@absolutejs/auth 0.75.7 → 0.76.1

package/dist/server.js

@@ -4368,8 +4368,8 @@ var failureResponse = (config, failure, requiredScopes) => new Response(JSON.str
 var agentAuthContextPlugin = (config) => new Elysia2({
   name: "@absolutejs/auth/agent-context",
   seed: pluginDependencySeed(config)
-}).derive(({ request }) => {
-  const protectAgent = async (requiredScopes, handleAuth, handleAuthFail) => {
+}).derive(({ request }) => ({
+  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
     if (config === undefined) {
       const failure = {
         code: "Unauthorized",
@@ -4395,9 +4395,8 @@ var agentAuthContextPlugin = (config) => new Elysia2({
       return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
     }
     return handleAuth(principal);
-  };
-  return { protectAgent };
-}).as("global");
+  }
+})).as("global");
 
 // src/agents/oauthGuide.ts
 var DEFAULT_GUIDE_ROUTE = "/auth.md";
@@ -5608,17 +5607,17 @@ var protectPermissionPlugin = ({
 }).use(sessionStore()).guard({
   cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }),
   schema: "merge"
-}).derive(({ store: { session }, cookie: { user_session_id }, status }) => {
-  const protectPermission = (check, handleAuth, handleAuthFail) => getStatusFromSource({
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+  protectPermission: (check, handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
     user_session_id
   }).then(async ({ user, error }) => {
     if (error) {
-      return await handleAuthFail?.(error) ?? status(error.code, error.message);
+      return handleAuthFail?.(error) ?? status(error.code, error.message);
     }
     if (!user) {
-      return await handleAuthFail?.({
+      return handleAuthFail?.({
         code: "Unauthorized",
         message: "User is not authenticated"
       }) ?? status("Unauthorized", "User is not authenticated");
@@ -5635,15 +5634,14 @@ var protectPermissionPlugin = ({
         organizationId: check.organizationId,
         type: "authorization_denied"
       });
-      return await handleAuthFail?.({
+      return handleAuthFail?.({
         code: "Forbidden",
         message: "Insufficient permissions"
       }) ?? status("Forbidden", "Insufficient permissions");
     }
     return handleAuth(user);
-  });
-  return { protectPermission };
-}).as("global");
+  })
+})).as("global");
 
 // src/routes/protectRoute.ts
 import { Elysia as Elysia6, t as t4 } from "elysia";
@@ -5707,7 +5705,8 @@ var protectRoutePlugin = ({
 }).derive(async ({
   store: { session },
   cookie: { user_session_id },
-  headers
+  headers,
+  status
 }) => {
   const sessionStatus = await getStatusFromSource({
     authSessionStore,
@@ -5726,30 +5725,25 @@ var protectRoutePlugin = ({
       authorization: headers.authorization,
       config: accessTokens
     });
-  return { absoluteAuthStatus: sessionStatus, authPrincipal };
-}).derive(({ absoluteAuthStatus, authPrincipal, status }) => {
-  const protectRoute = async (handleAuth, handleAuthFail) => {
-    if (!absoluteAuthStatus)
-      return await handleAuthFail?.({
-        code: "Unauthorized",
-        message: "User is not authenticated"
-      }) ?? status("Unauthorized", "User is not authenticated");
-    const user = authPrincipal?.user;
-    const { error } = absoluteAuthStatus;
-    if (error) {
-      if (user)
-        return handleAuth(user);
-      return await handleAuthFail?.(error) ?? status(error.code, error.message);
-    }
-    if (!user) {
-      return await handleAuthFail?.({
-        code: "Unauthorized",
-        message: "User is not authenticated"
-      }) ?? status("Unauthorized", "User is not authenticated");
+  return {
+    authPrincipal,
+    protectRoute: (handleAuth, handleAuthFail) => {
+      const user = authPrincipal?.user;
+      const { error } = sessionStatus;
+      if (error) {
+        if (user)
+          return handleAuth(user);
+        return handleAuthFail?.(error) ?? status(error.code, error.message);
+      }
+      if (!user) {
+        return handleAuthFail?.({
+          code: "Unauthorized",
+          message: "User is not authenticated"
+        }) ?? status("Unauthorized", "User is not authenticated");
+      }
+      return handleAuth(user);
     }
-    return handleAuth(user);
   };
-  return { protectRoute };
 }).as("global");
 
 // src/routes/stepUp.ts
@@ -5762,24 +5756,23 @@ var stepUpPlugin = ({
 }).use(sessionStore()).guard({
   cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }),
   schema: "merge"
-}).derive(({ store: { session }, cookie: { user_session_id }, status }) => {
-  const requireRecentAuth = (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+  requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
     authSessionStore,
     session,
     userSessionId: user_session_id.value
-  }).then(async (userSession) => {
+  }).then((userSession) => {
     const authenticatedAt = userSession?.authenticatedAt;
     const isRecent = authenticatedAt !== undefined && Date.now() - authenticatedAt <= maxAgeMs;
     if (!userSession || !isRecent) {
-      return await handleAuthFail?.({
+      return handleAuthFail?.({
         code: "Unauthorized",
         message: "Recent authentication required"
       }) ?? status("Unauthorized", "Recent authentication required");
     }
     return handleAuth(userSession.user);
-  });
-  return { requireRecentAuth };
-}).as("global");
+  })
+})).as("global");
 
 // src/oidc/socketTickets.ts
 init_crypto();
@@ -7190,7 +7183,45 @@ var createLockoutGuard = ({
 });
 
 // src/mfa/types.ts
-var isMfaEnrolled = (enrollment) => enrollment !== undefined && (enrollment.totpVerified || enrollment.smsVerified || enrollment.backupCodeHashes.length > 0);
+var LEGACY_SMS_FACTOR_ID = "legacy-sms";
+var LEGACY_TOTP_FACTOR_ID = "legacy-totp";
+var getMfaFactors = (enrollment) => {
+  if (enrollment.factors !== undefined)
+    return enrollment.factors;
+  const factors = [];
+  if (enrollment.totpSecretCiphertext) {
+    factors.push({
+      id: LEGACY_TOTP_FACTOR_ID,
+      label: "Authenticator app",
+      secretCiphertext: enrollment.totpSecretCiphertext,
+      type: "totp",
+      verified: enrollment.totpVerified
+    });
+  }
+  if (enrollment.smsPhone) {
+    factors.push({
+      id: LEGACY_SMS_FACTOR_ID,
+      label: "Text message",
+      phone: enrollment.smsPhone,
+      type: "sms",
+      verified: enrollment.smsVerified
+    });
+  }
+  return factors;
+};
+var isMfaEnrolled = (enrollment) => enrollment !== undefined && (getMfaFactors(enrollment).some((factor) => factor.verified) || enrollment.backupCodeHashes.length > 0);
+var withMfaFactors = (enrollment, factors) => {
+  const firstSms = factors.find((factor) => factor.type === "sms");
+  const firstTotp = factors.find((factor) => factor.type === "totp");
+  return {
+    ...enrollment,
+    factors,
+    smsPhone: firstSms?.phone,
+    smsVerified: firstSms?.verified ?? false,
+    totpSecretCiphertext: firstTotp?.secretCiphertext,
+    totpVerified: firstTotp?.verified ?? false
+  };
+};
 
 // src/mfa/gate.ts
 var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(await mfaStore.getEnrollment(getUserId(user)));
@@ -7406,6 +7437,8 @@ var hasRecentAuthentication = (session, maxAgeMs, now = Date.now()) => session.a
 // src/mfa/sms.ts
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
+var FACTOR_LABEL_MAX_LENGTH = 80;
+var DEFAULT_SMS_LABEL = "Text message";
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
 var generateNumericCode = (length) => {
   const bytes = new Uint8Array(length);
@@ -7579,10 +7612,13 @@ var mfaSmsRoutes = ({
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
 }) => new Elysia18().use(sessionStore()).post(smsSetupRoute, {
-  body: t12.Object({ phone: t12.String() }),
+  body: t12.Object({
+    label: t12.Optional(t12.String({ maxLength: FACTOR_LABEL_MAX_LENGTH })),
+    phone: t12.String()
+  }),
   cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { phone },
+  body: { label, phone },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7610,21 +7646,35 @@ var mfaSmsRoutes = ({
   if (existing?.smsCodeSentAt !== undefined && now - existing.smsCodeSentAt < smsResendCooldownMs) {
     return status("Too Many Requests", "SMS resend cooldown active");
   }
+  const base = existing ?? {
+    backupCodeHashes: [],
+    createdAt: now,
+    smsVerified: false,
+    totpVerified: false,
+    updatedAt: now,
+    userId
+  };
+  const factor = {
+    id: crypto.randomUUID(),
+    label: label?.trim() || DEFAULT_SMS_LABEL,
+    phone,
+    type: "sms",
+    verified: false
+  };
+  const factors = [
+    ...getMfaFactors(base).filter((existingFactor) => existingFactor.type !== "sms" || existingFactor.verified),
+    factor
+  ];
   try {
     await issueAndStoreSmsCode({
       codeLength: smsCodeLength,
       enrollment: {
-        backupCodeHashes: existing?.backupCodeHashes ?? [],
-        createdAt: existing?.createdAt ?? now,
-        lastUsedAt: existing?.lastUsedAt,
+        ...withMfaFactors(base, factors),
         smsFailedAttempts: 0,
+        smsPendingFactorId: factor.id,
         smsPhone: phone,
-        smsVerified: false,
-        totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
-        totpSecretCiphertext: existing?.totpSecretCiphertext,
-        totpVerified: existing?.totpVerified ?? false,
         updatedAt: now,
-        userId
+        userId: base.userId
       },
       mfaStore,
       onSendSmsCode,
@@ -7641,12 +7691,18 @@ var mfaSmsRoutes = ({
       throw error;
     return status(mapped.status, mapped.message);
   }
-  return status("OK", { phone: maskPhone(phone) });
+  return status("OK", {
+    factorId: factor.id,
+    phone: maskPhone(phone)
+  });
 }).post(smsVerifyRoute, {
-  body: t12.Object({ code: t12.String() }),
+  body: t12.Object({
+    code: t12.String(),
+    factorId: t12.Optional(t12.String())
+  }),
   cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { code },
+  body: { code, factorId },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7667,6 +7723,12 @@ var mfaSmsRoutes = ({
   if (!enrollment?.smsPhone) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
+  const factors = getMfaFactors(enrollment);
+  const pendingFactorId = factorId ?? enrollment.smsPendingFactorId;
+  const pendingFactor = factors.find((candidate) => candidate.type === "sms" && (candidate.id === pendingFactorId || pendingFactorId === undefined && candidate.phone === enrollment.smsPhone));
+  if (!pendingFactor || pendingFactor.type !== "sms") {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
   const localCodeHash = enrollment.smsPendingCodeHash;
   const challengeId = enrollment.smsChallengeId;
   const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
@@ -7694,7 +7756,7 @@ var mfaSmsRoutes = ({
       purpose: "mfa_enrollment",
       reference: providerReference,
       subject: userId,
-      to: enrollment.smsPhone
+      to: pendingFactor.phone
     });
     if (checked.error !== undefined) {
       return status(checked.error.status, checked.error.message);
@@ -7710,8 +7772,10 @@ var mfaSmsRoutes = ({
     });
     return status(providerResult?.status === "max_attempts_reached" || attempts === undefined ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
   }
+  const verifiedFactors = factors.map((candidate) => candidate.id === pendingFactor.id ? { ...candidate, verified: true } : candidate);
   const completed = await mfaStore.completeSmsChallenge({
     challengeId,
+    factors: verifiedFactors,
     smsVerified: true,
     userId
   });
@@ -7741,15 +7805,50 @@ var mfaChallenge = ({
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
-}) => new Elysia19().use(sessionStore()).post(challengeRoute, {
+}) => new Elysia19().use(sessionStore()).get(challengeRoute, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
+  cookie: { user_session_id },
+  status,
+  store: { unregisteredSession }
+}) => {
+  const compatibilityLayer = await createSessionCompatibilityLayer({
+    authSessionStore,
+    userSessionId: user_session_id.value
+  });
+  const challengeUnregistered = authSessionStore ? compatibilityLayer.unregisteredSession : unregisteredSession;
+  const pendingId = user_session_id.value;
+  const pending = pendingId ? challengeUnregistered[pendingId] : undefined;
+  if (!pending) {
+    return status("Unauthorized", "No MFA challenge in progress");
+  }
+  const user = await getChallengeUser(pending.userIdentity ?? {});
+  const enrollment = user ? await mfaStore.getEnrollment(getUserId(user)) : undefined;
+  if (!enrollment) {
+    return status("Unauthorized", "No MFA challenge in progress");
+  }
+  const response = {
+    backupCodesAvailable: enrollment.backupCodeHashes.length > 0,
+    factors: getMfaFactors(enrollment).filter((factor) => factor.verified).map((factor) => ({
+      id: factor.id,
+      label: factor.label,
+      phone: factor.type === "sms" ? maskPhone(factor.phone) : null,
+      type: factor.type
+    }))
+  };
+  return status("OK", response);
+}).post(challengeRoute, {
   body: t13.Object({
     action: t13.Optional(t13.Union([t13.Literal("send"), t13.Literal("verify")])),
     code: t13.Optional(t13.String()),
-    factor: t13.Optional(t13.Literal("sms"))
+    factor: t13.Optional(t13.Union([
+      t13.Literal("backup_codes"),
+      t13.Literal("sms"),
+      t13.Literal("totp")
+    ])),
+    factorId: t13.Optional(t13.String())
   }),
   cookie: t13.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { action, code, factor },
+  body: { action, code, factor, factorId },
   cookie: { user_session_id },
   status,
   store: { session, unregisteredSession }
@@ -7770,6 +7869,7 @@ var mfaChallenge = ({
   if (!user || !enrollment) {
     return status("Unauthorized", "No MFA challenge in progress");
   }
+  const factors = getMfaFactors(enrollment);
   const promote = async () => {
     delete challengeUnregistered[pendingId];
     const userSessionId = crypto.randomUUID();
@@ -7792,10 +7892,18 @@ var mfaChallenge = ({
     if (enrollment.smsCodeSentAt !== undefined && Date.now() - enrollment.smsCodeSentAt < smsResendCooldownMs) {
       return status("Too Many Requests", "SMS resend cooldown active");
     }
+    const smsFactor = factors.find((candidate) => candidate.type === "sms" && candidate.verified && (candidate.id === factorId || factorId === undefined));
+    if (!smsFactor || smsFactor.type !== "sms") {
+      return status("Bad Request", "SMS factor not found");
+    }
     try {
       await issueAndStoreSmsCode({
         codeLength: smsCodeLength,
-        enrollment,
+        enrollment: {
+          ...withMfaFactors(enrollment, factors),
+          smsPendingFactorId: smsFactor.id,
+          smsPhone: smsFactor.phone
+        },
         mfaStore,
         onSendSmsCode,
         previousEnrollment: enrollment,
@@ -7811,10 +7919,19 @@ var mfaChallenge = ({
         throw error;
       return status(mapped.status, mapped.message);
     }
-    return status("OK", { status: "sent" });
+    return status("OK", {
+      factorId: smsFactor.id,
+      phone: maskPhone(smsFactor.phone),
+      status: "sent"
+    });
   };
   const runSmsChallenge = async () => {
-    if (!enrollment.smsVerified || !enrollment.smsPhone) {
+    if (action !== "send" && factorId !== undefined && enrollment.smsPendingFactorId !== undefined && factorId !== enrollment.smsPendingFactorId) {
+      return status("Bad Request", "No SMS code in progress");
+    }
+    const selectedFactorId = enrollment.smsPendingFactorId ?? factorId;
+    const smsFactor = factors.find((candidate) => candidate.type === "sms" && candidate.verified && (candidate.id === selectedFactorId || selectedFactorId === undefined));
+    if (!smsFactor || smsFactor.type !== "sms") {
       return status("Unauthorized", "No MFA challenge in progress");
     }
     if (action === "send")
@@ -7853,7 +7970,7 @@ var mfaChallenge = ({
         purpose: "mfa_challenge",
         reference: providerReference,
         subject: getUserId(user),
-        to: enrollment.smsPhone
+        to: smsFactor.phone
       });
       if (checked.error !== undefined) {
         return status(checked.error.status, checked.error.message);
@@ -7875,6 +7992,7 @@ var mfaChallenge = ({
     }
     const completed = await mfaStore.completeSmsChallenge({
       challengeId,
+      factors,
       lastUsedAt: Date.now(),
       smsVerified: true,
       userId: getUserId(user)
@@ -7896,11 +8014,14 @@ var mfaChallenge = ({
     });
     return status("Unauthorized", "Too many attempts");
   }
-  const totpValid = enrollment.totpVerified && enrollment.totpSecretCiphertext ? await verifyTotp({
-    secret: await decryptTotpSecret(enrollment.totpSecretCiphertext, encryptionKey),
+  const totpFactors = factors.filter((candidate) => candidate.type === "totp" && candidate.verified && (candidate.id === factorId || factorId === undefined));
+  const totpChecks = factor === "backup_codes" ? [] : await Promise.all(totpFactors.map(async (candidate) => verifyTotp({
+    secret: await decryptTotpSecret(candidate.secretCiphertext, encryptionKey),
     token: code
-  }) : false;
-  const remainingBackupHashes = totpValid ? undefined : await consumeBackupCode(code, enrollment.backupCodeHashes);
+  })));
+  const totpValid = totpChecks.some(Boolean);
+  const mayUseBackupCode = factor === "backup_codes" || factor === undefined && factorId === undefined;
+  const remainingBackupHashes = totpValid || !mayUseBackupCode ? undefined : await consumeBackupCode(code, enrollment.backupCodeHashes);
   if (!totpValid && remainingBackupHashes === undefined) {
     await mfaStore.saveEnrollment({
       ...enrollment,
@@ -7932,6 +8053,12 @@ var maskPhone2 = (phone) => {
   const suffix = phone.slice(-visibleDigits);
   return `${"*".repeat(Math.max(0, phone.length - visibleDigits))}${suffix}`;
 };
+var publicFactors = (enrollment) => enrollment ? getMfaFactors(enrollment).filter((factor) => factor.verified).map((factor) => ({
+  id: factor.id,
+  label: factor.label,
+  phone: factor.type === "sms" ? maskPhone2(factor.phone) : null,
+  type: factor.type
+})) : [];
 var mfaManagementRoutes = ({
   authSessionStore,
   getUserId,
@@ -7955,6 +8082,7 @@ var mfaManagementRoutes = ({
   const response = {
     backupCodesRemaining: enrollment?.backupCodeHashes.length ?? 0,
     enabled: isMfaEnrolled(enrollment),
+    factors: publicFactors(enrollment),
     smsBackup: {
       enabled: enrollment?.smsVerified ?? false,
       phone: maskPhone2(enrollment?.smsPhone)
@@ -7980,11 +8108,54 @@ var mfaManagementRoutes = ({
   }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
+}).delete(`${managementRoute}/factors/:factorId`, {
+  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }),
+  params: t14.Object({ factorId: t14.String() })
+}, async ({
+  cookie: { user_session_id },
+  params: { factorId },
+  status,
+  store: { session }
+}) => {
+  const userSession = await loadSessionFromSource({
+    authSessionStore,
+    session,
+    userSessionId: user_session_id.value
+  });
+  if (!userSession) {
+    return status("Unauthorized", "Authentication required");
+  }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
+  const userId = getUserId(userSession.user);
+  const enrollment = await mfaStore.getEnrollment(userId);
+  if (!enrollment) {
+    return status("Not Found", "MFA factor not found");
+  }
+  const factors = getMfaFactors(enrollment);
+  if (!factors.some((factor) => factor.id === factorId)) {
+    return status("Not Found", "MFA factor not found");
+  }
+  const remaining = factors.filter((factor) => factor.id !== factorId);
+  if (remaining.length === 0) {
+    await mfaStore.removeEnrollment(userId);
+  } else {
+    const hasVerifiedFactor = remaining.some((factor) => factor.verified);
+    await mfaStore.saveEnrollment(withMfaFactors({
+      ...enrollment,
+      backupCodeHashes: hasVerifiedFactor ? enrollment.backupCodeHashes : [],
+      updatedAt: Date.now()
+    }, remaining));
+  }
+  return status("OK", { status: "removed" });
 });
 
 // src/mfa/totp.ts
 init_crypto();
 import { Elysia as Elysia21, t as t15 } from "elysia";
+var FACTOR_LABEL_MAX_LENGTH2 = 80;
+var DEFAULT_TOTP_LABEL = "Authenticator app";
 var mfaTotpRoutes = ({
   authSessionStore,
   backupCodeCount = DEFAULT_BACKUP_CODE_COUNT,
@@ -7996,7 +8167,13 @@ var mfaTotpRoutes = ({
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
   totpVerifyRoute = "/auth/mfa/totp/verify"
-}) => new Elysia21().use(sessionStore()).post(totpSetupRoute, { cookie: t15.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
+}) => new Elysia21().use(sessionStore()).post(totpSetupRoute, {
+  body: t15.Object({
+    label: t15.Optional(t15.String({ maxLength: FACTOR_LABEL_MAX_LENGTH2 }))
+  }),
+  cookie: t15.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
+  body: { label },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -8016,20 +8193,25 @@ var mfaTotpRoutes = ({
   const secret = generateTotpSecret();
   const existing = await mfaStore.getEnrollment(userId);
   const now = Date.now();
-  await mfaStore.saveEnrollment({
-    backupCodeHashes: existing?.backupCodeHashes ?? [],
-    createdAt: existing?.createdAt ?? now,
-    smsFailedAttempts: existing?.smsFailedAttempts,
-    smsPendingCodeExpiresAt: existing?.smsPendingCodeExpiresAt,
-    smsPendingCodeHash: existing?.smsPendingCodeHash,
-    smsPhone: existing?.smsPhone,
-    smsVerified: existing?.smsVerified ?? false,
-    totpSecretCiphertext: await encryptTotpSecret(secret, encryptionKey),
+  const base = existing ?? {
+    backupCodeHashes: [],
+    createdAt: now,
+    smsVerified: false,
     totpVerified: false,
     updatedAt: now,
     userId
-  });
+  };
+  const factor = {
+    id: crypto.randomUUID(),
+    label: label?.trim() || DEFAULT_TOTP_LABEL,
+    secretCiphertext: await encryptTotpSecret(secret, encryptionKey),
+    type: "totp",
+    verified: false
+  };
+  const factors = getMfaFactors(base).filter((existingFactor) => existingFactor.type !== "totp" || existingFactor.verified);
+  await mfaStore.saveEnrollment(withMfaFactors({ ...base, updatedAt: now }, [...factors, factor]));
   return status("OK", {
+    factorId: factor.id,
     secret,
     uri: createTotpKeyUri({
       accountName: userId,
@@ -8038,10 +8220,13 @@ var mfaTotpRoutes = ({
     })
   });
 }).post(totpVerifyRoute, {
-  body: t15.Object({ code: t15.String() }),
+  body: t15.Object({
+    code: t15.String(),
+    factorId: t15.Optional(t15.String())
+  }),
   cookie: t15.Cookie({ user_session_id: userSessionIdTypebox })
 }, async ({
-  body: { code },
+  body: { code, factorId },
   cookie: { user_session_id },
   status,
   store: { session }
@@ -8059,21 +8244,26 @@ var mfaTotpRoutes = ({
   }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
-  if (!enrollment?.totpSecretCiphertext) {
+  if (!enrollment) {
+    return status("Bad Request", "No TOTP enrollment in progress");
+  }
+  const factors = getMfaFactors(enrollment);
+  const factor = factors.find((candidate) => candidate.type === "totp" && (candidate.id === factorId || factorId === undefined && !candidate.verified));
+  if (!factor || factor.type !== "totp") {
     return status("Bad Request", "No TOTP enrollment in progress");
   }
-  const secret = await decryptTotpSecret(enrollment.totpSecretCiphertext, encryptionKey);
+  const secret = await decryptTotpSecret(factor.secretCiphertext, encryptionKey);
   const valid = await verifyTotp({ secret, token: code });
   if (!valid) {
     return status("Bad Request", "Invalid TOTP code");
   }
   const { codes, hashes } = await generateBackupCodes(backupCodeCount);
-  await mfaStore.saveEnrollment({
+  const verifiedFactors = factors.map((candidate) => candidate.id === factor.id ? { ...candidate, verified: true } : candidate);
+  await mfaStore.saveEnrollment(withMfaFactors({
     ...enrollment,
     backupCodeHashes: hashes,
-    totpVerified: true,
     updatedAt: Date.now()
-  });
+  }, verifiedFactors));
   await onMfaEnrolled?.({ userId });
   return status("OK", { backupCodes: codes });
 });
@@ -35948,23 +36138,33 @@ var ensureReadable = async (ciphertext, key, userId) => {
   }
 };
 var planEnrollment = async (enrollment, oldKey, newKey) => {
-  const ciphertext = enrollment.totpSecretCiphertext;
-  if (ciphertext === undefined || ciphertext.length === 0) {
+  const factors = getMfaFactors(enrollment);
+  const totpFactors = factors.filter((factor) => factor.type === "totp");
+  if (totpFactors.length === 0) {
     const plan2 = { kind: "skip" };
     return plan2;
   }
-  const secret = await tryDecrypt(ciphertext, oldKey);
-  if (secret === undefined) {
-    await ensureReadable(ciphertext, newKey, enrollment.userId);
+  let rotated = false;
+  const nextFactors = await Promise.all(factors.map(async (factor) => {
+    if (factor.type !== "totp")
+      return factor;
+    const secret = await tryDecrypt(factor.secretCiphertext, oldKey);
+    if (secret === undefined) {
+      await ensureReadable(factor.secretCiphertext, newKey, enrollment.userId);
+      return factor;
+    }
+    rotated = true;
+    return {
+      ...factor,
+      secretCiphertext: await encryptTotpSecret(secret, newKey)
+    };
+  }));
+  if (!rotated) {
     const plan2 = { kind: "already" };
     return plan2;
   }
   const plan = {
-    enrollment: {
-      ...enrollment,
-      totpSecretCiphertext: await encryptTotpSecret(secret, newKey),
-      updatedAt: Date.now()
-    },
+    enrollment: withMfaFactors({ ...enrollment, updatedAt: Date.now() }, nextFactors),
     kind: "rotate"
   };
   return plan;
@@ -35987,7 +36187,8 @@ var rotateMfaEncryptionKey = async ({
 // src/mfa/inMemoryMfaStore.ts
 var cloneEnrollment = (value) => ({
   ...value,
-  backupCodeHashes: [...value.backupCodeHashes]
+  backupCodeHashes: [...value.backupCodeHashes],
+  factors: value.factors?.map((factor) => ({ ...factor }))
 });
 var createInMemoryMfaStore = () => {
   const enrollments = new Map;
@@ -36009,6 +36210,7 @@ var createInMemoryMfaStore = () => {
     },
     completeSmsChallenge: async ({
       challengeId,
+      factors,
       lastUsedAt,
       smsVerified,
       userId
@@ -36018,11 +36220,13 @@ var createInMemoryMfaStore = () => {
         return false;
       enrollments.set(userId, cloneEnrollment({
         ...current,
+        factors: factors ?? current.factors,
         lastUsedAt: lastUsedAt ?? current.lastUsedAt,
         smsChallengeId: undefined,
         smsFailedAttempts: 0,
         smsPendingCodeExpiresAt: undefined,
         smsPendingCodeHash: undefined,
+        smsPendingFactorId: undefined,
         smsPendingPurpose: undefined,
         smsProviderReference: undefined,
         smsVerified,
@@ -36083,6 +36287,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   backup_code_hashes: jsonb("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
+  mfa_factors: jsonb("mfa_factors").$type(),
   sms_challenge_id: text("sms_challenge_id"),
   sms_code_sent_at_ms: bigint("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
@@ -36090,6 +36295,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
     mode: "number"
   }),
   sms_pending_code_hash: text("sms_pending_code_hash"),
+  sms_pending_factor_id: text("sms_pending_factor_id"),
   sms_pending_purpose: text("sms_pending_purpose").$type(),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
   sms_provider_reference: text("sms_provider_reference"),
@@ -36103,12 +36309,14 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
 var toEnrollment = (row) => ({
   backupCodeHashes: row.backup_code_hashes,
   createdAt: row.created_at_ms,
+  factors: row.mfa_factors ?? undefined,
   lastUsedAt: row.last_used_at_ms ?? undefined,
   smsChallengeId: row.sms_challenge_id ?? undefined,
   smsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,
   smsFailedAttempts: row.sms_failed_attempts,
   smsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
+  smsPendingFactorId: row.sms_pending_factor_id ?? undefined,
   smsPendingPurpose: row.sms_pending_purpose ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
   smsProviderReference: row.sms_provider_reference ?? undefined,
@@ -36125,11 +36333,13 @@ var createPostgresMfaStore = (db) => {
     backup_code_hashes: enrollment.backupCodeHashes,
     created_at_ms: enrollment.createdAt,
     last_used_at_ms: enrollment.lastUsedAt ?? null,
+    mfa_factors: enrollment.factors ?? null,
     sms_challenge_id: enrollment.smsChallengeId ?? null,
     sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
     sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
     sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
     sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
+    sms_pending_factor_id: enrollment.smsPendingFactorId ?? null,
     sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
     sms_phone: enrollment.smsPhone ?? null,
     sms_provider_reference: enrollment.smsProviderReference ?? null,
@@ -36152,11 +36362,13 @@ var createPostgresMfaStore = (db) => {
       });
       const rows = await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
         set: {
+          mfa_factors: enrollment.factors ?? null,
           sms_challenge_id: challengeId,
           sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
           sms_failed_attempts: 0,
           sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
           sms_pending_code_hash: null,
+          sms_pending_factor_id: enrollment.smsPendingFactorId ?? null,
           sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
           sms_phone: enrollment.smsPhone ?? null,
           sms_provider_reference: null,
@@ -36170,16 +36382,19 @@ var createPostgresMfaStore = (db) => {
     },
     completeSmsChallenge: async ({
       challengeId,
+      factors,
       lastUsedAt,
       smsVerified,
       userId
     }) => {
       const rows = await db.update(mfaEnrollmentsTable).set({
         last_used_at_ms: lastUsedAt,
+        mfa_factors: factors,
         sms_challenge_id: null,
         sms_failed_attempts: 0,
         sms_pending_code_expires_at_ms: null,
         sms_pending_code_hash: null,
+        sms_pending_factor_id: null,
         sms_pending_purpose: null,
         sms_provider_reference: null,
         sms_verified: smsVerified,
@@ -40573,12 +40788,7 @@ var renderChunk = (chunk) => {
   return "";
 };
 var formatSqlTemplate = (value) => value.queryChunks.map(renderChunk).join("");
-var columnSqlType = (column) => {
-  const dimensions = Reflect.get(column, "dimensions");
-  const elementType = column.getSQLType();
-  return typeof dimensions === "number" && dimensions > 0 ? `${elementType}${"[]".repeat(dimensions)}` : elementType;
-};
-var formatScalarDefault = (value) => {
+var formatDefault = (value) => {
   if (value === null || value === undefined)
     return "NULL";
   if (is(value, SQL))
@@ -40589,17 +40799,15 @@ var formatScalarDefault = (value) => {
     return value ? "true" : "false";
   if (typeof value === "number")
     return String(value);
-  if (typeof value === "object") {
+  if (Array.isArray(value) || typeof value === "object") {
     return `'${JSON.stringify(value)}'::jsonb`;
   }
   return String(value);
 };
-var formatArrayDefault = (values) => `ARRAY[${values.map((value) => Array.isArray(value) ? formatArrayDefault(value) : formatScalarDefault(value)).join(", ")}]`;
-var formatDefault = (column, value) => {
+var columnSqlType = (column) => {
   const dimensions = Reflect.get(column, "dimensions");
-  if (Array.isArray(value) && typeof dimensions === "number" && dimensions > 0)
-    return `${formatArrayDefault(value)}::${columnSqlType(column)}`;
-  return formatScalarDefault(value);
+  const elementType = column.getSQLType();
+  return typeof dimensions === "number" && dimensions > 0 ? `${elementType}${"[]".repeat(dimensions)}` : elementType;
 };
 var columnSql = (column) => {
   const parts = [`"${column.name}"`, columnSqlType(column)];
@@ -40608,7 +40816,7 @@ var columnSql = (column) => {
   if (column.notNull && !column.primary)
     parts.push("NOT NULL");
   if (column.hasDefault && column.default !== undefined) {
-    parts.push(`DEFAULT ${formatDefault(column, column.default)}`);
+    parts.push(`DEFAULT ${formatDefault(column.default)}`);
   }
   if (column.isUnique)
     parts.push("UNIQUE");
@@ -40726,6 +40934,14 @@ var mfaSmsAtomicChallengeMigration = {
   id: "0005_sms_atomic_challenge",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_challenge_id" text;'
 };
+var mfaMultipleFactorsMigration = {
+  id: "0006_multiple_factors",
+  sql: [
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "mfa_factors" jsonb;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_pending_factor_id" text;'
+  ].join(`
+`)
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -40807,7 +41023,8 @@ var blockMigrations = {
       mfaSmsColumnsMigration,
       mfaTotpLockoutMigration,
       mfaSmsDeliveryPolicyMigration,
-      mfaSmsAtomicChallengeMigration
+      mfaSmsAtomicChallengeMigration,
+      mfaMultipleFactorsMigration
     ]
   },
   oidc: {
@@ -41849,5 +42066,5 @@ export {
   userSessionIdTypebox
 };
 
-//# debugId=AF5D9E4F453A58D064756E2164756E21
+//# debugId=EBB1CE453260D04564756E2164756E21
 //# sourceMappingURL=server.js.map