@getpara/core-sdk 3.3.0 → 3.5.0

package/dist/esm/state/CoreStateManager.js

@@ -80,7 +80,7 @@ const _CoreStateManager = class _CoreStateManager {
    * Extracts all data needed by UI consumers from authStateResult.
    */
   computeAuthStateInfo(authContext, walletContext) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I, _J, _K, _L;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I, _J, _K, _L, _M, _N, _O, _P, _Q;
     const defaultAuthStateInfo = {
       userId: null,
       isPasskeySupported: false,
@@ -102,6 +102,7 @@ const _CoreStateManager = class _CoreStateManager {
       fallbackUsed: false,
       fallbackChannel: null,
       externalWalletVerification: null,
+      mfa: null,
       recoverySecret: null,
       isNewUser: false
     };
@@ -143,6 +144,7 @@ const _CoreStateManager = class _CoreStateManager {
     let deliveryChannel = null;
     let fallbackUsed = false;
     let fallbackChannel = null;
+    let mfa = null;
     if (stage === "login") {
       const loginState = authStateResult;
       const authMethods = (_j = loginState.loginAuthMethods) != null ? _j : [];
@@ -179,6 +181,17 @@ const _CoreStateManager = class _CoreStateManager {
       deliveryChannel = (_E = verifyState.deliveryChannel) != null ? _E : null;
       fallbackUsed = (_F = verifyState.fallbackUsed) != null ? _F : false;
       fallbackChannel = (_G = verifyState.fallbackChannel) != null ? _G : null;
+    } else if (stage === "mfa") {
+      const { mfa: challenge } = authStateResult;
+      mfa = {
+        mode: challenge.mode,
+        step: challenge.step,
+        methods: (_H = challenge.methods) != null ? _H : null,
+        attemptsRemaining: (_I = challenge.attemptsRemaining) != null ? _I : null,
+        lockedUntil: (_J = challenge.lockedUntil) != null ? _J : null,
+        secretUri: (_K = challenge.secretUri) != null ? _K : null,
+        backupCodes: (_L = challenge.backupCodes) != null ? _L : null
+      };
     }
     return {
       userId,
@@ -201,10 +214,11 @@ const _CoreStateManager = class _CoreStateManager {
       fallbackUsed,
       fallbackChannel,
       externalWalletVerification: externalWalletVerification ? {
-        signatureVerificationMessage: (_H = externalWalletVerification.signatureVerificationMessage) != null ? _H : "",
-        walletAddress: (_J = (_I = externalWalletVerification.externalWallet) == null ? void 0 : _I.address) != null ? _J : "",
-        walletType: (_L = (_K = externalWalletVerification.externalWallet) == null ? void 0 : _K.type) != null ? _L : ""
+        signatureVerificationMessage: (_M = externalWalletVerification.signatureVerificationMessage) != null ? _M : "",
+        walletAddress: (_O = (_N = externalWalletVerification.externalWallet) == null ? void 0 : _N.address) != null ? _O : "",
+        walletType: (_Q = (_P = externalWalletVerification.externalWallet) == null ? void 0 : _P.type) != null ? _Q : ""
       } : null,
+      mfa,
       recoverySecret,
       isNewUser
     };
@@ -265,10 +279,19 @@ const _CoreStateManager = class _CoreStateManager {
   }
   authStateInfoEqual(a, b) {
     var _a, _b, _c, _d, _e, _f, _g, _h, _i;
-    return a.userId === b.userId && a.isPasskeySupported === b.isPasskeySupported && a.hasPasskey === b.hasPasskey && a.hasPassword === b.hasPassword && a.hasPin === b.hasPin && a.passkeyUrl === b.passkeyUrl && a.passkeyFullUrl === b.passkeyFullUrl && a.passkeyKnownDeviceUrl === b.passkeyKnownDeviceUrl && a.passwordUrl === b.passwordUrl && a.passwordFullUrl === b.passwordFullUrl && a.pinUrl === b.pinUrl && a.pinFullUrl === b.pinFullUrl && a.passkeyId === b.passkeyId && a.verificationUrl === b.verificationUrl && a.verificationFullUrl === b.verificationFullUrl && a.deliveryChannel === b.deliveryChannel && a.fallbackUsed === b.fallbackUsed && a.fallbackChannel === b.fallbackChannel && a.recoverySecret === b.recoverySecret && a.isNewUser === b.isNewUser && ((_a = a.externalWalletVerification) == null ? void 0 : _a.signatureVerificationMessage) === ((_b = b.externalWalletVerification) == null ? void 0 : _b.signatureVerificationMessage) && ((_c = a.externalWalletVerification) == null ? void 0 : _c.walletAddress) === ((_d = b.externalWalletVerification) == null ? void 0 : _d.walletAddress) && ((_e = a.externalWalletVerification) == null ? void 0 : _e.walletType) === ((_f = b.externalWalletVerification) == null ? void 0 : _f.walletType) && ((_g = a.passkeyHints) == null ? void 0 : _g.length) === ((_h = b.passkeyHints) == null ? void 0 : _h.length) && ((_i = a.passkeyHints) != null ? _i : []).every(
+    return a.userId === b.userId && a.isPasskeySupported === b.isPasskeySupported && a.hasPasskey === b.hasPasskey && a.hasPassword === b.hasPassword && a.hasPin === b.hasPin && a.passkeyUrl === b.passkeyUrl && a.passkeyFullUrl === b.passkeyFullUrl && a.passkeyKnownDeviceUrl === b.passkeyKnownDeviceUrl && a.passwordUrl === b.passwordUrl && a.passwordFullUrl === b.passwordFullUrl && a.pinUrl === b.pinUrl && a.pinFullUrl === b.pinFullUrl && a.passkeyId === b.passkeyId && a.verificationUrl === b.verificationUrl && a.verificationFullUrl === b.verificationFullUrl && a.deliveryChannel === b.deliveryChannel && a.fallbackUsed === b.fallbackUsed && a.fallbackChannel === b.fallbackChannel && a.recoverySecret === b.recoverySecret && a.isNewUser === b.isNewUser && ((_a = a.externalWalletVerification) == null ? void 0 : _a.signatureVerificationMessage) === ((_b = b.externalWalletVerification) == null ? void 0 : _b.signatureVerificationMessage) && ((_c = a.externalWalletVerification) == null ? void 0 : _c.walletAddress) === ((_d = b.externalWalletVerification) == null ? void 0 : _d.walletAddress) && ((_e = a.externalWalletVerification) == null ? void 0 : _e.walletType) === ((_f = b.externalWalletVerification) == null ? void 0 : _f.walletType) && this.mfaEqual(a.mfa, b.mfa) && ((_g = a.passkeyHints) == null ? void 0 : _g.length) === ((_h = b.passkeyHints) == null ? void 0 : _h.length) && ((_i = a.passkeyHints) != null ? _i : []).every(
       (hint, i) => hint.useragent === b.passkeyHints[i].useragent && hint.aaguid === b.passkeyHints[i].aaguid
     );
   }
+  mfaEqual(a, b) {
+    if (a === b) return true;
+    if (!a || !b) return false;
+    const sameStringArray = (x, y) => {
+      var _a, _b;
+      return ((_a = x == null ? void 0 : x.length) != null ? _a : -1) === ((_b = y == null ? void 0 : y.length) != null ? _b : -1) && (x != null ? x : []).every((v, i) => v === y[i]);
+    };
+    return a.mode === b.mode && a.step === b.step && a.attemptsRemaining === b.attemptsRemaining && a.lockedUntil === b.lockedUntil && a.secretUri === b.secretUri && sameStringArray(a.methods, b.methods) && sameStringArray(a.backupCodes, b.backupCodes);
+  }
 };
 _CoreStateManager.CORE_LOADING_STATES = /* @__PURE__ */ new Set([
   "setting_up",
@@ -282,7 +305,11 @@ _CoreStateManager.AUTH_LOADING_STATES = /* @__PURE__ */ new Set([
   "authenticating_farcaster",
   "processing_authentication",
   "authenticating_telegram",
-  "checking_state"
+  "checking_state",
+  // Re-polling the login status after the second factor is satisfied (ENG-6906).
+  // awaiting_2fa / awaiting_2fa_enrollment are deliberately NOT loading — they are
+  // user-input holds where the UI shows the MFA prompt.
+  "resolving_2fa"
 ]);
 _CoreStateManager.WALLET_LOADING_STATES = /* @__PURE__ */ new Set([
   "checking_wallet_state",

package/dist/esm/state/machines/authStateMachine.js

@@ -712,18 +712,18 @@ function createAuthStateMachine(paraCoreInterface) {
               guard: and([
                 ({ event }) => {
                   const output = event.output;
-                  return !!output.externalWallet;
+                  return !!(output == null ? void 0 : output.externalWallet);
                 },
                 or([
                   ({ event }) => {
                     var _a;
                     const output = event.output;
-                    return output.stage === "done" && !((_a = output.externalWallet) == null ? void 0 : _a.withFullParaAuth);
+                    return (output == null ? void 0 : output.stage) === "done" && !((_a = output == null ? void 0 : output.externalWallet) == null ? void 0 : _a.withFullParaAuth);
                   },
                   ({ event }) => {
                     var _a, _b;
                     const output = event.output;
-                    return output.stage === "verify" && !((_a = output.externalWallet) == null ? void 0 : _a.withFullParaAuth) && !((_b = output.externalWallet) == null ? void 0 : _b.withVerification);
+                    return (output == null ? void 0 : output.stage) === "verify" && !((_a = output == null ? void 0 : output.externalWallet) == null ? void 0 : _a.withFullParaAuth) && !((_b = output == null ? void 0 : output.externalWallet) == null ? void 0 : _b.withVerification);
                   }
                 ])
               ])
@@ -740,12 +740,12 @@ function createAuthStateMachine(paraCoreInterface) {
               guard: and([
                 ({ event }) => {
                   const output = event.output;
-                  return !!output.externalWallet;
+                  return !!(output == null ? void 0 : output.externalWallet);
                 },
                 ({ event }) => {
                   var _a, _b;
                   const output = event.output;
-                  return output.stage === "verify" && !((_a = output.externalWallet) == null ? void 0 : _a.withFullParaAuth) && ((_b = output.externalWallet) == null ? void 0 : _b.withVerification);
+                  return (output == null ? void 0 : output.stage) === "verify" && !((_a = output == null ? void 0 : output.externalWallet) == null ? void 0 : _a.withFullParaAuth) && ((_b = output == null ? void 0 : output.externalWallet) == null ? void 0 : _b.withVerification);
                 }
               ])
             },
@@ -761,12 +761,12 @@ function createAuthStateMachine(paraCoreInterface) {
               guard: and([
                 ({ event }) => {
                   const output = event.output;
-                  return !!output.externalWallet;
+                  return !!(output == null ? void 0 : output.externalWallet);
                 },
                 ({ event }) => {
                   var _a;
                   const output = event.output;
-                  return output.stage === "verify" && !!((_a = output.externalWallet) == null ? void 0 : _a.withFullParaAuth);
+                  return (output == null ? void 0 : output.stage) === "verify" && !!((_a = output == null ? void 0 : output.externalWallet) == null ? void 0 : _a.withFullParaAuth);
                 }
               ])
             },
@@ -780,11 +780,37 @@ function createAuthStateMachine(paraCoreInterface) {
                 ({ event }) => {
                   var _a;
                   const output = event.output;
-                  return output.stage === "verify" && !((_a = output.externalWallet) == null ? void 0 : _a.withFullParaAuth);
+                  return (output == null ? void 0 : output.stage) === "verify" && !((_a = output == null ? void 0 : output.externalWallet) == null ? void 0 : _a.withFullParaAuth);
                 },
                 () => !paraCoreInterface.authService.isEnclaveUser
               ])
             },
+            // Login-time 2FA (ENG-6906): the server gated the login behind a second
+            // factor. Enrollment (no factor yet) and verification (existing factor)
+            // are surfaced as distinct phases so a custom UI can show the right step.
+            {
+              target: "awaiting_2fa_enrollment",
+              actions: [
+                "storeAuthStateResult",
+                { type: "logTransition", params: { to: "awaiting_2fa_enrollment", detail: "mfa enroll" } }
+              ],
+              guard: ({ event }) => {
+                var _a;
+                const output = event.output;
+                return (output == null ? void 0 : output.stage) === "mfa" && ((_a = output == null ? void 0 : output.mfa) == null ? void 0 : _a.mode) === "enroll";
+              }
+            },
+            {
+              target: "awaiting_2fa",
+              actions: [
+                "storeAuthStateResult",
+                { type: "logTransition", params: { to: "awaiting_2fa", detail: "mfa verify" } }
+              ],
+              guard: ({ event }) => {
+                const output = event.output;
+                return (output == null ? void 0 : output.stage) === "mfa";
+              }
+            },
             {
               target: "awaiting_session_start",
               actions: [
@@ -827,6 +853,77 @@ function createAuthStateMachine(paraCoreInterface) {
           CANCEL: { target: "unauthenticated", actions: ["resetState"] }
         }
       },
+      // Login-time 2FA hold states (ENG-6906). The SDK satisfies the second factor
+      // out-of-band (enrollMfa/verifyMfa against /internal/v1/auth/2fa/*); once the
+      // backend has stamped the session, a RESOLVE_2FA event re-polls the login
+      // status, which now returns stage:'done'.
+      awaiting_2fa: {
+        on: {
+          RESOLVE_2FA: { target: "resolving_2fa", actions: ["setPollingCallbacks", "resetError"] },
+          CANCEL: { target: "unauthenticated", actions: ["resetState"] }
+        }
+      },
+      awaiting_2fa_enrollment: {
+        on: {
+          RESOLVE_2FA: { target: "resolving_2fa", actions: ["setPollingCallbacks", "resetError"] },
+          CANCEL: { target: "unauthenticated", actions: ["resetState"] }
+        }
+      },
+      resolving_2fa: {
+        entry: [{ type: "logTransition", params: { to: "resolving_2fa" } }],
+        invoke: {
+          src: "polling",
+          input: ({ context }) => {
+            var _a;
+            let resolvedAuthState = null;
+            return {
+              checkCondition: () => __async(this, null, function* () {
+                try {
+                  const result = yield paraCoreInterface.pollingService.waitForOAuth({
+                    onSuccess: (serverAuthState) => {
+                      resolvedAuthState = serverAuthState;
+                    }
+                  })();
+                  return { finished: result.finished && !!resolvedAuthState, data: { authState: resolvedAuthState } };
+                } catch (error) {
+                  throw new Error(`2FA resolution polling failed: ${extractErrorMessage(error, "Unknown error")}`);
+                }
+              }),
+              onPoll: () => {
+                var _a2, _b;
+                return (_b = (_a2 = context.pollingCallbacks) == null ? void 0 : _a2.onPoll) == null ? void 0 : _b.call(_a2);
+              },
+              onCancel: () => {
+                var _a2, _b;
+                return (_b = (_a2 = context.pollingCallbacks) == null ? void 0 : _a2.onCancel) == null ? void 0 : _b.call(_a2);
+              },
+              isCanceled: ((_a = context.pollingCallbacks) == null ? void 0 : _a.isCanceled) || (() => false),
+              id: "resolving2fa"
+            };
+          },
+          onError: {
+            target: "error",
+            actions: setAuthErrorAssign("2FA resolution failed")
+          }
+        },
+        on: makePollingOnHandlers("processing_authentication", "2FA resolution failed", [
+          assign({
+            serverAuthStateResult: ({ event }) => {
+              var _a;
+              const authState = ((_a = event.data) == null ? void 0 : _a.authState) || null;
+              return {
+                authState,
+                opts: DEFAULT_AUTH_OPTS
+              };
+            },
+            isNewUser: ({ event }) => {
+              var _a;
+              const authState = (_a = event.data) == null ? void 0 : _a.authState;
+              return authState ? computeIsNewUser(authState) : false;
+            }
+          })
+        ])
+      },
       awaiting_session_start: {
         on: {
           WAIT_FOR_SESSION: {

package/dist/esm/state/machines/coreStateMachine.js

@@ -180,6 +180,14 @@ function createCoreStateMachine(paraCoreInterface) {
           "WAIT_FOR_WALLET_CREATION": {
             actions: ({ context, event }) => context.authMachineRef.send(event)
           },
+          // Login-time 2FA (ENG-6906): after the second factor is satisfied, verifyMfa
+          // fires RESOLVE_2FA so the auth machine re-polls verify-oauth and advances the
+          // login. Without forwarding it here the parent silently drops the event, the
+          // auth child stays parked at awaiting_2fa[_enrollment], and the user never gets
+          // a wallet.
+          "RESOLVE_2FA": {
+            actions: ({ context, event }) => context.authMachineRef.send(event)
+          },
           "INITIALIZE_GUEST_MODE": {
             actions: ({ context, event }) => context.authMachineRef.send(event)
           },

package/dist/esm/types/coreApi.js

@@ -17,6 +17,8 @@ const PARA_CORE_METHODS = [
   "setup2fa",
   "enable2fa",
   "verify2fa",
+  "enrollMfa",
+  "verifyMfa",
   "logout",
   "clearStorage",
   "isSessionActive",

package/dist/types/ParaCore.d.ts

@@ -556,7 +556,7 @@ export declare abstract class ParaCore implements CoreInterface {
     protected verifyTelegramProcess(opts: InternalMethodParams<'verifyTelegramLink'> & {
         isLinkAccount: true;
     }): InternalMethodResponse<'verifyTelegramLink'>;
-    verifyTelegram(params: VerifyTelegramParams): Promise<import("./types/authState.js").AuthStateSignupOrLoginOrDone>;
+    verifyTelegram(params: VerifyTelegramParams): Promise<OAuthResponse>;
     protected verifyTelegramLink(opts: InternalMethodParams<'verifyTelegramLink'>): InternalMethodResponse<'verifyTelegramLink'>;
     /**
      * Performs 2FA verification.
@@ -577,6 +577,27 @@ export declare abstract class ParaCore implements CoreInterface {
      * @param {string} opts.verificationCode - the verification code received via 2FA.
      */
     enable2fa({ verificationCode }: CoreMethodParams<'enable2fa'>): CoreMethodResponse<'enable2fa'>;
+    /**
+     * Login-time 2FA (ENG-6906): enroll a TOTP second factor for the current session.
+     * Distinct from setup2fa/enable2fa, which configure the recovery-gating 2FA. This
+     * is authenticated by the active session (no recovery config gate); the backend
+     * 404s the surface when the login-MFA flag is off.
+     *
+     * @returns {Object} `{ uri, backupCodes }` — otpauth URI to render as a QR, plus
+     * one-time backup codes to show the user exactly once.
+     */
+    enrollMfa(): CoreMethodResponse<'enrollMfa'>;
+    /**
+     * Login-time 2FA (ENG-6906): verify the second factor for the current login. On
+     * success the backend stamps the session and this re-polls the login status so the
+     * flow advances toward `done`; a wrong code resolves to `{ ok:false, attemptsRemaining }`
+     * so the UI can re-prompt without treating it as a hard error.
+     *
+     * @param {Object} opts the options object.
+     * @param {string} opts.code the TOTP or backup code entered by the user.
+     * @returns {Object} `{ ok: true } | { ok: false; attemptsRemaining? }`
+     */
+    verifyMfa({ code }: CoreMethodParams<'verifyMfa'>): CoreMethodResponse<'verifyMfa'>;
     /**
      * Resend a verification email for the current user.
      */
@@ -626,7 +647,7 @@ export declare abstract class ParaCore implements CoreInterface {
     protected verifyFarcasterProcess(opts: InternalMethodParams<'verifyFarcasterLink'> & {
         isLinkAccount: true;
     }): InternalMethodResponse<'verifyFarcasterLink'>;
-    verifyFarcaster(params: VerifyFarcasterParams): Promise<import("./types/authState.js").AuthStateSignupOrLoginOrDone>;
+    verifyFarcaster(params: VerifyFarcasterParams): Promise<OAuthResponse>;
     protected verifyFarcasterLink(opts: InternalMethodParams<'verifyFarcasterLink'>): InternalMethodResponse<'verifyFarcasterLink'>;
     /**
      * Generates a URL for the user to log in with OAuth using a desire method.

package/dist/types/PlatformUtils.d.ts

@@ -9,6 +9,17 @@ export interface EventData<T = any> {
 export type EventHandler<T = any> = (data: T) => void;
 export interface PlatformUtils {
     sdkType: SDKType;
+    /**
+     * Node-only: keep-alive HTTP(S) agents for the user-management client so
+     * server-to-server callers reuse connections instead of re-handshaking
+     * TCP+TLS per request. Browser/RN platforms omit this (the runtime pools
+     * sockets itself). Returned as `unknown` to keep node:http types out of
+     * browser-bundled core-sdk.
+     */
+    getRequestAgents?(): {
+        httpAgent?: unknown;
+        httpsAgent?: unknown;
+    } | undefined;
     getPrivateKey(ctx: Ctx, userId: string, walletId: string, share: string, sessionCookie: string): Promise<string>;
     getED25519PrivateKey(ctx: Ctx, userId: string, walletId: string, share: string, sessionCookie: string): Promise<string>;
     keygen(ctx: Ctx, userId: string, type: Exclude<TWalletType, 'SOLANA'>, secretKey: string | null, // should be acceptable as null in RN as we don't pre-gen them

package/dist/types/external/userManagementClient.d.ts

@@ -11,7 +11,7 @@ export declare function getBaseMPCNetworkUrl(env: Environment, useWebsocket?: bo
  * outside this core SDK path.
  */
 export declare function normalizePlatform(platform?: string): string | undefined;
-export declare function initClient({ env, version, apiKey, partnerId, platform, useFetchAdapter, retrieveSessionCookie, persistSessionCookie, staticTraceContext, }: {
+export declare function initClient({ env, version, apiKey, partnerId, platform, useFetchAdapter, retrieveSessionCookie, persistSessionCookie, staticTraceContext, httpAgent, httpsAgent, }: {
     env: Environment;
     version?: string;
     apiKey: string;
@@ -22,4 +22,6 @@ export declare function initClient({ env, version, apiKey, partnerId, platform,
     retrieveSessionCookie?: () => string;
     persistSessionCookie?: (cookie: string) => void;
     staticTraceContext?: Record<string, string>;
+    httpAgent?: unknown;
+    httpsAgent?: unknown;
 }): Client;

package/dist/types/index.d.ts

@@ -1,6 +1,6 @@
 import { ParaCore } from './ParaCore.js';
-export { type Auth, type AuthInfo, type PrimaryAuthInfo, type VerifiedAuthInfo, type VerifiedAuth, AuthMethod, type TAuthMethod, AuthMethodStatus, AuthLayout, type TAuthLayout, type AuthExtras, type CurrentWalletIds, EmailTheme, type PartnerEntity, type PartnerAppConfig, type WalletEntity, Network, type TNetwork, WalletType, type TWalletType, WalletScheme, type TWalletScheme, OnRampAsset, type TOnRampAsset, OnRampPurchaseType, OnRampProvider, OnRampPurchaseStatus, type OnRampConfig, type OnRampAssets, type OnRampPurchase, type OnRampAssetInfo, type ProviderAssetInfo, OnRampMethod, OAuthMethod, type TOAuthMethod, type TLinkedAccountType, type SupportedAccountLinks, type SupportedWalletTypes, type TPregenIdentifierType, type PregenIds, type LinkedAccount, type LinkedAccounts, type TExternalWallet, type ExternalWalletInfo, type PregenAuth, type Setup2faResponse, type TelegramAuthResponse, type VerifyExternalWalletParams, type AssetMetadata, type AssetMetadataIndexed, type AssetValue, type BalancesConfig, type WalletBalance, type ProfileBalance, type OfframpDepositRequest, type WalletWithMetadata, RecoveryStatus, ThemeMode, NON_ED25519, PREGEN_IDENTIFIER_TYPES, WALLET_TYPES, WALLET_SCHEMES, OAUTH_METHODS, LINKED_ACCOUNT_TYPES, EXTERNAL_WALLET_TYPES, EVM_WALLETS, SOLANA_WALLETS, COSMOS_WALLETS, formatAssetQuantity, formatCurrency, type EstimateTransactionOpts, type EstimateTransactionResult, type BroadcastTransactionOpts, type BroadcastTransactionResult, type PendingTransactionEntity, type SerializedDecodedTx, type SerializedTxData, type GetPendingTransactionResponse, DeliveryChannel, type PartnerThemeConfig as Theme, } from '@getpara/user-management-client';
-export { PopupType, PregenIdentifierType, type AuthStateSignup, type AuthStateVerify, type AuthStateLogin, type AuthState, type OAuthResponse, type CoreAuthInfo, type SignatureRes, type FullSignatureRes, type SuccessfulSignatureRes, type DeniedSignatureRes, type DeniedSignatureResWithUrl, type Wallet, type AvailableWallet, type AccountLinkInProgress, AccountLinkError, type InternalInterface, type Verify2faParams, type Verify2faResponse, type StorageType, type TelegramParams, type CreateParaSignerBaseOptions, } from './types/index.js';
+export { type Auth, type AuthInfo, type PrimaryAuthInfo, type VerifiedAuthInfo, type VerifiedAuth, AuthMethod, type TAuthMethod, AuthMethodStatus, AuthLayout, type TAuthLayout, type AuthExtras, type CurrentWalletIds, EmailTheme, type PartnerEntity, type PartnerAppConfig, type WalletEntity, Network, type TNetwork, WalletType, type TWalletType, WalletScheme, type TWalletScheme, OnRampAsset, type TOnRampAsset, OnRampPurchaseType, OnRampProvider, OnRampPurchaseStatus, type OnRampConfig, type OnRampAssets, type OnRampPurchase, type OnRampAssetInfo, type ProviderAssetInfo, OnRampMethod, OAuthMethod, type TOAuthMethod, type TLinkedAccountType, type SupportedAccountLinks, type SupportedWalletTypes, type TPregenIdentifierType, type PregenIds, type LinkedAccount, type LinkedAccounts, type TExternalWallet, type ExternalWalletInfo, type PregenAuth, type Setup2faResponse, type EnrollMfaResponse, type VerifyMfaResult, type MfaChallenge, type MfaMode, type MfaStep, type TelegramAuthResponse, type VerifyExternalWalletParams, type AssetMetadata, type AssetMetadataIndexed, type AssetValue, type BalancesConfig, type WalletBalance, type ProfileBalance, type OfframpDepositRequest, type WalletWithMetadata, RecoveryStatus, ThemeMode, NON_ED25519, PREGEN_IDENTIFIER_TYPES, WALLET_TYPES, WALLET_SCHEMES, OAUTH_METHODS, LINKED_ACCOUNT_TYPES, EXTERNAL_WALLET_TYPES, EVM_WALLETS, SOLANA_WALLETS, COSMOS_WALLETS, formatAssetQuantity, formatCurrency, type EstimateTransactionOpts, type EstimateTransactionResult, type BroadcastTransactionOpts, type BroadcastTransactionResult, type PendingTransactionEntity, type SerializedDecodedTx, type SerializedTxData, type GetPendingTransactionResponse, DeliveryChannel, type PartnerThemeConfig as Theme, } from '@getpara/user-management-client';
+export { PopupType, PregenIdentifierType, type AuthStateSignup, type AuthStateVerify, type AuthStateLogin, type AuthState, type OAuthResponse, type CoreAuthInfo, type SignatureRes, type FullSignatureRes, type SuccessfulSignatureRes, type DeniedSignatureRes, type DeniedSignatureResWithUrl, type Wallet, type AvailableWallet, type AccountLinkInProgress, AccountLinkError, type InternalInterface, type Verify2faParams, type Verify2faResponse, type VerifyMfaParams, type AuthStateMfa, type StorageType, type TelegramParams, type CreateParaSignerBaseOptions, } from './types/index.js';
 export * from './types/smartAccounts.js';
 export * from './types/coreApi.js';
 export * from './types/events.js';

package/dist/types/services/AuthService.d.ts

@@ -9,7 +9,7 @@ import { WalletService } from './WalletService.js';
 import type { WaitForLoginMethod } from './types/LoginFlowServiceTypes';
 import type { WaitForSignupMethod, WaitForWalletCreationMethod } from './types/SignupFlowServiceTypes';
 import { PerformVerifyExternalWalletMethod, PerformVerifyFarcasterMethod, PerformVerifyNewAccountMethod, PerformVerifyTelegramMethod, RetryVerifyExternalWalletMethod, VerifyExternalWalletMethod, VerifyFarcasterMethod, VerifyNewAccountMethod, VerifyTelegramMethod } from './types/VerificationFlowServiceTypes.js';
-import type { AddCredentialMethod, AssertIsAuthSetMethod, AssertUserIdMethod, AuthenticateWithEmailOrPhoneMethod, AuthenticateWithOAuthMethod, ConnectExternalWalletMethod, GetNewCredentialAndUrlMethod, LoginExternalWalletMethod, PerformLoginExternalWalletMethod, PerformSignUpOrLogInMethod, PrepareAuthStateMethod, PrepareLoginStateMethod, ResendVerificationCodeMethod, SetAuthMethod, SignExternalWalletVerificationMethod, SignUpOrLogInMethod, SupportedUserAuthMethodsMethod, VerifyOAuthProcessMethod } from './types/AuthServiceTypes.js';
+import type { AddCredentialMethod, AssertIsAuthSetMethod, AssertUserIdMethod, AuthenticateWithEmailOrPhoneMethod, AuthenticateWithOAuthMethod, ConnectExternalWalletMethod, EnrollMfaMethod, GetNewCredentialAndUrlMethod, LoginExternalWalletMethod, PerformLoginExternalWalletMethod, PerformSignUpOrLogInMethod, PrepareAuthStateMethod, PrepareLoginStateMethod, ResendVerificationCodeMethod, ResolveMfaMethod, VerifyMfaMethod, SetAuthMethod, SignExternalWalletVerificationMethod, SignUpOrLogInMethod, SupportedUserAuthMethodsMethod, VerifyOAuthProcessMethod } from './types/AuthServiceTypes.js';
 export declare class AuthService {
     #private;
     userId?: string;
@@ -60,6 +60,15 @@ export declare class AuthService {
     connectExternalWallet: ConnectExternalWalletMethod;
     signExternalWalletVerification: SignExternalWalletVerificationMethod;
     verifyOAuthProcess: VerifyOAuthProcessMethod;
+    /**
+     * Login-time 2FA (ENG-6906): after the second factor has been satisfied/enrolled
+     * server-side, re-poll the login status to advance the flow. Fires RESOLVE_2FA,
+     * which re-enters verify-oauth polling (now returning stage:'done') and routes
+     * onward to awaiting_session_start / authenticated.
+     */
+    resolveMfa: ResolveMfaMethod;
+    enrollMfa: EnrollMfaMethod;
+    verifyMfa: VerifyMfaMethod;
     authenticateWithOAuth: AuthenticateWithOAuthMethod;
     performVerifyTelegram: PerformVerifyTelegramMethod;
     verifyTelegram: VerifyTelegramMethod;

package/dist/types/services/types/AuthServiceTypes.d.ts

@@ -1,5 +1,5 @@
-import type { Auth, AuthExtras, AuthMethod, AuthType, DeliveryChannel, ExternalWalletInfo, PrimaryAuth, PrimaryAuthInfo, ServerAuthState, ServerAuthStateLogin, TAuthMethod, PartnerThemeConfig, TOAuthMethod } from '@getpara/user-management-client';
-import type { AuthState, AuthStateDone, AuthStateLogin, AuthStateSignup, AuthStateVerify, CoreAuthInfo, WithCustomTheme, WithSessionLookupId, WithShorten, WithUseShortUrls } from '../../types/index.js';
+import type { Auth, AuthExtras, AuthMethod, AuthType, DeliveryChannel, EnrollMfaResponse, ExternalWalletInfo, PrimaryAuth, PrimaryAuthInfo, ServerAuthState, ServerAuthStateLogin, TAuthMethod, PartnerThemeConfig, TOAuthMethod, VerifyMfaResult } from '@getpara/user-management-client';
+import type { AuthState, AuthStateDone, AuthStateLogin, AuthStateMfa, AuthStateSignup, AuthStateVerify, CoreAuthInfo, VerifyMfaParams, WithCustomTheme, WithSessionLookupId, WithShorten, WithUseShortUrls } from '../../types/index.js';
 import type { InitOAuthPollingParams, PollingCallbacks } from './PollingServiceTypes.js';
 import { PerformConnectExternalWalletResponse, ExternalSignMessageParams } from './ExternalWalletServiceTypes.js';
 import { BaseVerifyExternalWalletParams } from './VerificationFlowServiceTypes.js';
@@ -96,8 +96,11 @@ interface PerformLoginExternalWalletResponse {
 export type PerformLoginExternalWalletMethod = (_: LoginExternalWalletParams) => Promise<PerformLoginExternalWalletResponse>;
 export interface VerifyOAuthProcessParams extends PollingCallbacks, InitOAuthPollingParams {
 }
-export type VerifyOAuthProcessResponse = AuthStateLogin | AuthStateSignup | AuthStateDone;
+export type VerifyOAuthProcessResponse = AuthStateLogin | AuthStateSignup | AuthStateDone | AuthStateMfa;
 export type VerifyOAuthProcessMethod = (_: VerifyOAuthProcessParams) => Promise<VerifyOAuthProcessResponse>;
+export type EnrollMfaMethod = () => Promise<EnrollMfaResponse>;
+export type VerifyMfaMethod = (_: VerifyMfaParams) => Promise<VerifyMfaResult>;
+export type ResolveMfaMethod = (_?: PollingCallbacks) => Promise<AuthState>;
 export interface AuthenticateWithOAuthParams extends WithCustomTheme, WithUseShortUrls {
     /**
      * The third-party OAuth service.

package/dist/types/state/CoreStateManager.d.ts

@@ -33,4 +33,5 @@ export declare class CoreStateManager {
     private notifyListeners;
     private statesEqual;
     private authStateInfoEqual;
+    private mfaEqual;
 }

package/dist/types/state/machines/authStateMachine.d.ts

@@ -216,7 +216,7 @@ export declare function createAuthStateMachine(paraCoreInterface: StateMachineIn
         type: "canRetryNewAccount";
         params: unknown;
     };
-}>, never, "error" | "checking_state" | "clearing_state" | "unauthenticated" | "authenticating_email_phone" | "authenticating_oauth" | "connecting_external_wallet" | "switching_external_wallet" | "authenticating_external_wallet" | "authenticating_telegram" | "authenticating_telegram_legacy" | "authenticating_farcaster" | "authenticating_farcaster_legacy" | "waiting_for_farcaster" | "processing_authentication" | "awaiting_wallet_signature" | "awaiting_wallet_verification" | "awaiting_account_verification" | "awaiting_session_start" | "verifying_new_account" | "verifying_external_wallet" | "waiting_for_session" | "authenticated" | "guest_mode" | "signing_external_wallet_verification", string, AuthInput, {}, import("xstate").EventObject, import("xstate").MetaObject, {
+}>, never, "error" | "checking_state" | "clearing_state" | "unauthenticated" | "authenticating_email_phone" | "authenticating_oauth" | "connecting_external_wallet" | "switching_external_wallet" | "authenticating_external_wallet" | "authenticating_telegram" | "authenticating_telegram_legacy" | "authenticating_farcaster" | "authenticating_farcaster_legacy" | "waiting_for_farcaster" | "processing_authentication" | "awaiting_wallet_signature" | "awaiting_wallet_verification" | "awaiting_account_verification" | "awaiting_2fa" | "awaiting_2fa_enrollment" | "resolving_2fa" | "awaiting_session_start" | "verifying_new_account" | "verifying_external_wallet" | "waiting_for_session" | "authenticated" | "guest_mode" | "signing_external_wallet_verification", string, AuthInput, {}, import("xstate").EventObject, import("xstate").MetaObject, {
     readonly id: "auth";
     readonly initial: "checking_state";
     readonly context: ({ input: { coreRef } }: {
@@ -2041,6 +2041,26 @@ export declare function createAuthStateMachine(paraCoreInterface: StateMachineIn
                         };
                     }];
                     readonly guard: import("xstate/dist/declarations/src/guards.js").GuardPredicate<AuthContext, import("xstate").DoneActorEvent<AuthState, string>, unknown, never>;
+                }, {
+                    readonly target: "awaiting_2fa_enrollment";
+                    readonly actions: readonly ["storeAuthStateResult", {
+                        readonly type: "logTransition";
+                        readonly params: {
+                            readonly to: "awaiting_2fa_enrollment";
+                            readonly detail: "mfa enroll";
+                        };
+                    }];
+                    readonly guard: ({ event }: import("xstate/dist/declarations/src/guards.js").GuardArgs<AuthContext, import("xstate").DoneActorEvent<AuthState, string>>) => boolean;
+                }, {
+                    readonly target: "awaiting_2fa";
+                    readonly actions: readonly ["storeAuthStateResult", {
+                        readonly type: "logTransition";
+                        readonly params: {
+                            readonly to: "awaiting_2fa";
+                            readonly detail: "mfa verify";
+                        };
+                    }];
+                    readonly guard: ({ event }: import("xstate/dist/declarations/src/guards.js").GuardArgs<AuthContext, import("xstate").DoneActorEvent<AuthState, string>>) => boolean;
                 }, {
                     readonly target: "awaiting_session_start";
                     readonly actions: readonly ["storeAuthStateResult", {
@@ -2100,6 +2120,62 @@ export declare function createAuthStateMachine(paraCoreInterface: StateMachineIn
                 };
             };
         };
+        readonly awaiting_2fa: {
+            readonly on: {
+                readonly RESOLVE_2FA: {
+                    readonly target: "resolving_2fa";
+                    readonly actions: readonly ["setPollingCallbacks", "resetError"];
+                };
+                readonly CANCEL: {
+                    readonly target: "unauthenticated";
+                    readonly actions: readonly ["resetState"];
+                };
+            };
+        };
+        readonly awaiting_2fa_enrollment: {
+            readonly on: {
+                readonly RESOLVE_2FA: {
+                    readonly target: "resolving_2fa";
+                    readonly actions: readonly ["setPollingCallbacks", "resetError"];
+                };
+                readonly CANCEL: {
+                    readonly target: "unauthenticated";
+                    readonly actions: readonly ["resetState"];
+                };
+            };
+        };
+        readonly resolving_2fa: {
+            readonly entry: readonly [{
+                readonly type: "logTransition";
+                readonly params: {
+                    readonly to: "resolving_2fa";
+                };
+            }];
+            readonly invoke: {
+                readonly src: "polling";
+                readonly input: ({ context }: {
+                    context: AuthContext;
+                    event: AuthEvents;
+                    self: import("xstate").ActorRef<import("xstate").MachineSnapshot<AuthContext, AuthEvents, Record<string, import("xstate").AnyActorRef>, import("xstate").StateValue, string, unknown, any, any>, AuthEvents, import("xstate").AnyEventObject>;
+                }) => {
+                    checkCondition: () => Promise<{
+                        finished: boolean;
+                        data: {
+                            authState: ServerAuthState;
+                        };
+                    }>;
+                    onPoll: () => void;
+                    onCancel: () => void;
+                    isCanceled: () => boolean;
+                    id: string;
+                };
+                readonly onError: {
+                    readonly target: "error";
+                    readonly actions: any;
+                };
+            };
+            readonly on: any;
+        };
         readonly awaiting_session_start: {
             readonly on: {
                 readonly WAIT_FOR_SESSION: {