@spfn/auth 0.2.1 → 0.3.0-beta.1

package/dist/index.d.ts

@@ -1,9 +1,11 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { R as RoleConfig, P as PermissionConfig, C as CheckAccountExistsResult, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, U as UserProfile, c as ProfileInfo, m as mainAuthRouter } from './authenticate-eucncHxN.js';
-export { l as AuthInitOptions, A as AuthSession, d as INVITATION_STATUSES, o as InvitationStatus, K as KEY_ALGORITHM, n as KeyAlgorithmType, j as PERMISSION_CATEGORIES, k as PermissionCategory, f as SOCIAL_PROVIDERS, q as SocialProvider, e as USER_STATUSES, p as UserStatus, i as VERIFICATION_PURPOSES, h as VERIFICATION_TARGET_TYPES, g as VerificationPurpose, V as VerificationTargetType } from './authenticate-eucncHxN.js';
+import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, K as KeySummary, c as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, d as OAuthNativeResult, U as UserProfile, e as ProfileInfo } from './authenticate-DlTGaBT8.js';
+export { A as AuthInitOptions, f as AuthSession, g as PERMISSION_CATEGORIES, h as PermissionCategory, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, j as VerificationPurpose, k as VerificationTargetType } from './authenticate-DlTGaBT8.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
+export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, c as AccountDeletionRequestedBy, I as INVITATION_STATUSES, d as InvitationStatus, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, K as KeyAlgorithmType, h as KeyPlatformType, P as PURGE_STRATEGIES, i as PurgeStrategy, S as SOCIAL_PROVIDERS, j as SocialProvider, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
+import 'hono';
 import '@spfn/auth/server';
 
 /**
@@ -87,18 +89,11 @@ declare const routeMap: Record<string, RouteInfo>;
  * ```
  */
 declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
-    checkAccountExists: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TUnion<[_sinclair_typebox.TObject<{
-            email: _sinclair_typebox.TString;
-        }>, _sinclair_typebox.TObject<{
-            phone: _sinclair_typebox.TString;
-        }>]>;
-    }, {}, CheckAccountExistsResult>;
     sendVerificationCode: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             target: _sinclair_typebox.TString;
             targetType: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
-            purpose: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">]>;
+            purpose: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">, _sinclair_typebox.TLiteral<"account_deletion">]>;
         }>;
     }, {}, SendVerificationCodeResult>;
     verifyCode: _spfn_core_route.RouteDef<{
@@ -106,7 +101,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             target: _sinclair_typebox.TString;
             targetType: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
             code: _sinclair_typebox.TString;
-            purpose: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">]>;
+            purpose: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">, _sinclair_typebox.TLiteral<"account_deletion">]>;
         }>;
     }, {}, {
         valid: boolean;
@@ -126,6 +121,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
@@ -141,6 +138,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
@@ -150,11 +149,33 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RotateKeyResult>;
+    listKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeRevoked: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        keys: KeySummary[];
+    }>;
+    revokeKey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            keyId: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        keyId: string;
+        selfRevoked: boolean;
+    }>;
+    revokeAllKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, RevokeAllKeysResult>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            currentPassword: _sinclair_typebox.TString;
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             newPassword: _sinclair_typebox.TString;
         }>;
     }, {}, void>;
@@ -176,8 +197,27 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         email: string | null;
         emailVerified: boolean;
         phoneVerified: boolean;
+        hasPassword: boolean;
     }>;
     issueOneTimeToken: _spfn_core_route.RouteDef<{}, {}, IssueOneTimeTokenResult>;
+    requestAccountDeletion: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            password: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            verificationToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            immediate: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        purgeScheduledAt: string;
+    }>;
+    cancelAccountDeletion: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            password: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            verificationToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, void>;
     oauthGoogleStart: _spfn_core_route.RouteDef<{
         query: _sinclair_typebox.TObject<{
             state: _sinclair_typebox.TString;
@@ -193,7 +233,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, Response>;
     oauthStart: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "github" | "kakao" | "naver">[]>;
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
             returnUrl: _sinclair_typebox.TString;
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;
@@ -203,11 +243,12 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         }>;
     }, {}, OAuthStartResult>;
     oauthProviders: _spfn_core_route.RouteDef<{}, {}, {
-        providers: ("google" | "github" | "kakao" | "naver")[];
+        providers: ("google" | "apple" | "github" | "kakao" | "naver" | "superself")[];
     }>;
     getGoogleOAuthUrl: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
             state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
     }, {}, {
@@ -225,6 +266,67 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         keyId: string;
         returnUrl: string;
     }>;
+    oauthProviderStart: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            state: _sinclair_typebox.TString;
+        }>;
+    }, {}, Response>;
+    oauthProviderCallback: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, Response>;
+    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        authUrl: string;
+    }>;
+    oauthNative: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            idToken: _sinclair_typebox.TString;
+            nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
+                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            }>>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+        }>;
+    }, {}, OAuthNativeResult>;
+    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
     getInvitation: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
             token: _sinclair_typebox.TString;
@@ -357,6 +459,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
         }>;
     }, {}, {
+        deletedAt: Date | null;
+        deletedBy: string | null;
         createdAt: Date;
         updatedAt: Date;
         id: number;
@@ -367,7 +471,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         passwordHash: string | null;
         passwordChangeRequired: boolean;
         roleId: number;
-        status: "active" | "inactive" | "suspended";
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -386,8 +490,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, {
         roles: {
             description: string | null;
-            id: number;
             name: string;
+            id: number;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -408,8 +512,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            id: number;
             name: string;
+            id: number;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -432,8 +536,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            id: number;
             name: string;
+            id: number;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;

package/dist/index.js

@@ -15,7 +15,8 @@ import {
   ValidationError,
   UnauthorizedError,
   ForbiddenError,
-  ConflictError
+  ConflictError,
+  NotFoundError
 } from "@spfn/core/errors";
 var InvalidCredentialsError = class extends UnauthorizedError {
   constructor(data = {}) {
@@ -29,6 +30,12 @@ var InvalidTokenError = class extends UnauthorizedError {
     this.name = "InvalidTokenError";
   }
 };
+var InvalidSocialTokenError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({ message: data.message || "Invalid social id_token", details: data.details });
+    this.name = "InvalidSocialTokenError";
+  }
+};
 var TokenExpiredError = class extends UnauthorizedError {
   constructor(data = {}) {
     super({ message: data.message || "Authentication token has expired", details: data.details });
@@ -51,6 +58,33 @@ var AccountDisabledError = class extends ForbiddenError {
     this.name = "AccountDisabledError";
   }
 };
+var AccountPendingDeletionError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Account is scheduled for deletion",
+      details: { status: "pending_deletion", purgeScheduledAt: data.purgeScheduledAt, ...data.details }
+    });
+    this.name = "AccountPendingDeletionError";
+  }
+};
+var DeletionAlreadyRequestedError = class extends ConflictError {
+  constructor(data = {}) {
+    super({ message: data.message || "Account deletion has already been requested", details: data.details });
+    this.name = "DeletionAlreadyRequestedError";
+  }
+};
+var DeletionNotRequestedError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "No pending account deletion request found", details: data.details });
+    this.name = "DeletionNotRequestedError";
+  }
+};
+var ImmediateDeletionNotAllowedError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({ message: data.message || "Immediate self-service deletion is not enabled", details: data.details });
+    this.name = "ImmediateDeletionNotAllowedError";
+  }
+};
 var AccountAlreadyExistsError = class extends ConflictError {
   constructor(data = {}) {
     super({
@@ -64,6 +98,12 @@ var AccountAlreadyExistsError = class extends ConflictError {
     this.name = "AccountAlreadyExistsError";
   }
 };
+var RegistrationRejectedError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({ message: data.message || "Registration rejected", details: data.details });
+    this.name = "RegistrationRejectedError";
+  }
+};
 var InvalidVerificationCodeError = class extends ValidationError {
   constructor(data = {}) {
     super({ message: data.message || "Invalid verification code", details: data.details });
@@ -76,12 +116,54 @@ var InvalidVerificationTokenError = class extends ValidationError {
     this.name = "InvalidVerificationTokenError";
   }
 };
+var KeyIdAlreadyRegisteredError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This keyId is already registered. Generate a new keyId and retry.",
+      details: data.details
+    });
+    this.name = "KeyIdAlreadyRegisteredError";
+  }
+};
 var InvalidKeyFingerprintError = class extends ValidationError {
   constructor(data = {}) {
     super({ message: data.message || "Invalid key fingerprint", details: data.details });
     this.name = "InvalidKeyFingerprintError";
   }
 };
+var KeyNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "Key not found", details: data.details });
+    this.name = "KeyNotFoundError";
+  }
+};
+var NonceKeyBindingError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "nonce must be the fingerprint of the submitted public key",
+      details: data.details
+    });
+    this.name = "NonceKeyBindingError";
+  }
+};
+var NativeSignInUnsupportedError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This provider does not support native id_token sign-in.",
+      details: data.details
+    });
+    this.name = "NativeSignInUnsupportedError";
+  }
+};
+var UnverifiedEmailLinkError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Cannot link to existing account with unverified email. Please verify your email with the provider first.",
+      details: data.details
+    });
+    this.name = "UnverifiedEmailLinkError";
+  }
+};
 var VerificationTokenPurposeMismatchError = class extends ValidationError {
   constructor(data = {}) {
     const expected = data.expected || "unknown";
@@ -146,15 +228,26 @@ var authErrorRegistry = new ErrorRegistry();
 authErrorRegistry.append([
   InvalidCredentialsError,
   InvalidTokenError,
+  InvalidSocialTokenError,
   TokenExpiredError,
   KeyExpiredError,
   AccountDisabledError,
+  AccountPendingDeletionError,
+  DeletionAlreadyRequestedError,
+  DeletionNotRequestedError,
+  ImmediateDeletionNotAllowedError,
   AccountAlreadyExistsError,
+  RegistrationRejectedError,
   ReservedUsernameError,
   UsernameAlreadyTakenError,
   InvalidVerificationCodeError,
   InvalidVerificationTokenError,
   InvalidKeyFingerprintError,
+  NonceKeyBindingError,
+  NativeSignInUnsupportedError,
+  UnverifiedEmailLinkError,
+  KeyNotFoundError,
+  KeyIdAlreadyRegisteredError,
   VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError,
   InsufficientPermissionsError,
@@ -163,13 +256,15 @@ authErrorRegistry.append([
 
 // src/generated/route-map.ts
 var routeMap = {
-  checkAccountExists: { method: "POST", path: "/_auth/exists" },
   sendVerificationCode: { method: "POST", path: "/_auth/codes" },
   verifyCode: { method: "POST", path: "/_auth/codes/verify" },
   register: { method: "POST", path: "/_auth/register" },
   login: { method: "POST", path: "/_auth/login" },
   logout: { method: "POST", path: "/_auth/logout" },
   rotateKey: { method: "POST", path: "/_auth/keys/rotate" },
+  listKeys: { method: "POST", path: "/_auth/keys/list" },
+  revokeKey: { method: "POST", path: "/_auth/keys/revoke" },
+  revokeAllKeys: { method: "POST", path: "/_auth/keys/revoke-all" },
   changePassword: { method: "PUT", path: "/_auth/password" },
   getAuthSession: { method: "GET", path: "/_auth/session" },
   issueOneTimeToken: { method: "POST", path: "/_auth/tokens" },
@@ -191,11 +286,19 @@ var routeMap = {
   oauthProviders: { method: "GET", path: "/_auth/oauth/providers" },
   getGoogleOAuthUrl: { method: "POST", path: "/_auth/oauth/google/url" },
   oauthFinalize: { method: "POST", path: "/_auth/oauth/finalize" },
+  oauthProviderStart: { method: "GET", path: "/_auth/oauth/:provider" },
+  oauthProviderCallback: { method: "GET", path: "/_auth/oauth/:provider/callback" },
+  getProviderOAuthUrl: { method: "POST", path: "/_auth/oauth/:provider/url" },
+  oauthNative: { method: "POST", path: "/_auth/oauth/:provider/native" },
+  oauthUnlinkNotify: { method: "POST", path: "/_auth/oauth/:provider/unlink-notify" },
+  oauthUnlinkNotifyGet: { method: "GET", path: "/_auth/oauth/:provider/unlink-notify" },
   listRoles: { method: "GET", path: "/_auth/admin/roles" },
   createAdminRole: { method: "POST", path: "/_auth/admin/roles" },
   updateAdminRole: { method: "PATCH", path: "/_auth/admin/roles/:id" },
   deleteAdminRole: { method: "DELETE", path: "/_auth/admin/roles/:id" },
-  updateUserRole: { method: "PATCH", path: "/_auth/admin/users/:userId/role" }
+  updateUserRole: { method: "PATCH", path: "/_auth/admin/users/:userId/role" },
+  requestAccountDeletion: { method: "POST", path: "/_auth/deletion/request" },
+  cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" }
 };
 
 // src/lib/types.ts
@@ -331,9 +434,14 @@ var BUILTIN_ROLE_PERMISSIONS = {
 
 // src/server/types.ts
 var KEY_ALGORITHM = ["ES256", "RS256"];
+var KEY_PLATFORM = ["ios", "android", "web", "desktop"];
+var KEY_DEVICE_NAME_MAX_LENGTH = 64;
 var INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
-var USER_STATUSES = ["active", "inactive", "suspended"];
-var SOCIAL_PROVIDERS = ["google", "github", "kakao", "naver"];
+var USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
+var SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
+var ACCOUNT_DELETION_REQUEST_STATUSES = ["pending", "cancelled", "completed"];
+var ACCOUNT_DELETION_REQUESTED_BY = ["self", "admin"];
+var PURGE_STRATEGIES = ["anonymize", "hard-delete"];
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/guard/value.mjs
 var value_exports = {};
@@ -2956,9 +3064,18 @@ var PhoneSchema = Type.String({
   pattern: PHONE_PATTERN2,
   description: "Phone number in E.164 format (e.g., +821012345678)"
 });
+var DeviceNameSchema = Type.String({
+  maxLength: KEY_DEVICE_NAME_MAX_LENGTH,
+  description: `Device label shown in the key list (max ${KEY_DEVICE_NAME_MAX_LENGTH} chars)`
+});
+var PlatformSchema = Type.Union(
+  KEY_PLATFORM.map((platform) => Type.Literal(platform)),
+  { description: "Platform the key lives on" }
+);
 var PasswordSchema = Type.String({
   minLength: 8,
-  description: "User password (minimum 8 characters)"
+  maxLength: 72,
+  description: "User password (8\u201372 characters). bcrypt silently ignores bytes past 72, so longer inputs are rejected rather than truncated."
 });
 var TargetTypeSchema = Type.Union([
   Type.Literal("email"),
@@ -2972,17 +3089,20 @@ var VerificationPurposeSchema = Type.Union([
   Type.Literal("login"),
   Type.Literal("password_reset"),
   Type.Literal("email_change"),
-  Type.Literal("phone_change")
+  Type.Literal("phone_change"),
+  Type.Literal("account_deletion")
 ], {
   description: "Purpose of verification"
 });
-var VERIFICATION_PURPOSES = ["registration", "login", "password_reset", "email_change", "phone_change"];
+var VERIFICATION_PURPOSES = ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
 
 // src/index.ts
 var authApi = createApi({
   errorRegistry: [authErrorRegistry]
 });
 export {
+  ACCOUNT_DELETION_REQUESTED_BY,
+  ACCOUNT_DELETION_REQUEST_STATUSES,
   BASE64_PATTERN,
   BUILTIN_PERMISSIONS,
   BUILTIN_ROLES,
@@ -2993,6 +3113,7 @@ export {
   KEY_ALGORITHM,
   PERMISSION_CATEGORIES,
   PHONE_PATTERN,
+  PURGE_STRATEGIES,
   SOCIAL_PROVIDERS,
   USER_STATUSES,
   UUID_PATTERN,