@absolutejs/auth 0.75.3 → 0.76.0

package/dist/mfa/challenge.d.ts

@@ -1,4 +1,13 @@
 import { type MfaRouteProps } from './config';
+export type MfaChallengeOptions = {
+    backupCodesAvailable: boolean;
+    factors: Array<{
+        id: string;
+        label: string;
+        phone: string | null;
+        type: 'sms' | 'totp';
+    }>;
+};
 export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, verificationProvider, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, totpMaxAttempts }: MfaRouteProps<UserType>) => import("elysia/types").AddRoute<"", "local", {
     decorator: {};
     store: {
@@ -9,7 +18,39 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
 }, {
     typebox: {};
     error: [];
-}, import("elysia/types").DefaultMetadata, {}, import("elysia/types").DefaultEphemeral, {
+}, import("elysia/types").DefaultMetadata, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "No MFA challenge in progress";
+                200: {
+                    backupCodesAvailable: boolean;
+                    factors: Array<{
+                        id: string;
+                        label: string;
+                        phone: string | null;
+                        type: "sms" | "totp";
+                    }>;
+                };
+                422: {
+                    type: "validation";
+                    title: "Validation Error";
+                    status: 422;
+                    detail?: string;
+                    on: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+            error: never;
+        };
+    };
+}, import("elysia/types").DefaultEphemeral, {
     derive: {};
     schema: {};
     schemas: {};
@@ -19,16 +60,18 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
     body: import("typebox").TObject<{
         action: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TLiteral<"send">, import("typebox").TLiteral<"verify">]>>;
         code: import("typebox").TOptional<import("typebox").TString>;
-        factor: import("typebox").TOptional<import("typebox").TLiteral<"sms">>;
+        factor: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TLiteral<"backup_codes">, import("typebox").TLiteral<"sms">, import("typebox").TLiteral<"totp">]>>;
+        factorId: import("typebox").TOptional<import("typebox").TString>;
     }>;
     cookie: import("elysia").TCookieObject<{
         user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
     }>;
-}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { action, code, factor }, cookie: { user_session_id }, status, store: { session, unregisteredSession } }: {
+}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { action, code, factor, factorId }, cookie: { user_session_id }, status, store: { session, unregisteredSession } }: {
     body: {
         code?: string | undefined;
         action?: "verify" | "send" | undefined;
-        factor?: "sms" | undefined;
+        factorId?: string | undefined;
+        factor?: "sms" | "backup_codes" | "totp" | undefined;
     };
     query: Record<string, string | undefined>;
     params: {};
@@ -172,7 +215,8 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
         body: import("typebox").TObject<{
             action: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TLiteral<"send">, import("typebox").TLiteral<"verify">]>>;
             code: import("typebox").TOptional<import("typebox").TString>;
-            factor: import("typebox").TOptional<import("typebox").TLiteral<"sms">>;
+            factor: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TLiteral<"backup_codes">, import("typebox").TLiteral<"sms">, import("typebox").TLiteral<"totp">]>>;
+            factorId: import("typebox").TOptional<import("typebox").TString>;
         }>;
         cookie: import("elysia").TCookieObject<{
             user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
@@ -195,8 +239,10 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
         session: import("..").SessionRecord<UserType>;
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
-}) => Promise<import("elysia").ElysiaStatus<"Too Many Requests", "SMS resend cooldown active", 429> | import("elysia").ElysiaStatus<"Bad Request" | "Too Many Requests" | "Service Unavailable", string, 400 | 429 | 503> | import("elysia").ElysiaStatus<"Unauthorized", "No MFA challenge in progress", 401> | import("elysia").ElysiaStatus<"OK", {
+}) => Promise<import("elysia").ElysiaStatus<"Too Many Requests", "SMS resend cooldown active", 429> | import("elysia").ElysiaStatus<"Bad Request" | "Too Many Requests" | "Service Unavailable", string, 400 | 429 | 503> | import("elysia").ElysiaStatus<"Unauthorized", "No MFA challenge in progress", 401> | import("elysia").ElysiaStatus<"Bad Request", "No SMS code in progress", 400> | import("elysia").ElysiaStatus<"Bad Request", "SMS factor not found", 400> | import("elysia").ElysiaStatus<"OK", {
+    readonly factorId: string;
+    readonly phone: string;
     readonly status: "sent";
-}, 200> | import("elysia").ElysiaStatus<"Bad Request", "SMS code required", 400> | import("elysia").ElysiaStatus<"Bad Request", "No SMS code in progress", 400> | import("elysia").ElysiaStatus<"Unauthorized", "SMS code expired", 401> | import("elysia").ElysiaStatus<"Unauthorized", "Too many attempts", 401> | import("elysia").ElysiaStatus<"Unauthorized" | "Too Many Requests", "SMS code expired" | "Invalid MFA code", 401 | 429> | import("elysia").ElysiaStatus<"Unauthorized", "SMS challenge is no longer active", 401> | import("elysia").ElysiaStatus<"OK", {
+}, 200> | import("elysia").ElysiaStatus<"Bad Request", "SMS code required", 400> | import("elysia").ElysiaStatus<"Unauthorized", "SMS code expired", 401> | import("elysia").ElysiaStatus<"Unauthorized", "Too many attempts", 401> | import("elysia").ElysiaStatus<"Unauthorized" | "Too Many Requests", "SMS code expired" | "Invalid MFA code", 401 | 429> | import("elysia").ElysiaStatus<"Unauthorized", "SMS challenge is no longer active", 401> | import("elysia").ElysiaStatus<"OK", {
     readonly status: "authenticated";
 }, 200> | import("elysia").ElysiaStatus<"Unauthorized", "Invalid MFA code", 401>>>;

package/dist/mfa/management.d.ts

@@ -1,7 +1,15 @@
 import { type MfaRouteProps } from './config';
+import { type MfaFactorType } from './types';
+export type MfaPublicFactor = {
+    id: string;
+    label: string;
+    phone: string | null;
+    type: Exclude<MfaFactorType, 'backup_codes'>;
+};
 export type MfaStatus = {
     backupCodesRemaining: number;
     enabled: boolean;
+    factors: MfaPublicFactor[];
     smsBackup: {
         enabled: boolean;
         phone: string | null;
@@ -32,6 +40,7 @@ export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUser
                 200: {
                     backupCodesRemaining: number;
                     enabled: boolean;
+                    factors: MfaPublicFactor[];
                     smsBackup: {
                         enabled: boolean;
                         phone: string | null;
@@ -54,20 +63,51 @@ export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUser
             error: never;
         };
     };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly status: "disabled";
+                };
+                422: {
+                    type: "validation";
+                    title: "Validation Error";
+                    status: 422;
+                    detail?: string;
+                    on: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+            error: never;
+        };
+    };
 }, import("elysia/types").DefaultEphemeral, {
     derive: {};
     schema: {};
     schemas: {};
     response: {};
     error: [];
-}, "delete", `/${string}`, import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
+}, "delete", `/${string}/factors/:factorId`, import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
     cookie: import("elysia").TCookieObject<{
         user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
     }>;
-}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ cookie: { user_session_id }, status, store: { session } }: {
+    params: import("typebox").TObject<{
+        factorId: import("typebox").TString;
+    }>;
+}, {}, `/${string}/factors/:factorId`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ cookie: { user_session_id }, params: { factorId }, status, store: { session } }: {
     body: unknown;
     query: Record<string, string | undefined>;
-    params: {};
+    params: {
+        factorId: string;
+    };
     headers: Record<string, string | undefined>;
     cookie: Record<string, import("elysia").Cookie<unknown>> & {
         user_session_id: import("elysia").Cookie<`${string}-${string}-${string}-${string}-${string}` | undefined>;
@@ -208,7 +248,10 @@ export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUser
         cookie: import("elysia").TCookieObject<{
             user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
         }>;
-    }, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>>, NoInfer<{
+        params: import("typebox").TObject<{
+            factorId: import("typebox").TString;
+        }>;
+    }, {}, `/${string}/factors/:factorId`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>>, NoInfer<{
         decorator: {};
         store: {
             session: import("..").SessionRecord<UserType>;
@@ -226,6 +269,6 @@ export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUser
         session: import("..").SessionRecord<UserType>;
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
-}) => Promise<import("elysia").ElysiaStatus<"Unauthorized", "Recent authentication required", 401> | import("elysia").ElysiaStatus<"Unauthorized", "Authentication required", 401> | import("elysia").ElysiaStatus<"OK", {
-    readonly status: "disabled";
+}) => Promise<import("elysia").ElysiaStatus<"Unauthorized", "Recent authentication required", 401> | import("elysia").ElysiaStatus<"Unauthorized", "Authentication required", 401> | import("elysia").ElysiaStatus<"Not Found", "MFA factor not found", 404> | import("elysia").ElysiaStatus<"OK", {
+    readonly status: "removed";
 }, 200>>>;

package/dist/mfa/postgresMfaStore.d.ts

@@ -1,5 +1,5 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { MFAStore } from './types';
+import type { MfaFactor, MFAStore } from './types';
 export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_mfa_enrollments";
     schema: undefined;
@@ -49,6 +49,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        mfa_factors: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, MfaFactor[]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "object json";
+            data: MfaFactor[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_challenge_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
             name: string;
             tableName: "auth_mfa_enrollments";
@@ -124,6 +139,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_pending_factor_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_pending_purpose: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, import("..").VerificationPurpose | undefined>, {
             name: string;
             tableName: "auth_mfa_enrollments";

package/dist/mfa/rotation.d.ts

@@ -1,4 +1,4 @@
-import type { MFAStore } from './types';
+import { type MFAStore } from './types';
 export type MfaKeyRotationResult = {
     alreadyRotated: number;
     rotated: number;

package/dist/mfa/routes.d.ts

@@ -22,6 +22,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                 200: {
                     backupCodesRemaining: number;
                     enabled: boolean;
+                    factors: import("./management").MfaPublicFactor[];
                     smsBackup: {
                         enabled: boolean;
                         phone: string | null;
@@ -70,16 +71,52 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             error: never;
         };
     };
+} & {
+    [x: string]: {
+        factors: {
+            ":factorId": {
+                delete: {
+                    body: unknown;
+                    params: {
+                        factorId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Recent authentication required" | "Authentication required";
+                        404: "MFA factor not found";
+                        200: {
+                            readonly status: "removed";
+                        };
+                        422: {
+                            type: "validation";
+                            title: "Validation Error";
+                            status: 422;
+                            detail?: string;
+                            on: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                    error: never;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         post: {
-            body: unknown;
+            body: {
+                label?: string | undefined;
+            };
             params: {};
             query: unknown;
             headers: unknown;
             response: {
                 401: "Recent authentication required" | "Authentication required";
                 200: {
+                    readonly factorId: string;
                     readonly secret: string;
                     readonly uri: string;
                 };
@@ -101,6 +138,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
     [x: string]: {
         post: {
             body: {
+                factorId?: string | undefined;
                 code: string;
             };
             params: {};
@@ -130,6 +168,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
     [x: string]: {
         post: {
             body: {
+                label?: string | undefined;
                 phone: string;
             };
             params: {};
@@ -140,6 +179,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                 401: "Recent authentication required" | "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
+                    readonly factorId: string;
                     readonly phone: string;
                 };
                 422: {
@@ -162,6 +202,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
     [x: string]: {
         post: {
             body: {
+                factorId?: string | undefined;
                 code: string;
             };
             params: {};
@@ -189,13 +230,46 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             error: never;
         };
     };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "No MFA challenge in progress";
+                200: {
+                    backupCodesAvailable: boolean;
+                    factors: Array<{
+                        id: string;
+                        label: string;
+                        phone: string | null;
+                        type: "sms" | "totp";
+                    }>;
+                };
+                422: {
+                    type: "validation";
+                    title: "Validation Error";
+                    status: 422;
+                    detail?: string;
+                    on: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+            error: never;
+        };
+    };
 } & {
     [x: string]: {
         post: {
             body: {
                 code?: string | undefined;
                 action?: "verify" | "send" | undefined;
-                factor?: "sms" | undefined;
+                factorId?: string | undefined;
+                factor?: "sms" | "backup_codes" | "totp" | undefined;
             };
             params: {};
             query: unknown;
@@ -204,6 +278,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                 400: string;
                 401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
+                    readonly factorId: string;
+                    readonly phone: string;
                     readonly status: "sent";
                 } | {
                     readonly status: "authenticated";

package/dist/mfa/sms.d.ts

@@ -1,6 +1,6 @@
 import { type VerificationCheckInput, type VerificationProvider } from '../verification/types';
 import { type MfaRouteProps, type SmsCodeMessage } from './config';
-import type { MfaEnrollment, MFAStore } from './types';
+import { type MfaEnrollment, type MFAStore } from './types';
 export declare class SmsChallengeConflictError extends Error {
     name: string;
 }
@@ -58,6 +58,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
     [x: string]: {
         post: {
             body: {
+                label?: string | undefined;
                 phone: string;
             };
             params: {};
@@ -68,6 +69,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                 401: "Recent authentication required" | "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
+                    readonly factorId: string;
                     readonly phone: string;
                 };
                 422: {
@@ -95,12 +97,14 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
 }, "post", `/${string}`, import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
     body: import("typebox").TObject<{
         code: import("typebox").TString;
+        factorId: import("typebox").TOptional<import("typebox").TString>;
     }>;
     cookie: import("elysia").TCookieObject<{
         user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
     }>;
-}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { code }, cookie: { user_session_id }, status, store: { session } }: {
+}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { code, factorId }, cookie: { user_session_id }, status, store: { session } }: {
     body: {
+        factorId?: string | undefined;
         code: string;
     };
     query: Record<string, string | undefined>;
@@ -244,6 +248,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
     defer: (fn: import("elysia/types").AfterResponseHandler<NoInfer<import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
         body: import("typebox").TObject<{
             code: import("typebox").TString;
+            factorId: import("typebox").TOptional<import("typebox").TString>;
         }>;
         cookie: import("elysia").TCookieObject<{
             user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;

package/dist/mfa/totp.d.ts

@@ -12,13 +12,16 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
 }, import("elysia/types").DefaultMetadata, {
     [x: string]: {
         post: {
-            body: unknown;
+            body: {
+                label?: string | undefined;
+            };
             params: {};
             query: unknown;
             headers: unknown;
             response: {
                 401: "Recent authentication required" | "Authentication required";
                 200: {
+                    readonly factorId: string;
                     readonly secret: string;
                     readonly uri: string;
                 };
@@ -45,12 +48,14 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
 }, "post", `/${string}`, import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
     body: import("typebox").TObject<{
         code: import("typebox").TString;
+        factorId: import("typebox").TOptional<import("typebox").TString>;
     }>;
     cookie: import("elysia").TCookieObject<{
         user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
     }>;
-}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { code }, cookie: { user_session_id }, status, store: { session } }: {
+}, {}, `/${string}`>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { code, factorId }, cookie: { user_session_id }, status, store: { session } }: {
     body: {
+        factorId?: string | undefined;
         code: string;
     };
     query: Record<string, string | undefined>;
@@ -194,6 +199,7 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
     defer: (fn: import("elysia/types").AfterResponseHandler<NoInfer<import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
         body: import("typebox").TObject<{
             code: import("typebox").TString;
+            factorId: import("typebox").TOptional<import("typebox").TString>;
         }>;
         cookie: import("elysia").TCookieObject<{
             user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;

package/dist/mfa/types.d.ts

@@ -1,13 +1,33 @@
 import type { VerificationPurpose } from '../verification/types';
 export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
+export type SmsMfaFactor = {
+    id: string;
+    label: string;
+    phone: string;
+    type: 'sms';
+    verified: boolean;
+};
+export type TotpMfaFactor = {
+    id: string;
+    label: string;
+    secretCiphertext: string;
+    type: 'totp';
+    verified: boolean;
+};
+export type MfaFactor = SmsMfaFactor | TotpMfaFactor;
 export type MfaEnrollment = {
     backupCodeHashes: string[];
     createdAt: number;
+    /** Labeled factor collection. Undefined means a legacy single-factor row that
+     * has not yet been rewritten by a management operation. */
+    factors?: MfaFactor[];
     lastUsedAt?: number;
     smsFailedAttempts?: number;
     smsPendingCodeHash?: string;
     smsPendingCodeExpiresAt?: number;
     smsPendingPurpose?: VerificationPurpose;
+    /** Factor selected for the currently active SMS enrollment/challenge. */
+    smsPendingFactorId?: string;
     smsProviderReference?: string;
     smsCodeSentAt?: number;
     /** Opaque generation binding every update to the currently active challenge. */
@@ -29,6 +49,7 @@ export type MFAStore = {
     }) => Promise<boolean>;
     completeSmsChallenge: (input: {
         challengeId: string;
+        factors?: MfaFactor[];
         lastUsedAt?: number;
         smsVerified: boolean;
         userId: string;
@@ -55,4 +76,30 @@ export type MFAStore = {
     }) => Promise<void>;
     saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
 };
+export declare const getMfaFactors: (enrollment: MfaEnrollment) => MfaFactor[];
 export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;
+/** Keep the historical single-factor columns synchronized for consumers that
+ * have not moved to the factor collection yet. */
+export declare const withMfaFactors: (enrollment: MfaEnrollment, factors: MfaFactor[]) => {
+    factors: MfaFactor[];
+    smsPhone: string | undefined;
+    smsVerified: boolean;
+    totpSecretCiphertext: string | undefined;
+    totpVerified: boolean;
+    backupCodeHashes: string[];
+    createdAt: number;
+    lastUsedAt?: number;
+    smsFailedAttempts?: number;
+    smsPendingCodeHash?: string;
+    smsPendingCodeExpiresAt?: number;
+    smsPendingPurpose?: VerificationPurpose;
+    /** Factor selected for the currently active SMS enrollment/challenge. */
+    smsPendingFactorId?: string;
+    smsProviderReference?: string;
+    smsCodeSentAt?: number;
+    /** Opaque generation binding every update to the currently active challenge. */
+    smsChallengeId?: string;
+    totpFailedAttempts?: number;
+    updatedAt: number;
+    userId: string;
+};