\n * ```\n */\nexport const authEnvSchema = defineEnvSchema({\n    // ============================================================================\n    // Session Configuration\n    // ============================================================================\n    SPFN_AUTH_SESSION_SECRET: {\n        ...envString({\n            description: 'Session encryption secret (minimum 32 characters for AES-256)',\n            required: true,\n            fallbackKeys: ['SESSION_SECRET'],\n            validator: createSecureSecretParser({\n                minLength: 32,\n                minUniqueChars: 16,\n                minEntropy: 3.5,\n            }),\n            sensitive: true,\n            nextjs: true, // Required for Next.js RSC session validation\n            examples: [\n                'my-super-secret-session-key-at-least-32-chars-long',\n                'use-a-cryptographically-secure-random-string-here',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_SESSION_TTL: {\n        ...envString({\n            description: 'Session TTL (time to live) - supports duration strings like \\'7d\\', \\'12h\\', \\'45m\\'',\n            default: '7d',\n            required: false,\n            nextjs: true, // May be needed for session validation in Next.js RSC\n            examples: ['7d', '30d', '12h', '45m', '3600'],\n        }),\n    },\n\n    // ============================================================================\n    // JWT Configuration\n    // ============================================================================\n    SPFN_AUTH_JWT_SECRET: {\n        ...envString({\n            description: 'JWT signing secret for server-signed tokens (legacy mode)',\n            default: 'dev-secret-key-change-in-production',\n            required: false,\n            examples: [\n                'your-jwt-secret-key-here',\n                'use-different-from-session-secret',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_JWT_EXPIRES_IN: {\n        ...envString({\n            description: 'JWT token expiration time (e.g., \\'7d\\', \\'24h\\', \\'1h\\')',\n            default: '7d',\n            required: false,\n            examples: ['7d', '24h', '1h', '30m'],\n        }),\n    },\n\n    // ============================================================================\n    // Security Configuration\n    // ============================================================================\n    SPFN_AUTH_COOKIE_SECURE: {\n        ...envBoolean({\n            description: 'Override cookie Secure flag. Defaults to NODE_ENV === \"production\". Set to false for HTTP-only environments (e.g. bastion over plain HTTP).',\n            required: false,\n            nextjs: true,\n            examples: [true, false],\n        }),\n    },\n\n    SPFN_AUTH_BCRYPT_SALT_ROUNDS: {\n        ...envNumber({\n            description: 'Bcrypt salt rounds (cost factor, higher = more secure but slower)',\n            default: 12,\n            required: false,\n            examples: [10, 12, 14],\n        }),\n        key: 'SPFN_AUTH_BCRYPT_SALT_ROUNDS',\n    },\n\n    SPFN_AUTH_VERIFICATION_TOKEN_SECRET: {\n        ...envString({\n            description: 'Verification token secret for email verification, password reset, etc.',\n            required: true,\n            examples: [\n                'your-verification-token-secret',\n                'can-be-different-from-jwt-secret',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_TOKEN_ENCRYPTION_KEYS: {\n        ...envString({\n            description: 'Backend-only OAuth token encryption keyring. Comma-separated <keyId>:<base64-encoded 32-byte key> entries; the first key encrypts new values and remaining keys decrypt during rotation.',\n            required: false,\n            sensitive: true,\n            examples: [\n                'v2:<base64-encoded-32-byte-key>,v1:<previous-base64-encoded-32-byte-key>',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // Admin Account Configuration\n    // ============================================================================\n    SPFN_AUTH_ADMIN_ACCOUNTS: {\n        ...envString({\n            description: 'JSON array of admin accounts (recommended for multiple admins)',\n            required: false,\n            examples: [\n                '[{\"email\":\"admin@example.com\",\"password\":\"secure-pass\",\"role\":\"admin\"}]',\n                '[{\"email\":\"super@example.com\",\"password\":\"pass1\",\"role\":\"superadmin\"},{\"email\":\"admin@example.com\",\"password\":\"pass2\",\"role\":\"admin\"}]',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAILS: {\n        ...envString({\n            description: 'Comma-separated list of admin emails (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin@example.com,user@example.com',\n                'super@example.com,admin@example.com,user@example.com',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORDS: {\n        ...envString({\n            description: 'Comma-separated list of admin passwords (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin-pass,user-pass',\n                'super-pass,admin-pass,user-pass',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_ROLES: {\n        ...envString({\n            description: 'Comma-separated list of admin roles (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin,user',\n                'superadmin,admin,user',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAIL: {\n        ...envString({\n            description: 'Single admin email (simplest format)',\n            required: false,\n            examples: ['admin@example.com'],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORD: {\n        ...envString({\n            description: 'Single admin password (simplest format)',\n            required: false,\n            validator: createPasswordParser({\n                minLength: 8,\n                requireUppercase: true,\n                requireLowercase: true,\n                requireNumber: true,\n                requireSpecial: true,\n            }),\n            sensitive: true,\n            examples: ['SecureAdmin123!'],\n        }),\n    },\n\n    // ============================================================================\n    // Username Configuration\n    // ============================================================================\n    SPFN_AUTH_RESERVED_USERNAMES: {\n        ...envString({\n            description: 'Comma-separated list of reserved usernames that cannot be registered',\n            required: false,\n            default: 'admin,root,system,support,help,moderator,superadmin',\n            examples: [\n                'admin,root,system,support,help',\n                'admin,root,system,support,help,moderator,superadmin,operator',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_USERNAME_MIN_LENGTH: {\n        ...envNumber({\n            description: 'Minimum username length',\n            default: 3,\n            required: false,\n            examples: [2, 3, 4],\n        }),\n    },\n\n    SPFN_AUTH_USERNAME_MAX_LENGTH: {\n        ...envNumber({\n            description: 'Maximum username length',\n            default: 30,\n            required: false,\n            examples: [20, 30, 50],\n        }),\n    },\n\n    // ============================================================================\n    // API Configuration\n    // ============================================================================\n    SPFN_API_URL: {\n        ...envString({\n            description: 'Internal API URL for server-to-server communication',\n            default: 'http://localhost:8790',\n            required: false,\n            examples: [\n                'https://api.example.com',\n                'http://localhost:8790',\n            ],\n        }),\n    },\n\n    NEXT_PUBLIC_SPFN_API_URL: {\n        ...envString({\n            description: 'Public-facing API URL used for browser-facing redirects. Falls back to SPFN_API_URL if not set.',\n            required: false,\n            examples: [\n                'https://api.example.com',\n                'http://localhost:8790',\n            ],\n        }),\n    },\n\n    SPFN_APP_URL: {\n        ...envString({\n            description: 'Next.js application URL (internal). Used for server-to-server communication.',\n            default: 'http://localhost:3000',\n            required: false,\n            examples: [\n                'https://app.example.com',\n                'http://localhost:3000',\n            ],\n        }),\n    },\n\n    NEXT_PUBLIC_SPFN_APP_URL: {\n        ...envString({\n            description: 'Public-facing Next.js app URL for browser redirects (e.g. OAuth redirect). Falls back to SPFN_APP_URL if not set.',\n            required: false,\n            examples: [\n                'https://app.example.com',\n                'http://localhost:3000',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Google\n    // ============================================================================\n    SPFN_AUTH_GOOGLE_CLIENT_ID: {\n        ...envString({\n            description: 'Google OAuth 2.0 Client ID. When set, Google OAuth routes are automatically enabled.',\n            required: false,\n            examples: ['123456789-abc123.apps.googleusercontent.com'],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_CLIENT_SECRET: {\n        ...envString({\n            description: 'Google OAuth 2.0 Client Secret',\n            required: false,\n            sensitive: true,\n            examples: ['GOCSPX-abcdefghijklmnop'],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_SCOPES: {\n        ...envString({\n            description: 'Comma-separated Google OAuth scopes. Defaults to \"email,profile\" if not set.',\n            required: false,\n            examples: [\n                'email,profile',\n                'email,profile,https://www.googleapis.com/auth/gmail.readonly',\n                'email,profile,https://www.googleapis.com/auth/calendar.readonly',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_REDIRECT_URI: {\n        ...envString({\n            description: 'Google OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/google/callback — the callback must return to the web app origin that set the oauth_csrf cookie (the app rewrites /_auth/:path* to the API). Set this explicitly only when the callback should hit a different host (e.g. the API host for the direct oauthStart flow).',\n            required: false,\n            examples: [\n                'https://app.example.com/_auth/oauth/google/callback',\n                'http://localhost:3000/_auth/oauth/google/callback',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Kakao\n    // ============================================================================\n    SPFN_AUTH_KAKAO_CLIENT_ID: {\n        ...envString({\n            description: 'Kakao Login REST API key. Used as the OAuth client_id.',\n            required: false,\n            examples: ['your-kakao-rest-api-key'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_CLIENT_SECRET: {\n        ...envString({\n            description: 'Kakao Login client secret. Required when the Kakao client-secret feature is enabled.',\n            required: false,\n            sensitive: true,\n            examples: ['your-kakao-client-secret'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_ADMIN_KEY: {\n        ...envString({\n            description: 'Kakao app admin key. Required to verify the User Unlinked webhook (Authorization: KakaoAK header).',\n            required: false,\n            sensitive: true,\n            examples: ['your-kakao-admin-key'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_SCOPES: {\n        ...envString({\n            description: 'Comma-separated Kakao consent scopes. Defaults to account_email.',\n            required: false,\n            examples: ['account_email'],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_REDIRECT_URI: {\n        ...envString({\n            description: 'Kakao OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/kakao/callback.',\n            required: false,\n            examples: ['https://app.example.com/_auth/oauth/kakao/callback'],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Naver\n    // ============================================================================\n    SPFN_AUTH_NAVER_CLIENT_ID: {\n        ...envString({\n            description: 'Naver Login OAuth client ID.',\n            required: false,\n            examples: ['your-naver-client-id'],\n        }),\n    },\n\n    SPFN_AUTH_NAVER_CLIENT_SECRET: {\n        ...envString({\n            description: 'Naver Login OAuth client secret.',\n            required: false,\n            sensitive: true,\n            examples: ['your-naver-client-secret'],\n        }),\n    },\n\n    SPFN_AUTH_NAVER_REDIRECT_URI: {\n        ...envString({\n            description: 'Naver OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/naver/callback.',\n            required: false,\n            examples: ['https://app.example.com/_auth/oauth/naver/callback'],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - GitHub\n    // ============================================================================\n    SPFN_AUTH_GITHUB_CLIENT_ID: {\n        ...envString({\n            description: 'GitHub OAuth app client ID. When set, GitHub OAuth routes are automatically enabled.',\n            required: false,\n            examples: ['Iv1.abc123def456'],\n        }),\n    },\n\n    SPFN_AUTH_GITHUB_CLIENT_SECRET: {\n        ...envString({\n            description: 'GitHub OAuth app client secret.',\n            required: false,\n            sensitive: true,\n            examples: ['your-github-client-secret'],\n        }),\n    },\n\n    SPFN_AUTH_GITHUB_SCOPES: {\n        ...envString({\n            description: 'Comma-separated GitHub OAuth scopes. Defaults to \"read:user,user:email\".',\n            required: false,\n            examples: ['read:user,user:email'],\n        }),\n    },\n\n    SPFN_AUTH_GITHUB_REDIRECT_URI: {\n        ...envString({\n            description: 'GitHub OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/github/callback.',\n            required: false,\n            examples: ['https://app.example.com/_auth/oauth/github/callback'],\n        }),\n    },\n\n    // ============================================================================\n    // Native Social Login (mobile/web id_token verification)\n    //\n    // 네이티브 SDK가 받은 id_token을 서버가 JWKS로 검증하는 경로 전용 설정.\n    // authorization code 교환을 하지 않으므로 client secret이 필요 없다.\n    // audience(aud)로 허용할 client id 목록만 지정한다.\n    // ============================================================================\n    SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS: {\n        ...envString({\n            description: 'Comma-separated Google client IDs accepted as id_token audience for native sign-in (iOS, Android, web). When set, Google native sign-in is enabled. SPFN_AUTH_GOOGLE_CLIENT_ID is also accepted automatically.',\n            required: false,\n            examples: [\n                '123-ios.apps.googleusercontent.com,123-android.apps.googleusercontent.com',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_APPLE_CLIENT_IDS: {\n        ...envString({\n            description: 'Comma-separated Apple client IDs accepted as id_token audience for native sign-in (iOS bundle ID, web/Android Services ID). When set, Apple native sign-in is enabled.',\n            required: false,\n            examples: [\n                'com.example.app,com.example.app.service',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS: {\n        ...envString({\n            description: 'Comma-separated Kakao app keys accepted as id_token audience for native sign-in (native app key). SPFN_AUTH_KAKAO_CLIENT_ID (REST API key) is also accepted automatically, so native sign-in is available when either variable is set. Requires OpenID Connect to be enabled in the Kakao developer console.',\n            required: false,\n            examples: [\n                'your-kakao-native-app-key',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS: {\n        ...envString({\n            description: 'Comma-separated Naver client IDs accepted as id_token audience for native sign-in. SPFN_AUTH_NAVER_CLIENT_ID is also accepted automatically, and one Naver application has a single client ID covering web and app environments — set this only when the app uses a separate application.',\n            required: false,\n            examples: [\n                'your-naver-app-client-id',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_OAUTH_SUCCESS_URL: {\n        ...envString({\n            description: 'OAuth callback page URL. This page should use OAuthCallback component to finalize session.',\n            required: false,\n            default: '/auth/callback',\n            examples: [\n                '/auth/callback',\n                'https://app.example.com/auth/callback',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_OAUTH_ERROR_URL: {\n        ...envString({\n            description: 'URL to redirect after OAuth error. Use {error} placeholder for error message.',\n            required: false,\n            default: '/auth/error?error={error}',\n            examples: [\n                'https://app.example.com/auth/error?error={error}',\n                'http://localhost:3000/auth/error?error={error}',\n            ],\n        }),\n    },\n});\n"],"mappings":";AAcA,SAAS,yBAAyB;;;ACLlC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAoBA,IAAM,gBAAgB,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIzC,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,cAAc,CAAC,gBAAgB;AAAA,MAC/B,WAAW,yBAAyB;AAAA,QAChC,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,YAAY;AAAA,MAChB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,MACR,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ;AAAA;AAAA,MACR,UAAU,CAAC,MAAM,OAAO,OAAO,OAAO,MAAM;AAAA,IAChD,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AAAA,IAClB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,MAAM,OAAO,MAAM,KAAK;AAAA,IACvC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,yBAAyB;AAAA,IACrB,GAAG,WAAW;AAAA,MACV,aAAa;AAAA,MACb,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU,CAAC,MAAM,KAAK;AAAA,IAC1B,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,IAAI,IAAI,EAAE;AAAA,IACzB,CAAC;AAAA,IACD,KAAK;AAAA,EACT;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,iCAAiC;AAAA,IAC7B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,wBAAwB;AAAA,IACpB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,mBAAmB;AAAA,IAClC,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW,qBAAqB;AAAA,QAC5B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,gBAAgB;AAAA,MACpB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,UAAU,CAAC,iBAAiB;AAAA,IAChC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,GAAG,GAAG,CAAC;AAAA,IACtB,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,IAAI,IAAI,EAAE;AAAA,IACzB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,6CAA6C;AAAA,IAC5D,CAAC;AAAA,EACL;AAAA,EAEA,gCAAgC;AAAA,IAC5B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,yBAAyB;AAAA,IACxC,CAAC;AAAA,EACL;AAAA,EAEA,yBAAyB;AAAA,IACrB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,yBAAyB;AAAA,IACxC,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0BAA0B;AAAA,IACzC,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,wBAAwB;AAAA,IACpB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,eAAe;AAAA,IAC9B,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,oDAAoD;AAAA,IACnE,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0BAA0B;AAAA,IACzC,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,oDAAoD;AAAA,IACnE,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,kBAAkB;AAAA,IACjC,CAAC;AAAA,EACL;AAAA,EAEA,gCAAgC;AAAA,IAC5B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,2BAA2B;AAAA,IAC1C,CAAC;AAAA,EACL;AAAA,EAEA,yBAAyB;AAAA,IACrB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,qDAAqD;AAAA,IACpE,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oCAAoC;AAAA,IAChC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,mCAAmC;AAAA,IAC/B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,mCAAmC;AAAA,IAC/B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AACJ,CAAC;;;AD1eD,IAAM,WAAW,kBAAkB,aAAa;AACzC,IAAM,MAAM,SAAS,SAAS;","names":[]}

package/dist/errors.d.ts

@@ -171,6 +171,23 @@ declare class InvalidVerificationTokenError extends ValidationError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Key ID Already Registered Error (409)
+ *
+ * Thrown when a sign-in submits a keyId that is already taken — the client's own
+ * revoked keyId, or a keyId belonging to another user. `keyId` is unique across
+ * all users, so either case would collide on insert.
+ *
+ * The same error covers both cases on purpose: a distinguishable response would
+ * let a caller probe whether an arbitrary keyId exists. Revoked stays revoked —
+ * the client must generate a fresh keyId and retry.
+ */
+declare class KeyIdAlreadyRegisteredError extends ConflictError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 /**
  * Invalid Key Fingerprint Error (400)
  *
@@ -182,6 +199,70 @@ declare class InvalidKeyFingerprintError extends ValidationError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Key Not Found Error (404)
+ *
+ * Thrown when a key operation names a keyId the caller does not own. It says
+ * nothing about whether that keyId exists on another account — the repository
+ * scopes every lookup by userId, so the answer is only ever "not yours".
+ */
+declare class KeyNotFoundError extends NotFoundError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Nonce Key Binding Error (400)
+ *
+ * Thrown when a native id_token sign-in submits a nonce that is not the public
+ * key's fingerprint. The nonce is what the provider echoed back inside the
+ * id_token, so tying it to the key is what proves the id_token and the key came
+ * from the same device — see the native section of the README.
+ */
+declare class NonceKeyBindingError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Native Sign-In Unsupported Error (400)
+ *
+ * Thrown when a provider is asked for native id_token sign-in and has no
+ * implementation for it — a server configuration fact, not something the user
+ * did. A client reading this hides that provider's native button instead of
+ * asking the user to try again.
+ *
+ * Split out of ValidationError because the other native-enrollment refusal
+ * (linking to an account whose email the provider never verified) needs a
+ * different response from the app, and one code cannot ask for two.
+ */
+declare class NativeSignInUnsupportedError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Unverified Email Link Error (400)
+ *
+ * Thrown when a social identity carries an email that already belongs to an
+ * account, but the provider never verified it. Linking on an unverified email
+ * is account takeover, so the refusal stands and the user is sent to a path
+ * that proves the address.
+ *
+ * This says an account exists for that address. It is not a leak introduced
+ * here: the message this replaces already stated the same fact in prose, and
+ * the paths that must not disclose account existence (password login, deletion
+ * re-auth, verification issuance) answer uniformly and are untouched.
+ */
+declare class UnverifiedEmailLinkError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 /**
  * Verification Token Purpose Mismatch Error (400)
  *
@@ -285,12 +366,22 @@ type authErrors_InvalidVerificationTokenError = InvalidVerificationTokenError;
 declare const authErrors_InvalidVerificationTokenError: typeof InvalidVerificationTokenError;
 type authErrors_KeyExpiredError = KeyExpiredError;
 declare const authErrors_KeyExpiredError: typeof KeyExpiredError;
+type authErrors_KeyIdAlreadyRegisteredError = KeyIdAlreadyRegisteredError;
+declare const authErrors_KeyIdAlreadyRegisteredError: typeof KeyIdAlreadyRegisteredError;
+type authErrors_KeyNotFoundError = KeyNotFoundError;
+declare const authErrors_KeyNotFoundError: typeof KeyNotFoundError;
+type authErrors_NativeSignInUnsupportedError = NativeSignInUnsupportedError;
+declare const authErrors_NativeSignInUnsupportedError: typeof NativeSignInUnsupportedError;
+type authErrors_NonceKeyBindingError = NonceKeyBindingError;
+declare const authErrors_NonceKeyBindingError: typeof NonceKeyBindingError;
 type authErrors_RegistrationRejectedError = RegistrationRejectedError;
 declare const authErrors_RegistrationRejectedError: typeof RegistrationRejectedError;
 type authErrors_ReservedUsernameError = ReservedUsernameError;
 declare const authErrors_ReservedUsernameError: typeof ReservedUsernameError;
 type authErrors_TokenExpiredError = TokenExpiredError;
 declare const authErrors_TokenExpiredError: typeof TokenExpiredError;
+type authErrors_UnverifiedEmailLinkError = UnverifiedEmailLinkError;
+declare const authErrors_UnverifiedEmailLinkError: typeof UnverifiedEmailLinkError;
 type authErrors_UsernameAlreadyTakenError = UsernameAlreadyTakenError;
 declare const authErrors_UsernameAlreadyTakenError: typeof UsernameAlreadyTakenError;
 type authErrors_VerificationTokenPurposeMismatchError = VerificationTokenPurposeMismatchError;
@@ -298,7 +389,7 @@ declare const authErrors_VerificationTokenPurposeMismatchError: typeof Verificat
 type authErrors_VerificationTokenTargetMismatchError = VerificationTokenTargetMismatchError;
 declare const authErrors_VerificationTokenTargetMismatchError: typeof VerificationTokenTargetMismatchError;
 declare namespace authErrors {
-  export { authErrors_AccountAlreadyExistsError as AccountAlreadyExistsError, authErrors_AccountDisabledError as AccountDisabledError, authErrors_AccountPendingDeletionError as AccountPendingDeletionError, authErrors_DeletionAlreadyRequestedError as DeletionAlreadyRequestedError, authErrors_DeletionNotRequestedError as DeletionNotRequestedError, authErrors_ImmediateDeletionNotAllowedError as ImmediateDeletionNotAllowedError, authErrors_InsufficientPermissionsError as InsufficientPermissionsError, authErrors_InsufficientRoleError as InsufficientRoleError, authErrors_InvalidCredentialsError as InvalidCredentialsError, authErrors_InvalidKeyFingerprintError as InvalidKeyFingerprintError, authErrors_InvalidSocialTokenError as InvalidSocialTokenError, authErrors_InvalidTokenError as InvalidTokenError, authErrors_InvalidVerificationCodeError as InvalidVerificationCodeError, authErrors_InvalidVerificationTokenError as InvalidVerificationTokenError, authErrors_KeyExpiredError as KeyExpiredError, authErrors_RegistrationRejectedError as RegistrationRejectedError, authErrors_ReservedUsernameError as ReservedUsernameError, authErrors_TokenExpiredError as TokenExpiredError, authErrors_UsernameAlreadyTakenError as UsernameAlreadyTakenError, authErrors_VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError, authErrors_VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError };
+  export { authErrors_AccountAlreadyExistsError as AccountAlreadyExistsError, authErrors_AccountDisabledError as AccountDisabledError, authErrors_AccountPendingDeletionError as AccountPendingDeletionError, authErrors_DeletionAlreadyRequestedError as DeletionAlreadyRequestedError, authErrors_DeletionNotRequestedError as DeletionNotRequestedError, authErrors_ImmediateDeletionNotAllowedError as ImmediateDeletionNotAllowedError, authErrors_InsufficientPermissionsError as InsufficientPermissionsError, authErrors_InsufficientRoleError as InsufficientRoleError, authErrors_InvalidCredentialsError as InvalidCredentialsError, authErrors_InvalidKeyFingerprintError as InvalidKeyFingerprintError, authErrors_InvalidSocialTokenError as InvalidSocialTokenError, authErrors_InvalidTokenError as InvalidTokenError, authErrors_InvalidVerificationCodeError as InvalidVerificationCodeError, authErrors_InvalidVerificationTokenError as InvalidVerificationTokenError, authErrors_KeyExpiredError as KeyExpiredError, authErrors_KeyIdAlreadyRegisteredError as KeyIdAlreadyRegisteredError, authErrors_KeyNotFoundError as KeyNotFoundError, authErrors_NativeSignInUnsupportedError as NativeSignInUnsupportedError, authErrors_NonceKeyBindingError as NonceKeyBindingError, authErrors_RegistrationRejectedError as RegistrationRejectedError, authErrors_ReservedUsernameError as ReservedUsernameError, authErrors_TokenExpiredError as TokenExpiredError, authErrors_UnverifiedEmailLinkError as UnverifiedEmailLinkError, authErrors_UsernameAlreadyTakenError as UsernameAlreadyTakenError, authErrors_VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError, authErrors_VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError };
 }
 
 /**
@@ -307,4 +398,4 @@ declare namespace authErrors {
 
 declare const authErrorRegistry: ErrorRegistry;
 
-export { AccountAlreadyExistsError, AccountDisabledError, AccountPendingDeletionError, authErrors as AuthError, DeletionAlreadyRequestedError, DeletionNotRequestedError, ImmediateDeletionNotAllowedError, InsufficientPermissionsError, InsufficientRoleError, InvalidCredentialsError, InvalidKeyFingerprintError, InvalidSocialTokenError, InvalidTokenError, InvalidVerificationCodeError, InvalidVerificationTokenError, KeyExpiredError, RegistrationRejectedError, ReservedUsernameError, TokenExpiredError, UsernameAlreadyTakenError, VerificationTokenPurposeMismatchError, VerificationTokenTargetMismatchError, authErrorRegistry };
+export { AccountAlreadyExistsError, AccountDisabledError, AccountPendingDeletionError, authErrors as AuthError, DeletionAlreadyRequestedError, DeletionNotRequestedError, ImmediateDeletionNotAllowedError, InsufficientPermissionsError, InsufficientRoleError, InvalidCredentialsError, InvalidKeyFingerprintError, InvalidSocialTokenError, InvalidTokenError, InvalidVerificationCodeError, InvalidVerificationTokenError, KeyExpiredError, KeyIdAlreadyRegisteredError, KeyNotFoundError, NativeSignInUnsupportedError, NonceKeyBindingError, RegistrationRejectedError, ReservedUsernameError, TokenExpiredError, UnverifiedEmailLinkError, UsernameAlreadyTakenError, VerificationTokenPurposeMismatchError, VerificationTokenTargetMismatchError, authErrorRegistry };

package/dist/errors.js

@@ -25,9 +25,14 @@ __export(auth_errors_exports, {
   InvalidVerificationCodeError: () => InvalidVerificationCodeError,
   InvalidVerificationTokenError: () => InvalidVerificationTokenError,
   KeyExpiredError: () => KeyExpiredError,
+  KeyIdAlreadyRegisteredError: () => KeyIdAlreadyRegisteredError,
+  KeyNotFoundError: () => KeyNotFoundError,
+  NativeSignInUnsupportedError: () => NativeSignInUnsupportedError,
+  NonceKeyBindingError: () => NonceKeyBindingError,
   RegistrationRejectedError: () => RegistrationRejectedError,
   ReservedUsernameError: () => ReservedUsernameError,
   TokenExpiredError: () => TokenExpiredError,
+  UnverifiedEmailLinkError: () => UnverifiedEmailLinkError,
   UsernameAlreadyTakenError: () => UsernameAlreadyTakenError,
   VerificationTokenPurposeMismatchError: () => VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError: () => VerificationTokenTargetMismatchError
@@ -137,12 +142,54 @@ var InvalidVerificationTokenError = class extends ValidationError {
     this.name = "InvalidVerificationTokenError";
   }
 };
+var KeyIdAlreadyRegisteredError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This keyId is already registered. Generate a new keyId and retry.",
+      details: data.details
+    });
+    this.name = "KeyIdAlreadyRegisteredError";
+  }
+};
 var InvalidKeyFingerprintError = class extends ValidationError {
   constructor(data = {}) {
     super({ message: data.message || "Invalid key fingerprint", details: data.details });
     this.name = "InvalidKeyFingerprintError";
   }
 };
+var KeyNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "Key not found", details: data.details });
+    this.name = "KeyNotFoundError";
+  }
+};
+var NonceKeyBindingError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "nonce must be the fingerprint of the submitted public key",
+      details: data.details
+    });
+    this.name = "NonceKeyBindingError";
+  }
+};
+var NativeSignInUnsupportedError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This provider does not support native id_token sign-in.",
+      details: data.details
+    });
+    this.name = "NativeSignInUnsupportedError";
+  }
+};
+var UnverifiedEmailLinkError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Cannot link to existing account with unverified email. Please verify your email with the provider first.",
+      details: data.details
+    });
+    this.name = "UnverifiedEmailLinkError";
+  }
+};
 var VerificationTokenPurposeMismatchError = class extends ValidationError {
   constructor(data = {}) {
     const expected = data.expected || "unknown";
@@ -222,6 +269,11 @@ authErrorRegistry.append([
   InvalidVerificationCodeError,
   InvalidVerificationTokenError,
   InvalidKeyFingerprintError,
+  NonceKeyBindingError,
+  NativeSignInUnsupportedError,
+  UnverifiedEmailLinkError,
+  KeyNotFoundError,
+  KeyIdAlreadyRegisteredError,
   VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError,
   InsufficientPermissionsError,
@@ -244,9 +296,14 @@ export {
   InvalidVerificationCodeError,
   InvalidVerificationTokenError,
   KeyExpiredError,
+  KeyIdAlreadyRegisteredError,
+  KeyNotFoundError,
+  NativeSignInUnsupportedError,
+  NonceKeyBindingError,
   RegistrationRejectedError,
   ReservedUsernameError,
   TokenExpiredError,
+  UnverifiedEmailLinkError,
   UsernameAlreadyTakenError,
   VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError,

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors/index.ts","../src/errors/auth-errors.ts"],"sourcesContent":["/**\n * Auth Error Exports\n */\n\nimport { ErrorRegistry } from '@spfn/core/errors';\n\nimport {\n    InvalidCredentialsError,\n    InvalidTokenError,\n    InvalidSocialTokenError,\n    TokenExpiredError,\n    KeyExpiredError,\n    AccountDisabledError,\n    AccountPendingDeletionError,\n    DeletionAlreadyRequestedError,\n    DeletionNotRequestedError,\n    ImmediateDeletionNotAllowedError,\n    AccountAlreadyExistsError,\n    RegistrationRejectedError,\n    ReservedUsernameError,\n    UsernameAlreadyTakenError,\n    InvalidVerificationCodeError,\n    InvalidVerificationTokenError,\n    InvalidKeyFingerprintError,\n    VerificationTokenPurposeMismatchError,\n    VerificationTokenTargetMismatchError,\n    InsufficientPermissionsError,\n    InsufficientRoleError,\n} from './auth-errors';\n\nexport {\n    InvalidCredentialsError,\n    InvalidTokenError,\n    InvalidSocialTokenError,\n    TokenExpiredError,\n    KeyExpiredError,\n    AccountDisabledError,\n    AccountPendingDeletionError,\n    DeletionAlreadyRequestedError,\n    DeletionNotRequestedError,\n    ImmediateDeletionNotAllowedError,\n    AccountAlreadyExistsError,\n    RegistrationRejectedError,\n    ReservedUsernameError,\n    UsernameAlreadyTakenError,\n    InvalidVerificationCodeError,\n    InvalidVerificationTokenError,\n    InvalidKeyFingerprintError,\n    VerificationTokenPurposeMismatchError,\n    VerificationTokenTargetMismatchError,\n    InsufficientPermissionsError,\n    InsufficientRoleError,\n} from './auth-errors';\n\nexport const authErrorRegistry = new ErrorRegistry();\nauthErrorRegistry.append([\n    InvalidCredentialsError,\n    InvalidTokenError,\n    InvalidSocialTokenError,\n    TokenExpiredError,\n    KeyExpiredError,\n    AccountDisabledError,\n    AccountPendingDeletionError,\n    DeletionAlreadyRequestedError,\n    DeletionNotRequestedError,\n    ImmediateDeletionNotAllowedError,\n    AccountAlreadyExistsError,\n    RegistrationRejectedError,\n    ReservedUsernameError,\n    UsernameAlreadyTakenError,\n    InvalidVerificationCodeError,\n    InvalidVerificationTokenError,\n    InvalidKeyFingerprintError,\n    VerificationTokenPurposeMismatchError,\n    VerificationTokenTargetMismatchError,\n    InsufficientPermissionsError,\n    InsufficientRoleError,\n]);\n\nexport * as AuthError from './auth-errors';\n","/**\n * Authentication & Authorization Error Classes\n *\n * Custom error classes for auth-specific scenarios\n */\n\nimport {\n    ValidationError,\n    UnauthorizedError,\n    ForbiddenError,\n    ConflictError,\n    NotFoundError,\n} from '@spfn/core/errors';\n\n/**\n * Invalid Credentials Error (401)\n *\n * Thrown when login credentials are incorrect\n */\nexport class InvalidCredentialsError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid credentials', details: data.details });\n        this.name = 'InvalidCredentialsError';\n    }\n}\n\n/**\n * Invalid Token Error (401)\n *\n * Thrown when authentication token is invalid or malformed\n */\nexport class InvalidTokenError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid authentication token', details: data.details });\n        this.name = 'InvalidTokenError';\n    }\n}\n\n/**\n * Invalid Social Token Error (401)\n *\n * Thrown when a social provider id_token fails verification\n * (bad signature, wrong issuer/audience, expired, or nonce mismatch).\n */\nexport class InvalidSocialTokenError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid social id_token', details: data.details });\n        this.name = 'InvalidSocialTokenError';\n    }\n}\n\n/**\n * Token Expired Error (401)\n *\n * Thrown when authentication token has expired\n */\nexport class TokenExpiredError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Authentication token has expired', details: data.details });\n        this.name = 'TokenExpiredError';\n    }\n}\n\n/**\n * Key Expired Error (401)\n *\n * Thrown when public key has expired\n */\nexport class KeyExpiredError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Public key has expired', details: data.details });\n        this.name = 'KeyExpiredError';\n    }\n}\n\n/**\n * Account Disabled Error (403)\n *\n * Thrown when user account is disabled or inactive\n */\nexport class AccountDisabledError extends ForbiddenError\n{\n    constructor(data: { status?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        const status = data.status || 'disabled';\n        super({\n            message: data.message || `Account is ${status}`,\n            details: { status, ...data.details },\n        });\n        this.name = 'AccountDisabledError';\n    }\n}\n\n/**\n * Account Pending Deletion Error (403)\n *\n * Thrown on login (password/OAuth/authenticate) when the account is within its\n * deletion grace period. Carries `purgeScheduledAt` so the client can offer a\n * recovery flow instead of a generic \"disabled\" message.\n */\nexport class AccountPendingDeletionError extends ForbiddenError\n{\n    constructor(data: { purgeScheduledAt?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Account is scheduled for deletion',\n            details: { status: 'pending_deletion', purgeScheduledAt: data.purgeScheduledAt, ...data.details },\n        });\n        this.name = 'AccountPendingDeletionError';\n    }\n}\n\n/**\n * Deletion Already Requested Error (409)\n *\n * Thrown when requesting deletion for an account that already has a pending\n * deletion request (or has already been purged).\n */\nexport class DeletionAlreadyRequestedError extends ConflictError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Account deletion has already been requested', details: data.details });\n        this.name = 'DeletionAlreadyRequestedError';\n    }\n}\n\n/**\n * Deletion Not Requested Error (404)\n *\n * Thrown when trying to cancel/purge a deletion for an account that has no\n * pending deletion request.\n */\nexport class DeletionNotRequestedError extends NotFoundError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'No pending account deletion request found', details: data.details });\n        this.name = 'DeletionNotRequestedError';\n    }\n}\n\n/**\n * Immediate Deletion Not Allowed Error (403)\n *\n * Thrown when a self-service caller requests `immediate: true` but the server\n * has not enabled `deletion.allowSelfImmediate`.\n */\nexport class ImmediateDeletionNotAllowedError extends ForbiddenError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Immediate self-service deletion is not enabled', details: data.details });\n        this.name = 'ImmediateDeletionNotAllowedError';\n    }\n}\n\n/**\n * Account Already Exists Error (409)\n *\n * Thrown when trying to register with existing email/phone\n */\nexport class AccountAlreadyExistsError extends ConflictError\n{\n    constructor(data: { identifier?: string; identifierType?: 'email' | 'phone'; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Account already exists',\n            details: {\n                identifier: data.identifier,\n                identifierType: data.identifierType,\n                ...data.details,\n            },\n        });\n        this.name = 'AccountAlreadyExistsError';\n    }\n}\n\n/**\n * Registration Rejected Error (403)\n *\n * Thrown by the app-injected beforeRegister hook to reject a registration\n * (age gate, domain restriction, block list, ...)\n */\nexport class RegistrationRejectedError extends ForbiddenError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Registration rejected', details: data.details });\n        this.name = 'RegistrationRejectedError';\n    }\n}\n\n/**\n * Invalid Verification Code Error (400)\n *\n * Thrown when verification code is invalid, expired, or already used\n */\nexport class InvalidVerificationCodeError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid verification code', details: data.details });\n        this.name = 'InvalidVerificationCodeError';\n    }\n}\n\n/**\n * Invalid Verification Token Error (400)\n *\n * Thrown when verification token is invalid or expired\n */\nexport class InvalidVerificationTokenError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid or expired verification token', details: data.details });\n        this.name = 'InvalidVerificationTokenError';\n    }\n}\n\n/**\n * Invalid Key Fingerprint Error (400)\n *\n * Thrown when public key fingerprint doesn't match the public key\n */\nexport class InvalidKeyFingerprintError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid key fingerprint', details: data.details });\n        this.name = 'InvalidKeyFingerprintError';\n    }\n}\n\n/**\n * Verification Token Purpose Mismatch Error (400)\n *\n * Thrown when verification token purpose doesn't match expected purpose\n */\nexport class VerificationTokenPurposeMismatchError extends ValidationError\n{\n    constructor(data: { expected?: string; actual?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        const expected = data.expected || 'unknown';\n        const actual = data.actual || 'unknown';\n        super({\n            message: data.message || `Verification token is for ${actual}, but ${expected} was expected`,\n            details: { expected, actual, ...data.details },\n        });\n        this.name = 'VerificationTokenPurposeMismatchError';\n    }\n}\n\n/**\n * Verification Token Target Mismatch Error (400)\n *\n * Thrown when verification token target doesn't match provided email/phone\n */\nexport class VerificationTokenTargetMismatchError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Verification token does not match provided email/phone',\n            details: data.details,\n        });\n        this.name = 'VerificationTokenTargetMismatchError';\n    }\n}\n\n/**\n * Reserved Username Error (400)\n *\n * Thrown when trying to use a reserved/prohibited username\n */\nexport class ReservedUsernameError extends ValidationError\n{\n    constructor(data: { username?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'This username is reserved',\n            details: { username: data.username, ...data.details },\n        });\n        this.name = 'ReservedUsernameError';\n    }\n}\n\n/**\n * Username Already Taken Error (409)\n *\n * Thrown when trying to set a username that is already in use\n */\nexport class UsernameAlreadyTakenError extends ConflictError\n{\n    constructor(data: { username?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Username is already taken',\n            details: { username: data.username, ...data.details },\n        });\n        this.name = 'UsernameAlreadyTakenError';\n    }\n}\n\n/**\n * Insufficient Permissions Error (403)\n *\n * Thrown when user lacks required permissions for the operation\n */\nexport class InsufficientPermissionsError extends ForbiddenError\n{\n    constructor(data: { requiredPermissions?: string[]; message?: string; details?: Record<string, any> } = {})\n    {\n        const requiredPermissions = data.requiredPermissions || [];\n        super({\n            message: data.message || `Missing required permissions: ${requiredPermissions.join(', ')}`,\n            details: { requiredPermissions, ...data.details },\n        });\n        this.name = 'InsufficientPermissionsError';\n    }\n}\n\n/**\n * Insufficient Role Error (403)\n *\n * Thrown when user lacks required role for the operation\n */\nexport class InsufficientRoleError extends ForbiddenError\n{\n    constructor(data: { requiredRoles?: string[]; message?: string; details?: Record<string, any> } = {})\n    {\n        const requiredRoles = data.requiredRoles || [];\n        super({\n            message: data.message || `Required roles: ${requiredRoles.join(', ')}`,\n            details: { requiredRoles, ...data.details },\n        });\n        this.name = 'InsufficientRoleError';\n    }\n}\n"],"mappings":";;;;;;;AAIA,SAAS,qBAAqB;;;ACJ9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAOA,IAAM,0BAAN,cAAsC,kBAC7C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,uBAAuB,SAAS,KAAK,QAAQ,CAAC;AAC/E,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,oBAAN,cAAgC,kBACvC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,gCAAgC,SAAS,KAAK,QAAQ,CAAC;AACxF,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,0BAAN,cAAsC,kBAC7C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,2BAA2B,SAAS,KAAK,QAAQ,CAAC;AACnF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,oBAAN,cAAgC,kBACvC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,oCAAoC,SAAS,KAAK,QAAQ,CAAC;AAC5F,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,kBAAN,cAA8B,kBACrC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,0BAA0B,SAAS,KAAK,QAAQ,CAAC;AAClF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,uBAAN,cAAmC,eAC1C;AAAA,EACI,YAAY,OAA6E,CAAC,GAC1F;AACI,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,cAAc,MAAM;AAAA,MAC7C,SAAS,EAAE,QAAQ,GAAG,KAAK,QAAQ;AAAA,IACvC,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AASO,IAAM,8BAAN,cAA0C,eACjD;AAAA,EACI,YAAY,OAAuF,CAAC,GACpG;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,EAAE,QAAQ,oBAAoB,kBAAkB,KAAK,kBAAkB,GAAG,KAAK,QAAQ;AAAA,IACpG,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,gCAAN,cAA4C,cACnD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,+CAA+C,SAAS,KAAK,QAAQ,CAAC;AACvG,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,4BAAN,cAAwC,cAC/C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,6CAA6C,SAAS,KAAK,QAAQ,CAAC;AACrG,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,mCAAN,cAA+C,eACtD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,kDAAkD,SAAS,KAAK,QAAQ,CAAC;AAC1G,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,4BAAN,cAAwC,cAC/C;AAAA,EACI,YAAY,OAAqH,CAAC,GAClI;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACL,YAAY,KAAK;AAAA,QACjB,gBAAgB,KAAK;AAAA,QACrB,GAAG,KAAK;AAAA,MACZ;AAAA,IACJ,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,4BAAN,cAAwC,eAC/C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,yBAAyB,SAAS,KAAK,QAAQ,CAAC;AACjF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,+BAAN,cAA2C,gBAClD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,6BAA6B,SAAS,KAAK,QAAQ,CAAC;AACrF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,gCAAN,cAA4C,gBACnD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,yCAAyC,SAAS,KAAK,QAAQ,CAAC;AACjG,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,6BAAN,cAAyC,gBAChD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,2BAA2B,SAAS,KAAK,QAAQ,CAAC;AACnF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,wCAAN,cAAoD,gBAC3D;AAAA,EACI,YAAY,OAAgG,CAAC,GAC7G;AACI,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,6BAA6B,MAAM,SAAS,QAAQ;AAAA,MAC7E,SAAS,EAAE,UAAU,QAAQ,GAAG,KAAK,QAAQ;AAAA,IACjD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,uCAAN,cAAmD,gBAC1D;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,KAAK;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,wBAAN,cAAoC,gBAC3C;AAAA,EACI,YAAY,OAA+E,CAAC,GAC5F;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,EAAE,UAAU,KAAK,UAAU,GAAG,KAAK,QAAQ;AAAA,IACxD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,4BAAN,cAAwC,cAC/C;AAAA,EACI,YAAY,OAA+E,CAAC,GAC5F;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,EAAE,UAAU,KAAK,UAAU,GAAG,KAAK,QAAQ;AAAA,IACxD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,+BAAN,cAA2C,eAClD;AAAA,EACI,YAAY,OAA4F,CAAC,GACzG;AACI,UAAM,sBAAsB,KAAK,uBAAuB,CAAC;AACzD,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,iCAAiC,oBAAoB,KAAK,IAAI,CAAC;AAAA,MACxF,SAAS,EAAE,qBAAqB,GAAG,KAAK,QAAQ;AAAA,IACpD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,wBAAN,cAAoC,eAC3C;AAAA,EACI,YAAY,OAAsF,CAAC,GACnG;AACI,UAAM,gBAAgB,KAAK,iBAAiB,CAAC;AAC7C,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,mBAAmB,cAAc,KAAK,IAAI,CAAC;AAAA,MACpE,SAAS,EAAE,eAAe,GAAG,KAAK,QAAQ;AAAA,IAC9C,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;;;ADvSO,IAAM,oBAAoB,IAAI,cAAc;AACnD,kBAAkB,OAAO;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;","names":[]}
+{"version":3,"sources":["../src/errors/index.ts","../src/errors/auth-errors.ts"],"sourcesContent":["/**\n * Auth Error Exports\n */\n\nimport { ErrorRegistry } from '@spfn/core/errors';\n\nimport {\n    InvalidCredentialsError,\n    InvalidTokenError,\n    InvalidSocialTokenError,\n    TokenExpiredError,\n    KeyExpiredError,\n    AccountDisabledError,\n    AccountPendingDeletionError,\n    DeletionAlreadyRequestedError,\n    DeletionNotRequestedError,\n    ImmediateDeletionNotAllowedError,\n    AccountAlreadyExistsError,\n    RegistrationRejectedError,\n    ReservedUsernameError,\n    UsernameAlreadyTakenError,\n    InvalidVerificationCodeError,\n    InvalidVerificationTokenError,\n    InvalidKeyFingerprintError,\n    NonceKeyBindingError,\n    NativeSignInUnsupportedError,\n    UnverifiedEmailLinkError,\n    KeyNotFoundError,\n    KeyIdAlreadyRegisteredError,\n    VerificationTokenPurposeMismatchError,\n    VerificationTokenTargetMismatchError,\n    InsufficientPermissionsError,\n    InsufficientRoleError,\n} from './auth-errors';\n\nexport {\n    InvalidCredentialsError,\n    InvalidTokenError,\n    InvalidSocialTokenError,\n    TokenExpiredError,\n    KeyExpiredError,\n    AccountDisabledError,\n    AccountPendingDeletionError,\n    DeletionAlreadyRequestedError,\n    DeletionNotRequestedError,\n    ImmediateDeletionNotAllowedError,\n    AccountAlreadyExistsError,\n    RegistrationRejectedError,\n    ReservedUsernameError,\n    UsernameAlreadyTakenError,\n    InvalidVerificationCodeError,\n    InvalidVerificationTokenError,\n    InvalidKeyFingerprintError,\n    NonceKeyBindingError,\n    NativeSignInUnsupportedError,\n    UnverifiedEmailLinkError,\n    KeyNotFoundError,\n    KeyIdAlreadyRegisteredError,\n    VerificationTokenPurposeMismatchError,\n    VerificationTokenTargetMismatchError,\n    InsufficientPermissionsError,\n    InsufficientRoleError,\n} from './auth-errors';\n\nexport const authErrorRegistry = new ErrorRegistry();\nauthErrorRegistry.append([\n    InvalidCredentialsError,\n    InvalidTokenError,\n    InvalidSocialTokenError,\n    TokenExpiredError,\n    KeyExpiredError,\n    AccountDisabledError,\n    AccountPendingDeletionError,\n    DeletionAlreadyRequestedError,\n    DeletionNotRequestedError,\n    ImmediateDeletionNotAllowedError,\n    AccountAlreadyExistsError,\n    RegistrationRejectedError,\n    ReservedUsernameError,\n    UsernameAlreadyTakenError,\n    InvalidVerificationCodeError,\n    InvalidVerificationTokenError,\n    InvalidKeyFingerprintError,\n    NonceKeyBindingError,\n    NativeSignInUnsupportedError,\n    UnverifiedEmailLinkError,\n    KeyNotFoundError,\n    KeyIdAlreadyRegisteredError,\n    VerificationTokenPurposeMismatchError,\n    VerificationTokenTargetMismatchError,\n    InsufficientPermissionsError,\n    InsufficientRoleError,\n]);\n\nexport * as AuthError from './auth-errors';\n","/**\n * Authentication & Authorization Error Classes\n *\n * Custom error classes for auth-specific scenarios\n */\n\nimport {\n    ValidationError,\n    UnauthorizedError,\n    ForbiddenError,\n    ConflictError,\n    NotFoundError,\n} from '@spfn/core/errors';\n\n/**\n * Invalid Credentials Error (401)\n *\n * Thrown when login credentials are incorrect\n */\nexport class InvalidCredentialsError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid credentials', details: data.details });\n        this.name = 'InvalidCredentialsError';\n    }\n}\n\n/**\n * Invalid Token Error (401)\n *\n * Thrown when authentication token is invalid or malformed\n */\nexport class InvalidTokenError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid authentication token', details: data.details });\n        this.name = 'InvalidTokenError';\n    }\n}\n\n/**\n * Invalid Social Token Error (401)\n *\n * Thrown when a social provider id_token fails verification\n * (bad signature, wrong issuer/audience, expired, or nonce mismatch).\n */\nexport class InvalidSocialTokenError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid social id_token', details: data.details });\n        this.name = 'InvalidSocialTokenError';\n    }\n}\n\n/**\n * Token Expired Error (401)\n *\n * Thrown when authentication token has expired\n */\nexport class TokenExpiredError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Authentication token has expired', details: data.details });\n        this.name = 'TokenExpiredError';\n    }\n}\n\n/**\n * Key Expired Error (401)\n *\n * Thrown when public key has expired\n */\nexport class KeyExpiredError extends UnauthorizedError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Public key has expired', details: data.details });\n        this.name = 'KeyExpiredError';\n    }\n}\n\n/**\n * Account Disabled Error (403)\n *\n * Thrown when user account is disabled or inactive\n */\nexport class AccountDisabledError extends ForbiddenError\n{\n    constructor(data: { status?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        const status = data.status || 'disabled';\n        super({\n            message: data.message || `Account is ${status}`,\n            details: { status, ...data.details },\n        });\n        this.name = 'AccountDisabledError';\n    }\n}\n\n/**\n * Account Pending Deletion Error (403)\n *\n * Thrown on login (password/OAuth/authenticate) when the account is within its\n * deletion grace period. Carries `purgeScheduledAt` so the client can offer a\n * recovery flow instead of a generic \"disabled\" message.\n */\nexport class AccountPendingDeletionError extends ForbiddenError\n{\n    constructor(data: { purgeScheduledAt?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Account is scheduled for deletion',\n            details: { status: 'pending_deletion', purgeScheduledAt: data.purgeScheduledAt, ...data.details },\n        });\n        this.name = 'AccountPendingDeletionError';\n    }\n}\n\n/**\n * Deletion Already Requested Error (409)\n *\n * Thrown when requesting deletion for an account that already has a pending\n * deletion request (or has already been purged).\n */\nexport class DeletionAlreadyRequestedError extends ConflictError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Account deletion has already been requested', details: data.details });\n        this.name = 'DeletionAlreadyRequestedError';\n    }\n}\n\n/**\n * Deletion Not Requested Error (404)\n *\n * Thrown when trying to cancel/purge a deletion for an account that has no\n * pending deletion request.\n */\nexport class DeletionNotRequestedError extends NotFoundError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'No pending account deletion request found', details: data.details });\n        this.name = 'DeletionNotRequestedError';\n    }\n}\n\n/**\n * Immediate Deletion Not Allowed Error (403)\n *\n * Thrown when a self-service caller requests `immediate: true` but the server\n * has not enabled `deletion.allowSelfImmediate`.\n */\nexport class ImmediateDeletionNotAllowedError extends ForbiddenError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Immediate self-service deletion is not enabled', details: data.details });\n        this.name = 'ImmediateDeletionNotAllowedError';\n    }\n}\n\n/**\n * Account Already Exists Error (409)\n *\n * Thrown when trying to register with existing email/phone\n */\nexport class AccountAlreadyExistsError extends ConflictError\n{\n    constructor(data: { identifier?: string; identifierType?: 'email' | 'phone'; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Account already exists',\n            details: {\n                identifier: data.identifier,\n                identifierType: data.identifierType,\n                ...data.details,\n            },\n        });\n        this.name = 'AccountAlreadyExistsError';\n    }\n}\n\n/**\n * Registration Rejected Error (403)\n *\n * Thrown by the app-injected beforeRegister hook to reject a registration\n * (age gate, domain restriction, block list, ...)\n */\nexport class RegistrationRejectedError extends ForbiddenError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Registration rejected', details: data.details });\n        this.name = 'RegistrationRejectedError';\n    }\n}\n\n/**\n * Invalid Verification Code Error (400)\n *\n * Thrown when verification code is invalid, expired, or already used\n */\nexport class InvalidVerificationCodeError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid verification code', details: data.details });\n        this.name = 'InvalidVerificationCodeError';\n    }\n}\n\n/**\n * Invalid Verification Token Error (400)\n *\n * Thrown when verification token is invalid or expired\n */\nexport class InvalidVerificationTokenError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid or expired verification token', details: data.details });\n        this.name = 'InvalidVerificationTokenError';\n    }\n}\n\n/**\n * Key ID Already Registered Error (409)\n *\n * Thrown when a sign-in submits a keyId that is already taken — the client's own\n * revoked keyId, or a keyId belonging to another user. `keyId` is unique across\n * all users, so either case would collide on insert.\n *\n * The same error covers both cases on purpose: a distinguishable response would\n * let a caller probe whether an arbitrary keyId exists. Revoked stays revoked —\n * the client must generate a fresh keyId and retry.\n */\nexport class KeyIdAlreadyRegisteredError extends ConflictError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'This keyId is already registered. Generate a new keyId and retry.',\n            details: data.details,\n        });\n        this.name = 'KeyIdAlreadyRegisteredError';\n    }\n}\n\n/**\n * Invalid Key Fingerprint Error (400)\n *\n * Thrown when public key fingerprint doesn't match the public key\n */\nexport class InvalidKeyFingerprintError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Invalid key fingerprint', details: data.details });\n        this.name = 'InvalidKeyFingerprintError';\n    }\n}\n\n/**\n * Key Not Found Error (404)\n *\n * Thrown when a key operation names a keyId the caller does not own. It says\n * nothing about whether that keyId exists on another account — the repository\n * scopes every lookup by userId, so the answer is only ever \"not yours\".\n */\nexport class KeyNotFoundError extends NotFoundError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({ message: data.message || 'Key not found', details: data.details });\n        this.name = 'KeyNotFoundError';\n    }\n}\n\n/**\n * Nonce Key Binding Error (400)\n *\n * Thrown when a native id_token sign-in submits a nonce that is not the public\n * key's fingerprint. The nonce is what the provider echoed back inside the\n * id_token, so tying it to the key is what proves the id_token and the key came\n * from the same device — see the native section of the README.\n */\nexport class NonceKeyBindingError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'nonce must be the fingerprint of the submitted public key',\n            details: data.details,\n        });\n        this.name = 'NonceKeyBindingError';\n    }\n}\n\n/**\n * Native Sign-In Unsupported Error (400)\n *\n * Thrown when a provider is asked for native id_token sign-in and has no\n * implementation for it — a server configuration fact, not something the user\n * did. A client reading this hides that provider's native button instead of\n * asking the user to try again.\n *\n * Split out of ValidationError because the other native-enrollment refusal\n * (linking to an account whose email the provider never verified) needs a\n * different response from the app, and one code cannot ask for two.\n */\nexport class NativeSignInUnsupportedError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'This provider does not support native id_token sign-in.',\n            details: data.details,\n        });\n        this.name = 'NativeSignInUnsupportedError';\n    }\n}\n\n/**\n * Unverified Email Link Error (400)\n *\n * Thrown when a social identity carries an email that already belongs to an\n * account, but the provider never verified it. Linking on an unverified email\n * is account takeover, so the refusal stands and the user is sent to a path\n * that proves the address.\n *\n * This says an account exists for that address. It is not a leak introduced\n * here: the message this replaces already stated the same fact in prose, and\n * the paths that must not disclose account existence (password login, deletion\n * re-auth, verification issuance) answer uniformly and are untouched.\n */\nexport class UnverifiedEmailLinkError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message\n                || 'Cannot link to existing account with unverified email. Please verify your email with the provider first.',\n            details: data.details,\n        });\n        this.name = 'UnverifiedEmailLinkError';\n    }\n}\n\n/**\n * Verification Token Purpose Mismatch Error (400)\n *\n * Thrown when verification token purpose doesn't match expected purpose\n */\nexport class VerificationTokenPurposeMismatchError extends ValidationError\n{\n    constructor(data: { expected?: string; actual?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        const expected = data.expected || 'unknown';\n        const actual = data.actual || 'unknown';\n        super({\n            message: data.message || `Verification token is for ${actual}, but ${expected} was expected`,\n            details: { expected, actual, ...data.details },\n        });\n        this.name = 'VerificationTokenPurposeMismatchError';\n    }\n}\n\n/**\n * Verification Token Target Mismatch Error (400)\n *\n * Thrown when verification token target doesn't match provided email/phone\n */\nexport class VerificationTokenTargetMismatchError extends ValidationError\n{\n    constructor(data: { message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Verification token does not match provided email/phone',\n            details: data.details,\n        });\n        this.name = 'VerificationTokenTargetMismatchError';\n    }\n}\n\n/**\n * Reserved Username Error (400)\n *\n * Thrown when trying to use a reserved/prohibited username\n */\nexport class ReservedUsernameError extends ValidationError\n{\n    constructor(data: { username?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'This username is reserved',\n            details: { username: data.username, ...data.details },\n        });\n        this.name = 'ReservedUsernameError';\n    }\n}\n\n/**\n * Username Already Taken Error (409)\n *\n * Thrown when trying to set a username that is already in use\n */\nexport class UsernameAlreadyTakenError extends ConflictError\n{\n    constructor(data: { username?: string; message?: string; details?: Record<string, any> } = {})\n    {\n        super({\n            message: data.message || 'Username is already taken',\n            details: { username: data.username, ...data.details },\n        });\n        this.name = 'UsernameAlreadyTakenError';\n    }\n}\n\n/**\n * Insufficient Permissions Error (403)\n *\n * Thrown when user lacks required permissions for the operation\n */\nexport class InsufficientPermissionsError extends ForbiddenError\n{\n    constructor(data: { requiredPermissions?: string[]; message?: string; details?: Record<string, any> } = {})\n    {\n        const requiredPermissions = data.requiredPermissions || [];\n        super({\n            message: data.message || `Missing required permissions: ${requiredPermissions.join(', ')}`,\n            details: { requiredPermissions, ...data.details },\n        });\n        this.name = 'InsufficientPermissionsError';\n    }\n}\n\n/**\n * Insufficient Role Error (403)\n *\n * Thrown when user lacks required role for the operation\n */\nexport class InsufficientRoleError extends ForbiddenError\n{\n    constructor(data: { requiredRoles?: string[]; message?: string; details?: Record<string, any> } = {})\n    {\n        const requiredRoles = data.requiredRoles || [];\n        super({\n            message: data.message || `Required roles: ${requiredRoles.join(', ')}`,\n            details: { requiredRoles, ...data.details },\n        });\n        this.name = 'InsufficientRoleError';\n    }\n}\n"],"mappings":";;;;;;;AAIA,SAAS,qBAAqB;;;ACJ9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAOA,IAAM,0BAAN,cAAsC,kBAC7C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,uBAAuB,SAAS,KAAK,QAAQ,CAAC;AAC/E,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,oBAAN,cAAgC,kBACvC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,gCAAgC,SAAS,KAAK,QAAQ,CAAC;AACxF,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,0BAAN,cAAsC,kBAC7C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,2BAA2B,SAAS,KAAK,QAAQ,CAAC;AACnF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,oBAAN,cAAgC,kBACvC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,oCAAoC,SAAS,KAAK,QAAQ,CAAC;AAC5F,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,kBAAN,cAA8B,kBACrC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,0BAA0B,SAAS,KAAK,QAAQ,CAAC;AAClF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,uBAAN,cAAmC,eAC1C;AAAA,EACI,YAAY,OAA6E,CAAC,GAC1F;AACI,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,cAAc,MAAM;AAAA,MAC7C,SAAS,EAAE,QAAQ,GAAG,KAAK,QAAQ;AAAA,IACvC,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AASO,IAAM,8BAAN,cAA0C,eACjD;AAAA,EACI,YAAY,OAAuF,CAAC,GACpG;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,EAAE,QAAQ,oBAAoB,kBAAkB,KAAK,kBAAkB,GAAG,KAAK,QAAQ;AAAA,IACpG,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,gCAAN,cAA4C,cACnD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,+CAA+C,SAAS,KAAK,QAAQ,CAAC;AACvG,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,4BAAN,cAAwC,cAC/C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,6CAA6C,SAAS,KAAK,QAAQ,CAAC;AACrG,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,mCAAN,cAA+C,eACtD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,kDAAkD,SAAS,KAAK,QAAQ,CAAC;AAC1G,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,4BAAN,cAAwC,cAC/C;AAAA,EACI,YAAY,OAAqH,CAAC,GAClI;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACL,YAAY,KAAK;AAAA,QACjB,gBAAgB,KAAK;AAAA,QACrB,GAAG,KAAK;AAAA,MACZ;AAAA,IACJ,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAQO,IAAM,4BAAN,cAAwC,eAC/C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,yBAAyB,SAAS,KAAK,QAAQ,CAAC;AACjF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,+BAAN,cAA2C,gBAClD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,6BAA6B,SAAS,KAAK,QAAQ,CAAC;AACrF,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,gCAAN,cAA4C,gBACnD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,yCAAyC,SAAS,KAAK,QAAQ,CAAC;AACjG,SAAK,OAAO;AAAA,EAChB;AACJ;AAaO,IAAM,8BAAN,cAA0C,cACjD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,KAAK;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,6BAAN,cAAyC,gBAChD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,2BAA2B,SAAS,KAAK,QAAQ,CAAC;AACnF,SAAK,OAAO;AAAA,EAChB;AACJ;AASO,IAAM,mBAAN,cAA+B,cACtC;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM,EAAE,SAAS,KAAK,WAAW,iBAAiB,SAAS,KAAK,QAAQ,CAAC;AACzE,SAAK,OAAO;AAAA,EAChB;AACJ;AAUO,IAAM,uBAAN,cAAmC,gBAC1C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,KAAK;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAcO,IAAM,+BAAN,cAA2C,gBAClD;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,KAAK;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAeO,IAAM,2BAAN,cAAuC,gBAC9C;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WACP;AAAA,MACP,SAAS,KAAK;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,wCAAN,cAAoD,gBAC3D;AAAA,EACI,YAAY,OAAgG,CAAC,GAC7G;AACI,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,6BAA6B,MAAM,SAAS,QAAQ;AAAA,MAC7E,SAAS,EAAE,UAAU,QAAQ,GAAG,KAAK,QAAQ;AAAA,IACjD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,uCAAN,cAAmD,gBAC1D;AAAA,EACI,YAAY,OAA4D,CAAC,GACzE;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,KAAK;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,wBAAN,cAAoC,gBAC3C;AAAA,EACI,YAAY,OAA+E,CAAC,GAC5F;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,EAAE,UAAU,KAAK,UAAU,GAAG,KAAK,QAAQ;AAAA,IACxD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,4BAAN,cAAwC,cAC/C;AAAA,EACI,YAAY,OAA+E,CAAC,GAC5F;AACI,UAAM;AAAA,MACF,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS,EAAE,UAAU,KAAK,UAAU,GAAG,KAAK,QAAQ;AAAA,IACxD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,+BAAN,cAA2C,eAClD;AAAA,EACI,YAAY,OAA4F,CAAC,GACzG;AACI,UAAM,sBAAsB,KAAK,uBAAuB,CAAC;AACzD,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,iCAAiC,oBAAoB,KAAK,IAAI,CAAC;AAAA,MACxF,SAAS,EAAE,qBAAqB,GAAG,KAAK,QAAQ;AAAA,IACpD,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;AAOO,IAAM,wBAAN,cAAoC,eAC3C;AAAA,EACI,YAAY,OAAsF,CAAC,GACnG;AACI,UAAM,gBAAgB,KAAK,iBAAiB,CAAC;AAC7C,UAAM;AAAA,MACF,SAAS,KAAK,WAAW,mBAAmB,cAAc,KAAK,IAAI,CAAC;AAAA,MACpE,SAAS,EAAE,eAAe,GAAG,KAAK,QAAQ;AAAA,IAC9C,CAAC;AACD,SAAK,OAAO;AAAA,EAChB;AACJ;;;AD1YO,IAAM,oBAAoB,IAAI,cAAc;AACnD,kBAAkB,OAAO;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;","names":[]}

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { R as RoleConfig, P as PermissionConfig, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, c as OAuthNativeResult, U as UserProfile, d as ProfileInfo, m as mainAuthRouter } from './authenticate-C7w-pLOR.js';
-export { j as AuthInitOptions, A as AuthSession, h as PERMISSION_CATEGORIES, i as PermissionCategory, g as VERIFICATION_PURPOSES, f as VERIFICATION_TARGET_TYPES, e as VerificationPurpose, V as VerificationTargetType } from './authenticate-C7w-pLOR.js';
+import { R as RoleConfig, P as PermissionConfig, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, K as KeySummary, c as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, d as OAuthNativeResult, U as UserProfile, e as ProfileInfo, m as mainAuthRouter } from './authenticate-ZssfqJ7d.js';
+export { k as AuthInitOptions, A as AuthSession, i as PERMISSION_CATEGORIES, j as PermissionCategory, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './authenticate-ZssfqJ7d.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
-export { b as ACCOUNT_DELETION_REQUESTED_BY, A as ACCOUNT_DELETION_REQUEST_STATUSES, f as AccountDeletionRequestStatus, g as AccountDeletionRequestedBy, I as INVITATION_STATUSES, c as InvitationStatus, a as KEY_ALGORITHM, K as KeyAlgorithmType, P as PURGE_STRATEGIES, h as PurgeStrategy, S as SOCIAL_PROVIDERS, e as SocialProvider, U as USER_STATUSES, d as UserStatus } from './types-1BMx0OX1.js';
+export { b as ACCOUNT_DELETION_REQUESTED_BY, A as ACCOUNT_DELETION_REQUEST_STATUSES, i as AccountDeletionRequestStatus, j as AccountDeletionRequestedBy, I as INVITATION_STATUSES, f as InvitationStatus, a as KEY_ALGORITHM, e as KEY_DEVICE_NAME_MAX_LENGTH, c as KEY_PLATFORM, K as KeyAlgorithmType, d as KeyPlatformType, P as PURGE_STRATEGIES, k as PurgeStrategy, S as SOCIAL_PROVIDERS, h as SocialProvider, U as USER_STATUSES, g as UserStatus } from './types-CD95yudz.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import 'hono';
 import '@spfn/auth/server';
@@ -121,6 +121,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
@@ -136,6 +138,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
@@ -145,8 +149,30 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RotateKeyResult>;
+    listKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeRevoked: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        keys: KeySummary[];
+    }>;
+    revokeKey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            keyId: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        keyId: string;
+        selfRevoked: boolean;
+    }>;
+    revokeAllKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, RevokeAllKeysResult>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -164,7 +190,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             id: number;
             name: string;
             displayName: string;
-            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
         }[];
         userId: number;
         publicId: string;
@@ -278,10 +304,13 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         body: _sinclair_typebox.TObject<{
             idToken: _sinclair_typebox.TString;
             nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
             profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
                 name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             }>>;
@@ -461,8 +490,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, {
         roles: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -483,8 +512,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -507,8 +536,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;