@getpara/shared 1.30.0 → 1.32.0

package/dist/cjs/index.js

@@ -40,6 +40,7 @@ exports.transactionTypes = void 0;
 __exportStar(require("./types/index.js"), exports);
 __exportStar(require("./types/permissions.js"), exports);
 __exportStar(require("./schemas/permissionsV2.js"), exports);
+__exportStar(require("./schemas/permissionsV2Lifecycle.js"), exports);
 __exportStar(require("./schemas/permissionsV2UserParameters.js"), exports);
 __exportStar(require("./utils/index.js"), exports);
 const transactionTypes = __importStar(require("./types/transaction.js"));

package/dist/cjs/schemas/permissionsV2.js

@@ -617,6 +617,7 @@ exports.permissionsV2TransactionSignatureCollectionSchema = zod_1.z
 exports.permissionsV2ConditionalApprovalCaseListSchema = zod_1.z
     .object({
     cases: zod_1.z.array(exports.permissionsV2ConditionalApprovalCaseViewSchema),
+    nextBeforeCaseId: conditionalApprovalIdentifierSchema.optional(),
 })
     .strict();
 exports.permissionsV2PolicyRuleSchema = zod_1.z

package/dist/cjs/schemas/permissionsV2Lifecycle.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.permissionsV2AuthorizationConfigurationHistorySchema = exports.permissionsV2AuthorizationScopeBindingHistorySchema = exports.permissionsV2AuthoritySetHistorySchema = exports.permissionsV2AuthorizationScopeMembersSchema = exports.permissionsV2AuthorizationScopeCapabilitiesSchema = exports.permissionsV2EffectiveAuthorizationConfigurationSchema = exports.permissionsV2ResolvedConditionalApprovalRequirementSchema = exports.permissionsV2ConditionalRequirementListSchema = exports.permissionsV2ConditionalRequirementViewSchema = exports.permissionsV2ConditionalApprovalPartnerCaseListSchema = exports.permissionsV2ConditionalApprovalCaseSummarySchema = exports.permissionsV2PolicyUsageSchema = exports.permissionsV2PolicyUsageMeterSchema = exports.permissionsV2PolicyVersionsResponseSchema = exports.permissionsV2PolicyResponseSchema = exports.permissionsV2PolicyListResponseSchema = exports.permissionsV2PolicyViewSchema = void 0;
+const zod_1 = require("zod");
+const permissionsV2_js_1 = require("./permissionsV2.js");
+const nonEmptyStringSchema = zod_1.z.string().min(1);
+const positiveRevisionSchema = zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const permissionsV2PolicyViewSelectorSchema = permissionsV2_js_1.permissionsV2PartnerAuthoredPolicySelectorSchema.extend({
+    actorId: nonEmptyStringSchema.optional(),
+    partnerId: nonEmptyStringSchema.optional(),
+    appId: nonEmptyStringSchema.optional(),
+    userId: nonEmptyStringSchema.optional(),
+    walletOwnerPartnerId: nonEmptyStringSchema.optional(),
+    feature: nonEmptyStringSchema.optional(),
+});
+exports.permissionsV2PolicyViewSchema = zod_1.z
+    .object({
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    lifecycle: zod_1.z.enum(['active', 'inactive', 'superseded', 'archived']),
+    activation: zod_1.z
+        .object({
+        effectiveFrom: zod_1.z.string().datetime(),
+        effectiveUntil: zod_1.z.string().datetime().optional(),
+    })
+        .strict(),
+    binding: zod_1.z
+        .object({ kind: zod_1.z.literal('user_consent'), subject: zod_1.z.literal('user_wallet') })
+        .strict()
+        .optional(),
+    policy: zod_1.z
+        .object({
+        id: nonEmptyStringSchema,
+        schemaVersion: zod_1.z.literal('permissions.policy.v1'),
+        version: nonEmptyStringSchema,
+        layer: zod_1.z.literal('partner'),
+        selector: permissionsV2PolicyViewSelectorSchema,
+        rules: zod_1.z.array(permissionsV2_js_1.permissionsV2PolicyRuleSchema).min(1),
+        metadata: permissionsV2_js_1.permissionsV2PartnerPolicyMetadataSchema,
+    })
+        .strict(),
+})
+    .strict();
+exports.permissionsV2PolicyListResponseSchema = zod_1.z.object({ policies: zod_1.z.array(exports.permissionsV2PolicyViewSchema) }).strict();
+exports.permissionsV2PolicyResponseSchema = zod_1.z.object({ policy: exports.permissionsV2PolicyViewSchema }).strict();
+exports.permissionsV2PolicyVersionsResponseSchema = zod_1.z
+    .object({ versions: zod_1.z.array(exports.permissionsV2PolicyViewSchema) })
+    .strict();
+exports.permissionsV2PolicyUsageMeterSchema = zod_1.z
+    .object({
+    ruleId: nonEmptyStringSchema,
+    conditionPath: nonEmptyStringSchema,
+    fact: zod_1.z.enum(['wallet.spend.native', 'wallet.spend.erc20']),
+    operator: zod_1.z.enum(['lt', 'lte', 'gt', 'gte']),
+    ruleEffect: permissionsV2_js_1.permissionsV2PolicyEffectSchema,
+    assetType: zod_1.z.enum(['NATIVE', 'ERC20']),
+    tokenAddress: nonEmptyStringSchema.optional(),
+    chainId: nonEmptyStringSchema,
+    windowMs: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    bucketStart: zod_1.z.string().datetime(),
+    resetAt: zod_1.z.string().datetime(),
+    limitBaseUnits: zod_1.z.string().regex(/^(0|[1-9][0-9]*)$/),
+    committedBaseUnits: zod_1.z.string().regex(/^(0|[1-9][0-9]*)$/),
+    reservedBaseUnits: zod_1.z.string().regex(/^(0|[1-9][0-9]*)$/),
+    usedBaseUnits: zod_1.z.string().regex(/^(0|[1-9][0-9]*)$/),
+    remainingBaseUnits: zod_1.z
+        .string()
+        .regex(/^(0|[1-9][0-9]*)$/)
+        .nullable(),
+})
+    .strict();
+exports.permissionsV2PolicyUsageSchema = zod_1.z
+    .object({
+    userId: nonEmptyStringSchema.nullable(),
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    walletId: nonEmptyStringSchema,
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    asOf: zod_1.z.string().datetime(),
+    configuration: zod_1.z
+        .object({
+        revision: zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+        provenance: zod_1.z.enum(['default', 'personal']),
+        configurationHash: nonEmptyStringSchema.optional(),
+    })
+        .strict()
+        .nullable(),
+    meters: zod_1.z.array(exports.permissionsV2PolicyUsageMeterSchema),
+})
+    .strict();
+exports.permissionsV2ConditionalApprovalCaseSummarySchema = permissionsV2_js_1.permissionsV2ConditionalApprovalCaseViewSchema.omit({
+    decision: true,
+});
+exports.permissionsV2ConditionalApprovalPartnerCaseListSchema = zod_1.z
+    .object({
+    cases: zod_1.z.array(exports.permissionsV2ConditionalApprovalCaseSummarySchema),
+    nextBeforeCaseId: nonEmptyStringSchema.optional(),
+})
+    .strict();
+exports.permissionsV2ConditionalRequirementViewSchema = zod_1.z
+    .object({
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    ruleId: nonEmptyStringSchema,
+    requirementId: nonEmptyStringSchema,
+    requirement: permissionsV2_js_1.permissionsV2ConditionalApprovalRequirementSchema,
+})
+    .strict();
+exports.permissionsV2ConditionalRequirementListSchema = zod_1.z
+    .object({ requirements: zod_1.z.array(exports.permissionsV2ConditionalRequirementViewSchema) })
+    .strict();
+// A resolved view can replace stage values while retaining the authored safe-knob catalog.
+// Validate its transport structure without reapplying authoring-time default consistency checks.
+exports.permissionsV2ResolvedConditionalApprovalRequirementSchema = permissionsV2_js_1.permissionsV2ConditionalApprovalRequirementSchema.innerType();
+exports.permissionsV2EffectiveAuthorizationConfigurationSchema = exports.permissionsV2ConditionalRequirementViewSchema
+    .extend({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: nonEmptyStringSchema,
+    configuration: permissionsV2_js_1.permissionsV2AuthorizationConfigurationViewSchema.nullable(),
+    effectiveRequirement: exports.permissionsV2ResolvedConditionalApprovalRequirementSchema,
+})
+    .strict();
+exports.permissionsV2AuthorizationScopeCapabilitiesSchema = zod_1.z
+    .object({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: nonEmptyStringSchema,
+    userId: nonEmptyStringSchema,
+    requirements: zod_1.z.array(zod_1.z
+        .object({
+        policyId: nonEmptyStringSchema,
+        policyVersion: nonEmptyStringSchema,
+        policyHash: nonEmptyStringSchema,
+        ruleId: nonEmptyStringSchema,
+        requirementId: nonEmptyStringSchema,
+        canManageConfiguration: zod_1.z.literal(true),
+    })
+        .strict()),
+})
+    .strict();
+exports.permissionsV2AuthorizationScopeMembersSchema = zod_1.z
+    .object({
+    members: zod_1.z.array(permissionsV2_js_1.permissionsV2AuthoritySetViewSchema),
+    nextAfterUserId: nonEmptyStringSchema.optional(),
+})
+    .strict();
+exports.permissionsV2AuthoritySetHistorySchema = zod_1.z
+    .object({ assignments: zod_1.z.array(permissionsV2_js_1.permissionsV2AuthoritySetViewSchema) })
+    .strict();
+exports.permissionsV2AuthorizationScopeBindingHistorySchema = zod_1.z
+    .object({
+    revisions: zod_1.z.array(permissionsV2_js_1.permissionsV2AuthorizationScopeBindingViewSchema),
+    nextBeforeRevision: positiveRevisionSchema.optional(),
+})
+    .strict();
+exports.permissionsV2AuthorizationConfigurationHistorySchema = zod_1.z
+    .object({ configurations: zod_1.z.array(permissionsV2_js_1.permissionsV2AuthorizationConfigurationViewSchema) })
+    .strict();

package/dist/cjs/types/authFactor.js

@@ -2,13 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_FACTOR_PROVENANCES = exports.AUTH_FACTOR_STATUSES = exports.AUTH_FACTOR_TIERS = exports.AUTH_FACTOR_TYPES = void 0;
 /**
- * Auth factors are the ways an account authenticates: the identity-bearing
- * FIRST factors (email, phone, OAuth, external wallet) plus, going forward,
- * SECOND factors. This is the correct "authentication factor" model.
+ * Auth factors are the ways an account authenticates: the identity-bearing FIRST factors (email, phone,
+ * OAuth, external wallet) plus, going forward, SECOND factors.
  *
- * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/
- * BASIC_LOGIN), which describes the legacy credential/unlock methods and is
- * being retired with the enclave migration. Existing passkeys/PINs/passwords/
+ * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/BASIC_LOGIN) — legacy
+ * credential/unlock methods being retired with the enclave migration. Existing passkeys/PINs/passwords/
  * TOTP are NEVER represented here — they stay in their own tables and age out.
  */
 exports.AUTH_FACTOR_TYPES = [
@@ -23,6 +21,10 @@ exports.AUTH_FACTOR_TYPES = [
 ];
 /** Which factor in the authentication sequence this is. */
 exports.AUTH_FACTOR_TIERS = ['FIRST', 'SECOND'];
-exports.AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'REVOKED'];
+// PENDING = a login credential mid-proof (email/phone first-write before its OTP) — reserved. VERIFIED = a
+// proven login credential. UNVERIFIED = a linking HINT: an OAuth vouched for this email but the owner never
+// proved it, so it is NOT a login credential (can't log in) and several may coexist across accounts — powers
+// only the needs_link linking UI. REVOKED = unlinked. (ENG-7075)
+exports.AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'UNVERIFIED', 'REVOKED'];
 /** How this factor came to be attached to the account (drives migration/audit). */
 exports.AUTH_FACTOR_PROVENANCES = ['SIGNUP', 'EXPLICIT_LINK', 'IMPLICIT_MERGE_LEGACY', 'MIGRATION'];

package/dist/cjs/types/authState.js

@@ -1,32 +1,31 @@
 "use strict";
 /**
- * Status-model auth envelope returned by the `/v2/auth` endpoints and consumed
- * by the backend and new SDKs. Clerk-style: a single `status` drives the client,
- * with typed per-status fields. New statuses are added additively; a client that
- * sees a status it doesn't recognize should treat the flow as not-yet-complete
- * (show generic / hand off) rather than erroring (forward-compat).
- *
- * This is the canonical auth contract — new SDKs consume it directly instead of
- * a parallel client mirror. (ENG-6910)
+ * Status-model auth envelope returned by `/v2/auth`, consumed by the backend and new SDKs.
+ * Clerk-style: a single `status` drives the client, with typed per-status fields. Statuses are added
+ * additively; an unrecognized one is treated as not-yet-complete (show generic / hand off), never an
+ * error (forward-compat). The canonical auth contract — new SDKs consume it directly, not a parallel
+ * client mirror. (ENG-6910)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_FLOW_METHODS = exports.AUTH_STATUSES = void 0;
 /**
- * Flow statuses. Only `needs_verification` and `authenticated` are emitted today;
- * the rest are reserved so the contract is forward-stable and added to as the
- * slices that emit them land (credential setup, cross-method link prompt).
+ * Flow statuses. Only `needs_verification` and `authenticated` are emitted today; the rest are
+ * reserved for forward-stability, emitted as their slices land (credential setup, link prompt).
  */
 exports.AUTH_STATUSES = [
     'needs_verification', // a code was sent; awaiting it
-    'needs_credential', // identity verified, account still needs a credential — reserved, not emitted yet
+    'needs_credential', // first factor proven; the session is withheld until the account's share-gate credential is too (ENG-7075)
     'needs_link', // identifier collides with an account from another method — reserved (cross-method linking)
     'needs_second_factor', // first factor passed; awaiting a login-time MFA challenge (ENG-6906)
     'authenticated', // done; a session has been established
+    'linked', // a factor-link flow (start+continue with intent:'link') attached the proven factor to the session's account (ENG-7075)
+    'needs_step_up', // a factor-link or factor-unlink flow must prove the SESSION's existing account first (ENG-7075)
+    'unlinked', // a factor-unlink flow proved the account and revoked the named factor (ENG-7075)
 ];
 /**
- * First-factor methods the `/v2/auth` flow handles. Email/phone authenticate via a delivered
- * one-time code; external-wallet by signing a SIWE challenge; passkey by a WebAuthn assertion
- * (usernameless — resolved from the credential at `continue`); oauth by a provider redirect
- * (the specific provider rides on the flow; the account is resolved at `continue`). (ENG-6911)
+ * First-factor methods `/v2/auth` handles: email/phone via a delivered one-time code; external-wallet
+ * via a SIWE signature; passkey via a WebAuthn assertion (usernameless — resolved from the credential at
+ * `continue`); oauth via a provider redirect (provider rides on the flow, account resolved at
+ * `continue`). (ENG-6911)
  */
 exports.AUTH_FLOW_METHODS = ['EMAIL', 'PHONE', 'EXTERNAL_WALLET', 'PASSKEY', 'OAUTH'];

package/dist/esm/index.js

@@ -1,6 +1,7 @@
 export * from './types/index.js';
 export * from './types/permissions.js';
 export * from './schemas/permissionsV2.js';
+export * from './schemas/permissionsV2Lifecycle.js';
 export * from './schemas/permissionsV2UserParameters.js';
 export * from './utils/index.js';
 import * as transactionTypes from './types/transaction.js';

package/dist/esm/schemas/permissionsV2.js

@@ -613,6 +613,7 @@ export const permissionsV2TransactionSignatureCollectionSchema = z
 export const permissionsV2ConditionalApprovalCaseListSchema = z
     .object({
     cases: z.array(permissionsV2ConditionalApprovalCaseViewSchema),
+    nextBeforeCaseId: conditionalApprovalIdentifierSchema.optional(),
 })
     .strict();
 export const permissionsV2PolicyRuleSchema = z

package/dist/esm/schemas/permissionsV2Lifecycle.js

@@ -0,0 +1,160 @@
+import { z } from 'zod';
+import { permissionsV2AuthorizationConfigurationViewSchema, permissionsV2AuthorizationScopeBindingViewSchema, permissionsV2AuthoritySetViewSchema, permissionsV2ConditionalApprovalCaseViewSchema, permissionsV2ConditionalApprovalRequirementSchema, permissionsV2PartnerAuthoredPolicySelectorSchema, permissionsV2PartnerPolicyMetadataSchema, permissionsV2PolicyEffectSchema, permissionsV2PolicyRuleSchema, } from './permissionsV2.js';
+const nonEmptyStringSchema = z.string().min(1);
+const positiveRevisionSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const permissionsV2PolicyViewSelectorSchema = permissionsV2PartnerAuthoredPolicySelectorSchema.extend({
+    actorId: nonEmptyStringSchema.optional(),
+    partnerId: nonEmptyStringSchema.optional(),
+    appId: nonEmptyStringSchema.optional(),
+    userId: nonEmptyStringSchema.optional(),
+    walletOwnerPartnerId: nonEmptyStringSchema.optional(),
+    feature: nonEmptyStringSchema.optional(),
+});
+export const permissionsV2PolicyViewSchema = z
+    .object({
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    lifecycle: z.enum(['active', 'inactive', 'superseded', 'archived']),
+    activation: z
+        .object({
+        effectiveFrom: z.string().datetime(),
+        effectiveUntil: z.string().datetime().optional(),
+    })
+        .strict(),
+    binding: z
+        .object({ kind: z.literal('user_consent'), subject: z.literal('user_wallet') })
+        .strict()
+        .optional(),
+    policy: z
+        .object({
+        id: nonEmptyStringSchema,
+        schemaVersion: z.literal('permissions.policy.v1'),
+        version: nonEmptyStringSchema,
+        layer: z.literal('partner'),
+        selector: permissionsV2PolicyViewSelectorSchema,
+        rules: z.array(permissionsV2PolicyRuleSchema).min(1),
+        metadata: permissionsV2PartnerPolicyMetadataSchema,
+    })
+        .strict(),
+})
+    .strict();
+export const permissionsV2PolicyListResponseSchema = z.object({ policies: z.array(permissionsV2PolicyViewSchema) }).strict();
+export const permissionsV2PolicyResponseSchema = z.object({ policy: permissionsV2PolicyViewSchema }).strict();
+export const permissionsV2PolicyVersionsResponseSchema = z
+    .object({ versions: z.array(permissionsV2PolicyViewSchema) })
+    .strict();
+export const permissionsV2PolicyUsageMeterSchema = z
+    .object({
+    ruleId: nonEmptyStringSchema,
+    conditionPath: nonEmptyStringSchema,
+    fact: z.enum(['wallet.spend.native', 'wallet.spend.erc20']),
+    operator: z.enum(['lt', 'lte', 'gt', 'gte']),
+    ruleEffect: permissionsV2PolicyEffectSchema,
+    assetType: z.enum(['NATIVE', 'ERC20']),
+    tokenAddress: nonEmptyStringSchema.optional(),
+    chainId: nonEmptyStringSchema,
+    windowMs: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    bucketStart: z.string().datetime(),
+    resetAt: z.string().datetime(),
+    limitBaseUnits: z.string().regex(/^(0|[1-9][0-9]*)$/),
+    committedBaseUnits: z.string().regex(/^(0|[1-9][0-9]*)$/),
+    reservedBaseUnits: z.string().regex(/^(0|[1-9][0-9]*)$/),
+    usedBaseUnits: z.string().regex(/^(0|[1-9][0-9]*)$/),
+    remainingBaseUnits: z
+        .string()
+        .regex(/^(0|[1-9][0-9]*)$/)
+        .nullable(),
+})
+    .strict();
+export const permissionsV2PolicyUsageSchema = z
+    .object({
+    userId: nonEmptyStringSchema.nullable(),
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    walletId: nonEmptyStringSchema,
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    asOf: z.string().datetime(),
+    configuration: z
+        .object({
+        revision: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+        provenance: z.enum(['default', 'personal']),
+        configurationHash: nonEmptyStringSchema.optional(),
+    })
+        .strict()
+        .nullable(),
+    meters: z.array(permissionsV2PolicyUsageMeterSchema),
+})
+    .strict();
+export const permissionsV2ConditionalApprovalCaseSummarySchema = permissionsV2ConditionalApprovalCaseViewSchema.omit({
+    decision: true,
+});
+export const permissionsV2ConditionalApprovalPartnerCaseListSchema = z
+    .object({
+    cases: z.array(permissionsV2ConditionalApprovalCaseSummarySchema),
+    nextBeforeCaseId: nonEmptyStringSchema.optional(),
+})
+    .strict();
+export const permissionsV2ConditionalRequirementViewSchema = z
+    .object({
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    ruleId: nonEmptyStringSchema,
+    requirementId: nonEmptyStringSchema,
+    requirement: permissionsV2ConditionalApprovalRequirementSchema,
+})
+    .strict();
+export const permissionsV2ConditionalRequirementListSchema = z
+    .object({ requirements: z.array(permissionsV2ConditionalRequirementViewSchema) })
+    .strict();
+// A resolved view can replace stage values while retaining the authored safe-knob catalog.
+// Validate its transport structure without reapplying authoring-time default consistency checks.
+export const permissionsV2ResolvedConditionalApprovalRequirementSchema = permissionsV2ConditionalApprovalRequirementSchema.innerType();
+export const permissionsV2EffectiveAuthorizationConfigurationSchema = permissionsV2ConditionalRequirementViewSchema
+    .extend({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: nonEmptyStringSchema,
+    configuration: permissionsV2AuthorizationConfigurationViewSchema.nullable(),
+    effectiveRequirement: permissionsV2ResolvedConditionalApprovalRequirementSchema,
+})
+    .strict();
+export const permissionsV2AuthorizationScopeCapabilitiesSchema = z
+    .object({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: nonEmptyStringSchema,
+    userId: nonEmptyStringSchema,
+    requirements: z.array(z
+        .object({
+        policyId: nonEmptyStringSchema,
+        policyVersion: nonEmptyStringSchema,
+        policyHash: nonEmptyStringSchema,
+        ruleId: nonEmptyStringSchema,
+        requirementId: nonEmptyStringSchema,
+        canManageConfiguration: z.literal(true),
+    })
+        .strict()),
+})
+    .strict();
+export const permissionsV2AuthorizationScopeMembersSchema = z
+    .object({
+    members: z.array(permissionsV2AuthoritySetViewSchema),
+    nextAfterUserId: nonEmptyStringSchema.optional(),
+})
+    .strict();
+export const permissionsV2AuthoritySetHistorySchema = z
+    .object({ assignments: z.array(permissionsV2AuthoritySetViewSchema) })
+    .strict();
+export const permissionsV2AuthorizationScopeBindingHistorySchema = z
+    .object({
+    revisions: z.array(permissionsV2AuthorizationScopeBindingViewSchema),
+    nextBeforeRevision: positiveRevisionSchema.optional(),
+})
+    .strict();
+export const permissionsV2AuthorizationConfigurationHistorySchema = z
+    .object({ configurations: z.array(permissionsV2AuthorizationConfigurationViewSchema) })
+    .strict();

package/dist/esm/types/authFactor.js

@@ -1,11 +1,9 @@
 /**
- * Auth factors are the ways an account authenticates: the identity-bearing
- * FIRST factors (email, phone, OAuth, external wallet) plus, going forward,
- * SECOND factors. This is the correct "authentication factor" model.
+ * Auth factors are the ways an account authenticates: the identity-bearing FIRST factors (email, phone,
+ * OAuth, external wallet) plus, going forward, SECOND factors.
  *
- * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/
- * BASIC_LOGIN), which describes the legacy credential/unlock methods and is
- * being retired with the enclave migration. Existing passkeys/PINs/passwords/
+ * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/BASIC_LOGIN) — legacy
+ * credential/unlock methods being retired with the enclave migration. Existing passkeys/PINs/passwords/
  * TOTP are NEVER represented here — they stay in their own tables and age out.
  */
 export const AUTH_FACTOR_TYPES = [
@@ -20,6 +18,10 @@ export const AUTH_FACTOR_TYPES = [
 ];
 /** Which factor in the authentication sequence this is. */
 export const AUTH_FACTOR_TIERS = ['FIRST', 'SECOND'];
-export const AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'REVOKED'];
+// PENDING = a login credential mid-proof (email/phone first-write before its OTP) — reserved. VERIFIED = a
+// proven login credential. UNVERIFIED = a linking HINT: an OAuth vouched for this email but the owner never
+// proved it, so it is NOT a login credential (can't log in) and several may coexist across accounts — powers
+// only the needs_link linking UI. REVOKED = unlinked. (ENG-7075)
+export const AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'UNVERIFIED', 'REVOKED'];
 /** How this factor came to be attached to the account (drives migration/audit). */
 export const AUTH_FACTOR_PROVENANCES = ['SIGNUP', 'EXPLICIT_LINK', 'IMPLICIT_MERGE_LEGACY', 'MIGRATION'];

package/dist/esm/types/authState.js

@@ -1,29 +1,28 @@
 /**
- * Status-model auth envelope returned by the `/v2/auth` endpoints and consumed
- * by the backend and new SDKs. Clerk-style: a single `status` drives the client,
- * with typed per-status fields. New statuses are added additively; a client that
- * sees a status it doesn't recognize should treat the flow as not-yet-complete
- * (show generic / hand off) rather than erroring (forward-compat).
- *
- * This is the canonical auth contract — new SDKs consume it directly instead of
- * a parallel client mirror. (ENG-6910)
+ * Status-model auth envelope returned by `/v2/auth`, consumed by the backend and new SDKs.
+ * Clerk-style: a single `status` drives the client, with typed per-status fields. Statuses are added
+ * additively; an unrecognized one is treated as not-yet-complete (show generic / hand off), never an
+ * error (forward-compat). The canonical auth contract — new SDKs consume it directly, not a parallel
+ * client mirror. (ENG-6910)
  */
 /**
- * Flow statuses. Only `needs_verification` and `authenticated` are emitted today;
- * the rest are reserved so the contract is forward-stable and added to as the
- * slices that emit them land (credential setup, cross-method link prompt).
+ * Flow statuses. Only `needs_verification` and `authenticated` are emitted today; the rest are
+ * reserved for forward-stability, emitted as their slices land (credential setup, link prompt).
  */
 export const AUTH_STATUSES = [
     'needs_verification', // a code was sent; awaiting it
-    'needs_credential', // identity verified, account still needs a credential — reserved, not emitted yet
+    'needs_credential', // first factor proven; the session is withheld until the account's share-gate credential is too (ENG-7075)
     'needs_link', // identifier collides with an account from another method — reserved (cross-method linking)
     'needs_second_factor', // first factor passed; awaiting a login-time MFA challenge (ENG-6906)
     'authenticated', // done; a session has been established
+    'linked', // a factor-link flow (start+continue with intent:'link') attached the proven factor to the session's account (ENG-7075)
+    'needs_step_up', // a factor-link or factor-unlink flow must prove the SESSION's existing account first (ENG-7075)
+    'unlinked', // a factor-unlink flow proved the account and revoked the named factor (ENG-7075)
 ];
 /**
- * First-factor methods the `/v2/auth` flow handles. Email/phone authenticate via a delivered
- * one-time code; external-wallet by signing a SIWE challenge; passkey by a WebAuthn assertion
- * (usernameless — resolved from the credential at `continue`); oauth by a provider redirect
- * (the specific provider rides on the flow; the account is resolved at `continue`). (ENG-6911)
+ * First-factor methods `/v2/auth` handles: email/phone via a delivered one-time code; external-wallet
+ * via a SIWE signature; passkey via a WebAuthn assertion (usernameless — resolved from the credential at
+ * `continue`); oauth via a provider redirect (provider rides on the flow, account resolved at
+ * `continue`). (ENG-6911)
  */
 export const AUTH_FLOW_METHODS = ['EMAIL', 'PHONE', 'EXTERNAL_WALLET', 'PASSKEY', 'OAUTH'];

package/dist/types/index.d.ts

@@ -1,6 +1,7 @@
 export * from './types/index.js';
 export * from './types/permissions.js';
 export * from './schemas/permissionsV2.js';
+export * from './schemas/permissionsV2Lifecycle.js';
 export * from './schemas/permissionsV2UserParameters.js';
 export * from './utils/index.js';
 import * as transactionTypes from './types/transaction.js';

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0CAA0C,CAAC;AACzD,cAAc,kBAAkB,CAAC;AAEjC,OAAO,KAAK,gBAAgB,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kBAAkB,CAAC;AAEjC,OAAO,KAAK,gBAAgB,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/types/schemas/permissionsV2.d.ts

@@ -2238,6 +2238,7 @@ export declare const permissionsV2ConditionalApprovalCaseListSchema: z.ZodObject
         evidence?: "authenticated_approval" | "transaction_signature" | undefined;
         terminalReason?: string | undefined;
     }>, "many">;
+    nextBeforeCaseId: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     cases: {
         status: "pending" | "completed" | "rejected" | "expired" | "invalidated";
@@ -2294,6 +2295,7 @@ export declare const permissionsV2ConditionalApprovalCaseListSchema: z.ZodObject
         evidence?: "authenticated_approval" | "transaction_signature" | undefined;
         terminalReason?: string | undefined;
     }[];
+    nextBeforeCaseId?: string | undefined;
 }, {
     cases: {
         status: "pending" | "completed" | "rejected" | "expired" | "invalidated";
@@ -2350,6 +2352,7 @@ export declare const permissionsV2ConditionalApprovalCaseListSchema: z.ZodObject
         evidence?: "authenticated_approval" | "transaction_signature" | undefined;
         terminalReason?: string | undefined;
     }[];
+    nextBeforeCaseId?: string | undefined;
 }>;
 export declare const permissionsV2PolicyRuleSchema: z.ZodEffects<z.ZodObject<{
     id: z.ZodString;