@djangocfg/api 2.1.457 → 2.1.460

package/dist/auth.d.cts

@@ -697,7 +697,7 @@ interface UseGithubAuthReturn {
  */
 declare const useGithubAuth: (options?: UseGithubAuthOptions) => UseGithubAuthReturn;
 
-interface UseTwoFactorOptions {
+interface UseTwoFactorVerifyOptions {
     /** Callback on successful 2FA verification */
     onSuccess?: (user: any) => void;
     /** Callback on error */
@@ -707,7 +707,7 @@ interface UseTwoFactorOptions {
     /** Skip automatic redirect after success (caller handles navigation) */
     skipRedirect?: boolean;
 }
-interface UseTwoFactorReturn {
+interface UseTwoFactorVerifyReturn {
     /** Loading state */
     isLoading: boolean;
     /** Error message */
@@ -726,31 +726,13 @@ interface UseTwoFactorReturn {
     clearError: () => void;
 }
 /**
- * Hook for 2FA verification during login.
- *
- * Usage:
- * 1. After OTP/OAuth verification returns requires_2fa=true and session_id
- * 2. Show 2FA form and collect TOTP code from user
- * 3. Call verifyTOTP(sessionId, code) to complete authentication
- *
- * @example
- * ```tsx
- * const { isLoading, error, verifyTOTP, verifyBackupCode } = useTwoFactor({
- *   onSuccess: (user) => console.log('Logged in:', user),
- *   onError: (error) => console.error(error),
- *   redirectUrl: '/dashboard',
- * });
+ * 2FA verification during login (internal — composed by {@link useTwoFactor}).
  *
- * const handleSubmit = async (code: string) => {
- *   if (useBackupCode) {
- *     await verifyBackupCode(sessionId, code);
- *   } else {
- *     await verifyTOTP(sessionId, code);
- *   }
- * };
- * ```
+ * After OTP/OAuth verification returns requires_2fa=true and a session_id,
+ * collect the TOTP (or backup) code and call verifyTOTP/verifyBackupCode to
+ * complete authentication.
  */
-declare const useTwoFactor: (options?: UseTwoFactorOptions) => UseTwoFactorReturn;
+declare const useTwoFactorVerify: (options?: UseTwoFactorVerifyOptions) => UseTwoFactorVerifyReturn;
 
 interface TwoFactorSetupData {
     /** Device ID to use for confirmation */
@@ -793,38 +775,9 @@ interface UseTwoFactorSetupReturn {
     clearError: () => void;
 }
 /**
- * Hook for 2FA setup (enabling TOTP authentication).
- *
- * Flow:
- * 1. Call startSetup() to get QR code and provisioning URI
- * 2. User scans QR code with authenticator app
- * 3. Call confirmSetup(code) with the 6-digit code from app
- * 4. Show backup codes to user (they must save these!)
- *
- * @example
- * ```tsx
- * const {
- *   isLoading,
- *   error,
- *   setupData,
- *   backupCodes,
- *   setupStep,
- *   startSetup,
- *   confirmSetup,
- * } = useTwoFactorSetup({
- *   onComplete: (codes) => console.log('Backup codes:', codes),
- *   onError: (error) => console.error(error),
- * });
- *
- * // Start setup
- * const data = await startSetup('My iPhone');
+ * 2FA setup — enabling TOTP (internal, composed by {@link useTwoFactor}).
  *
- * // Show QR code
- * <QRCodeSVG value={data.provisioningUri} />
- *
- * // Confirm with code from app
- * const codes = await confirmSetup('123456');
- * ```
+ * Flow: startSetup() → user scans QR → confirmSetup(code) → show backup codes.
  */
 declare const useTwoFactorSetup: (options?: UseTwoFactorSetupOptions) => UseTwoFactorSetupReturn;
 
@@ -851,8 +804,49 @@ interface UseTwoFactorStatusReturn {
     /** Clear error */
     clearError: () => void;
 }
+/**
+ * Read and manage 2FA status (internal, composed by {@link useTwoFactor}).
+ *
+ * Fetches the device list / enabled flag and disables 2FA.
+ */
 declare const useTwoFactorStatus: () => UseTwoFactorStatusReturn;
 
+interface UseTwoFactorOptions {
+    /** Options for the login-time verification namespace */
+    verify?: UseTwoFactorVerifyOptions;
+    /** Options for the setup (enable) namespace */
+    setup?: UseTwoFactorSetupOptions;
+}
+interface UseTwoFactorReturn {
+    /** Verify a 2FA challenge during login (TOTP / backup code). */
+    verify: UseTwoFactorVerifyReturn;
+    /** Enable 2FA — QR provisioning → confirm → backup codes. */
+    setup: UseTwoFactorSetupReturn;
+    /** Read device list / enabled flag and disable 2FA. */
+    status: UseTwoFactorStatusReturn;
+}
+/**
+ * Single entry point for all two-factor authentication flows.
+ *
+ * The three concerns — **verify** (login), **setup** (enable) and **status**
+ * (manage/disable) — are distinct verbs over the same `CfgTotp*` API, so each
+ * is exposed as its own namespace with an independent loading/error surface:
+ *
+ * @example
+ * ```tsx
+ * const two = useTwoFactor({ verify: { redirectUrl: '/dashboard' } });
+ *
+ * await two.verify.verifyTOTP(sessionId, code); // login
+ * await two.setup.startSetup('My iPhone');       // enable
+ * await two.status.fetchStatus();                // manage
+ * ```
+ *
+ * Consumers that only need one concern can compose the underlying hooks
+ * directly (`useTwoFactorVerify` / `useTwoFactorSetup` / `useTwoFactorStatus`),
+ * all re-exported alongside this one, to avoid mounting the others' state.
+ */
+declare const useTwoFactor: (options?: UseTwoFactorOptions) => UseTwoFactorReturn;
+
 interface AuthRedirectOptions {
     fallbackUrl?: string;
     clearOnUse?: boolean;
@@ -1111,4 +1105,4 @@ declare const Analytics: {
     setUser(userId: string): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.d.ts

@@ -697,7 +697,7 @@ interface UseGithubAuthReturn {
  */
 declare const useGithubAuth: (options?: UseGithubAuthOptions) => UseGithubAuthReturn;
 
-interface UseTwoFactorOptions {
+interface UseTwoFactorVerifyOptions {
     /** Callback on successful 2FA verification */
     onSuccess?: (user: any) => void;
     /** Callback on error */
@@ -707,7 +707,7 @@ interface UseTwoFactorOptions {
     /** Skip automatic redirect after success (caller handles navigation) */
     skipRedirect?: boolean;
 }
-interface UseTwoFactorReturn {
+interface UseTwoFactorVerifyReturn {
     /** Loading state */
     isLoading: boolean;
     /** Error message */
@@ -726,31 +726,13 @@ interface UseTwoFactorReturn {
     clearError: () => void;
 }
 /**
- * Hook for 2FA verification during login.
- *
- * Usage:
- * 1. After OTP/OAuth verification returns requires_2fa=true and session_id
- * 2. Show 2FA form and collect TOTP code from user
- * 3. Call verifyTOTP(sessionId, code) to complete authentication
- *
- * @example
- * ```tsx
- * const { isLoading, error, verifyTOTP, verifyBackupCode } = useTwoFactor({
- *   onSuccess: (user) => console.log('Logged in:', user),
- *   onError: (error) => console.error(error),
- *   redirectUrl: '/dashboard',
- * });
+ * 2FA verification during login (internal — composed by {@link useTwoFactor}).
  *
- * const handleSubmit = async (code: string) => {
- *   if (useBackupCode) {
- *     await verifyBackupCode(sessionId, code);
- *   } else {
- *     await verifyTOTP(sessionId, code);
- *   }
- * };
- * ```
+ * After OTP/OAuth verification returns requires_2fa=true and a session_id,
+ * collect the TOTP (or backup) code and call verifyTOTP/verifyBackupCode to
+ * complete authentication.
  */
-declare const useTwoFactor: (options?: UseTwoFactorOptions) => UseTwoFactorReturn;
+declare const useTwoFactorVerify: (options?: UseTwoFactorVerifyOptions) => UseTwoFactorVerifyReturn;
 
 interface TwoFactorSetupData {
     /** Device ID to use for confirmation */
@@ -793,38 +775,9 @@ interface UseTwoFactorSetupReturn {
     clearError: () => void;
 }
 /**
- * Hook for 2FA setup (enabling TOTP authentication).
- *
- * Flow:
- * 1. Call startSetup() to get QR code and provisioning URI
- * 2. User scans QR code with authenticator app
- * 3. Call confirmSetup(code) with the 6-digit code from app
- * 4. Show backup codes to user (they must save these!)
- *
- * @example
- * ```tsx
- * const {
- *   isLoading,
- *   error,
- *   setupData,
- *   backupCodes,
- *   setupStep,
- *   startSetup,
- *   confirmSetup,
- * } = useTwoFactorSetup({
- *   onComplete: (codes) => console.log('Backup codes:', codes),
- *   onError: (error) => console.error(error),
- * });
- *
- * // Start setup
- * const data = await startSetup('My iPhone');
+ * 2FA setup — enabling TOTP (internal, composed by {@link useTwoFactor}).
  *
- * // Show QR code
- * <QRCodeSVG value={data.provisioningUri} />
- *
- * // Confirm with code from app
- * const codes = await confirmSetup('123456');
- * ```
+ * Flow: startSetup() → user scans QR → confirmSetup(code) → show backup codes.
  */
 declare const useTwoFactorSetup: (options?: UseTwoFactorSetupOptions) => UseTwoFactorSetupReturn;
 
@@ -851,8 +804,49 @@ interface UseTwoFactorStatusReturn {
     /** Clear error */
     clearError: () => void;
 }
+/**
+ * Read and manage 2FA status (internal, composed by {@link useTwoFactor}).
+ *
+ * Fetches the device list / enabled flag and disables 2FA.
+ */
 declare const useTwoFactorStatus: () => UseTwoFactorStatusReturn;
 
+interface UseTwoFactorOptions {
+    /** Options for the login-time verification namespace */
+    verify?: UseTwoFactorVerifyOptions;
+    /** Options for the setup (enable) namespace */
+    setup?: UseTwoFactorSetupOptions;
+}
+interface UseTwoFactorReturn {
+    /** Verify a 2FA challenge during login (TOTP / backup code). */
+    verify: UseTwoFactorVerifyReturn;
+    /** Enable 2FA — QR provisioning → confirm → backup codes. */
+    setup: UseTwoFactorSetupReturn;
+    /** Read device list / enabled flag and disable 2FA. */
+    status: UseTwoFactorStatusReturn;
+}
+/**
+ * Single entry point for all two-factor authentication flows.
+ *
+ * The three concerns — **verify** (login), **setup** (enable) and **status**
+ * (manage/disable) — are distinct verbs over the same `CfgTotp*` API, so each
+ * is exposed as its own namespace with an independent loading/error surface:
+ *
+ * @example
+ * ```tsx
+ * const two = useTwoFactor({ verify: { redirectUrl: '/dashboard' } });
+ *
+ * await two.verify.verifyTOTP(sessionId, code); // login
+ * await two.setup.startSetup('My iPhone');       // enable
+ * await two.status.fetchStatus();                // manage
+ * ```
+ *
+ * Consumers that only need one concern can compose the underlying hooks
+ * directly (`useTwoFactorVerify` / `useTwoFactorSetup` / `useTwoFactorStatus`),
+ * all re-exported alongside this one, to avoid mounting the others' state.
+ */
+declare const useTwoFactor: (options?: UseTwoFactorOptions) => UseTwoFactorReturn;
+
 interface AuthRedirectOptions {
     fallbackUrl?: string;
     clearOnUse?: boolean;
@@ -1111,4 +1105,4 @@ declare const Analytics: {
     setUser(userId: string): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.mjs

@@ -1081,7 +1081,7 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAutoAuth");
 
-// src/auth/hooks/useTwoFactor.ts
+// src/auth/hooks/useTwoFactorVerify.ts
 import { useCallback as useCallback4, useState as useState4 } from "react";
 
 // src/_api/generated/core/bodySerializer.gen.ts
@@ -2609,8 +2609,35 @@ var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAuthRedirectManager");
 
-// src/auth/hooks/useTwoFactor.ts
-var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
+// src/auth/hooks/twoFactor.shared.ts
+var TOTP_CODE_LENGTH = 6;
+function extractTwoFactorError(err, fallback) {
+  if (err instanceof APIError) {
+    const body = err.response ?? null;
+    if (typeof body?.error === "string") return body.error;
+    if (typeof body?.detail === "string") return body.detail;
+    if (typeof body?.message === "string") return body.message;
+    return err.errorMessage ?? err.message;
+  }
+  if (err instanceof Error) return err.message;
+  return fallback;
+}
+__name(extractTwoFactorError, "extractTwoFactorError");
+function extractAttemptsRemaining(err) {
+  if (err instanceof APIError) {
+    const body = err.response ?? null;
+    if (typeof body?.attempts_remaining === "number") return body.attempts_remaining;
+  }
+  return null;
+}
+__name(extractAttemptsRemaining, "extractAttemptsRemaining");
+function isValidTotpCode(code) {
+  return !!code && code.length === TOTP_CODE_LENGTH;
+}
+__name(isValidTotpCode, "isValidTotpCode");
+
+// src/auth/hooks/useTwoFactorVerify.ts
+var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
   const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
   const [isLoading, setIsLoading] = useState4(false);
@@ -2650,7 +2677,7 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
       onError?.(msg);
       return false;
     }
-    if (!code || code.length !== 6) {
+    if (!isValidTotpCode(code)) {
       const msg = "Please enter a 6-digit code";
       setError(msg);
       onError?.(msg);
@@ -2672,10 +2699,9 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
       return true;
     } catch (err) {
       authLogger.error("2FA TOTP verification error:", err);
-      const errorMessage = err instanceof APIError ? err.response?.error || err.response?.detail || err.response?.message || err.errorMessage : err instanceof Error ? err.message : "Invalid verification code";
-      if (err instanceof APIError && typeof err.response?.attempts_remaining === "number") {
-        setAttemptsRemaining(err.response.attempts_remaining);
-      }
+      const errorMessage = extractTwoFactorError(err, "Invalid verification code");
+      const attempts = extractAttemptsRemaining(err);
+      if (attempts !== null) setAttemptsRemaining(attempts);
       setError(errorMessage);
       onError?.(errorMessage);
       Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
@@ -2719,10 +2745,9 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
       return true;
     } catch (err) {
       authLogger.error("2FA backup code verification error:", err);
-      const errorMessage = err instanceof APIError ? err.response?.error || err.response?.detail || err.response?.message || err.errorMessage : err instanceof Error ? err.message : "Invalid backup code";
-      if (err instanceof APIError && typeof err.response?.attempts_remaining === "number") {
-        setAttemptsRemaining(err.response.attempts_remaining);
-      }
+      const errorMessage = extractTwoFactorError(err, "Invalid backup code");
+      const attempts = extractAttemptsRemaining(err);
+      if (attempts !== null) setAttemptsRemaining(attempts);
       setError(errorMessage);
       onError?.(errorMessage);
       Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
@@ -2744,7 +2769,7 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
     verifyBackupCode,
     clearError
   };
-}, "useTwoFactor");
+}, "useTwoFactorVerify");
 
 // src/auth/hooks/useAuthForm.ts
 var useAuthForm = /* @__PURE__ */ __name((options) => {
@@ -2788,7 +2813,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     startRateLimitCountdown,
     setWebmail
   } = formState;
-  const twoFactor = useTwoFactor({
+  const twoFactor = useTwoFactorVerify({
     onSuccess: /* @__PURE__ */ __name(() => {
       authLogger.info("2FA verification successful, showing success screen");
       setStep("success");
@@ -3179,7 +3204,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       authLogger.info("2FA setup initiated, expires in:", data.expiresIn, "seconds");
       return data;
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "Failed to start 2FA setup";
+      const errorMessage = extractTwoFactorError(err, "Failed to start 2FA setup");
       authLogger.error("2FA setup error:", err);
       setError(errorMessage);
       setSetupStep("idle");
@@ -3196,7 +3221,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       onError?.(msg);
       return null;
     }
-    if (!code || code.length !== 6) {
+    if (!isValidTotpCode(code)) {
       const msg = "Please enter a 6-digit code";
       setError(msg);
       onError?.(msg);
@@ -3220,7 +3245,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       onComplete?.(codes);
       return codes;
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "Invalid code. Please try again.";
+      const errorMessage = extractTwoFactorError(err, "Invalid code. Please try again.");
       authLogger.error("2FA setup confirmation error:", err);
       setError(errorMessage);
       setSetupStep("scanning");
@@ -3246,17 +3271,6 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 
 // src/auth/hooks/useTwoFactorStatus.ts
 import { useCallback as useCallback8, useState as useState7 } from "react";
-function extractErrorMessage(err, fallback) {
-  if (err instanceof APIError) {
-    const body = err.response;
-    if (typeof body?.error === "string") return body.error;
-    if (typeof body?.detail === "string") return body.detail;
-    return err.message;
-  }
-  if (err instanceof Error) return err.message;
-  return fallback;
-}
-__name(extractErrorMessage, "extractErrorMessage");
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
   const [isLoading, setIsLoading] = useState7(false);
   const [error, setError] = useState7(null);
@@ -3283,7 +3297,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setHas2FAEnabled(response.has_2fa_enabled);
       authLogger.info("2FA status:", response.has_2fa_enabled ? "enabled" : "disabled");
     } catch (err) {
-      const errorMessage = extractErrorMessage(err, "Failed to fetch 2FA status");
+      const errorMessage = extractTwoFactorError(err, "Failed to fetch 2FA status");
       authLogger.error("Failed to fetch 2FA status:", err);
       setError(errorMessage);
     } finally {
@@ -3291,7 +3305,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
     }
   }, []);
   const disable2FA = useCallback8(async (code) => {
-    if (!code || code.length !== 6) {
+    if (!isValidTotpCode(code)) {
       setError("Please enter a 6-digit code");
       return false;
     }
@@ -3305,7 +3319,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       authLogger.info("2FA disabled successfully");
       return true;
     } catch (err) {
-      const errorMessage = extractErrorMessage(err, "Invalid verification code");
+      const errorMessage = extractTwoFactorError(err, "Invalid verification code");
       authLogger.error("Failed to disable 2FA:", err);
       setError(errorMessage);
       return false;
@@ -3324,6 +3338,14 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
   };
 }, "useTwoFactorStatus");
 
+// src/auth/hooks/useTwoFactor.ts
+var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
+  const verify = useTwoFactorVerify(options.verify);
+  const setup = useTwoFactorSetup(options.setup);
+  const status = useTwoFactorStatus();
+  return { verify, setup, status };
+}, "useTwoFactor");
+
 // src/auth/hooks/useLocalStorage.ts
 import { useState as useState8 } from "react";
 function useLocalStorage(key, initialValue) {
@@ -4815,6 +4837,7 @@ export {
   useTwoFactor,
   useTwoFactorSetup,
   useTwoFactorStatus,
+  useTwoFactorVerify,
   validateEmail,
   validateIdentifier
 };