@hilbras/keystone 1.6.0 → 1.9.0

package/dist/sdk/index.js

@@ -1,30 +1,97 @@
 import { getContainer } from "../container.js";
 import { buildApplicationServices } from "../di.js";
+import { toPublicApplication, toPublicUser, toSelfUser } from "../types.js";
 class SdkAuthenticationClient {
     app;
     constructor(app) {
         this.app = app;
     }
-    register(input) {
-        return this.app.register(input);
-    }
-    login(input) {
-        return this.app.login(input);
+    async register(input) {
+        const result = await this.app.register(input);
+        if (!result.success)
+            return result;
+        return {
+            success: true,
+            data: {
+                accessToken: result.data.accessToken,
+                refreshToken: result.data.refreshToken,
+                expiresAt: result.data.expiresAt,
+                user: toSelfUser(result.data.user),
+            },
+        };
+    }
+    async login(input) {
+        const result = await this.app.login(input);
+        if (!result.success)
+            return result;
+        if (result.data.status === "requires_mfa") {
+            return {
+                success: true,
+                data: {
+                    status: "requires_mfa",
+                    data: {
+                        status: "requires_mfa",
+                        user: toSelfUser(result.data.data.user),
+                        challenge: result.data.data.challenge,
+                        expiresAt: result.data.data.expiresAt,
+                        flow: result.data.data.flow,
+                        clientId: result.data.data.clientId,
+                    },
+                },
+            };
+        }
+        return {
+            success: true,
+            data: {
+                status: "authenticated",
+                data: {
+                    accessToken: result.data.data.accessToken,
+                    refreshToken: result.data.data.refreshToken,
+                    expiresAt: result.data.data.expiresAt,
+                    user: toSelfUser(result.data.data.user),
+                },
+            },
+        };
+    }
+    async completeMfa(input) {
+        const result = await this.app.completeMfa(input);
+        if (!result.success)
+            return result;
+        return {
+            success: true,
+            data: {
+                accessToken: result.data.accessToken,
+                refreshToken: result.data.refreshToken,
+                expiresAt: result.data.expiresAt,
+                user: toSelfUser(result.data.user),
+                flow: result.data.flow,
+                factor: result.data.factor,
+                clientId: result.data.clientId,
+            },
+        };
     }
     async refresh(refreshToken, clientId) {
         const result = await this.app.refresh(refreshToken, clientId);
         if (!result.success)
             return result;
-        return { success: true, data: { accessToken: result.data.accessToken, refreshToken: result.data.refreshToken, expiresAt: result.data.expiresAt } };
+        return { success: true, data: { accessToken: result.data.accessToken, refreshToken: result.data.refreshToken, expiresAt: result.data.expiresAt, userId: result.data.userId } };
     }
     logout(refreshToken) {
         return this.app.logout(refreshToken);
     }
-    createPasswordResetToken(email) {
-        return this.app.createPasswordResetToken(email);
+    async createPasswordResetToken(email) {
+        const result = await this.app.createPasswordResetToken(email);
+        if (!result.success)
+            return result;
+        if (result.data === null)
+            return { success: true, data: null };
+        return { success: true, data: { token: result.data.token, user: toSelfUser(result.data.user) } };
     }
-    resetPasswordWithToken(token, newPassword) {
-        return this.app.resetPasswordWithToken(token, newPassword);
+    async resetPasswordWithToken(token, newPassword) {
+        const result = await this.app.resetPasswordWithToken(token, newPassword);
+        if (!result.success)
+            return result;
+        return { success: true, data: toSelfUser(result.data) };
     }
 }
 class SdkIdentityClient {
@@ -32,32 +99,44 @@ class SdkIdentityClient {
     constructor(app) {
         this.app = app;
     }
-    findUser(id) {
-        return this.app.findUser(id);
-    }
-    findUserByEmail(email) {
-        return this.app.findUserByEmail(email);
-    }
-    upsertInvitedUser(input) {
-        return this.app.upsertInvitedUser(input);
+    async updateUserProfile(actorId, userId, updates, context) {
+        const result = await this.app.updateUserProfile(actorId, userId, updates, context);
+        if (!result.success)
+            return result;
+        return { success: true, data: toPublicUser(result.data) };
     }
-    updateUserProfile(userId, updates) {
-        return this.app.updateUserProfile(userId, updates);
+    async updatePlatformRole(actorId, targetUserId, role, context) {
+        const result = await this.app.updatePlatformRole(actorId, targetUserId, role, context);
+        if (!result.success)
+            return result;
+        return { success: true, data: toPublicUser(result.data) };
     }
-    deactivate(userId) {
-        return this.app.deactivate(userId);
+    async reviewAccount(actorId, targetUserId, active, context) {
+        const result = await this.app.reviewAccount(actorId, targetUserId, active, context);
+        if (!result.success)
+            return result;
+        return { success: true, data: toPublicUser(result.data) };
     }
-    listOrganizationUsers(orgId) {
-        return this.app.listOrganizationUsers(orgId);
+    deactivate(actorId, targetUserId, context) {
+        return this.app.deactivate(actorId, targetUserId, context);
     }
-    linkUserIdentity(userId, providerId, providerType, externalSub, email) {
-        return this.app.linkUserIdentity(userId, providerId, providerType, externalSub, email);
+    linkUserIdentity(actorId, userId, providerId, providerType, externalSub, email) {
+        return this.app.linkUserIdentity(actorId, userId, providerId, providerType, externalSub, email);
     }
     getFederationAuthorizeUrl(provider, state, redirectUri) {
         return this.app.getFederationAuthorizeUrl(provider, state, redirectUri);
     }
-    completeFederationLogin(provider, code, redirectUri) {
-        return this.app.completeFederationLogin(provider, code, redirectUri);
+    async completeFederationLogin(provider, code, redirectUri, application) {
+        const result = await this.app.completeFederationLogin(provider, code, redirectUri, application);
+        if (!result.success)
+            return result;
+        return {
+            success: true,
+            data: {
+                user: toSelfUser(result.data.user),
+                tokens: result.data.tokens,
+            },
+        };
     }
 }
 class SdkOrganizationClient {
@@ -74,17 +153,36 @@ class SdkOrganizationClient {
     listUserOrganizations(userId) {
         return this.app.listUserOrganizations(userId);
     }
-    inviteMember(actorId, orgId, input) {
-        return this.app.inviteMember(actorId, orgId, input);
+    async inviteMember(actorId, orgId, input, context) {
+        const result = await this.app.inviteMember(actorId, orgId, input, context);
+        if (!result.success)
+            return result;
+        return { success: true, data: { ...result.data, user: toPublicUser(result.data.user) } };
+    }
+    updateMemberRole(actorId, orgId, targetUserId, role, context) {
+        return this.app.updateMemberRole(actorId, orgId, targetUserId, role, context);
+    }
+    removeMember(actorId, orgId, targetUserId, context) {
+        return this.app.removeMember(actorId, orgId, targetUserId, context);
     }
-    createApplication(actorId, orgId, input) {
-        return this.app.createApplication(actorId, orgId, input);
+    async createApplication(actorId, orgId, input) {
+        const result = await this.app.createApplication(actorId, orgId, input);
+        if (!result.success)
+            return result;
+        const safeApplication = toPublicApplication(result.data);
+        return { success: true, data: { ...safeApplication, clientSecret: result.data.clientSecret } };
     }
-    listOrganizationApplications(actorId, orgId) {
-        return this.app.listOrganizationApplications(actorId, orgId);
+    async listOrganizationApplications(actorId, orgId) {
+        const result = await this.app.listOrganizationApplications(actorId, orgId);
+        if (!result.success)
+            return result;
+        return { success: true, data: result.data.map(toPublicApplication) };
     }
-    updateApplication(actorId, orgId, appId, updates) {
-        return this.app.updateApplication(actorId, orgId, appId, updates);
+    async updateApplication(actorId, orgId, appId, updates) {
+        const result = await this.app.updateApplication(actorId, orgId, appId, updates);
+        if (!result.success)
+            return result;
+        return { success: true, data: toPublicApplication(result.data) };
     }
 }
 class SdkAuthorizationClient {
@@ -92,11 +190,14 @@ class SdkAuthorizationClient {
     constructor(domain) {
         this.domain = domain;
     }
-    hasPermission(role, resource, action) {
-        return this.domain.hasPermission(role, resource, action);
+    hasPermission(userId, orgId, resource, action) {
+        return this.domain.hasOrganizationPermission(userId, orgId, resource, action);
     }
-    requirePermission(role, resource, action) {
-        return this.domain.requirePermission(role, resource, action);
+    async requirePermission(userId, orgId, resource, action) {
+        const result = await this.domain.requireOrganizationPermission(userId, orgId, ["owner", "admin", "member"], resource, action);
+        if (!result.success)
+            return result;
+        return { success: true, data: undefined };
     }
     requireOrgRole(userId, orgId, allowedRoles) {
         return this.domain.requireOrgRole(userId, orgId, allowedRoles);

package/dist/sdk/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,uBAAuB;IACE;IAA7B,YAA6B,GAAqC;QAArC,QAAG,GAAH,GAAG,CAAkC;IAAG,CAAC;IAEtE,QAAQ,CAAC,KAAkI;QACzI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAA6D;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IAC9J,CAAC;IAED,MAAM,CAAC,YAAqB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,wBAAwB,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,iBAAiB;IACQ;IAA7B,YAA6B,GAA+B;QAA/B,QAAG,GAAH,GAAG,CAA4B;IAAG,CAAC;IAEhE,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,iBAAiB,CAAC,KAA0D;QAC1E,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,OAA0F;QAC1H,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,qBAAqB,CAAC,KAAa;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,UAAkB,EAAE,YAAoB,EAAE,WAAmB,EAAE,KAAc;QAC5G,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,CAAC;IAED,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,uBAAuB,CAAC,QAAgB,EAAE,IAAY,EAAE,WAAmB;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;CACF;AAED,MAAM,qBAAqB;IACI;IAA7B,YAA6B,GAAmC;QAAnC,QAAG,GAAH,GAAG,CAAgC;IAAG,CAAC;IAEpE,kBAAkB,CAAC,MAAc,EAAE,KAAqD;QACtF,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,eAAe,CAAC,MAAc,EAAE,KAAa;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,KAA4D;QACvG,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,KAA2E;QAC3H,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,KAAa;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa,EAAE,OAAsL;QACrP,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;CACF;AAED,MAAM,sBAAsB;IACG;IAA7B,YAA6B,MAAkC;QAAlC,WAAM,GAAN,MAAM,CAA4B;IAAG,CAAC;IAEnE,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAiD;QAC7F,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,KAAa;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;CACF;AAED,IAAI,SAAS,GAAuB,IAAI,CAAC;AAEzC,MAAM,UAAU,MAAM;IACpB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjD,SAAS,GAAG;QACV,cAAc,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QACtD,QAAQ,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,YAAY,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;QAC1D,aAAa,EAAE,IAAI,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAgB;IACrC,SAAS,GAAG,GAAG,CAAC;AAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG5E,MAAM,uBAAuB;IACE,GAAG;IAAhC,YAA6B,GAAqC;mBAArC,GAAG;IAAqC,CAAC;IAEtE,KAAK,CAAC,QAAQ,CAAC,KAAkI;QAC/I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;gBACtC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;aACnC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA6F;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,IAAa;gBACtB,IAAI,EAAE;oBACJ,MAAM,EAAE,cAAuB;oBAC/B,IAAI,EAAE;wBACJ,MAAM,EAAE,cAAuB;wBAC/B,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;wBACvC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS;wBACrC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS;wBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;wBAC3B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;qBACpC;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE;gBACJ,MAAM,EAAE,eAAwB;gBAChC,IAAI,EAAE;oBACJ,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;oBACzC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;oBAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS;oBACrC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;iBACxC;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAmH;QACnI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;gBACtC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1L,CAAC;IAED,MAAM,CAAC,YAAqB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC;CACF;AAED,MAAM,iBAAiB;IACQ,GAAG;IAAhC,YAA6B,GAA+B;mBAA/B,GAAG;IAA+B,CAAC;IAEhE,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,OAA4E,EAAE,OAAsB;QAC3J,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,YAAoB,EAAE,IAAsB,EAAE,OAAsB;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,YAAoB,EAAE,MAAe,EAAE,OAAsB;QAChG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,UAAU,CAAC,OAAe,EAAE,YAAoB,EAAE,OAAsB;QACtE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,gBAAgB,CAAC,OAAe,EAAE,MAAc,EAAE,UAAkB,EAAE,YAAoB,EAAE,WAAmB,EAAE,KAAc;QAC7H,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAClG,CAAC;IAED,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,QAAgB,EAAE,IAAY,EAAE,WAAmB,EAAE,WAA0C;QAC3H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE;gBACJ,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;aAC3B;SACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,qBAAqB;IACI,GAAG;IAAhC,YAA6B,GAAmC;mBAAnC,GAAG;IAAmC,CAAC;IAEpE,kBAAkB,CAAC,MAAc,EAAE,KAAqD;QACtF,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,eAAe,CAAC,MAAc,EAAE,KAAa;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,KAA4D,EAAE,OAAsB;QACrI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,gBAAgB,CAAC,OAAe,EAAE,KAAa,EAAE,YAAoB,EAAE,IAAkC,EAAE,OAAsB;QAC/H,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,YAAoB,EAAE,OAAsB;QACvF,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,KAA2E;QACjI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,GAAG,eAAe,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;IAC1G,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,OAAe,EAAE,KAAa;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa,EAAE,OAAsL;QAC3P,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5E,CAAC;CACF;AAED,MAAM,sBAAsB;IACG,MAAM;IAAnC,YAA6B,MAAkC;sBAAlC,MAAM;IAA+B,CAAC;IAEnE,aAAa,CAAC,MAAc,EAAE,KAAa,EAAE,QAAgB,EAAE,MAAc;QAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,KAAa,EAAE,QAAgB,EAAE,MAAc;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9H,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAiD;QAC7F,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,KAAa;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;CACF;AAED,IAAI,SAAS,GAAuB,IAAI,CAAC;AAEzC,MAAM,UAAU,MAAM;IACpB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjD,SAAS,GAAG;QACV,cAAc,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QACtD,QAAQ,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,YAAY,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;QAC1D,aAAa,EAAE,IAAI,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAgB;IACrC,SAAS,GAAG,GAAG,CAAC;AAClB,CAAC"}

package/dist/sdk/types.d.ts

@@ -1,11 +1,38 @@
-import type { User, Organization, Application, OrgMembership } from "../db/schema.js";
+import type { Organization, OrgMembership } from "../db/schema.js";
+import type { PublicApplication, PublicUser, SelfUser } from "../types.js";
 import type { Result } from "../lib/result.js";
+import type { EventContext } from "../services/events/types.js";
+import type { FederationApplicationContext } from "../services/federation.js";
 export interface AuthResponse {
-    user: User;
+    user: SelfUser;
     accessToken: string;
     refreshToken: string;
     expiresAt: Date;
 }
+/**
+ * The password step succeeded but MFA is enabled. No tokens are present; call
+ * `completeMfa` with `challenge` to obtain them.
+ */
+export interface MfaRequiredResponse {
+    status: "requires_mfa";
+    user: SelfUser;
+    challenge: string;
+    expiresAt: Date;
+    flow: "login" | "token_login";
+    clientId?: string;
+}
+export type LoginResponse = {
+    status: "authenticated";
+    data: AuthResponse;
+} | {
+    status: "requires_mfa";
+    data: MfaRequiredResponse;
+};
+export interface MfaCompleteResponse extends AuthResponse {
+    flow: "login" | "token_login";
+    factor: "totp" | "backup_code";
+    clientId?: string;
+}
 export interface AuthenticationSdk {
     register(input: {
         username: string;
@@ -19,41 +46,43 @@ export interface AuthenticationSdk {
         email: string;
         password: string;
         clientId?: string;
-    }): Promise<Result<AuthResponse>>;
+        flow?: "login" | "token_login";
+    }): Promise<Result<LoginResponse>>;
+    completeMfa(input: {
+        challenge: string;
+        code: string;
+        factor?: "totp" | "backup_code";
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<Result<MfaCompleteResponse>>;
     refresh(refreshToken: string, clientId?: string): Promise<Result<{
         accessToken: string;
         refreshToken: string;
         expiresAt: Date;
+        userId?: string;
     }>>;
     logout(refreshToken?: string): Promise<Result<void>>;
     createPasswordResetToken(email: string): Promise<Result<{
         token: string;
-        user: User;
+        user: SelfUser;
     } | null>>;
-    resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>>;
+    resetPasswordWithToken(token: string, newPassword: string): Promise<Result<SelfUser>>;
 }
 export interface IdentitySdk {
-    findUser(id: string): Promise<Result<User>>;
-    findUserByEmail(email: string): Promise<Result<User>>;
-    upsertInvitedUser(input: {
-        email: string;
-        name?: string;
-        username?: string;
-    }): Promise<Result<User>>;
-    updateUserProfile(userId: string, updates: Partial<{
+    updateUserProfile(actorId: string, userId: string, updates: Partial<{
         name: string;
         username: string;
-        role: string;
         emailVerified: boolean;
-    }>): Promise<Result<User>>;
-    deactivate(userId: string): Promise<Result<void>>;
-    listOrganizationUsers(orgId: string): Promise<User[]>;
-    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    }>, context?: EventContext): Promise<Result<PublicUser>>;
+    updatePlatformRole(actorId: string, targetUserId: string, role: "owner" | "user", context?: EventContext): Promise<Result<PublicUser>>;
+    deactivate(actorId: string, targetUserId: string, context?: EventContext): Promise<Result<void>>;
+    reviewAccount(actorId: string, targetUserId: string, active: boolean, context?: EventContext): Promise<Result<PublicUser>>;
+    linkUserIdentity(actorId: string, userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
     getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
         url: string;
     }>>;
-    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
-        user: User;
+    completeFederationLogin(provider: string, code: string, redirectUri: string, application?: FederationApplicationContext): Promise<Result<{
+        user: SelfUser;
         tokens: {
             accessToken: string;
             refreshToken: string;
@@ -71,20 +100,22 @@ export interface OrganizationSdk {
     inviteMember(actorId: string, orgId: string, input: {
         email: string;
         role: "owner" | "admin" | "member";
-    }): Promise<Result<{
-        user: {
-            id: string;
-        };
+    }, context?: EventContext): Promise<Result<{
+        user: PublicUser;
         membership: OrgMembership;
     }>>;
+    updateMemberRole(actorId: string, orgId: string, targetUserId: string, role: "owner" | "admin" | "member", context?: EventContext): Promise<Result<OrgMembership>>;
+    removeMember(actorId: string, orgId: string, targetUserId: string, context?: EventContext): Promise<Result<{
+        success: boolean;
+    }>>;
     createApplication(actorId: string, orgId: string, input: {
         name: string;
         redirectUris?: string[];
         allowedOrigins?: string[];
-    }): Promise<Result<Application & {
+    }): Promise<Result<PublicApplication & {
         clientSecret: string;
     }>>;
-    listOrganizationApplications(actorId: string, orgId: string): Promise<Result<Application[]>>;
+    listOrganizationApplications(actorId: string, orgId: string): Promise<Result<PublicApplication[]>>;
     updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{
         name: string;
         redirectUris: string[];
@@ -93,11 +124,11 @@ export interface OrganizationSdk {
         blockedIps: string[];
         isActive: boolean;
         branding: Record<string, unknown>;
-    }>): Promise<Result<Application>>;
+    }>): Promise<Result<PublicApplication>>;
 }
 export interface AuthorizationSdk {
-    hasPermission(role: string, resource: string, action: string): Promise<boolean>;
-    requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
+    hasPermission(userId: string, orgId: string, resource: string, action: string): Promise<boolean>;
+    requirePermission(userId: string, orgId: string, resource: string, action: string): Promise<Result<void>>;
     requireOrgRole(userId: string, orgId: string, allowedRoles: Array<"owner" | "admin" | "member">): Promise<Result<OrgMembership>>;
     isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
 }

package/dist/sdk/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdk/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5K,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACpG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAClI,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrJ,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvI,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC,CAAC;CACtK;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACzH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC,CAAC;IACjL,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACxL,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7F,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;CACxR;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACjI,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,iBAAiB,CAAC;IAClC,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,gBAAgB,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdk/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5K,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACrI,WAAW,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvK,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACnJ,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACnG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;CACvF;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACtL,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACvI,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3H,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxJ,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC,CAAC;CACtN;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACzH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC,CAAC;IACrM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACnK,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,CAAC;IAClI,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC9L,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACnG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;CAC9R;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1G,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACjI,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,iBAAiB,CAAC;IAClC,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,gBAAgB,CAAC;CACjC"}

package/dist/services/application/authentication.d.ts

@@ -1,6 +1,8 @@
 import type { AuthenticationDomainService } from "../domain/authentication.js";
 import type { TokenSet } from "../tokens.js";
 import type { User } from "../../db/schema.js";
+import type { MfaFlow } from "../../repositories/types.js";
+import type { MfaFactor } from "../mfa.js";
 import type { Result } from "../../lib/result.js";
 export interface RegisterRequest {
     username: string;
@@ -14,6 +16,9 @@ export interface LoginRequest {
     email: string;
     password: string;
     clientId?: string;
+    flow?: MfaFlow;
+    ipAddress?: string;
+    userAgent?: string;
 }
 export interface AuthResponse {
     user: User;
@@ -21,11 +26,44 @@ export interface AuthResponse {
     refreshToken: string;
     expiresAt: Date;
 }
+/**
+ * The password step succeeded but the second factor has not been satisfied.
+ * No access or refresh token is present; `challenge` must be presented to
+ * `completeMfa` before any token is issued.
+ */
+export interface MfaRequiredResponse {
+    status: "requires_mfa";
+    user: User;
+    challenge: string;
+    expiresAt: Date;
+    flow: MfaFlow;
+    clientId?: string;
+}
+export type LoginResponse = {
+    status: "authenticated";
+    data: AuthResponse;
+} | {
+    status: "requires_mfa";
+    data: MfaRequiredResponse;
+};
+export interface MfaCompleteRequest {
+    challenge: string;
+    code: string;
+    factor?: MfaFactor;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export interface MfaCompleteResponse extends AuthResponse {
+    flow: MfaFlow;
+    factor: MfaFactor;
+    clientId?: string;
+}
 export declare class AuthenticationApplicationService {
     private readonly domain;
     constructor(domain: AuthenticationDomainService);
     register(request: RegisterRequest): Promise<Result<AuthResponse>>;
-    login(request: LoginRequest): Promise<Result<AuthResponse>>;
+    login(request: LoginRequest): Promise<Result<LoginResponse>>;
+    completeMfa(request: MfaCompleteRequest): Promise<Result<MfaCompleteResponse>>;
     refresh(refreshToken: string, clientId?: string): Promise<Result<TokenSet>>;
     logout(refreshToken?: string): Promise<Result<void>>;
     createPasswordResetToken(email: string): Promise<Result<{

package/dist/services/application/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/application/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,gCAAgC;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,2BAA2B;IAE1D,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IASjE,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAS3D,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAM3E,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIpD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAI9F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIvF,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/application/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,gCAAgC;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,2BAA2B,EAAI;IAE9D,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAOtE;IAEK,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CA4BjE;IAEK,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAmBnF;IAEK,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAIhF;IAEK,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAEzD;IAEK,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAEnG;IAEK,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAEtF;IAED,OAAO,CAAC,cAAc;CAQvB"}

package/dist/services/application/authentication.js

@@ -16,9 +16,43 @@ export class AuthenticationApplicationService {
         const result = await this.domain.login(request);
         if (!result.success)
             return result;
+        if (result.data.status === "requires_mfa") {
+            return {
+                success: true,
+                data: {
+                    status: "requires_mfa",
+                    data: {
+                        status: "requires_mfa",
+                        user: result.data.user,
+                        challenge: result.data.challenge.challenge,
+                        expiresAt: result.data.challenge.expiresAt,
+                        flow: result.data.challenge.flow,
+                        clientId: result.data.challenge.clientId,
+                    },
+                },
+            };
+        }
         return {
             success: true,
-            data: this.toAuthResponse(result.data.user, result.data.tokens),
+            data: {
+                status: "authenticated",
+                data: this.toAuthResponse(result.data.user, result.data.tokens),
+            },
+        };
+    }
+    async completeMfa(request) {
+        const factor = request.factor ?? detectFactor(request.code);
+        const result = await this.domain.completeMfa(request.challenge, request.code, factor, request.ipAddress, request.userAgent);
+        if (!result.success)
+            return result;
+        return {
+            success: true,
+            data: {
+                ...this.toAuthResponse(result.data.user, result.data.tokens),
+                flow: result.data.flow,
+                factor: result.data.factor,
+                clientId: result.data.clientId,
+            },
         };
     }
     async refresh(refreshToken, clientId) {
@@ -45,4 +79,12 @@ export class AuthenticationApplicationService {
         };
     }
 }
+/**
+ * TOTP codes are exactly six digits; anything else is treated as a backup
+ * code. The MFA service still validates the factor independently, so this only
+ * picks which verification path to run.
+ */
+function detectFactor(code) {
+    return /^[0-9]{6}$/.test(code.trim()) ? "totp" : "backup_code";
+}
 //# sourceMappingURL=authentication.js.map

package/dist/services/application/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/application/authentication.ts"],"names":[],"mappings":"AA2BA,MAAM,OAAO,gCAAgC;IACd;IAA7B,YAA6B,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAEpE,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAEO,cAAc,CAAC,IAAU,EAAE,MAAgB;QACjD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/application/authentication.ts"],"names":[],"mappings":"AAgEA,MAAM,OAAO,gCAAgC;IACd,MAAM;IAAnC,YAA6B,MAAmC;sBAAnC,MAAM;IAAgC,CAAC;IAEpE,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,cAAc;oBACtB,IAAI,EAAE;wBACJ,MAAM,EAAE,cAAc;wBACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;wBACtB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS;wBAC1C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS;wBAC1C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI;wBAChC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChE;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAA2B;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAC1C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,IAAI,EACZ,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC5D,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAEO,cAAc,CAAC,IAAU,EAAE,MAAgB;QACjD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AACjE,CAAC"}

package/dist/services/application/identity.d.ts

@@ -1,6 +1,9 @@
 import type { IdentityDomainService } from "../domain/identity.js";
 import type { User } from "../../db/schema.js";
 import type { Result } from "../../lib/result.js";
+import type { PlatformRole } from "../domain/authorization.js";
+import type { EventContext } from "../events/types.js";
+import type { FederationApplicationContext } from "../federation.js";
 export declare class IdentityApplicationService {
     private readonly domain;
     constructor(domain: IdentityDomainService);
@@ -11,19 +14,19 @@ export declare class IdentityApplicationService {
         name?: string;
         username?: string;
     }): Promise<Result<User>>;
-    updateUserProfile(userId: string, updates: Partial<{
+    updateUserProfile(actorId: string, userId: string, updates: Partial<{
         name: string;
         username: string;
-        role: string;
         emailVerified: boolean;
-    }>): Promise<Result<User>>;
-    deactivate(userId: string): Promise<Result<void>>;
-    listOrganizationUsers(orgId: string): Promise<User[]>;
-    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    }>, context?: EventContext): Promise<Result<User>>;
+    updatePlatformRole(actorId: string, targetUserId: string, role: PlatformRole, context?: EventContext): Promise<Result<User>>;
+    reviewAccount(actorId: string, targetUserId: string, active: boolean, context?: EventContext): Promise<Result<User>>;
+    deactivate(actorId: string, targetUserId: string, context?: EventContext): Promise<Result<void>>;
+    linkUserIdentity(actorId: string, userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
     getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
         url: string;
     }>>;
-    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
+    completeFederationLogin(provider: string, code: string, redirectUri: string, application?: FederationApplicationContext): Promise<Result<{
         user: User;
         tokens: {
             accessToken: string;