@absolutejs/auth 0.75.3 → 0.76.0

package/dist/index.js

@@ -6185,7 +6185,45 @@ var createLockoutGuard = ({
 });
 
 // src/mfa/types.ts
-var isMfaEnrolled = (enrollment) => enrollment !== undefined && (enrollment.totpVerified || enrollment.smsVerified || enrollment.backupCodeHashes.length > 0);
+var LEGACY_SMS_FACTOR_ID = "legacy-sms";
+var LEGACY_TOTP_FACTOR_ID = "legacy-totp";
+var getMfaFactors = (enrollment) => {
+  if (enrollment.factors !== undefined)
+    return enrollment.factors;
+  const factors = [];
+  if (enrollment.totpSecretCiphertext) {
+    factors.push({
+      id: LEGACY_TOTP_FACTOR_ID,
+      label: "Authenticator app",
+      secretCiphertext: enrollment.totpSecretCiphertext,
+      type: "totp",
+      verified: enrollment.totpVerified
+    });
+  }
+  if (enrollment.smsPhone) {
+    factors.push({
+      id: LEGACY_SMS_FACTOR_ID,
+      label: "Text message",
+      phone: enrollment.smsPhone,
+      type: "sms",
+      verified: enrollment.smsVerified
+    });
+  }
+  return factors;
+};
+var isMfaEnrolled = (enrollment) => enrollment !== undefined && (getMfaFactors(enrollment).some((factor) => factor.verified) || enrollment.backupCodeHashes.length > 0);
+var withMfaFactors = (enrollment, factors) => {
+  const firstSms = factors.find((factor) => factor.type === "sms");
+  const firstTotp = factors.find((factor) => factor.type === "totp");
+  return {
+    ...enrollment,
+    factors,
+    smsPhone: firstSms?.phone,
+    smsVerified: firstSms?.verified ?? false,
+    totpSecretCiphertext: firstTotp?.secretCiphertext,
+    totpVerified: firstTotp?.verified ?? false
+  };
+};
 
 // src/mfa/gate.ts
 var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(await mfaStore.getEnrollment(getUserId(user)));
@@ -6401,6 +6439,8 @@ var hasRecentAuthentication = (session, maxAgeMs, now = Date.now()) => session.a
 // src/mfa/sms.ts
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
+var FACTOR_LABEL_MAX_LENGTH = 80;
+var DEFAULT_SMS_LABEL = "Text message";
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
 var generateNumericCode = (length) => {
   const bytes = new Uint8Array(length);
@@ -6574,10 +6614,13 @@ var mfaSmsRoutes = ({
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
 }) => new Elysia18().use(sessionStore()).post(smsSetupRoute, {
-  body: t12.Object({ phone: t12.String() }),
+  body: t12.Object({
+    label: t12.Optional(t12.String({ maxLength: FACTOR_LABEL_MAX_LENGTH })),
+    phone: t12.String()
+  }),
   cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { phone },
+  body: { label, phone },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6605,21 +6648,35 @@ var mfaSmsRoutes = ({
   if (existing?.smsCodeSentAt !== undefined && now - existing.smsCodeSentAt < smsResendCooldownMs) {
     return status("Too Many Requests", "SMS resend cooldown active");
   }
+  const base = existing ?? {
+    backupCodeHashes: [],
+    createdAt: now,
+    smsVerified: false,
+    totpVerified: false,
+    updatedAt: now,
+    userId
+  };
+  const factor = {
+    id: crypto.randomUUID(),
+    label: label?.trim() || DEFAULT_SMS_LABEL,
+    phone,
+    type: "sms",
+    verified: false
+  };
+  const factors = [
+    ...getMfaFactors(base).filter((existingFactor) => existingFactor.type !== "sms" || existingFactor.verified),
+    factor
+  ];
   try {
     await issueAndStoreSmsCode({
       codeLength: smsCodeLength,
       enrollment: {
-        backupCodeHashes: existing?.backupCodeHashes ?? [],
-        createdAt: existing?.createdAt ?? now,
-        lastUsedAt: existing?.lastUsedAt,
+        ...withMfaFactors(base, factors),
         smsFailedAttempts: 0,
+        smsPendingFactorId: factor.id,
         smsPhone: phone,
-        smsVerified: false,
-        totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
-        totpSecretCiphertext: existing?.totpSecretCiphertext,
-        totpVerified: existing?.totpVerified ?? false,
         updatedAt: now,
-        userId
+        userId: base.userId
       },
       mfaStore,
       onSendSmsCode,
@@ -6636,12 +6693,18 @@ var mfaSmsRoutes = ({
       throw error;
     return status(mapped.status, mapped.message);
   }
-  return status("OK", { phone: maskPhone(phone) });
+  return status("OK", {
+    factorId: factor.id,
+    phone: maskPhone(phone)
+  });
 }).post(smsVerifyRoute, {
-  body: t12.Object({ code: t12.String() }),
+  body: t12.Object({
+    code: t12.String(),
+    factorId: t12.Optional(t12.String())
+  }),
   cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { code },
+  body: { code, factorId },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6662,6 +6725,12 @@ var mfaSmsRoutes = ({
   if (!enrollment?.smsPhone) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
+  const factors = getMfaFactors(enrollment);
+  const pendingFactorId = factorId ?? enrollment.smsPendingFactorId;
+  const pendingFactor = factors.find((candidate) => candidate.type === "sms" && (candidate.id === pendingFactorId || pendingFactorId === undefined && candidate.phone === enrollment.smsPhone));
+  if (!pendingFactor || pendingFactor.type !== "sms") {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
   const localCodeHash = enrollment.smsPendingCodeHash;
   const challengeId = enrollment.smsChallengeId;
   const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
@@ -6689,7 +6758,7 @@ var mfaSmsRoutes = ({
       purpose: "mfa_enrollment",
       reference: providerReference,
       subject: userId,
-      to: enrollment.smsPhone
+      to: pendingFactor.phone
     });
     if (checked.error !== undefined) {
       return status(checked.error.status, checked.error.message);
@@ -6705,8 +6774,10 @@ var mfaSmsRoutes = ({
     });
     return status(providerResult?.status === "max_attempts_reached" || attempts === undefined ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
   }
+  const verifiedFactors = factors.map((candidate) => candidate.id === pendingFactor.id ? { ...candidate, verified: true } : candidate);
   const completed = await mfaStore.completeSmsChallenge({
     challengeId,
+    factors: verifiedFactors,
     smsVerified: true,
     userId
   });
@@ -6736,15 +6807,50 @@ var mfaChallenge = ({
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
-}) => new Elysia19().use(sessionStore()).post(challengeRoute, {
+}) => new Elysia19().use(sessionStore()).get(challengeRoute, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
+  cookie: { user_session_id },
+  status,
+  store: { unregisteredSession }
+}) => {
+  const compatibilityLayer = await createSessionCompatibilityLayer({
+    authSessionStore,
+    userSessionId: user_session_id.value
+  });
+  const challengeUnregistered = authSessionStore ? compatibilityLayer.unregisteredSession : unregisteredSession;
+  const pendingId = user_session_id.value;
+  const pending = pendingId ? challengeUnregistered[pendingId] : undefined;
+  if (!pending) {
+    return status("Unauthorized", "No MFA challenge in progress");
+  }
+  const user = await getChallengeUser(pending.userIdentity ?? {});
+  const enrollment = user ? await mfaStore.getEnrollment(getUserId(user)) : undefined;
+  if (!enrollment) {
+    return status("Unauthorized", "No MFA challenge in progress");
+  }
+  const response = {
+    backupCodesAvailable: enrollment.backupCodeHashes.length > 0,
+    factors: getMfaFactors(enrollment).filter((factor) => factor.verified).map((factor) => ({
+      id: factor.id,
+      label: factor.label,
+      phone: factor.type === "sms" ? maskPhone(factor.phone) : null,
+      type: factor.type
+    }))
+  };
+  return status("OK", response);
+}).post(challengeRoute, {
   body: t13.Object({
     action: t13.Optional(t13.Union([t13.Literal("send"), t13.Literal("verify")])),
     code: t13.Optional(t13.String()),
-    factor: t13.Optional(t13.Literal("sms"))
+    factor: t13.Optional(t13.Union([
+      t13.Literal("backup_codes"),
+      t13.Literal("sms"),
+      t13.Literal("totp")
+    ])),
+    factorId: t13.Optional(t13.String())
   }),
   cookie: t13.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { action, code, factor },
+  body: { action, code, factor, factorId },
   cookie: { user_session_id },
   status,
   store: { session, unregisteredSession }
@@ -6765,6 +6871,7 @@ var mfaChallenge = ({
   if (!user || !enrollment) {
     return status("Unauthorized", "No MFA challenge in progress");
   }
+  const factors = getMfaFactors(enrollment);
   const promote = async () => {
     delete challengeUnregistered[pendingId];
     const userSessionId = crypto.randomUUID();
@@ -6787,10 +6894,18 @@ var mfaChallenge = ({
     if (enrollment.smsCodeSentAt !== undefined && Date.now() - enrollment.smsCodeSentAt < smsResendCooldownMs) {
       return status("Too Many Requests", "SMS resend cooldown active");
     }
+    const smsFactor = factors.find((candidate) => candidate.type === "sms" && candidate.verified && (candidate.id === factorId || factorId === undefined));
+    if (!smsFactor || smsFactor.type !== "sms") {
+      return status("Bad Request", "SMS factor not found");
+    }
     try {
       await issueAndStoreSmsCode({
         codeLength: smsCodeLength,
-        enrollment,
+        enrollment: {
+          ...withMfaFactors(enrollment, factors),
+          smsPendingFactorId: smsFactor.id,
+          smsPhone: smsFactor.phone
+        },
         mfaStore,
         onSendSmsCode,
         previousEnrollment: enrollment,
@@ -6806,10 +6921,19 @@ var mfaChallenge = ({
         throw error;
       return status(mapped.status, mapped.message);
     }
-    return status("OK", { status: "sent" });
+    return status("OK", {
+      factorId: smsFactor.id,
+      phone: maskPhone(smsFactor.phone),
+      status: "sent"
+    });
   };
   const runSmsChallenge = async () => {
-    if (!enrollment.smsVerified || !enrollment.smsPhone) {
+    if (action !== "send" && factorId !== undefined && enrollment.smsPendingFactorId !== undefined && factorId !== enrollment.smsPendingFactorId) {
+      return status("Bad Request", "No SMS code in progress");
+    }
+    const selectedFactorId = enrollment.smsPendingFactorId ?? factorId;
+    const smsFactor = factors.find((candidate) => candidate.type === "sms" && candidate.verified && (candidate.id === selectedFactorId || selectedFactorId === undefined));
+    if (!smsFactor || smsFactor.type !== "sms") {
       return status("Unauthorized", "No MFA challenge in progress");
     }
     if (action === "send")
@@ -6848,7 +6972,7 @@ var mfaChallenge = ({
         purpose: "mfa_challenge",
         reference: providerReference,
         subject: getUserId(user),
-        to: enrollment.smsPhone
+        to: smsFactor.phone
       });
       if (checked.error !== undefined) {
         return status(checked.error.status, checked.error.message);
@@ -6870,6 +6994,7 @@ var mfaChallenge = ({
     }
     const completed = await mfaStore.completeSmsChallenge({
       challengeId,
+      factors,
       lastUsedAt: Date.now(),
       smsVerified: true,
       userId: getUserId(user)
@@ -6891,11 +7016,14 @@ var mfaChallenge = ({
     });
     return status("Unauthorized", "Too many attempts");
   }
-  const totpValid = enrollment.totpVerified && enrollment.totpSecretCiphertext ? await verifyTotp({
-    secret: await decryptTotpSecret(enrollment.totpSecretCiphertext, encryptionKey),
+  const totpFactors = factors.filter((candidate) => candidate.type === "totp" && candidate.verified && (candidate.id === factorId || factorId === undefined));
+  const totpChecks = factor === "backup_codes" ? [] : await Promise.all(totpFactors.map(async (candidate) => verifyTotp({
+    secret: await decryptTotpSecret(candidate.secretCiphertext, encryptionKey),
     token: code
-  }) : false;
-  const remainingBackupHashes = totpValid ? undefined : await consumeBackupCode(code, enrollment.backupCodeHashes);
+  })));
+  const totpValid = totpChecks.some(Boolean);
+  const mayUseBackupCode = factor === "backup_codes" || factor === undefined && factorId === undefined;
+  const remainingBackupHashes = totpValid || !mayUseBackupCode ? undefined : await consumeBackupCode(code, enrollment.backupCodeHashes);
   if (!totpValid && remainingBackupHashes === undefined) {
     await mfaStore.saveEnrollment({
       ...enrollment,
@@ -6927,6 +7055,12 @@ var maskPhone2 = (phone) => {
   const suffix = phone.slice(-visibleDigits);
   return `${"*".repeat(Math.max(0, phone.length - visibleDigits))}${suffix}`;
 };
+var publicFactors = (enrollment) => enrollment ? getMfaFactors(enrollment).filter((factor) => factor.verified).map((factor) => ({
+  id: factor.id,
+  label: factor.label,
+  phone: factor.type === "sms" ? maskPhone2(factor.phone) : null,
+  type: factor.type
+})) : [];
 var mfaManagementRoutes = ({
   authSessionStore,
   getUserId,
@@ -6950,6 +7084,7 @@ var mfaManagementRoutes = ({
   const response = {
     backupCodesRemaining: enrollment?.backupCodeHashes.length ?? 0,
     enabled: isMfaEnrolled(enrollment),
+    factors: publicFactors(enrollment),
     smsBackup: {
       enabled: enrollment?.smsVerified ?? false,
       phone: maskPhone2(enrollment?.smsPhone)
@@ -6975,11 +7110,54 @@ var mfaManagementRoutes = ({
   }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
+}).delete(`${managementRoute}/factors/:factorId`, {
+  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }),
+  params: t14.Object({ factorId: t14.String() })
+}, async ({
+  cookie: { user_session_id },
+  params: { factorId },
+  status,
+  store: { session }
+}) => {
+  const userSession = await loadSessionFromSource({
+    authSessionStore,
+    session,
+    userSessionId: user_session_id.value
+  });
+  if (!userSession) {
+    return status("Unauthorized", "Authentication required");
+  }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
+  const userId = getUserId(userSession.user);
+  const enrollment = await mfaStore.getEnrollment(userId);
+  if (!enrollment) {
+    return status("Not Found", "MFA factor not found");
+  }
+  const factors = getMfaFactors(enrollment);
+  if (!factors.some((factor) => factor.id === factorId)) {
+    return status("Not Found", "MFA factor not found");
+  }
+  const remaining = factors.filter((factor) => factor.id !== factorId);
+  if (remaining.length === 0) {
+    await mfaStore.removeEnrollment(userId);
+  } else {
+    const hasVerifiedFactor = remaining.some((factor) => factor.verified);
+    await mfaStore.saveEnrollment(withMfaFactors({
+      ...enrollment,
+      backupCodeHashes: hasVerifiedFactor ? enrollment.backupCodeHashes : [],
+      updatedAt: Date.now()
+    }, remaining));
+  }
+  return status("OK", { status: "removed" });
 });
 
 // src/mfa/totp.ts
 init_crypto();
 import { Elysia as Elysia21, t as t15 } from "elysia";
+var FACTOR_LABEL_MAX_LENGTH2 = 80;
+var DEFAULT_TOTP_LABEL = "Authenticator app";
 var mfaTotpRoutes = ({
   authSessionStore,
   backupCodeCount = DEFAULT_BACKUP_CODE_COUNT,
@@ -6991,7 +7169,13 @@ var mfaTotpRoutes = ({
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
   totpVerifyRoute = "/auth/mfa/totp/verify"
-}) => new Elysia21().use(sessionStore()).post(totpSetupRoute, { cookie: t15.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
+}) => new Elysia21().use(sessionStore()).post(totpSetupRoute, {
+  body: t15.Object({
+    label: t15.Optional(t15.String({ maxLength: FACTOR_LABEL_MAX_LENGTH2 }))
+  }),
+  cookie: t15.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
+  body: { label },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7011,20 +7195,25 @@ var mfaTotpRoutes = ({
   const secret = generateTotpSecret();
   const existing = await mfaStore.getEnrollment(userId);
   const now = Date.now();
-  await mfaStore.saveEnrollment({
-    backupCodeHashes: existing?.backupCodeHashes ?? [],
-    createdAt: existing?.createdAt ?? now,
-    smsFailedAttempts: existing?.smsFailedAttempts,
-    smsPendingCodeExpiresAt: existing?.smsPendingCodeExpiresAt,
-    smsPendingCodeHash: existing?.smsPendingCodeHash,
-    smsPhone: existing?.smsPhone,
-    smsVerified: existing?.smsVerified ?? false,
-    totpSecretCiphertext: await encryptTotpSecret(secret, encryptionKey),
+  const base = existing ?? {
+    backupCodeHashes: [],
+    createdAt: now,
+    smsVerified: false,
     totpVerified: false,
     updatedAt: now,
     userId
-  });
+  };
+  const factor = {
+    id: crypto.randomUUID(),
+    label: label?.trim() || DEFAULT_TOTP_LABEL,
+    secretCiphertext: await encryptTotpSecret(secret, encryptionKey),
+    type: "totp",
+    verified: false
+  };
+  const factors = getMfaFactors(base).filter((existingFactor) => existingFactor.type !== "totp" || existingFactor.verified);
+  await mfaStore.saveEnrollment(withMfaFactors({ ...base, updatedAt: now }, [...factors, factor]));
   return status("OK", {
+    factorId: factor.id,
     secret,
     uri: createTotpKeyUri({
       accountName: userId,
@@ -7033,10 +7222,13 @@ var mfaTotpRoutes = ({
     })
   });
 }).post(totpVerifyRoute, {
-  body: t15.Object({ code: t15.String() }),
+  body: t15.Object({
+    code: t15.String(),
+    factorId: t15.Optional(t15.String())
+  }),
   cookie: t15.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { code },
+  body: { code, factorId },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7054,21 +7246,26 @@ var mfaTotpRoutes = ({
   }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
-  if (!enrollment?.totpSecretCiphertext) {
+  if (!enrollment) {
+    return status("Bad Request", "No TOTP enrollment in progress");
+  }
+  const factors = getMfaFactors(enrollment);
+  const factor = factors.find((candidate) => candidate.type === "totp" && (candidate.id === factorId || factorId === undefined && !candidate.verified));
+  if (!factor || factor.type !== "totp") {
     return status("Bad Request", "No TOTP enrollment in progress");
   }
-  const secret = await decryptTotpSecret(enrollment.totpSecretCiphertext, encryptionKey);
+  const secret = await decryptTotpSecret(factor.secretCiphertext, encryptionKey);
   const valid = await verifyTotp({ secret, token: code });
   if (!valid) {
     return status("Bad Request", "Invalid TOTP code");
   }
   const { codes, hashes } = await generateBackupCodes(backupCodeCount);
-  await mfaStore.saveEnrollment({
+  const verifiedFactors = factors.map((candidate) => candidate.id === factor.id ? { ...candidate, verified: true } : candidate);
+  await mfaStore.saveEnrollment(withMfaFactors({
     ...enrollment,
     backupCodeHashes: hashes,
-    totpVerified: true,
     updatedAt: Date.now()
-  });
+  }, verifiedFactors));
   await onMfaEnrolled?.({ userId });
   return status("OK", { backupCodes: codes });
 });
@@ -34782,23 +34979,33 @@ var ensureReadable = async (ciphertext, key, userId) => {
   }
 };
 var planEnrollment = async (enrollment, oldKey, newKey) => {
-  const ciphertext = enrollment.totpSecretCiphertext;
-  if (ciphertext === undefined || ciphertext.length === 0) {
+  const factors = getMfaFactors(enrollment);
+  const totpFactors = factors.filter((factor) => factor.type === "totp");
+  if (totpFactors.length === 0) {
     const plan2 = { kind: "skip" };
     return plan2;
   }
-  const secret = await tryDecrypt(ciphertext, oldKey);
-  if (secret === undefined) {
-    await ensureReadable(ciphertext, newKey, enrollment.userId);
+  let rotated = false;
+  const nextFactors = await Promise.all(factors.map(async (factor) => {
+    if (factor.type !== "totp")
+      return factor;
+    const secret = await tryDecrypt(factor.secretCiphertext, oldKey);
+    if (secret === undefined) {
+      await ensureReadable(factor.secretCiphertext, newKey, enrollment.userId);
+      return factor;
+    }
+    rotated = true;
+    return {
+      ...factor,
+      secretCiphertext: await encryptTotpSecret(secret, newKey)
+    };
+  }));
+  if (!rotated) {
     const plan2 = { kind: "already" };
     return plan2;
   }
   const plan = {
-    enrollment: {
-      ...enrollment,
-      totpSecretCiphertext: await encryptTotpSecret(secret, newKey),
-      updatedAt: Date.now()
-    },
+    enrollment: withMfaFactors({ ...enrollment, updatedAt: Date.now() }, nextFactors),
     kind: "rotate"
   };
   return plan;
@@ -34821,7 +35028,8 @@ var rotateMfaEncryptionKey = async ({
 // src/mfa/inMemoryMfaStore.ts
 var cloneEnrollment = (value) => ({
   ...value,
-  backupCodeHashes: [...value.backupCodeHashes]
+  backupCodeHashes: [...value.backupCodeHashes],
+  factors: value.factors?.map((factor) => ({ ...factor }))
 });
 var createInMemoryMfaStore = () => {
   const enrollments = new Map;
@@ -34843,6 +35051,7 @@ var createInMemoryMfaStore = () => {
     },
     completeSmsChallenge: async ({
       challengeId,
+      factors,
       lastUsedAt,
       smsVerified,
       userId
@@ -34852,11 +35061,13 @@ var createInMemoryMfaStore = () => {
         return false;
       enrollments.set(userId, cloneEnrollment({
         ...current,
+        factors: factors ?? current.factors,
         lastUsedAt: lastUsedAt ?? current.lastUsedAt,
         smsChallengeId: undefined,
         smsFailedAttempts: 0,
         smsPendingCodeExpiresAt: undefined,
         smsPendingCodeHash: undefined,
+        smsPendingFactorId: undefined,
         smsPendingPurpose: undefined,
         smsProviderReference: undefined,
         smsVerified,
@@ -34917,6 +35128,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   backup_code_hashes: jsonb("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
+  mfa_factors: jsonb("mfa_factors").$type(),
   sms_challenge_id: text("sms_challenge_id"),
   sms_code_sent_at_ms: bigint("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
@@ -34924,6 +35136,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
     mode: "number"
   }),
   sms_pending_code_hash: text("sms_pending_code_hash"),
+  sms_pending_factor_id: text("sms_pending_factor_id"),
   sms_pending_purpose: text("sms_pending_purpose").$type(),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
   sms_provider_reference: text("sms_provider_reference"),
@@ -34937,12 +35150,14 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
 var toEnrollment = (row) => ({
   backupCodeHashes: row.backup_code_hashes,
   createdAt: row.created_at_ms,
+  factors: row.mfa_factors ?? undefined,
   lastUsedAt: row.last_used_at_ms ?? undefined,
   smsChallengeId: row.sms_challenge_id ?? undefined,
   smsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,
   smsFailedAttempts: row.sms_failed_attempts,
   smsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
+  smsPendingFactorId: row.sms_pending_factor_id ?? undefined,
   smsPendingPurpose: row.sms_pending_purpose ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
   smsProviderReference: row.sms_provider_reference ?? undefined,
@@ -34959,11 +35174,13 @@ var createPostgresMfaStore = (db) => {
     backup_code_hashes: enrollment.backupCodeHashes,
     created_at_ms: enrollment.createdAt,
     last_used_at_ms: enrollment.lastUsedAt ?? null,
+    mfa_factors: enrollment.factors ?? null,
     sms_challenge_id: enrollment.smsChallengeId ?? null,
     sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
     sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
     sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
     sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
+    sms_pending_factor_id: enrollment.smsPendingFactorId ?? null,
     sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
     sms_phone: enrollment.smsPhone ?? null,
     sms_provider_reference: enrollment.smsProviderReference ?? null,
@@ -34986,11 +35203,13 @@ var createPostgresMfaStore = (db) => {
       });
       const rows = await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
         set: {
+          mfa_factors: enrollment.factors ?? null,
           sms_challenge_id: challengeId,
           sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
           sms_failed_attempts: 0,
           sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
           sms_pending_code_hash: null,
+          sms_pending_factor_id: enrollment.smsPendingFactorId ?? null,
           sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
           sms_phone: enrollment.smsPhone ?? null,
           sms_provider_reference: null,
@@ -35004,16 +35223,19 @@ var createPostgresMfaStore = (db) => {
     },
     completeSmsChallenge: async ({
       challengeId,
+      factors,
       lastUsedAt,
       smsVerified,
       userId
     }) => {
       const rows = await db.update(mfaEnrollmentsTable).set({
         last_used_at_ms: lastUsedAt,
+        mfa_factors: factors,
         sms_challenge_id: null,
         sms_failed_attempts: 0,
         sms_pending_code_expires_at_ms: null,
         sms_pending_code_hash: null,
+        sms_pending_factor_id: null,
         sms_pending_purpose: null,
         sms_provider_reference: null,
         sms_verified: smsVerified,
@@ -39553,6 +39775,14 @@ var mfaSmsAtomicChallengeMigration = {
   id: "0005_sms_atomic_challenge",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_challenge_id" text;'
 };
+var mfaMultipleFactorsMigration = {
+  id: "0006_multiple_factors",
+  sql: [
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "mfa_factors" jsonb;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_pending_factor_id" text;'
+  ].join(`
+`)
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -39634,7 +39864,8 @@ var blockMigrations = {
       mfaSmsColumnsMigration,
       mfaTotpLockoutMigration,
       mfaSmsDeliveryPolicyMigration,
-      mfaSmsAtomicChallengeMigration
+      mfaSmsAtomicChallengeMigration,
+      mfaMultipleFactorsMigration
     ]
   },
   oidc: {
@@ -40500,6 +40731,7 @@ var createAuthApplications = async (configuration) => buildAuthApplications(conf
 export {
   writeWarrant,
   withSpan,
+  withMfaFactors,
   withAbsoluteNativeAuthClients,
   webhookDeliveriesTable,
   webauthnRoutes,
@@ -40708,6 +40940,7 @@ export {
   getStatus,
   getRegisteredClient,
   getOrRefreshFederatedTokens,
+  getMfaFactors,
   getCredentialStatus,
   generateTotpSecret,
   generateTotp,
@@ -41026,5 +41259,5 @@ export {
   ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV
 };
 
-//# debugId=245E854B8173886A64756E2164756E21
+//# debugId=8C9E5A777004332D64756E2164756E21
 //# sourceMappingURL=index.js.map