@logto/schemas 1.10.0 → 1.11.0

package/lib/types/interactions.d.ts

@@ -160,14 +160,14 @@ export declare const profileGuard: z.ZodObject<{
     username?: string | undefined;
     email?: string | undefined;
     phone?: string | undefined;
-    password?: string | undefined;
     connectorId?: string | undefined;
+    password?: string | undefined;
 }, {
     username?: string | undefined;
     email?: string | undefined;
     phone?: string | undefined;
-    password?: string | undefined;
     connectorId?: string | undefined;
+    password?: string | undefined;
 }>;
 export type Profile = z.infer<typeof profileGuard>;
 export declare enum MissingProfile {
@@ -188,7 +188,112 @@ export declare const bindTotpPayloadGuard: z.ZodObject<{
     type: MfaFactor.TOTP;
 }>;
 export type BindTotpPayload = z.infer<typeof bindTotpPayloadGuard>;
-export declare const bindMfaPayloadGuard: z.ZodObject<{
+export declare const bindWebAuthnPayloadGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    id: z.ZodString;
+    rawId: z.ZodString;
+    /**
+     * The response from WebAuthn API
+     *
+     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredential}
+     */
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        attestationObject: z.ZodString;
+        authenticatorData: z.ZodOptional<z.ZodString>;
+        transports: z.ZodOptional<z.ZodArray<z.ZodEnum<["usb", "nfc", "ble", "internal", "cable", "hybrid", "smart-card"]>, "many">>;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodNumber>;
+        publicKey: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    }, {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    }>;
+    authenticatorAttachment: z.ZodOptional<z.ZodEnum<["cross-platform", "platform"]>>;
+    clientExtensionResults: z.ZodObject<{
+        appid: z.ZodOptional<z.ZodBoolean>;
+        crepProps: z.ZodOptional<z.ZodObject<{
+            rk: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            rk?: boolean | undefined;
+        }, {
+            rk?: boolean | undefined;
+        }>>;
+        hmacCreateSecret: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}>;
+export type BindWebAuthnPayload = z.infer<typeof bindWebAuthnPayloadGuard>;
+export declare const bindBackupCodePayloadGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.BackupCode;
+}, {
+    type: MfaFactor.BackupCode;
+}>;
+export type BindBackupCodePayload = z.infer<typeof bindBackupCodePayloadGuard>;
+export declare const bindMfaPayloadGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
     code: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -197,7 +302,108 @@ export declare const bindMfaPayloadGuard: z.ZodObject<{
 }, {
     code: string;
     type: MfaFactor.TOTP;
-}>;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    id: z.ZodString;
+    rawId: z.ZodString;
+    /**
+     * The response from WebAuthn API
+     *
+     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredential}
+     */
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        attestationObject: z.ZodString;
+        authenticatorData: z.ZodOptional<z.ZodString>;
+        transports: z.ZodOptional<z.ZodArray<z.ZodEnum<["usb", "nfc", "ble", "internal", "cable", "hybrid", "smart-card"]>, "many">>;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodNumber>;
+        publicKey: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    }, {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    }>;
+    authenticatorAttachment: z.ZodOptional<z.ZodEnum<["cross-platform", "platform"]>>;
+    clientExtensionResults: z.ZodObject<{
+        appid: z.ZodOptional<z.ZodBoolean>;
+        crepProps: z.ZodOptional<z.ZodObject<{
+            rk: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            rk?: boolean | undefined;
+        }, {
+            rk?: boolean | undefined;
+        }>>;
+        hmacCreateSecret: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        authenticatorData?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+        publicKeyAlgorithm?: number | undefined;
+        publicKey?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.BackupCode;
+}, {
+    type: MfaFactor.BackupCode;
+}>]>;
 export type BindMfaPayload = z.infer<typeof bindMfaPayloadGuard>;
 export declare const totpVerificationPayloadGuard: z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
@@ -210,7 +416,100 @@ export declare const totpVerificationPayloadGuard: z.ZodObject<{
     type: MfaFactor.TOTP;
 }>;
 export type TotpVerificationPayload = z.infer<typeof totpVerificationPayloadGuard>;
-export declare const verifyMfaPayloadGuard: z.ZodObject<{
+export declare const webAuthnVerificationPayloadGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    id: z.ZodString;
+    rawId: z.ZodString;
+    authenticatorAttachment: z.ZodOptional<z.ZodEnum<["cross-platform", "platform"]>>;
+    clientExtensionResults: z.ZodObject<{
+        appid: z.ZodOptional<z.ZodBoolean>;
+        crepProps: z.ZodOptional<z.ZodObject<{
+            rk: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            rk?: boolean | undefined;
+        }, {
+            rk?: boolean | undefined;
+        }>>;
+        hmacCreateSecret: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }>;
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    }, {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}>;
+export type WebAuthnVerificationPayload = z.infer<typeof webAuthnVerificationPayloadGuard>;
+export declare const backupCodeVerificationPayloadGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+    code: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    type: MfaFactor.BackupCode;
+}, {
+    code: string;
+    type: MfaFactor.BackupCode;
+}>;
+export type BackupCodeVerificationPayload = z.infer<typeof backupCodeVerificationPayloadGuard>;
+export declare const verifyMfaPayloadGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
     code: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -219,7 +518,96 @@ export declare const verifyMfaPayloadGuard: z.ZodObject<{
 }, {
     code: string;
     type: MfaFactor.TOTP;
-}>;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    id: z.ZodString;
+    rawId: z.ZodString;
+    authenticatorAttachment: z.ZodOptional<z.ZodEnum<["cross-platform", "platform"]>>;
+    clientExtensionResults: z.ZodObject<{
+        appid: z.ZodOptional<z.ZodBoolean>;
+        crepProps: z.ZodOptional<z.ZodObject<{
+            rk: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            rk?: boolean | undefined;
+        }, {
+            rk?: boolean | undefined;
+        }>>;
+        hmacCreateSecret: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }, {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    }>;
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    }, {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}, {
+    type: MfaFactor.WebAuthn;
+    id: string;
+    rawId: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | undefined;
+    };
+    clientExtensionResults: {
+        appid?: boolean | undefined;
+        crepProps?: {
+            rk?: boolean | undefined;
+        } | undefined;
+        hmacCreateSecret?: boolean | undefined;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+    code: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    type: MfaFactor.BackupCode;
+}, {
+    code: string;
+    type: MfaFactor.BackupCode;
+}>]>;
 export type VerifyMfaPayload = z.infer<typeof verifyMfaPayloadGuard>;
 export declare const pendingTotpGuard: z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
@@ -232,7 +620,29 @@ export declare const pendingTotpGuard: z.ZodObject<{
     secret: string;
 }>;
 export type PendingTotp = z.infer<typeof pendingTotpGuard>;
-export declare const pendingMfaGuard: z.ZodObject<{
+export declare const pendingWebAuthnGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    challenge: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    challenge: string;
+}, {
+    type: MfaFactor.WebAuthn;
+    challenge: string;
+}>;
+export type PendingWebAuthn = z.infer<typeof pendingWebAuthnGuard>;
+export declare const pendingBackupCodeGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+    codes: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}>;
+export type PendingBackupCode = z.infer<typeof pendingBackupCodeGuard>;
+export declare const pendingMfaGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
     secret: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -241,7 +651,25 @@ export declare const pendingMfaGuard: z.ZodObject<{
 }, {
     type: MfaFactor.TOTP;
     secret: string;
-}>;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    challenge: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    challenge: string;
+}, {
+    type: MfaFactor.WebAuthn;
+    challenge: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+    codes: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}>]>;
 export type PendingMfa = z.infer<typeof pendingMfaGuard>;
 export declare const bindTotpGuard: z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
@@ -254,7 +682,41 @@ export declare const bindTotpGuard: z.ZodObject<{
     secret: string;
 }>;
 export type BindTotp = z.infer<typeof bindTotpGuard>;
-export declare const bindMfaGuard: z.ZodObject<{
+export declare const bindWebAuthnGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    credentialId: z.ZodString;
+    publicKey: z.ZodString;
+    transports: z.ZodArray<z.ZodEnum<["usb", "nfc", "ble", "internal", "cable", "hybrid", "smart-card"]>, "many">;
+    counter: z.ZodNumber;
+    agent: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    credentialId: string;
+    publicKey: string;
+    transports: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[];
+    counter: number;
+    agent: string;
+}, {
+    type: MfaFactor.WebAuthn;
+    credentialId: string;
+    publicKey: string;
+    transports: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[];
+    counter: number;
+    agent: string;
+}>;
+export type BindWebAuthn = z.infer<typeof bindWebAuthnGuard>;
+export declare const bindBackupCodeGuard: z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+    codes: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}>;
+export type BindBackupCode = z.infer<typeof bindBackupCodeGuard>;
+export declare const bindMfaGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
     secret: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -263,7 +725,37 @@ export declare const bindMfaGuard: z.ZodObject<{
 }, {
     type: MfaFactor.TOTP;
     secret: string;
-}>;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.WebAuthn>;
+    credentialId: z.ZodString;
+    publicKey: z.ZodString;
+    transports: z.ZodArray<z.ZodEnum<["usb", "nfc", "ble", "internal", "cable", "hybrid", "smart-card"]>, "many">;
+    counter: z.ZodNumber;
+    agent: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.WebAuthn;
+    credentialId: string;
+    publicKey: string;
+    transports: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[];
+    counter: number;
+    agent: string;
+}, {
+    type: MfaFactor.WebAuthn;
+    credentialId: string;
+    publicKey: string;
+    transports: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[];
+    counter: number;
+    agent: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<MfaFactor.BackupCode>;
+    codes: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}, {
+    type: MfaFactor.BackupCode;
+    codes: string[];
+}>]>;
 export type BindMfa = z.infer<typeof bindMfaGuard>;
 export declare const verifyMfaResultGuard: z.ZodObject<{
     type: z.ZodNativeEnum<typeof MfaFactor>;

package/lib/types/interactions.js

@@ -1,6 +1,6 @@
 import { emailRegEx, phoneRegEx, usernameRegEx } from '@logto/core-kit';
 import { z } from 'zod';
-import { MfaFactor, jsonObjectGuard } from '../foundations/index.js';
+import { MfaFactor, jsonObjectGuard, webAuthnTransportGuard } from '../foundations/index.js';
 import { emailVerificationCodePayloadGuard, phoneVerificationCodePayloadGuard, } from './verification-code.js';
 /**
  * Detailed interaction identifier payload guard
@@ -68,19 +68,97 @@ export const bindTotpPayloadGuard = z.object({
     type: z.literal(MfaFactor.TOTP),
     code: z.string(),
 });
-export const bindMfaPayloadGuard = bindTotpPayloadGuard;
+export const bindWebAuthnPayloadGuard = z.object({
+    type: z.literal(MfaFactor.WebAuthn),
+    id: z.string(),
+    rawId: z.string(),
+    /**
+     * The response from WebAuthn API
+     *
+     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredential}
+     */
+    response: z.object({
+        clientDataJSON: z.string(),
+        attestationObject: z.string(),
+        authenticatorData: z.string().optional(),
+        transports: webAuthnTransportGuard.array().optional(),
+        publicKeyAlgorithm: z.number().optional(),
+        publicKey: z.string().optional(),
+    }),
+    authenticatorAttachment: z.enum(['cross-platform', 'platform']).optional(),
+    clientExtensionResults: z.object({
+        appid: z.boolean().optional(),
+        crepProps: z
+            .object({
+            rk: z.boolean().optional(),
+        })
+            .optional(),
+        hmacCreateSecret: z.boolean().optional(),
+    }),
+});
+export const bindBackupCodePayloadGuard = z.object({
+    type: z.literal(MfaFactor.BackupCode),
+});
+export const bindMfaPayloadGuard = z.discriminatedUnion('type', [
+    bindTotpPayloadGuard,
+    bindWebAuthnPayloadGuard,
+    bindBackupCodePayloadGuard,
+]);
 export const totpVerificationPayloadGuard = bindTotpPayloadGuard;
-export const verifyMfaPayloadGuard = totpVerificationPayloadGuard;
+export const webAuthnVerificationPayloadGuard = bindWebAuthnPayloadGuard
+    .omit({ response: true })
+    .extend({
+    response: z.object({
+        clientDataJSON: z.string(),
+        authenticatorData: z.string(),
+        signature: z.string(),
+        userHandle: z.string().optional(),
+    }),
+});
+export const backupCodeVerificationPayloadGuard = z.object({
+    type: z.literal(MfaFactor.BackupCode),
+    code: z.string(),
+});
+export const verifyMfaPayloadGuard = z.discriminatedUnion('type', [
+    totpVerificationPayloadGuard,
+    webAuthnVerificationPayloadGuard,
+    backupCodeVerificationPayloadGuard,
+]);
 export const pendingTotpGuard = z.object({
     type: z.literal(MfaFactor.TOTP),
     secret: z.string(),
 });
+export const pendingWebAuthnGuard = z.object({
+    type: z.literal(MfaFactor.WebAuthn),
+    challenge: z.string(),
+});
+export const pendingBackupCodeGuard = z.object({
+    type: z.literal(MfaFactor.BackupCode),
+    codes: z.array(z.string()),
+});
 // Some information like TOTP secret should be generated in the backend
 // and stored in the interaction temporarily.
-export const pendingMfaGuard = pendingTotpGuard;
+export const pendingMfaGuard = z.discriminatedUnion('type', [
+    pendingTotpGuard,
+    pendingWebAuthnGuard,
+    pendingBackupCodeGuard,
+]);
 export const bindTotpGuard = pendingTotpGuard;
+export const bindWebAuthnGuard = z.object({
+    type: z.literal(MfaFactor.WebAuthn),
+    credentialId: z.string(),
+    publicKey: z.string(),
+    transports: webAuthnTransportGuard.array(),
+    counter: z.number(),
+    agent: z.string(),
+});
+export const bindBackupCodeGuard = pendingBackupCodeGuard;
 // The type for binding new mfa verification to a user, not always equals to the pending type.
-export const bindMfaGuard = bindTotpGuard;
+export const bindMfaGuard = z.discriminatedUnion('type', [
+    bindTotpGuard,
+    bindWebAuthnGuard,
+    bindBackupCodeGuard,
+]);
 export const verifyMfaResultGuard = z.object({
     type: z.nativeEnum(MfaFactor),
     id: z.string(),