@getpara/shared 1.29.0 → 1.31.0

package/dist/types/types/authFactor.d.ts

@@ -1,13 +1,11 @@
 import { TOAuthMethod } from './auth.js';
 import { TExternalWalletType, TExternalWallet } from './wallet.js';
 /**
- * Auth factors are the ways an account authenticates: the identity-bearing
- * FIRST factors (email, phone, OAuth, external wallet) plus, going forward,
- * SECOND factors. This is the correct "authentication factor" model.
+ * Auth factors are the ways an account authenticates: the identity-bearing FIRST factors (email, phone,
+ * OAuth, external wallet) plus, going forward, SECOND factors.
  *
- * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/
- * BASIC_LOGIN), which describes the legacy credential/unlock methods and is
- * being retired with the enclave migration. Existing passkeys/PINs/passwords/
+ * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/BASIC_LOGIN) — legacy
+ * credential/unlock methods being retired with the enclave migration. Existing passkeys/PINs/passwords/
  * TOTP are NEVER represented here — they stay in their own tables and age out.
  */
 export declare const AUTH_FACTOR_TYPES: readonly ["EMAIL", "PHONE", "OAUTH", "PASSKEY", "PASSWORD", "PIN", "TOTP", "EXTERNAL_WALLET"];
@@ -15,26 +13,23 @@ export type TAuthFactorType = (typeof AUTH_FACTOR_TYPES)[number];
 /** Which factor in the authentication sequence this is. */
 export declare const AUTH_FACTOR_TIERS: readonly ["FIRST", "SECOND"];
 export type TAuthFactorTier = (typeof AUTH_FACTOR_TIERS)[number];
-export declare const AUTH_FACTOR_STATUSES: readonly ["PENDING", "VERIFIED", "REVOKED"];
+export declare const AUTH_FACTOR_STATUSES: readonly ["PENDING", "VERIFIED", "UNVERIFIED", "REVOKED"];
 export type TAuthFactorStatus = (typeof AUTH_FACTOR_STATUSES)[number];
 /** How this factor came to be attached to the account (drives migration/audit). */
 export declare const AUTH_FACTOR_PROVENANCES: readonly ["SIGNUP", "EXPLICIT_LINK", "IMPLICIT_MERGE_LEGACY", "MIGRATION"];
 export type TAuthFactorProvenance = (typeof AUTH_FACTOR_PROVENANCES)[number];
 /**
- * Provider behind a factor: OAuth providers (GOOGLE/APPLE/…) or external-wallet
- * providers (METAMASK/PHANTOM/…). Typed as the known unions for editor
- * autocomplete but left open to any string so we aren't limited to today's
- * providers. The psql column stays plain `text`.
+ * Provider behind a factor: OAuth providers (GOOGLE/APPLE/…) or external-wallet providers
+ * (METAMASK/PHANTOM/…). Typed as the known unions for autocomplete but left open to any string so we
+ * aren't limited to today's providers. The psql column stays plain `text`.
  */
 export type TAuthFactorProvider = TOAuthMethod | TExternalWallet | (string & {});
 /**
- * Canonical shape of an auth factor (the `auth_factors` row) — the thin
- * identity/tier/status index over an account's login factors. Consumed by the
- * backend and new SDKs.
+ * Canonical shape of an auth factor (the `auth_factors` row) — the thin identity/tier/status index over an
+ * account's login factors. Consumed by the backend and new SDKs.
  *
- * The credential secret (for PASSKEY/PASSWORD/PIN/TOTP) is NOT stored here;
- * `mechanicId` points at the row in the mechanic table (passwords /
- * biometrics / two_factor_authentications). In E1 the secret-bearing types are
+ * The credential secret (PASSKEY/PASSWORD/PIN/TOTP) is NOT stored here; `mechanicId` points at the row in the
+ * mechanic table (passwords / biometrics / two_factor_authentications). In E1 the secret-bearing types are
  * never populated and `mechanicId` stays null.
  */
 export type AuthFactor<D extends Date | string = Date> = {
@@ -53,9 +48,8 @@ export type AuthFactor<D extends Date | string = Date> = {
     metadata?: Record<string, unknown> | null;
     provenance: TAuthFactorProvenance;
     /**
-     * FK to the mechanic-table row holding the secret (for PASSKEY/PASSWORD/PIN/
-     * TOTP). Exactly one is set on a secret-bearing factor; all null otherwise.
-     * Currently always null.
+     * FK to the mechanic-table row holding the secret (PASSKEY/PASSWORD/PIN/TOTP). Exactly one is set on a
+     * secret-bearing factor; all null otherwise. Currently always null.
      */
     passwordId?: string | null;
     biometricId?: string | null;
@@ -66,9 +60,49 @@ export type AuthFactor<D extends Date | string = Date> = {
     updatedAt: D;
 };
 /**
- * A wallet connected for use only (not an auth factor). Also the billing
- * record for connection-only MAUs. `userId` is null for a pure connection
- * (one with no associated account).
+ * A display-ready projection of an auth factor for the account-management UI (list / unlink). DE-NORMALIZED
+ * for presentation vs the raw `AuthFactor` row: `identifier` is the human value (an OAuth factor's
+ * `"<provider>:<subject>"` stripped back to `<subject>`, matching the legacy linked-account UI), and
+ * `displayName`/`pfpUrl` are lifted out of `metadata`. The two flags carry the unlink guardrails to the
+ * client so the UI can disable the control without re-deriving the rule: `isCurrentSessionFactor` marks the
+ * factor that authenticated the calling session, `isUnlinkable` is false for that factor AND for the
+ * account's last remaining usable factor. Covers every listable type: EMAIL / PHONE / OAUTH /
+ * EXTERNAL_WALLET / CUSTOM_OAUTH+CUSTOM_OIDC (both carried on OAUTH). (ENG-7075)
+ */
+export type AuthFactorView<D extends Date | string = Date> = {
+    id: string;
+    type: TAuthFactorType;
+    /** OAuth provider (GOOGLE/…/CUSTOM_OAUTH/CUSTOM_OIDC) or wallet provider (METAMASK/…). */
+    provider?: TAuthFactorProvider | null;
+    /** Human identifier: email / E.164 phone / wallet address / OAuth subject (de-namespaced from the factor). */
+    identifier: string;
+    /** Chain for EXTERNAL_WALLET factors. */
+    chainType?: TExternalWalletType | null;
+    /** Provider display name (lifted from metadata), when the provider supplied one. */
+    displayName?: string;
+    /** Provider profile-picture URL (lifted from metadata), when available. */
+    pfpUrl?: string;
+    status: TAuthFactorStatus;
+    provenance: TAuthFactorProvenance;
+    /** The partner-configured connection (partner_oauth_configs.handle) that created this factor, when any. */
+    providerConfigHandle?: string | null;
+    /** The custom connection's human label (partner_oauth_configs.label, e.g. "Acme SSO") — so the UI shows the
+     *  connection name instead of a slug/subject. Custom OAuth/OIDC only. (ENG-7075) */
+    connectionLabel?: string;
+    createdAt: D;
+    verifiedAt?: D | null;
+    /** True for the exact factor the calling session authenticated with — never unlinkable (guardrail b). */
+    isCurrentSessionFactor: boolean;
+    /** False for the current-session factor and for the account's last remaining usable factor (guardrails a+b). */
+    isUnlinkable: boolean;
+};
+/** Response of the v2 list-factors endpoint. */
+export type ListAuthFactorsResponse<D extends Date | string = Date> = {
+    factors: AuthFactorView<D>[];
+};
+/**
+ * A wallet connected for use only (not an auth factor). Also the billing record for connection-only MAUs.
+ * `userId` is null for a pure connection (one with no associated account).
  */
 export type ConnectedWallet<D extends Date | string = Date> = {
     id: string;

package/dist/types/types/authFactor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authFactor.d.ts","sourceRoot":"","sources":["../../../src/types/authFactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,+FASpB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,8BAA+B,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,oBAAoB,6CAA8C,CAAC;AAEhF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,4EAA6E,CAAC;AAElH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjF;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,IAAI;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,qBAAqB,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC;IACb,SAAS,EAAE,CAAC,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,IAAI;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,CAAC,CAAC;IACpB,eAAe,EAAE,CAAC,CAAC;IACnB,SAAS,EAAE,CAAC,CAAC;IACb,SAAS,EAAE,CAAC,CAAC;CACd,CAAC"}
+{"version":3,"file":"authFactor.d.ts","sourceRoot":"","sources":["../../../src/types/authFactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,+FASpB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,8BAA+B,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMjE,eAAO,MAAM,oBAAoB,2DAA4D,CAAC;AAE9F,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,4EAA6E,CAAC;AAElH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,IAAI;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,qBAAqB,CAAC;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC;IACb,SAAS,EAAE,CAAC,CAAC;CACd,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,IAAI;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC;IACtB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,8GAA8G;IAC9G,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvC,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,qBAAqB,CAAC;IAClC,2GAA2G;IAC3G,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wFACoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC;IACb,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACtB,yGAAyG;IACzG,sBAAsB,EAAE,OAAO,CAAC;IAChC,gHAAgH;IAChH,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,IAAI;IACpE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;CAC9B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,IAAI;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,CAAC,CAAC;IACpB,eAAe,EAAE,CAAC,CAAC;IACnB,SAAS,EAAE,CAAC,CAAC;IACb,SAAS,EAAE,CAAC,CAAC;CACd,CAAC"}

package/dist/types/types/authState.d.ts

@@ -1,28 +1,25 @@
 /**
- * Status-model auth envelope returned by the `/v2/auth` endpoints and consumed
- * by the backend and new SDKs. Clerk-style: a single `status` drives the client,
- * with typed per-status fields. New statuses are added additively; a client that
- * sees a status it doesn't recognize should treat the flow as not-yet-complete
- * (show generic / hand off) rather than erroring (forward-compat).
- *
- * This is the canonical auth contract — new SDKs consume it directly instead of
- * a parallel client mirror. (ENG-6910)
+ * Status-model auth envelope returned by `/v2/auth`, consumed by the backend and new SDKs.
+ * Clerk-style: a single `status` drives the client, with typed per-status fields. Statuses are added
+ * additively; an unrecognized one is treated as not-yet-complete (show generic / hand off), never an
+ * error (forward-compat). The canonical auth contract — new SDKs consume it directly, not a parallel
+ * client mirror. (ENG-6910)
  */
-import type { MfaChallenge, TAuthMethod, TOAuthMethod } from './auth.js';
+import type { AuthFactorView } from './authFactor.js';
+import type { MfaChallenge, TAuthMethod, TelegramAuthResponse, TOAuthMethod } from './auth.js';
 import type { DeliveryChannel } from './otp.js';
 import type { TWalletType } from './wallet.js';
 /**
- * Flow statuses. Only `needs_verification` and `authenticated` are emitted today;
- * the rest are reserved so the contract is forward-stable and added to as the
- * slices that emit them land (credential setup, cross-method link prompt).
+ * Flow statuses. Only `needs_verification` and `authenticated` are emitted today; the rest are
+ * reserved for forward-stability, emitted as their slices land (credential setup, link prompt).
  */
-export declare const AUTH_STATUSES: readonly ["needs_verification", "needs_credential", "needs_link", "needs_second_factor", "authenticated"];
+export declare const AUTH_STATUSES: readonly ["needs_verification", "needs_credential", "needs_link", "needs_second_factor", "authenticated", "linked", "needs_step_up", "unlinked"];
 export type TAuthStatus = (typeof AUTH_STATUSES)[number];
 /**
- * First-factor methods the `/v2/auth` flow handles. Email/phone authenticate via a delivered
- * one-time code; external-wallet by signing a SIWE challenge; passkey by a WebAuthn assertion
- * (usernameless — resolved from the credential at `continue`); oauth by a provider redirect
- * (the specific provider rides on the flow; the account is resolved at `continue`). (ENG-6911)
+ * First-factor methods `/v2/auth` handles: email/phone via a delivered one-time code; external-wallet
+ * via a SIWE signature; passkey via a WebAuthn assertion (usernameless — resolved from the credential at
+ * `continue`); oauth via a provider redirect (provider rides on the flow, account resolved at
+ * `continue`). (ENG-6911)
  */
 export declare const AUTH_FLOW_METHODS: readonly ["EMAIL", "PHONE", "EXTERNAL_WALLET", "PASSKEY", "OAUTH"];
 export type TAuthFlowMethod = (typeof AUTH_FLOW_METHODS)[number];
@@ -38,132 +35,243 @@ export type AuthVerification = {
 };
 /**
  * The auth-flow envelope. `flowId` + `expiresAt` are the resumable handle
- * (`GET /v2/auth/flows/{flowId}`). `accountId` stays null until `authenticated`
- * so a pending flow never reveals whether the account already existed
- * (enumeration-safe). The session is cookie-based — `authenticated` plus the
- * `Set-Cookie` is the signal, so there is no token in the body.
+ * (`GET /v2/auth/flows/{flowId}`). `accountId` stays null until `authenticated`/`linked` so a pending
+ * flow never reveals whether the account already existed (enumeration-safe). Session is cookie-based —
+ * `authenticated` + the `Set-Cookie` is the signal, so no token in the body.
+ */
+/**
+ * Coarse summary of the EXISTING account on a `needs_link` collision — enough for the linking UI to show the
+ * value-prop ("link to reuse these N wallets") without exposing the account's id or identifier. Ships only once
+ * the incoming identity is proven (the needs_link prompt is post-proof). (ENG-7075)
+ */
+export type LinkExistingAccountSummary = {
+    /** How many wallets the existing account holds. */
+    walletCount: number;
+    /** The account's login methods (its OAuth redirect providers + EMAIL/PHONE). The card composes these into one
+     *  label ("Google + Twitter") so a single account that owns several reads as ONE account, not several. */
+    methods: (TAuthFlowMethod | TOAuthMethod)[];
+};
+/**
+ * One selectable account when a `needs_link` email is vouched by MORE THAN ONE existing account. `handle` is an
+ * opaque, flow-scoped reference (never the account id) the client passes back as `link.handle` to choose which
+ * account to link into; the server maps it to the real account. (ENG-7075)
  */
+export type LinkCandidate = LinkExistingAccountSummary & {
+    handle: string;
+};
+/**
+ * One step-up option for proving the existing account. OAuth providers carry only `method` (the redirect
+ * handshake identifies the account). EMAIL/PHONE carry a per-factor `handle` (opaque factor reference — never the
+ * row id's meaning) the client passes back as `link.handle` to pick THAT specific address/number, plus a
+ * `maskedIdentifier` for display (e.g. "t•••@gmail.com", "•••1234") — the full value never leaves the backend.
+ * An account with several emails/phones surfaces one option per factor so the user chooses which to verify.
+ * `handle`/`maskedIdentifier` are present only when the INCOMING identity is itself proven (a trusted+verified
+ * provider email, or an OTP the caller passed); an unverifiable claim gets bare method names. (ENG-6911)
+ */
+export type StepUpOption = {
+    method: TAuthFlowMethod | TOAuthMethod;
+    handle?: string;
+    maskedIdentifier?: string;
+    /**
+     * The real identifier, present ONLY on the authenticated factor-link rail (`needs_step_up`), where the caller
+     * is already signed in AS this factor — masking there hides nothing they cannot already see, and makes "where
+     * did the code go" needlessly unclear. Never sent on a `needs_link` collision: there the caller may not own
+     * the account, so `maskedIdentifier` is all they get. Prefer this for display when present. (ENG-7075)
+     */
+    identifier?: string;
+};
 export type AuthState = {
     status: TAuthStatus;
     flowId: string;
     /**
-     * ISO-8601 expiry of the flow handle. Present while the flow is pending; omitted
-     * once `authenticated` (the flow is gone and the session has its own lifetime).
+     * ISO-8601 expiry of the flow handle. Present while pending; omitted once `authenticated` (the flow
+     * is gone, the session has its own lifetime).
      */
     expiresAt?: string;
-    /** Resolved account id; null until `status === 'authenticated'`. */
+    /** Resolved account id; null until `status` is `'authenticated'` or `'linked'`. */
     accountId?: string | null;
     /**
      * Whether this `/start` (or `authenticated`) *created a new account row* vs resumed an existing one. v2
-     * never discards an account, so a resumed account — even a never-verified stub — reads `false`. Present on
-     * `authenticated` and, for account-resolved-at-start flows (email/phone, external wallet), on
-     * `needs_verification`. NOTE for the client: decide setup-vs-unlock from **empty `authMethods`** (no
-     * credential ⇒ setup), not from `isNewUser` alone — a resumed-but-unset-up account has `isNewUser: false`
-     * with no methods. See the account-info exposure note on `authMethods`. (ENG-7075)
+     * never discards an account, so a resumed one — even a never-verified stub — reads `false`. CLIENT: decide
+     * setup-vs-unlock from **empty `authMethods`** (no credential ⇒ setup), not `isNewUser` alone — a
+     * resumed-but-unset-up account is `isNewUser: false` with no methods. Present on `authenticated` and, for
+     * account-resolved-at-start flows (email/phone, external wallet), on `needs_verification`. See the exposure
+     * note on `authMethods`. (ENG-7075)
      */
     isNewUser?: boolean;
     /**
      * Whether the account's MPC user-share IS or WILL BE enclave-custodied (basic-login) vs credential-protected.
-     * The authoritative key-share-path signal — the backend asserts it so the SDK doesn't re-encode the
-     * "`BASIC_LOGIN` ⇒ enclave" rule. For a not-yet-set-up account (no user-share yet) on a BASIC_LOGIN partner
-     * this predicts `true` from the CURRENT partner's methods, so the first wallet is created enclave-custodied;
-     * the value is therefore partner-scoped (the same account can read differently across partners). On
-     * `needs_verification` it is emitted at `/start` (before any mint), on `authenticated` it mirrors the session
-     * stamp. Present on `authenticated`, and on `needs_verification` for account-resolved-at-start flows
-     * (email/phone, external wallet). (ENG-7075)
+     * The authoritative key-share-path signal — backend-asserted so the SDK doesn't re-encode the
+     * "`BASIC_LOGIN` ⇒ enclave" rule. For a not-yet-set-up account on a BASIC_LOGIN partner this predicts `true`
+     * from the CURRENT partner's methods (so the first wallet is minted enclave-custodied) — hence partner-scoped:
+     * the same account can read differently across partners. Present on `authenticated` (mirrors the session
+     * stamp) and, for account-resolved-at-start flows (email/phone, external wallet), on `needs_verification`
+     * (emitted at `/start`, before any mint). (ENG-7075)
      */
     isEnclaveUser?: boolean;
     /**
-     * The account's enrolled auth methods. The SDK reads this for the credential/method UI
-     * (`PASSKEY`/`PASSWORD`/`PIN`); the enclave decision itself comes from `isEnclaveUser` above. Mirrors
-     * the legacy `done` stage's `authMethods`. Present on `authenticated`, and on `needs_verification` for
-     * account-resolved-at-start flows (email/phone, external wallet) so the SDK can personalize its
-     * pre-verification screen (which method to offer).
+     * The account's enrolled auth methods, read by the SDK for the credential/method UI
+     * (`PASSKEY`/`PASSWORD`/`PIN`); the enclave decision itself comes from `isEnclaveUser`. Mirrors the legacy
+     * `done` stage's `authMethods`. Present on `authenticated`, and on `needs_verification` for
+     * account-resolved-at-start flows (email/phone, external wallet) to personalize the pre-verification screen.
      *
-     * EXPOSURE NOTE: emitting this (and `isNewUser`/`isEnclaveUser`/`hasPasswordWithoutPIN`) on
-     * `needs_verification` is pre-ownership-proof, so it discloses account existence + auth posture to the
-     * caller. The caller set is effectively PUBLIC, not partner-only: the `x-external-api-key` that gates
-     * `/internal/v1/auth/start` is a publishable key shipped in every partner's frontend bundle, and CORS is
-     * open — so anyone can lift it and probe `does this address have a Para account / how is it protected`.
-     * This is a deliberate product choice (the client needs it to render the pre-verification screen, and the
-     * same data is already visible on any Para-integrated site). What we still withhold is `accountId`/PII
-     * (null until `authenticated`) — which is STRICTER than legacy (`/users/init`'s login stage returned
-     * `userId`); "parity with legacy" is only directional (legacy emits a method list solely for accounts that
-     * pass `userIsComplete`). Get a security sign-off on this before the `AUTH_V2_ENABLED` flip. (ENG-7075)
+     * EXPOSURE NOTE: emitting this (plus `isNewUser`/`isEnclaveUser`/`hasPasswordWithoutPIN`) on
+     * `needs_verification` is pre-ownership-proof, so it discloses account existence + auth posture. The caller
+     * set is effectively PUBLIC, not partner-only: the `x-external-api-key` gating `/internal/v1/auth/start` is a
+     * publishable key shipped in every partner's frontend bundle and CORS is open, so anyone can lift it and
+     * probe `does this address have a Para account / how is it protected`. Deliberate: the client needs it to
+     * render the pre-verification screen, and the same data is already visible on any Para-integrated site. We
+     * still withhold `accountId`/PII (null until `authenticated`/`linked`) — STRICTER than legacy
+     * (`/users/init`'s login stage returned `userId`); "parity with legacy" is only directional (legacy emits a
+     * method list only for accounts passing `userIsComplete`). SIGNED OFF (security review, 2026-09-16): measured
+     * against `/users/exists` (keyed calls from any origin) and the legacy `stage:'login'` response (which returns
+     * `userId` + `loginAuthMethods` pre-OTP), v2 discloses at or below that level, behind `userCreateRateLimiter`.
+     * (ENG-7075)
      */
     authMethods?: TAuthMethod[];
     /**
-     * Whether the account has a real (non-PIN) password. `authMethods` reports `PASSWORD` even for a
-     * PIN-only account (legacy-SDK compat), so the SDK needs this to tell a password from a PIN — mirrors
-     * the legacy `login` stage's `hasPasswordWithoutPIN`. Present on `authenticated`, and on
-     * `needs_verification` for account-resolved-at-start flows (email/phone, external wallet). (ENG-7075)
+     * Whether the account has a real (non-PIN) password. `authMethods` reports `PASSWORD` even for a PIN-only
+     * account (legacy-SDK compat), so the SDK needs this to distinguish password from PIN. Mirrors the legacy
+     * `login` stage's field. Present on `authenticated`, and on `needs_verification` for
+     * account-resolved-at-start flows (email/phone, external wallet). (ENG-7075)
      */
     hasPasswordWithoutPIN?: boolean;
     verification?: AuthVerification;
     /** The login-time MFA challenge in flight (present while `needs_second_factor`). (ENG-6906) */
     secondFactor?: MfaChallenge;
     /**
-     * Present while `needs_verification` for a signature-based method (external wallet):
-     * the message the client must sign and send back to `continue`. (ENG-6911)
+     * Present while `needs_verification` for a signature-based proof: the external-wallet SIWE message, the
+     * passkey WebAuthn challenge, or (email/phone, returning account holding a PASSKEY) the assertion challenge
+     * the portal's passkey-unlock signs. Sent back to `continue`. (ENG-6911, ENG-7075)
      */
     challenge?: {
         message: string;
     };
     /**
-     * Present while `needs_verification` for OAuth: the provider authorization URL the client
-     * navigates to. The provider then calls our callback out-of-band; the client polls `continue`
-     * with the `flowId` to finish. (ENG-6911)
+     * Present while `needs_verification` for OAuth: the provider authorization URL to navigate to. The
+     * provider calls our callback out-of-band; the client polls `continue` with the `flowId` to finish. (ENG-6911)
      */
     redirect?: {
         url: string;
     };
     /**
-     * Present when `status === 'needs_link'`: the verified identifier from this login collides with an
-     * account established by a different method. Enumeration-safe (the user proved ownership of the
-     * identifier, and the existing account id is never exposed). `existingMethods` are the step-up
-     * options to prove the existing account — each is what the client passes back as `link.method`:
-     * an OTP method (`EMAIL`/`PHONE`) or an OAuth provider (`GOOGLE`/`FACEBOOK`/…, which re-runs that
-     * provider's handshake). An **empty** list means the incoming login already proved the identifier,
-     * so linking is a CONSENT — the client calls `link: { action: 'link' }` with no method. The client
-     * either links (step up or consent) or creates a separate account (`{ action: 'create_separate' }`).
-     * We never auto-merge. (ENG-6911)
+     * Present when `status === 'needs_link'`: this login's identifier collides with an account established by a
+     * different method. The account's id/identifier are never exposed — only a coarse, post-proof
+     * `existingAccount` summary (wallet count + a representative method) for the linking card. `mode` makes the
+     * required action explicit:
+     *  - `{ mode: 'consent' }` — the incoming login already CRYPTOGRAPHICALLY proved the identifier (a trusted+
+     *    verified OAuth email), so linking is one-click: `link: { action: 'link' }`, no method.
+     *  - `{ mode: 'step_up', methods }` — identifier NOT self-proven, so prove the existing account by re-proving
+     *    ONE of `methods` (each passed back as `link.method`): an OTP method (`EMAIL`/`PHONE`) or an OAuth provider
+     *    (re-runs that handshake). Empty `methods` ⇒ no step-up available, client can only create separate.
+     *  - `{ mode: 'select', candidates }` — the identifier is vouched by MORE THAN ONE existing account; the client
+     *    picks one (`link: { action: 'select', handle }`), then the flow re-surfaces `step_up` for that account.
+     * The client either links (consent/step-up), selects a candidate, or creates a separate account
+     * (`{ action: 'create_separate' }`). Never auto-merge. `existingAccount` is ABSENT on `step_up` when the
+     * incoming identity is unproven (an untrusted provider's email claim): nothing about the colliding account is
+     * disclosed until the caller proves something. (ENG-6911, ENG-7075)
      */
     link?: {
-        existingMethods?: (TAuthFlowMethod | TOAuthMethod)[];
+        mode: 'consent';
+        existingAccount: LinkExistingAccountSummary;
+    } | {
+        mode: 'step_up';
+        methods: StepUpOption[];
+        existingAccount?: LinkExistingAccountSummary;
+    } | {
+        mode: 'select';
+        candidates: LinkCandidate[];
     };
     /**
-     * Present on `authenticated` for an OAuth/OIDC login: which provider (and, when the login resolved
-     * through a partner-configured connection, that connection's stable `configHandle` + human `label`)
-     * authenticated the user — so the client can render "via Acme SSO" and offer per-connection revoke
-     * without a later reshape. `configHandle`/`label` are absent for logins on Para-global creds. (ENG-7008)
+     * Present on `needs_step_up`: the ways the caller may prove the account they are adding a factor TO. One
+     * option per usable FIRST-tier factor the account actually holds — email/phone (OTP, `handle` = factor id),
+     * an OAuth provider (redirect), or an external wallet (SIWE, `handle` = factor id).
+     *
+     * Distinct from `link.mode === 'step_up'`, which proves a COLLIDING account the caller has not logged into.
+     * Here the caller already holds a session for the account; the proof exists because a session alone must not
+     * authorize binding a new login factor — otherwise a stolen session becomes permanent access. Identifiers are
+     * masked for display only; the server picks the factor a proof is judged against. (ENG-7075)
+     */
+    stepUp?: {
+        methods: StepUpOption[];
+    };
+    /**
+     * Present on `authenticated` for an OAuth/OIDC login: which provider authenticated the user (plus, for a
+     * partner-configured connection, its stable `configHandle` + human `label`) — so the client renders "via
+     * Acme SSO" and offers per-connection revoke. `configHandle`/`label` absent on Para-global creds. (ENG-7008)
      */
     attribution?: {
         provider: TOAuthMethod;
         configHandle?: string;
         label?: string;
     };
+    /**
+     * Present on `linked`: the display-ready view of the factor the link flow just attached, so the client
+     * updates its factor list without a refetch. (ENG-7075)
+     */
+    factor?: AuthFactorView<string>;
+    /**
+     * Present on `unlinked`: the account's factor list AFTER the revoke, so the client re-renders without a
+     * second round-trip — the same courtesy `linked` does with `factor`. (ENG-7075)
+     */
+    factors?: AuthFactorView<string>[];
+    /**
+     * Present on `authenticated`: the initiating SDK session's lookup id — the session the backend bridged this
+     * login onto. The portal completes post-login (sessionAuth / share access) off THIS session, not a
+     * URL-threaded one, so the flow stays flowId-only (no sessionId on the OAuth callback URL). Omitted if the
+     * flow carried no initiating lookup (start always self-mints one). (ENG-7075)
+     */
+    sessionLookupId?: string;
+    /**
+     * Present on `authenticated` for an EXTERNAL_WALLET login: full-Para-auth (mint an embedded Para wallet) vs
+     * verify-only (prove ownership, no wallet), carried from the `/start` body. The portal reads this to SKIP the
+     * post-login wallet tail (all-wallets fetch / keyshare / migration) for verify-only — the flowId-only v2
+     * portal URL never seeds the client's `authInfo.externalWallet`, so this is the portal's only
+     * server-authoritative verify-vs-full signal. (ENG-7075)
+     */
+    externalWallet?: {
+        withFullParaAuth: boolean;
+    };
 };
 /**
- * Request bodies for the method-agnostic `/v2/auth` surface — the counterpart to the `AuthState`
- * response, kept here so the request+response contract is single-source across the backend handlers
- * (which validate `req.body` against these) and the SDK client (which constructs them). The backend
- * still runtime-validates every field; these types are the compile-time contract, not the trust
- * boundary. (ENG-6910 / ENG-6911)
+ * Request bodies for the method-agnostic `/v2/auth` surface — counterpart to the `AuthState` response,
+ * kept here so the request+response contract is single-source across the backend handlers (which validate
+ * `req.body`) and the SDK client (which constructs them). The backend still runtime-validates every field;
+ * these types are the compile-time contract, not the trust boundary. (ENG-6910 / ENG-6911)
+ */
+/**
+ * `start` body — discriminated by `method`; each carries only the fields its flow needs.
+ *
+ * `intent: 'link'` turns a start into an authenticated-user ADD-factor flow instead of a login: it binds to
+ * the CALLING SESSION's account (session cookie required), runs the same proof screen (OTP / SIWE / OAuth
+ * redirect), and `continue` ATTACHES the proven factor to that account (status `linked`) unless the identity
+ * already belongs to another account (409). PASSKEY does not participate in linking. Absent intent = normal
+ * login (unchanged). (ENG-7075)
  */
-/** `start` body — discriminated by `method`. Each method carries only the fields its flow needs. */
 export type AuthStartBody = {
     method: 'EMAIL';
     email: string;
+    intent?: 'link';
 } | {
     method: 'PHONE';
     phone: string;
     countryCode?: string;
+    intent?: 'link';
 } | {
     method: 'EXTERNAL_WALLET';
     address: string;
     chainType: TWalletType;
     uri: string;
     chainId?: string;
+    /**
+     * Full-Para-auth (mint an embedded Para wallet) vs verify-only (prove ownership, no wallet). Carried
+     * onto the flow at `/start` and mirrored back on the `authenticated` envelope
+     * (`externalWallet.withFullParaAuth`) so the portal can skip the wallet tail for verify-only — the
+     * flowId-only v2 portal URL never seeds `authInfo.externalWallet`, so this is its only
+     * server-authoritative signal. Absent ⇒ verify-only. (ENG-7075)
+     */
+    withFullParaAuth?: boolean;
+    intent?: 'link';
 } | {
     method: 'PASSKEY';
 } | {
@@ -171,13 +279,18 @@ export type AuthStartBody = {
     provider: TOAuthMethod;
     returnUrl?: string;
     providerConfigHandle?: string;
+    /** Farcaster (POLL) only: the mobile app scheme baked into the SIWF channel's redirect for deeplink-back. */
+    appScheme?: string;
+    intent?: 'link';
 };
-/** How a `needs_link` collision is resolved: step up to the existing account, or fork a separate one. */
-export type AuthLinkAction = 'link' | 'create_separate';
 /**
- * `continue` body — always the `flowId` plus the per-state proof. The endpoint is overloaded by the
- * flow's server-side state rather than a body discriminant, so each proof field is optional and the
- * relevant one is sent for the state the flow is in.
+ * How a `needs_link` collision is resolved: `select` a candidate (multi-account), `link` (step up to / consent
+ * into the existing account), or `create_separate` (fork a new one).
+ */
+export type AuthLinkAction = 'link' | 'create_separate' | 'select';
+/**
+ * `continue` body — always the `flowId` plus the per-state proof. The endpoint is overloaded by the flow's
+ * server-side state, not a body discriminant, so each proof field is optional and only the relevant one is sent.
  */
 export type AuthContinueBody = {
     flowId: string;
@@ -187,14 +300,37 @@ export type AuthContinueBody = {
     signature?: string;
     cosmosSigner?: string;
     cosmosPublicKeyHex?: string;
-    /** Passkey: the WebAuthn assertion. */
+    /** Passkey: the WebAuthn assertion — for a PASSKEY flow, or as a returning account's credential completion
+     *  of an EMAIL/PHONE flow (signs the challenge the start envelope carried). */
     credentialId?: string;
     clientDataJSON?: string;
     authenticatorData?: string;
-    /** Cross-method linking: resolve a `needs_link` collision. */
+    /**
+     * Password/PIN credential completion of an EMAIL/PHONE flow (returning non-enclave account): the
+     * RSA-challenge signature over the portal session's web challenge, plus the signing key's stored public key
+     * (selects among the ACCOUNT's own password rows server-side — never trusted as an identity). (ENG-7075)
+     */
+    credentialSignature?: string;
+    credentialPublicKey?: string;
+    /** Telegram (WIDGET mechanism): the signed Login Widget payload, HMAC-verified server-side. (ENG-7075) */
+    telegramAuthResponse?: TelegramAuthResponse;
+    /** Cross-method linking: resolve a `needs_link` collision. `method` is the step-up method being proved — an
+     *  OTP method (`EMAIL`/`PHONE`) or an OAuth provider. `handle` picks a candidate account in `select` mode. */
     link?: {
         action: AuthLinkAction;
-        method?: TOAuthMethod;
+        method?: TAuthFlowMethod | TOAuthMethod;
+        handle?: string;
+    };
+    /**
+     * Factor-link step-up (`needs_step_up`): which of the session account's own factors is being proved.
+     * `method` is an OTP method (`EMAIL`/`PHONE`), `EXTERNAL_WALLET`, or an OAuth provider; `handle` picks the
+     * exact factor when the account holds several of that type. Sending it with no proof STARTS the step-up
+     * (delivers the code / issues the challenge / returns the redirect); the proof itself then arrives in the
+     * matching field (`code`, `signature`) or via the provider callback. (ENG-7075)
+     */
+    stepUp?: {
+        method: TAuthFlowMethod | TOAuthMethod;
+        handle?: string;
     };
     /** OAuth step-up (during linking): where the provider callback returns to. */
     returnUrl?: string;

package/dist/types/types/authState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authState.d.ts","sourceRoot":"","sources":["../../../src/types/authState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,aAAa,2GAMhB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oEAAqE,CAAC;AAEpG,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,+FAA+F;IAC/F,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,CAAC,eAAe,GAAG,YAAY,CAAC,EAAE,CAAA;KAAE,CAAC;IAChE;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF,CAAC;AAEF;;;;;;GAMG;AAEH,oGAAoG;AACpG,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACrG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,iBAAiB,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,CAAA;KAAE,CAAC;IACzD,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAA;CAAE,CAAC"}
+{"version":3,"file":"authState.d.ts","sourceRoot":"","sources":["../../../src/types/authState.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,aAAa,kJAShB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oEAAqE,CAAC;AAEpG,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;8GAC0G;IAC1G,OAAO,EAAE,CAAC,eAAe,GAAG,YAAY,CAAC,EAAE,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,0BAA0B,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,eAAe,GAAG,YAAY,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,+FAA+F;IAC/F,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EACD;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,eAAe,EAAE,0BAA0B,CAAA;KAAE,GAChE;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,YAAY,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,0BAA0B,CAAA;KAAE,GAC1F;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IACE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;mFAC+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;kHAC8G;IAC9G,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5F;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,eAAe,GAAG,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAA;CAAE,CAAC"}

package/dist/types/types/partner.d.ts

@@ -15,6 +15,8 @@ export declare const LOGIN_TWO_FACTOR_MODES: readonly ["disabled", "optional", "
 export type LoginTwoFactorMode = (typeof LOGIN_TWO_FACTOR_MODES)[number];
 export interface IPartnerFeatureFlags {
     authV2?: boolean;
+    permissionsV2UserParameters?: boolean;
+    permissionsV2ConditionalApprovals?: boolean;
 }
 export interface IPartnerEntity {
     id: string;

package/dist/types/types/partner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"partner.d.ts","sourceRoot":"","sources":["../../../src/types/partner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,YAAY,EACZ,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAED,oBAAY,UAAU;IACpB,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAUD,eAAO,MAAM,sBAAsB,+CAAgD,CAAC;AACpF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzE,MAAM,WAAW,oBAAoB;IAKnC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAGD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,cAAc,EAAE,kBAAkB,CAAC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACzC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,kCAAkC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,2BAA2B,CAAC,EAAE,eAAe,CAAC;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,oBAAoB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC1D,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,YAAY,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAM3C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE7C,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC"}
+{"version":3,"file":"partner.d.ts","sourceRoot":"","sources":["../../../src/types/partner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,YAAY,EACZ,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAED,oBAAY,UAAU;IACpB,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAUD,eAAO,MAAM,sBAAsB,+CAAgD,CAAC;AACpF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzE,MAAM,WAAW,oBAAoB;IAKnC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,iCAAiC,CAAC,EAAE,OAAO,CAAC;CAC7C;AAGD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,cAAc,EAAE,kBAAkB,CAAC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACzC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,kCAAkC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,2BAA2B,CAAC,EAAE,eAAe,CAAC;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,oBAAoB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC1D,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,YAAY,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAM3C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE7C,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC"}