@getpara/shared 1.33.0 → 1.35.0

package/dist/cjs/schemas/permissionsV2.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.permissionsV2DelegationConsentViewSchema = exports.permissionsV2DelegationConsentSubmissionSchema = exports.permissionsV2DelegationConsentStandingRouteMutationSchema = exports.permissionsV2DelegationConsentNativeStandingMutationSchema = exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema = exports.permissionsV2DelegationConsentApiStatusSchema = exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissionsV2PartnerPolicyCandidateSchema = exports.permissionsV2PolicyRuleSchema = exports.permissionsV2ConditionalApprovalCaseListSchema = exports.permissionsV2TransactionSignatureCollectionSchema = exports.permissionsV2ConditionalApprovalSignatureSchema = exports.permissionsV2ConditionalApprovalDecisionSchema = exports.permissionsV2AuthorizationConfigurationViewSchema = exports.permissionsV2AuthorizationConfigurationWriteSchema = exports.permissionsV2AuthorizationScopeBindingViewSchema = exports.permissionsV2AuthorizationScopeBindingWriteSchema = exports.permissionsV2AuthoritySetViewSchema = exports.permissionsV2AuthoritySetWriteSchema = exports.permissionsV2AuthorityAssignmentSchema = exports.permissionsV2ConditionalApprovalCaseViewSchema = exports.permissionsV2ConditionalApprovalRequirementIdentitySchema = exports.permissionsV2ConditionalApprovalDecisionCapabilitySchema = exports.permissionsV2ConditionalApprovalDecisionUnavailableReasonSchema = exports.permissionsV2ConditionalApprovalCaseStatusSchema = exports.permissionsV2ConditionalApprovalRequirementSchema = exports.permissionsV2ConditionalApprovalSafeKnobSchema = exports.permissionsV2ConditionalApprovalStageSchema = exports.permissionsV2ConditionalApprovalEligibilitySchema = exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema = exports.permissionsV2PartnerAuthoredPolicySelectorSchema = exports.permissionsV2ConditionSchema = exports.policyAuthoringJsonObjectSchema = exports.policyAuthoringJsonValueSchema = exports.policyAuthoringJsonPrimitiveSchema = exports.permissionsV2SigningRequestTypeSchema = exports.permissionsV2SigningRequestRouteSchema = exports.permissionsV2SigningWalletTypeSchema = exports.permissionsV2AggregateOperatorSchema = exports.permissionsV2CompareOperatorSchema = exports.permissionsV2PolicyEffectSchema = exports.permissionsV2PolicyModeSchema = exports.permissionsV2PolicyLayerSchema = exports.permissionsV2ParameterDeclarationSchema = exports.permissionsV2SigningRequestTypes = exports.policyAuthoringSigningRequestRoutes = exports.policyAuthoringSigningWalletTypes = void 0;
-exports.permissionsV2ValidationErrorSchema = exports.permissionsV2DelegationConsentDiscoveryResponseSchema = exports.permissionsV2DelegationConsentSubmissionResponseSchema = exports.permissionsV2DelegationConsentRequestSchema = void 0;
+exports.permissionsV2DelegationConsentNativeStandingMutationSchema = exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema = exports.permissionsV2DelegationConsentApiStatusSchema = exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissionsV2PartnerPolicyCandidateSchema = exports.permissionsV2PolicyRuleSchema = exports.permissionsV2RuleActionsSchema = exports.permissionsV2ConditionalApprovalCaseListSchema = exports.permissionsV2TransactionSignatureCollectionSchema = exports.permissionsV2ConditionalApprovalSignatureSchema = exports.permissionsV2ConditionalApprovalDecisionSchema = exports.permissionsV2AuthorizationConfigurationViewSchema = exports.permissionsV2AuthorizationConfigurationWriteSchema = exports.permissionsV2AuthorizationScopeBindingViewSchema = exports.permissionsV2AuthorizationScopeBindingWriteSchema = exports.permissionsV2AuthoritySetViewSchema = exports.permissionsV2AuthoritySetWriteSchema = exports.permissionsV2AuthorityAssignmentSchema = exports.permissionsV2ConditionalApprovalCaseViewSchema = exports.permissionsV2ConditionalApprovalRequirementIdentitySchema = exports.permissionsV2ConditionalApprovalDecisionCapabilitySchema = exports.permissionsV2ConditionalApprovalDecisionUnavailableReasonSchema = exports.permissionsV2ConditionalApprovalCaseStatusSchema = exports.permissionsV2ConditionalApprovalRequirementSchema = exports.permissionsV2ConditionalApprovalSafeKnobSchema = exports.permissionsV2ConditionalApprovalStageSchema = exports.permissionsV2ConditionalApprovalEligibilitySchema = exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema = exports.permissionsV2PartnerAuthoredPolicySelectorSchema = exports.permissionsV2ConditionSchema = exports.policyAuthoringJsonObjectSchema = exports.policyAuthoringJsonValueSchema = exports.policyAuthoringJsonPrimitiveSchema = exports.permissionsV2RuleActionSchema = exports.permissionsV2SigningRequestTypeSchema = exports.permissionsV2SigningWalletTypeSchema = exports.permissionsV2AggregateOperatorSchema = exports.permissionsV2CompareOperatorSchema = exports.permissionsV2PolicyEffectSchema = exports.permissionsV2PolicyModeSchema = exports.permissionsV2PolicyLayerSchema = exports.permissionsV2ParameterDeclarationSchema = exports.permissionsV2RuleActionsByWalletType = exports.permissionsV2RuleActions = exports.permissionsV2SigningRequestTypes = exports.policyAuthoringSigningRequestRoutes = exports.policyAuthoringSigningWalletTypes = void 0;
+exports.permissionsV2ValidationErrorSchema = exports.permissionsV2DelegationConsentDiscoveryResponseSchema = exports.permissionsV2DelegationConsentSubmissionResponseSchema = exports.permissionsV2DelegationConsentRequestSchema = exports.permissionsV2DelegationConsentViewSchema = exports.permissionsV2DelegationConsentSubmissionSchema = exports.permissionsV2DelegationConsentStandingRouteMutationSchema = void 0;
 const zod_1 = require("zod");
 const permissionsV2UserParameters_js_1 = require("./permissionsV2UserParameters.js");
 exports.policyAuthoringSigningWalletTypes = ['EVM', 'SOLANA', 'COSMOS', 'STELLAR', 'SUI'];
@@ -31,6 +31,28 @@ exports.permissionsV2SigningRequestTypes = [
     'sui_transaction',
     'raw_message',
 ];
+exports.permissionsV2RuleActions = [
+    'transfer_native',
+    'transfer_tokens',
+    'call_contract',
+    'raw_signature',
+    'approve_tokens',
+    'transfer_nfts',
+    'deploy_contract',
+    'execute_safe_transaction',
+    'sign_message',
+    'sign_typed_data',
+    'sign_authorization',
+];
+const everyWalletTypeRuleActions = ['transfer_native', 'transfer_tokens', 'call_contract', 'raw_signature'];
+exports.permissionsV2RuleActionsByWalletType = {
+    EVM: exports.permissionsV2RuleActions,
+    SOLANA: everyWalletTypeRuleActions,
+    COSMOS: everyWalletTypeRuleActions,
+    STELLAR: everyWalletTypeRuleActions,
+    SUI: everyWalletTypeRuleActions,
+};
+const permissionsV2SelectorListMaximum = 100;
 const nonEmptyStringSchema = zod_1.z.string().min(1);
 exports.permissionsV2ParameterDeclarationSchema = zod_1.z
     .object({
@@ -38,18 +60,14 @@ exports.permissionsV2ParameterDeclarationSchema = zod_1.z
     label: nonEmptyStringSchema,
 })
     .strict();
-const uniqueNonEmptyStringsSchema = zod_1.z
-    .array(nonEmptyStringSchema)
-    .min(1)
-    .refine((values) => new Set(values).size === values.length, 'values must be unique');
 exports.permissionsV2PolicyLayerSchema = zod_1.z.enum(['para', 'partner']);
 exports.permissionsV2PolicyModeSchema = zod_1.z.enum(['guardrail', 'delegation']);
 exports.permissionsV2PolicyEffectSchema = zod_1.z.enum(['allow', 'deny', 'require_approval']);
 exports.permissionsV2CompareOperatorSchema = zod_1.z.enum(['eq', 'ne', 'lt', 'lte', 'gt', 'gte', 'in']);
 exports.permissionsV2AggregateOperatorSchema = zod_1.z.enum(['lt', 'lte', 'gt', 'gte']);
 exports.permissionsV2SigningWalletTypeSchema = zod_1.z.enum(exports.policyAuthoringSigningWalletTypes);
-exports.permissionsV2SigningRequestRouteSchema = zod_1.z.enum(exports.policyAuthoringSigningRequestRoutes);
 exports.permissionsV2SigningRequestTypeSchema = zod_1.z.enum(exports.permissionsV2SigningRequestTypes);
+exports.permissionsV2RuleActionSchema = zod_1.z.enum(exports.permissionsV2RuleActions);
 exports.policyAuthoringJsonPrimitiveSchema = zod_1.z.union([
     zod_1.z.string(),
     zod_1.z.number(),
@@ -102,13 +120,35 @@ exports.permissionsV2ConditionSchema = zod_1.z.lazy(() => zod_1.z.discriminatedU
     })
         .strict(),
 ]));
+function duplicateValues(values) {
+    return Array.from(new Set(values.filter((value, index) => values.indexOf(value) !== index)));
+}
+function selectorListEntriesSchema(field) {
+    const entries = zod_1.z.array(nonEmptyStringSchema).min(1, `${field} must list at least 1 entry`);
+    return field === 'chainId'
+        ? entries
+        : entries.max(permissionsV2SelectorListMaximum, `${field} must list at most ${permissionsV2SelectorListMaximum} entries`);
+}
+function selectorListSchema(field) {
+    return zod_1.z.union([
+        nonEmptyStringSchema,
+        selectorListEntriesSchema(field).superRefine((values, context) => {
+            const duplicates = duplicateValues(values);
+            if (duplicates.length > 0) {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    message: `${field} lists ${duplicates.join(', ')} more than once`,
+                });
+            }
+        }),
+    ]);
+}
 const permissionsV2PartnerAuthoredPolicySelectorObjectSchema = zod_1.z
     .object({
-    walletId: nonEmptyStringSchema.optional(),
-    chainId: zod_1.z.union([nonEmptyStringSchema, uniqueNonEmptyStringsSchema]).optional(),
-    walletType: exports.permissionsV2SigningWalletTypeSchema.optional(),
-    requestRoute: exports.permissionsV2SigningRequestRouteSchema.optional(),
-    requestType: exports.permissionsV2SigningRequestTypeSchema.optional(),
+    walletId: selectorListSchema('walletId').optional(),
+    userId: selectorListSchema('userId').optional(),
+    chainId: selectorListSchema('chainId').optional(),
+    walletType: exports.permissionsV2SigningWalletTypeSchema,
 })
     .strict();
 exports.permissionsV2PartnerAuthoredPolicySelectorSchema = permissionsV2PartnerAuthoredPolicySelectorObjectSchema;
@@ -620,10 +660,30 @@ exports.permissionsV2ConditionalApprovalCaseListSchema = zod_1.z
     nextBeforeCaseId: conditionalApprovalIdentifierSchema.optional(),
 })
     .strict();
+const permissionsV2RuleActionListSchema = zod_1.z
+    .array(exports.permissionsV2RuleActionSchema)
+    .min(1, 'actions must name at least one action or be "all"')
+    .superRefine((actions, context) => {
+    const duplicates = duplicateValues(actions);
+    if (duplicates.length > 0) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: `actions lists ${duplicates.join(', ')} more than once`,
+        });
+    }
+});
+exports.permissionsV2RuleActionsSchema = zod_1.z.union([zod_1.z.literal('all'), permissionsV2RuleActionListSchema], {
+    errorMap: (_issue, context) => ({
+        message: context.data === undefined
+            ? 'actions is required: name the actions this rule governs or use "all"'
+            : `actions must be "all" or a list of actions, received ${JSON.stringify(context.data)}`,
+    }),
+});
 exports.permissionsV2PolicyRuleSchema = zod_1.z
     .object({
     id: nonEmptyStringSchema,
     effect: exports.permissionsV2PolicyEffectSchema,
+    actions: exports.permissionsV2RuleActionsSchema,
     when: exports.permissionsV2ConditionSchema,
     approvalRequirement: exports.permissionsV2ConditionalApprovalRequirementSchema.optional(),
 })

package/dist/cjs/schemas/permissionsV2Lifecycle.js

@@ -9,7 +9,6 @@ const permissionsV2PolicyViewSelectorSchema = permissionsV2_js_1.permissionsV2Pa
     actorId: nonEmptyStringSchema.optional(),
     partnerId: nonEmptyStringSchema.optional(),
     appId: nonEmptyStringSchema.optional(),
-    userId: nonEmptyStringSchema.optional(),
     walletOwnerPartnerId: nonEmptyStringSchema.optional(),
     feature: nonEmptyStringSchema.optional(),
 });
@@ -51,10 +50,10 @@ exports.permissionsV2PolicyUsageMeterSchema = zod_1.z
     .object({
     ruleId: nonEmptyStringSchema,
     conditionPath: nonEmptyStringSchema,
-    fact: zod_1.z.enum(['wallet.spend.native', 'wallet.spend.erc20']),
+    fact: zod_1.z.enum(['wallet.spend.native', 'wallet.spend.erc20', 'wallet.spend.token']),
     operator: zod_1.z.enum(['lt', 'lte', 'gt', 'gte']),
     ruleEffect: permissionsV2_js_1.permissionsV2PolicyEffectSchema,
-    assetType: zod_1.z.enum(['NATIVE', 'ERC20']),
+    assetType: zod_1.z.enum(['NATIVE', 'ERC20', 'TOKEN']),
     tokenAddress: nonEmptyStringSchema.optional(),
     chainId: nonEmptyStringSchema,
     windowMs: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),

package/dist/cjs/types/auth.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RecoveryStatus = exports.LOGIN_METHODS = exports.LegacyAuthMethod = exports.AUTH_METHODS = exports.AuthMethod = exports.LINKED_ACCOUNT_TYPES = exports.OAUTH_METHODS = exports.OAuthMethod = exports.PublicKeyType = exports.AuthMethodStatus = exports.KeyShareType = exports.EncryptorType = exports.AUTH_TYPES = void 0;
+exports.RecoveryStatus = exports.LOGIN_METHODS = exports.MFA_METHODS = exports.LegacyAuthMethod = exports.AUTH_METHODS = exports.AuthMethod = exports.LINKED_ACCOUNT_TYPES = exports.OAUTH_METHODS = exports.OAuthMethod = exports.PublicKeyType = exports.AuthMethodStatus = exports.KeyShareType = exports.EncryptorType = exports.AUTH_TYPES = void 0;
 exports.AUTH_TYPES = [
     'email',
     'phone',
@@ -88,6 +88,12 @@ var LegacyAuthMethod;
     LegacyAuthMethod["PASSWORD"] = "PASSWORD";
     LegacyAuthMethod["BIOMETRIC"] = "BIOMETRIC";
 })(LegacyAuthMethod || (exports.LegacyAuthMethod = LegacyAuthMethod = {}));
+/**
+ * A login-time second-factor METHOD as the client sees it. `totp`/`backup_code` are the authenticator-app
+ * factor; `passkey`/`password`/`pin` are credentials that became true second factors once the account's key
+ * share moved to the enclave (they no longer gate the share — they gate the login). (ENG-6906)
+ */
+exports.MFA_METHODS = ['totp', 'backup_code', 'passkey', 'password', 'pin'];
 /**
  * Every way a user row can be established/authenticated. Runtime tuple (mirrors OAUTH_METHODS) so code
  * can iterate the canonical set instead of hand-maintaining parallel lists. OAuth providers are folded

package/dist/cjs/types/index.js

@@ -30,6 +30,8 @@ __exportStar(require("./permissions.js"), exports);
 __exportStar(require("./signing.js"), exports);
 __exportStar(require("./theme.js"), exports);
 __exportStar(require("./transaction.js"), exports);
+__exportStar(require("./twoFactor.js"), exports);
 __exportStar(require("./wallet.js"), exports);
 __exportStar(require("./user.js"), exports);
 __exportStar(require("./webhook.js"), exports);
+__exportStar(require("./restTransfer.js"), exports);

package/dist/cjs/types/partner.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOGIN_TWO_FACTOR_MODES = exports.EmailTheme = exports.ThemeMode = void 0;
+exports.DEFAULT_LOGIN_TWO_FACTOR_METHODS = exports.LOGIN_TWO_FACTOR_METHODS = exports.LOGIN_TWO_FACTOR_MODES = exports.EmailTheme = exports.ThemeMode = void 0;
 var ThemeMode;
 (function (ThemeMode) {
     ThemeMode["LIGHT"] = "LIGHT";
@@ -20,3 +20,10 @@ var EmailTheme;
 //   they hold a VERIFIED login-TOTP factor. Not forced on a fresh user.
 // - 'required': force-enroll + gate every user (what `require2fa: true` meant).
 exports.LOGIN_TWO_FACTOR_MODES = ['disabled', 'optional', 'required'];
+// The second-factor methods a partner can OFFER for enrollment (auth_config.loginTwoFactorMethods). TOTP is the
+// authenticator app; PASSKEY/PASSWORD/PIN are credential second factors — portal-origin ceremonies that only
+// exist for enclave-custodied accounts (a credential is share-gate OR 2FA, never both). Governs enrollment
+// only: at verify time an account's own enrolled factors are authoritative. Absent ⇒ ['TOTP'] (parity with
+// the TOTP-only launch). (ENG-6906)
+exports.LOGIN_TWO_FACTOR_METHODS = ['TOTP', 'PASSKEY', 'PASSWORD', 'PIN'];
+exports.DEFAULT_LOGIN_TWO_FACTOR_METHODS = ['TOTP'];

package/dist/cjs/types/restTransfer.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/twoFactor.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/webhook.js

@@ -31,6 +31,10 @@ var WebhookEventType;
     WebhookEventType["USER_EXTERNAL_WALLET_VERIFIED"] = "user.external_wallet_verified";
     /** Fired when a fiat on-ramp purchase settles on-chain — carries the settlement tx hash (Coinbase/CDP today) */
     WebhookEventType["ONRAMP_COMPLETED"] = "onramp.completed";
+    /** Fired when a partner resets (revokes) a user's login-time second factors via the REST API */
+    WebhookEventType["USER_TWO_FACTOR_RESET"] = "user.two_factor_reset";
+    /** Fired when Alchemy first reports an incoming fungible transfer to a watched wallet address */
+    WebhookEventType["FUNDS_RECEIVED"] = "funds.received";
     /** Test ping event - used for webhook connectivity testing */
     WebhookEventType["TEST_PING"] = "test.ping";
 })(WebhookEventType || (exports.WebhookEventType = WebhookEventType = {}));

package/dist/esm/schemas/permissionsV2.js

@@ -27,6 +27,28 @@ export const permissionsV2SigningRequestTypes = [
     'sui_transaction',
     'raw_message',
 ];
+export const permissionsV2RuleActions = [
+    'transfer_native',
+    'transfer_tokens',
+    'call_contract',
+    'raw_signature',
+    'approve_tokens',
+    'transfer_nfts',
+    'deploy_contract',
+    'execute_safe_transaction',
+    'sign_message',
+    'sign_typed_data',
+    'sign_authorization',
+];
+const everyWalletTypeRuleActions = ['transfer_native', 'transfer_tokens', 'call_contract', 'raw_signature'];
+export const permissionsV2RuleActionsByWalletType = {
+    EVM: permissionsV2RuleActions,
+    SOLANA: everyWalletTypeRuleActions,
+    COSMOS: everyWalletTypeRuleActions,
+    STELLAR: everyWalletTypeRuleActions,
+    SUI: everyWalletTypeRuleActions,
+};
+const permissionsV2SelectorListMaximum = 100;
 const nonEmptyStringSchema = z.string().min(1);
 export const permissionsV2ParameterDeclarationSchema = z
     .object({
@@ -34,18 +56,14 @@ export const permissionsV2ParameterDeclarationSchema = z
     label: nonEmptyStringSchema,
 })
     .strict();
-const uniqueNonEmptyStringsSchema = z
-    .array(nonEmptyStringSchema)
-    .min(1)
-    .refine((values) => new Set(values).size === values.length, 'values must be unique');
 export const permissionsV2PolicyLayerSchema = z.enum(['para', 'partner']);
 export const permissionsV2PolicyModeSchema = z.enum(['guardrail', 'delegation']);
 export const permissionsV2PolicyEffectSchema = z.enum(['allow', 'deny', 'require_approval']);
 export const permissionsV2CompareOperatorSchema = z.enum(['eq', 'ne', 'lt', 'lte', 'gt', 'gte', 'in']);
 export const permissionsV2AggregateOperatorSchema = z.enum(['lt', 'lte', 'gt', 'gte']);
 export const permissionsV2SigningWalletTypeSchema = z.enum(policyAuthoringSigningWalletTypes);
-export const permissionsV2SigningRequestRouteSchema = z.enum(policyAuthoringSigningRequestRoutes);
 export const permissionsV2SigningRequestTypeSchema = z.enum(permissionsV2SigningRequestTypes);
+export const permissionsV2RuleActionSchema = z.enum(permissionsV2RuleActions);
 export const policyAuthoringJsonPrimitiveSchema = z.union([
     z.string(),
     z.number(),
@@ -98,13 +116,35 @@ export const permissionsV2ConditionSchema = z.lazy(() => z.discriminatedUnion('k
     })
         .strict(),
 ]));
+function duplicateValues(values) {
+    return Array.from(new Set(values.filter((value, index) => values.indexOf(value) !== index)));
+}
+function selectorListEntriesSchema(field) {
+    const entries = z.array(nonEmptyStringSchema).min(1, `${field} must list at least 1 entry`);
+    return field === 'chainId'
+        ? entries
+        : entries.max(permissionsV2SelectorListMaximum, `${field} must list at most ${permissionsV2SelectorListMaximum} entries`);
+}
+function selectorListSchema(field) {
+    return z.union([
+        nonEmptyStringSchema,
+        selectorListEntriesSchema(field).superRefine((values, context) => {
+            const duplicates = duplicateValues(values);
+            if (duplicates.length > 0) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `${field} lists ${duplicates.join(', ')} more than once`,
+                });
+            }
+        }),
+    ]);
+}
 const permissionsV2PartnerAuthoredPolicySelectorObjectSchema = z
     .object({
-    walletId: nonEmptyStringSchema.optional(),
-    chainId: z.union([nonEmptyStringSchema, uniqueNonEmptyStringsSchema]).optional(),
-    walletType: permissionsV2SigningWalletTypeSchema.optional(),
-    requestRoute: permissionsV2SigningRequestRouteSchema.optional(),
-    requestType: permissionsV2SigningRequestTypeSchema.optional(),
+    walletId: selectorListSchema('walletId').optional(),
+    userId: selectorListSchema('userId').optional(),
+    chainId: selectorListSchema('chainId').optional(),
+    walletType: permissionsV2SigningWalletTypeSchema,
 })
     .strict();
 export const permissionsV2PartnerAuthoredPolicySelectorSchema = permissionsV2PartnerAuthoredPolicySelectorObjectSchema;
@@ -616,10 +656,30 @@ export const permissionsV2ConditionalApprovalCaseListSchema = z
     nextBeforeCaseId: conditionalApprovalIdentifierSchema.optional(),
 })
     .strict();
+const permissionsV2RuleActionListSchema = z
+    .array(permissionsV2RuleActionSchema)
+    .min(1, 'actions must name at least one action or be "all"')
+    .superRefine((actions, context) => {
+    const duplicates = duplicateValues(actions);
+    if (duplicates.length > 0) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `actions lists ${duplicates.join(', ')} more than once`,
+        });
+    }
+});
+export const permissionsV2RuleActionsSchema = z.union([z.literal('all'), permissionsV2RuleActionListSchema], {
+    errorMap: (_issue, context) => ({
+        message: context.data === undefined
+            ? 'actions is required: name the actions this rule governs or use "all"'
+            : `actions must be "all" or a list of actions, received ${JSON.stringify(context.data)}`,
+    }),
+});
 export const permissionsV2PolicyRuleSchema = z
     .object({
     id: nonEmptyStringSchema,
     effect: permissionsV2PolicyEffectSchema,
+    actions: permissionsV2RuleActionsSchema,
     when: permissionsV2ConditionSchema,
     approvalRequirement: permissionsV2ConditionalApprovalRequirementSchema.optional(),
 })

package/dist/esm/schemas/permissionsV2Lifecycle.js

@@ -6,7 +6,6 @@ const permissionsV2PolicyViewSelectorSchema = permissionsV2PartnerAuthoredPolicy
     actorId: nonEmptyStringSchema.optional(),
     partnerId: nonEmptyStringSchema.optional(),
     appId: nonEmptyStringSchema.optional(),
-    userId: nonEmptyStringSchema.optional(),
     walletOwnerPartnerId: nonEmptyStringSchema.optional(),
     feature: nonEmptyStringSchema.optional(),
 });
@@ -48,10 +47,10 @@ export const permissionsV2PolicyUsageMeterSchema = z
     .object({
     ruleId: nonEmptyStringSchema,
     conditionPath: nonEmptyStringSchema,
-    fact: z.enum(['wallet.spend.native', 'wallet.spend.erc20']),
+    fact: z.enum(['wallet.spend.native', 'wallet.spend.erc20', 'wallet.spend.token']),
     operator: z.enum(['lt', 'lte', 'gt', 'gte']),
     ruleEffect: permissionsV2PolicyEffectSchema,
-    assetType: z.enum(['NATIVE', 'ERC20']),
+    assetType: z.enum(['NATIVE', 'ERC20', 'TOKEN']),
     tokenAddress: nonEmptyStringSchema.optional(),
     chainId: nonEmptyStringSchema,
     windowMs: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),

package/dist/esm/types/auth.js

@@ -85,6 +85,12 @@ export var LegacyAuthMethod;
     LegacyAuthMethod["PASSWORD"] = "PASSWORD";
     LegacyAuthMethod["BIOMETRIC"] = "BIOMETRIC";
 })(LegacyAuthMethod || (LegacyAuthMethod = {}));
+/**
+ * A login-time second-factor METHOD as the client sees it. `totp`/`backup_code` are the authenticator-app
+ * factor; `passkey`/`password`/`pin` are credentials that became true second factors once the account's key
+ * share moved to the enclave (they no longer gate the share — they gate the login). (ENG-6906)
+ */
+export const MFA_METHODS = ['totp', 'backup_code', 'passkey', 'password', 'pin'];
 /**
  * Every way a user row can be established/authenticated. Runtime tuple (mirrors OAUTH_METHODS) so code
  * can iterate the canonical set instead of hand-maintaining parallel lists. OAuth providers are folded

package/dist/esm/types/index.js

@@ -14,6 +14,8 @@ export * from './permissions.js';
 export * from './signing.js';
 export * from './theme.js';
 export * from './transaction.js';
+export * from './twoFactor.js';
 export * from './wallet.js';
 export * from './user.js';
 export * from './webhook.js';
+export * from './restTransfer.js';

package/dist/esm/types/partner.js

@@ -17,3 +17,10 @@ export var EmailTheme;
 //   they hold a VERIFIED login-TOTP factor. Not forced on a fresh user.
 // - 'required': force-enroll + gate every user (what `require2fa: true` meant).
 export const LOGIN_TWO_FACTOR_MODES = ['disabled', 'optional', 'required'];
+// The second-factor methods a partner can OFFER for enrollment (auth_config.loginTwoFactorMethods). TOTP is the
+// authenticator app; PASSKEY/PASSWORD/PIN are credential second factors — portal-origin ceremonies that only
+// exist for enclave-custodied accounts (a credential is share-gate OR 2FA, never both). Governs enrollment
+// only: at verify time an account's own enrolled factors are authoritative. Absent ⇒ ['TOTP'] (parity with
+// the TOTP-only launch). (ENG-6906)
+export const LOGIN_TWO_FACTOR_METHODS = ['TOTP', 'PASSKEY', 'PASSWORD', 'PIN'];
+export const DEFAULT_LOGIN_TWO_FACTOR_METHODS = ['TOTP'];

package/dist/esm/types/restTransfer.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/twoFactor.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/webhook.js

@@ -26,6 +26,10 @@ export var WebhookEventType;
     WebhookEventType["USER_EXTERNAL_WALLET_VERIFIED"] = "user.external_wallet_verified";
     /** Fired when a fiat on-ramp purchase settles on-chain — carries the settlement tx hash (Coinbase/CDP today) */
     WebhookEventType["ONRAMP_COMPLETED"] = "onramp.completed";
+    /** Fired when a partner resets (revokes) a user's login-time second factors via the REST API */
+    WebhookEventType["USER_TWO_FACTOR_RESET"] = "user.two_factor_reset";
+    /** Fired when Alchemy first reports an incoming fungible transfer to a watched wallet address */
+    WebhookEventType["FUNDS_RECEIVED"] = "funds.received";
     /** Test ping event - used for webhook connectivity testing */
     WebhookEventType["TEST_PING"] = "test.ping";
 })(WebhookEventType || (WebhookEventType = {}));