@absolutejs/auth 0.57.9 → 0.59.0

package/dist/index.js

@@ -5848,11 +5848,13 @@ var generateBackupCodes = async (count) => {
 init_constants();
 var DEFAULT_BACKUP_CODE_COUNT = 10;
 var DEFAULT_MFA_ISSUER = "AbsoluteAuth";
+var DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS = 5 * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_MFA_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY;
 var DEFAULT_SMS_CODE_LENGTH = 6;
 var SMS_CODE_TTL_MINUTES = 5;
 var DEFAULT_SMS_CODE_TTL_MS = SMS_CODE_TTL_MINUTES * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_SMS_MAX_ATTEMPTS = 3;
+var DEFAULT_SMS_RESEND_COOLDOWN_MS = 30 * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 
 // src/mfa/secret.ts
@@ -5863,6 +5865,23 @@ var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret
 // src/mfa/sms.ts
 init_crypto();
 import { Elysia as Elysia17, t as t11 } from "elysia";
+
+// src/verification/types.ts
+class VerificationProviderError extends Error {
+  kind;
+  provider;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "VerificationProviderError";
+    this.kind = input.kind;
+    this.provider = input.provider;
+  }
+}
+
+// src/mfa/recentAuth.ts
+var hasRecentAuthentication = (session, maxAgeMs, now = Date.now()) => session.authenticatedAt !== undefined && now >= session.authenticatedAt && now - session.authenticatedAt <= maxAgeMs;
+
+// src/mfa/sms.ts
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
@@ -5877,28 +5896,147 @@ var issueSmsCode = async (codeLength, ttlMs) => {
   const expiresAt = Date.now() + ttlMs;
   return { code, expiresAt, hash };
 };
+var startProviderSmsChallenge = async (input) => {
+  let started;
+  try {
+    started = await input.verificationProvider.start({
+      channel: "sms",
+      purpose: input.purpose,
+      subject: input.userId,
+      to: input.phone
+    });
+  } catch (error) {
+    await input.mfaStore.rollbackSmsChallenge({
+      challengeId: input.challengeId,
+      previous: input.previousEnrollment,
+      userId: input.userId
+    });
+    throw error;
+  }
+  const finalized = await input.mfaStore.finalizeSmsChallenge({
+    challengeId: input.challengeId,
+    expiresAt: started.expiresAt,
+    providerReference: started.reference,
+    userId: input.userId
+  });
+  if (finalized)
+    return started;
+  await input.verificationProvider.cancel({
+    channel: "sms",
+    purpose: input.purpose,
+    reference: started.reference,
+    subject: input.userId,
+    to: input.phone
+  }).catch(() => {
+    return;
+  });
+  throw new SmsChallengeConflictError("SMS challenge claim was lost");
+};
+
+class SmsChallengeConflictError extends Error {
+  name = "SmsChallengeConflictError";
+}
+var checkWithVerificationProvider = async (provider, input) => {
+  try {
+    return { result: await provider.check(input) };
+  } catch (error) {
+    const mapped = mapVerificationProviderError(error);
+    if (mapped === undefined)
+      throw error;
+    return { error: mapped };
+  }
+};
 var isE164Phone = (phone) => E164_PATTERN.test(phone);
 var issueAndStoreSmsCode = async ({
   codeLength,
   enrollment,
   mfaStore,
   onSendSmsCode,
-  ttlMs
+  previousEnrollment,
+  purpose,
+  resendCooldownMs,
+  verificationProvider,
+  ttlMs,
+  userId
 }) => {
   const phone = enrollment.smsPhone;
   if (phone === undefined)
     return;
+  const challengeId = crypto.randomUUID();
+  const now = Date.now();
+  const claimed = await mfaStore.claimSmsChallenge({
+    challengeId,
+    cooldownCutoff: now - resendCooldownMs,
+    enrollment: {
+      ...enrollment,
+      smsChallengeId: challengeId,
+      smsCodeSentAt: now,
+      smsFailedAttempts: 0,
+      smsPendingCodeExpiresAt: now + ttlMs,
+      smsPendingCodeHash: undefined,
+      smsPendingPurpose: purpose,
+      smsProviderReference: undefined,
+      updatedAt: now
+    }
+  });
+  if (!claimed)
+    throw new SmsChallengeConflictError("SMS resend cooldown active");
+  if (verificationProvider !== undefined) {
+    const started = await startProviderSmsChallenge({
+      challengeId,
+      mfaStore,
+      phone,
+      previousEnrollment,
+      purpose,
+      userId,
+      verificationProvider
+    });
+    return started.expiresAt;
+  }
   const { code, expiresAt, hash } = await issueSmsCode(codeLength, ttlMs);
-  await mfaStore.saveEnrollment({
-    ...enrollment,
-    smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: expiresAt,
-    smsPendingCodeHash: hash,
-    updatedAt: Date.now()
+  const finalized = await mfaStore.finalizeSmsChallenge({
+    challengeId,
+    expiresAt,
+    hash,
+    userId
   });
-  await onSendSmsCode?.({ code, expiresAt, phone });
+  if (!finalized)
+    throw new SmsChallengeConflictError("SMS challenge claim was lost");
+  try {
+    await onSendSmsCode?.({ code, expiresAt, phone, purpose, userId });
+  } catch (error) {
+    await mfaStore.rollbackSmsChallenge({
+      challengeId,
+      previous: previousEnrollment,
+      userId
+    });
+    throw error;
+  }
   return expiresAt;
 };
+var mapVerificationProviderError = (error) => {
+  if (error instanceof SmsChallengeConflictError) {
+    return { message: error.message, status: "Too Many Requests" };
+  }
+  if (!(error instanceof VerificationProviderError))
+    return;
+  if (error.kind === "rate_limited") {
+    return {
+      message: "Verification provider rate limit reached",
+      status: "Too Many Requests"
+    };
+  }
+  if (error.kind === "invalid_destination") {
+    return {
+      message: "Phone number cannot receive verification codes",
+      status: "Bad Request"
+    };
+  }
+  return {
+    message: "Verification provider unavailable",
+    status: "Service Unavailable"
+  };
+};
 var maskPhone = (phone) => {
   const visible = phone.slice(-MASK_VISIBLE_DIGITS);
   const maskedLength = Math.max(phone.length - MASK_VISIBLE_DIGITS, 0);
@@ -5908,11 +6046,14 @@ var mfaSmsRoutes = ({
   authSessionStore,
   getUserId,
   mfaStore,
+  managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   onMfaEnrolled,
   onSendSmsCode,
+  verificationProvider,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
 }) => new Elysia17().use(sessionStore()).post(smsSetupRoute, async ({
@@ -5921,7 +6062,7 @@ var mfaSmsRoutes = ({
   status,
   store: { session }
 }) => {
-  if (onSendSmsCode === undefined) {
+  if (onSendSmsCode === undefined && verificationProvider === undefined) {
     return status("Not Implemented", "SMS MFA is not configured");
   }
   const userSession = await loadSessionFromSource({
@@ -5932,27 +6073,49 @@ var mfaSmsRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   if (!isE164Phone(phone)) {
     return status("Bad Request", "Phone must be in E.164 format");
   }
   const userId = getUserId(userSession.user);
   const existing = await mfaStore.getEnrollment(userId);
   const now = Date.now();
-  const { code, expiresAt, hash } = await issueSmsCode(smsCodeLength, smsCodeTtlMs);
-  await mfaStore.saveEnrollment({
-    backupCodeHashes: existing?.backupCodeHashes ?? [],
-    createdAt: existing?.createdAt ?? now,
-    smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: expiresAt,
-    smsPendingCodeHash: hash,
-    smsPhone: phone,
-    smsVerified: false,
-    totpSecretCiphertext: existing?.totpSecretCiphertext,
-    totpVerified: existing?.totpVerified ?? false,
-    updatedAt: now,
-    userId
-  });
-  await onSendSmsCode({ code, expiresAt, phone });
+  if (existing?.smsCodeSentAt !== undefined && now - existing.smsCodeSentAt < smsResendCooldownMs) {
+    return status("Too Many Requests", "SMS resend cooldown active");
+  }
+  try {
+    await issueAndStoreSmsCode({
+      codeLength: smsCodeLength,
+      enrollment: {
+        backupCodeHashes: existing?.backupCodeHashes ?? [],
+        createdAt: existing?.createdAt ?? now,
+        lastUsedAt: existing?.lastUsedAt,
+        smsFailedAttempts: 0,
+        smsPhone: phone,
+        smsVerified: false,
+        totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
+        totpSecretCiphertext: existing?.totpSecretCiphertext,
+        totpVerified: existing?.totpVerified ?? false,
+        updatedAt: now,
+        userId
+      },
+      mfaStore,
+      onSendSmsCode,
+      previousEnrollment: existing,
+      purpose: "mfa_enrollment",
+      resendCooldownMs: smsResendCooldownMs,
+      ttlMs: smsCodeTtlMs,
+      userId,
+      verificationProvider
+    });
+  } catch (error) {
+    const mapped = mapVerificationProviderError(error);
+    if (mapped === undefined)
+      throw error;
+    return status(mapped.status, mapped.message);
+  }
   return status("OK", { phone: maskPhone(phone) });
 }, {
   body: t11.Object({ phone: t11.String() }),
@@ -5971,34 +6134,65 @@ var mfaSmsRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
-  if (!enrollment?.smsPendingCodeHash || enrollment.smsPendingCodeExpiresAt === undefined) {
+  if (!enrollment?.smsPhone) {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
+  const localCodeHash = enrollment.smsPendingCodeHash;
+  const challengeId = enrollment.smsChallengeId;
+  const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
+  const providerReference = enrollment.smsProviderReference;
+  if (enrollment.smsPendingPurpose !== "mfa_enrollment" || localCodeExpiresAt === undefined || challengeId === undefined) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
-  if (Date.now() > enrollment.smsPendingCodeExpiresAt) {
+  if (verificationProvider === undefined && localCodeHash === undefined) {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
+  if (Date.now() > localCodeExpiresAt) {
     return status("Bad Request", "SMS code expired");
   }
   if ((enrollment.smsFailedAttempts ?? 0) >= smsMaxAttempts) {
     return status("Too Many Requests", "Too many attempts");
   }
-  const codeValid = await constantTimeEqual(await hashToken(code), enrollment.smsPendingCodeHash);
+  let providerResult;
+  if (verificationProvider !== undefined) {
+    if (providerReference === undefined) {
+      return status("Bad Request", "No SMS enrollment in progress");
+    }
+    const checked = await checkWithVerificationProvider(verificationProvider, {
+      channel: "sms",
+      code,
+      purpose: "mfa_enrollment",
+      reference: providerReference,
+      subject: userId,
+      to: enrollment.smsPhone
+    });
+    if (checked.error !== undefined) {
+      return status(checked.error.status, checked.error.message);
+    }
+    providerResult = checked.result;
+  }
+  const codeValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
   if (!codeValid) {
-    await mfaStore.saveEnrollment({
-      ...enrollment,
-      smsFailedAttempts: (enrollment.smsFailedAttempts ?? 0) + 1,
-      updatedAt: Date.now()
+    const attempts = await mfaStore.recordSmsFailure({
+      challengeId,
+      maxAttempts: smsMaxAttempts,
+      userId
     });
-    return status("Bad Request", "Invalid SMS code");
+    return status(providerResult?.status === "max_attempts_reached" || attempts === undefined ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
   }
-  await mfaStore.saveEnrollment({
-    ...enrollment,
-    smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: undefined,
-    smsPendingCodeHash: undefined,
+  const completed = await mfaStore.completeSmsChallenge({
+    challengeId,
     smsVerified: true,
-    updatedAt: Date.now()
+    userId
   });
+  if (!completed) {
+    return status("Bad Request", "SMS challenge is no longer active");
+  }
   await onMfaEnrolled?.({ userId });
   return status("OK", { status: "enrolled" });
 }, {
@@ -6018,10 +6212,12 @@ var mfaChallenge = ({
   onMfaChallengeError,
   onMfaChallengeSuccess,
   onSendSmsCode,
+  verificationProvider,
   sessionDurationMs = DEFAULT_MFA_SESSION_TTL_MS,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
 }) => new Elysia18().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
@@ -6063,27 +6259,51 @@ var mfaChallenge = ({
     await onMfaChallengeSuccess?.({ user, userSessionId });
     return status("OK", { status: "authenticated" });
   };
-  const runSmsChallenge = async () => {
-    if (!enrollment.smsVerified || !enrollment.smsPhone) {
-      return status("Unauthorized", "No MFA challenge in progress");
+  const sendSmsChallenge = async () => {
+    if (enrollment.smsCodeSentAt !== undefined && Date.now() - enrollment.smsCodeSentAt < smsResendCooldownMs) {
+      return status("Too Many Requests", "SMS resend cooldown active");
     }
-    if (action === "send") {
+    try {
       await issueAndStoreSmsCode({
         codeLength: smsCodeLength,
         enrollment,
         mfaStore,
         onSendSmsCode,
-        ttlMs: smsCodeTtlMs
+        previousEnrollment: enrollment,
+        purpose: "mfa_challenge",
+        resendCooldownMs: smsResendCooldownMs,
+        ttlMs: smsCodeTtlMs,
+        userId: getUserId(user),
+        verificationProvider
       });
-      return status("OK", { status: "sent" });
+    } catch (error) {
+      const mapped = mapVerificationProviderError(error);
+      if (mapped === undefined)
+        throw error;
+      return status(mapped.status, mapped.message);
     }
+    return status("OK", { status: "sent" });
+  };
+  const runSmsChallenge = async () => {
+    if (!enrollment.smsVerified || !enrollment.smsPhone) {
+      return status("Unauthorized", "No MFA challenge in progress");
+    }
+    if (action === "send")
+      return sendSmsChallenge();
     if (code === undefined) {
       return status("Bad Request", "SMS code required");
     }
-    if (!enrollment.smsPendingCodeHash || enrollment.smsPendingCodeExpiresAt === undefined) {
+    const localCodeHash = enrollment.smsPendingCodeHash;
+    const challengeId = enrollment.smsChallengeId;
+    const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
+    const providerReference = enrollment.smsProviderReference;
+    if (enrollment.smsPendingPurpose !== "mfa_challenge" || localCodeExpiresAt === undefined || challengeId === undefined) {
+      return status("Bad Request", "No SMS code in progress");
+    }
+    if (verificationProvider === undefined && localCodeHash === undefined) {
       return status("Bad Request", "No SMS code in progress");
     }
-    if (Date.now() > enrollment.smsPendingCodeExpiresAt) {
+    if (Date.now() > localCodeExpiresAt) {
       return status("Unauthorized", "SMS code expired");
     }
     if ((enrollment.smsFailedAttempts ?? 0) >= smsMaxAttempts) {
@@ -6093,27 +6313,46 @@ var mfaChallenge = ({
       });
       return status("Unauthorized", "Too many attempts");
     }
-    const smsValid = await constantTimeEqual(await hashToken(code), enrollment.smsPendingCodeHash);
+    let providerResult;
+    if (verificationProvider !== undefined) {
+      if (providerReference === undefined) {
+        return status("Bad Request", "No SMS code in progress");
+      }
+      const checked = await checkWithVerificationProvider(verificationProvider, {
+        channel: "sms",
+        code,
+        purpose: "mfa_challenge",
+        reference: providerReference,
+        subject: getUserId(user),
+        to: enrollment.smsPhone
+      });
+      if (checked.error !== undefined) {
+        return status(checked.error.status, checked.error.message);
+      }
+      providerResult = checked.result;
+    }
+    const smsValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
     if (!smsValid) {
-      await mfaStore.saveEnrollment({
-        ...enrollment,
-        smsFailedAttempts: (enrollment.smsFailedAttempts ?? 0) + 1,
-        updatedAt: Date.now()
+      const attempts = await mfaStore.recordSmsFailure({
+        challengeId,
+        maxAttempts: smsMaxAttempts,
+        userId: getUserId(user)
       });
       await onMfaChallengeError?.({
         error: new Error("invalid_mfa_code"),
         userId: getUserId(user)
       });
-      return status("Unauthorized", "Invalid MFA code");
+      return status(providerResult?.status === "max_attempts_reached" || attempts === undefined ? "Too Many Requests" : "Unauthorized", providerResult?.status === "expired" ? "SMS code expired" : "Invalid MFA code");
     }
-    await mfaStore.saveEnrollment({
-      ...enrollment,
+    const completed = await mfaStore.completeSmsChallenge({
+      challengeId,
       lastUsedAt: Date.now(),
-      smsFailedAttempts: 0,
-      smsPendingCodeExpiresAt: undefined,
-      smsPendingCodeHash: undefined,
-      updatedAt: Date.now()
+      smsVerified: true,
+      userId: getUserId(user)
     });
+    if (!completed) {
+      return status("Unauthorized", "SMS challenge is no longer active");
+    }
     return promote();
   };
   if (factor === "sms")
@@ -6175,6 +6414,7 @@ var mfaManagementRoutes = ({
   authSessionStore,
   getUserId,
   managementRoute = "/auth/mfa",
+  managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   mfaStore
 }) => new Elysia19().use(sessionStore()).get(managementRoute, async ({
   cookie: { user_session_id },
@@ -6213,6 +6453,9 @@ var mfaManagementRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
 }, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) });
@@ -6226,6 +6469,7 @@ var mfaTotpRoutes = ({
   encryptionKey,
   getUserId,
   issuer = DEFAULT_MFA_ISSUER,
+  managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   mfaStore,
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
@@ -6243,6 +6487,9 @@ var mfaTotpRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   const userId = getUserId(userSession.user);
   const secret = generateTotpSecret();
   const existing = await mfaStore.getEnrollment(userId);
@@ -6282,6 +6529,9 @@ var mfaTotpRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
   if (!enrollment?.totpSecretCiphertext) {
@@ -31820,14 +32070,85 @@ var cloneEnrollment = (value) => ({
 var createInMemoryMfaStore = () => {
   const enrollments = new Map;
   return {
+    claimSmsChallenge: async ({
+      challengeId,
+      cooldownCutoff,
+      enrollment
+    }) => {
+      const current = enrollments.get(enrollment.userId);
+      if (current?.smsCodeSentAt !== undefined && current.smsCodeSentAt > cooldownCutoff) {
+        return false;
+      }
+      enrollments.set(enrollment.userId, cloneEnrollment({
+        ...enrollment,
+        smsChallengeId: challengeId
+      }));
+      return true;
+    },
+    completeSmsChallenge: async ({
+      challengeId,
+      lastUsedAt,
+      smsVerified,
+      userId
+    }) => {
+      const current = enrollments.get(userId);
+      if (current?.smsChallengeId !== challengeId)
+        return false;
+      enrollments.set(userId, cloneEnrollment({
+        ...current,
+        lastUsedAt: lastUsedAt ?? current.lastUsedAt,
+        smsChallengeId: undefined,
+        smsFailedAttempts: 0,
+        smsPendingCodeExpiresAt: undefined,
+        smsPendingCodeHash: undefined,
+        smsPendingPurpose: undefined,
+        smsProviderReference: undefined,
+        smsVerified,
+        updatedAt: Date.now()
+      }));
+      return true;
+    },
+    finalizeSmsChallenge: async (input) => {
+      const current = enrollments.get(input.userId);
+      if (current?.smsChallengeId !== input.challengeId)
+        return false;
+      enrollments.set(input.userId, cloneEnrollment({
+        ...current,
+        smsPendingCodeExpiresAt: input.expiresAt,
+        smsPendingCodeHash: input.hash,
+        smsProviderReference: input.providerReference,
+        updatedAt: Date.now()
+      }));
+      return true;
+    },
     getEnrollment: async (userId) => {
       const enrollment = enrollments.get(userId);
       return enrollment ? cloneEnrollment(enrollment) : undefined;
     },
     listEnrollments: async () => Array.from(enrollments.values()).map(cloneEnrollment),
+    recordSmsFailure: async ({ challengeId, maxAttempts, userId }) => {
+      const current = enrollments.get(userId);
+      if (current?.smsChallengeId !== challengeId || (current.smsFailedAttempts ?? 0) >= maxAttempts)
+        return;
+      const attempts = (current.smsFailedAttempts ?? 0) + 1;
+      enrollments.set(userId, cloneEnrollment({
+        ...current,
+        smsFailedAttempts: attempts,
+        updatedAt: Date.now()
+      }));
+      return attempts;
+    },
     removeEnrollment: async (userId) => {
       enrollments.delete(userId);
     },
+    rollbackSmsChallenge: async ({ challengeId, previous, userId }) => {
+      if (enrollments.get(userId)?.smsChallengeId !== challengeId)
+        return;
+      if (previous)
+        enrollments.set(userId, cloneEnrollment(previous));
+      else
+        enrollments.delete(userId);
+    },
     saveEnrollment: async (enrollment) => {
       enrollments.set(enrollment.userId, cloneEnrollment(enrollment));
     }
@@ -31840,12 +32161,16 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   backup_code_hashes: jsonb("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
+  sms_challenge_id: text("sms_challenge_id"),
+  sms_code_sent_at_ms: bigint("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
   sms_pending_code_expires_at_ms: bigint("sms_pending_code_expires_at_ms", {
     mode: "number"
   }),
   sms_pending_code_hash: text("sms_pending_code_hash"),
+  sms_pending_purpose: text("sms_pending_purpose").$type(),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
+  sms_provider_reference: text("sms_provider_reference"),
   sms_verified: boolean("sms_verified").notNull().default(false),
   totp_failed_attempts: smallint("totp_failed_attempts").notNull().default(0),
   totp_secret_ciphertext: text("totp_secret_ciphertext"),
@@ -31857,10 +32182,14 @@ var toEnrollment = (row) => ({
   backupCodeHashes: row.backup_code_hashes,
   createdAt: row.created_at_ms,
   lastUsedAt: row.last_used_at_ms ?? undefined,
+  smsChallengeId: row.sms_challenge_id ?? undefined,
+  smsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,
   smsFailedAttempts: row.sms_failed_attempts,
   smsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
+  smsPendingPurpose: row.sms_pending_purpose ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
+  smsProviderReference: row.sms_provider_reference ?? undefined,
   smsVerified: row.sms_verified,
   totpFailedAttempts: row.totp_failed_attempts,
   totpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,
@@ -31869,40 +32198,118 @@ var toEnrollment = (row) => ({
   userId: row.user_id
 });
 var createNeonMfaStore = (databaseUrl) => createPostgresMfaStore(createNeonDatabase(databaseUrl));
-var createPostgresMfaStore = (db) => ({
-  getEnrollment: async (userId) => {
-    const [row] = await db.select().from(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId)).limit(1);
-    return row ? toEnrollment(row) : undefined;
-  },
-  listEnrollments: async () => {
-    const rows = await db.select().from(mfaEnrollmentsTable);
-    return rows.map(toEnrollment);
-  },
-  removeEnrollment: async (userId) => {
-    await db.delete(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId));
-  },
-  saveEnrollment: async (enrollment) => {
-    const values = {
-      backup_code_hashes: enrollment.backupCodeHashes,
-      created_at_ms: enrollment.createdAt,
-      last_used_at_ms: enrollment.lastUsedAt ?? null,
-      sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
-      sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
-      sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
-      sms_phone: enrollment.smsPhone ?? null,
-      sms_verified: enrollment.smsVerified,
-      totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
-      totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
-      totp_verified: enrollment.totpVerified,
-      updated_at_ms: enrollment.updatedAt,
-      user_id: enrollment.userId
-    };
-    await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: mfaEnrollmentsTable.user_id
-    });
-  }
-});
+var createPostgresMfaStore = (db) => {
+  const toValues = (enrollment) => ({
+    backup_code_hashes: enrollment.backupCodeHashes,
+    created_at_ms: enrollment.createdAt,
+    last_used_at_ms: enrollment.lastUsedAt ?? null,
+    sms_challenge_id: enrollment.smsChallengeId ?? null,
+    sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
+    sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
+    sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
+    sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
+    sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
+    sms_phone: enrollment.smsPhone ?? null,
+    sms_provider_reference: enrollment.smsProviderReference ?? null,
+    sms_verified: enrollment.smsVerified,
+    totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
+    totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
+    totp_verified: enrollment.totpVerified,
+    updated_at_ms: enrollment.updatedAt,
+    user_id: enrollment.userId
+  });
+  return {
+    claimSmsChallenge: async ({
+      challengeId,
+      cooldownCutoff,
+      enrollment
+    }) => {
+      const values = toValues({
+        ...enrollment,
+        smsChallengeId: challengeId
+      });
+      const rows = await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
+        set: {
+          sms_challenge_id: challengeId,
+          sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
+          sms_failed_attempts: 0,
+          sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
+          sms_pending_code_hash: null,
+          sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
+          sms_phone: enrollment.smsPhone ?? null,
+          sms_provider_reference: null,
+          sms_verified: enrollment.smsVerified,
+          updated_at_ms: enrollment.updatedAt
+        },
+        setWhere: or(isNull(mfaEnrollmentsTable.sms_code_sent_at_ms), lte(mfaEnrollmentsTable.sms_code_sent_at_ms, cooldownCutoff)),
+        target: mfaEnrollmentsTable.user_id
+      }).returning({ userId: mfaEnrollmentsTable.user_id });
+      return rows.length === 1;
+    },
+    completeSmsChallenge: async ({
+      challengeId,
+      lastUsedAt,
+      smsVerified,
+      userId
+    }) => {
+      const rows = await db.update(mfaEnrollmentsTable).set({
+        last_used_at_ms: lastUsedAt,
+        sms_challenge_id: null,
+        sms_failed_attempts: 0,
+        sms_pending_code_expires_at_ms: null,
+        sms_pending_code_hash: null,
+        sms_pending_purpose: null,
+        sms_provider_reference: null,
+        sms_verified: smsVerified,
+        updated_at_ms: Date.now()
+      }).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId))).returning({ userId: mfaEnrollmentsTable.user_id });
+      return rows.length === 1;
+    },
+    finalizeSmsChallenge: async (input) => {
+      const rows = await db.update(mfaEnrollmentsTable).set({
+        sms_pending_code_expires_at_ms: input.expiresAt,
+        sms_pending_code_hash: input.hash ?? null,
+        sms_provider_reference: input.providerReference ?? null,
+        updated_at_ms: Date.now()
+      }).where(and(eq(mfaEnrollmentsTable.user_id, input.userId), eq(mfaEnrollmentsTable.sms_challenge_id, input.challengeId))).returning({ userId: mfaEnrollmentsTable.user_id });
+      return rows.length === 1;
+    },
+    getEnrollment: async (userId) => {
+      const [row] = await db.select().from(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId)).limit(1);
+      return row ? toEnrollment(row) : undefined;
+    },
+    listEnrollments: async () => {
+      const rows = await db.select().from(mfaEnrollmentsTable);
+      return rows.map(toEnrollment);
+    },
+    recordSmsFailure: async ({ challengeId, maxAttempts, userId }) => {
+      const rows = await db.update(mfaEnrollmentsTable).set({
+        sms_failed_attempts: sql`${mfaEnrollmentsTable.sms_failed_attempts} + 1`,
+        updated_at_ms: Date.now()
+      }).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId), lte(mfaEnrollmentsTable.sms_failed_attempts, maxAttempts - 1))).returning({
+        attempts: mfaEnrollmentsTable.sms_failed_attempts
+      });
+      return rows[0]?.attempts;
+    },
+    removeEnrollment: async (userId) => {
+      await db.delete(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId));
+    },
+    rollbackSmsChallenge: async ({ challengeId, previous, userId }) => {
+      if (previous) {
+        await db.update(mfaEnrollmentsTable).set(toValues(previous)).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId)));
+        return;
+      }
+      await db.delete(mfaEnrollmentsTable).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId)));
+    },
+    saveEnrollment: async (enrollment) => {
+      const values = toValues(enrollment);
+      await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
+        set: values,
+        target: mfaEnrollmentsTable.user_id
+      });
+    }
+  };
+};
 // src/audit/types.ts
 var AUDIT_EVENT_TYPES = [
   "account_deleted",
@@ -36238,6 +36645,19 @@ var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
 };
+var mfaSmsDeliveryPolicyMigration = {
+  id: "0004_sms_delivery_policy",
+  sql: [
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_code_sent_at_ms" bigint;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_pending_purpose" text;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_provider_reference" text;'
+  ].join(`
+`)
+};
+var mfaSmsAtomicChallengeMigration = {
+  id: "0005_sms_atomic_challenge",
+  sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_challenge_id" text;'
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -36292,7 +36712,9 @@ var blockMigrations = {
     migrations: [
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
       mfaSmsColumnsMigration,
-      mfaTotpLockoutMigration
+      mfaTotpLockoutMigration,
+      mfaSmsDeliveryPolicyMigration,
+      mfaSmsAtomicChallengeMigration
     ]
   },
   oidc: {
@@ -36805,6 +37227,7 @@ var buildAuthApplications = async (configuration) => {
     credentials,
     customProviders,
     mfa,
+    verificationProvider,
     passwordless,
     lockout,
     sessions,
@@ -37037,7 +37460,8 @@ var buildAuthApplications = async (configuration) => {
     auditedMfa ? mfaRoutes({
       ...auditedMfa,
       authSessionStore,
-      cookieSecure: resolvedCookieSecure
+      cookieSecure: resolvedCookieSecure,
+      verificationProvider
     }) : new Elysia45,
     passwordless ? passwordlessRoutes({
       ...passwordless,
@@ -37564,6 +37988,7 @@ export {
   accessTokensTable,
   acceptInvitation,
   WEBAUTHN_CHALLENGE_COOKIE,
+  VerificationProviderError,
   STATUS_LIST_TYP,
   STATUS_LIST_SUB_TYP,
   REQUEST_URI_PREFIX,
@@ -37581,6 +38006,7 @@ export {
   DEFAULT_STATUS_ROUTE,
   DEFAULT_SSO_SESSION_TTL_MS,
   DEFAULT_SSO_ROUTE,
+  DEFAULT_SMS_RESEND_COOLDOWN_MS,
   DEFAULT_SMS_MAX_ATTEMPTS,
   DEFAULT_SMS_CODE_TTL_MS,
   DEFAULT_SMS_CODE_LENGTH,
@@ -37598,6 +38024,7 @@ export {
   DEFAULT_ORGANIZATIONS_ROUTE,
   DEFAULT_OIDC_ROUTE,
   DEFAULT_MFA_SESSION_TTL_MS,
+  DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   DEFAULT_MFA_ISSUER,
   DEFAULT_MAGIC_LINK_TTL_MS,
   DEFAULT_INVITATION_TTL_MS,
@@ -37613,5 +38040,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=0FBF734780C91B5D64756E2164756E21
+//# debugId=FC3F27A521162E4064756E2164756E21
 //# sourceMappingURL=index.js.map