@logto/schemas 1.43.0 → 1.45.0

package/lib/types/authentication-context.test.js

@@ -0,0 +1,186 @@
+import { describe, expect, it } from 'vitest';
+import { AuthenticationFactor, AuthenticationFactorClass, AuthenticationMethodReference, AuthenticationProofRole, AuthenticationContextMode, LogtoAcr, acrSatisfies, authenticationProofGuard, buildAuthenticationMethodReferences, getAuthenticationFactor, getAuthenticationFactorClass, getAuthenticationMethodReferences, isLogtoAcr, logtoAcrValues, requestedAuthenticationContextGuard, } from './authentication-context.js';
+import { VerificationType } from './verification-records/verification-type.js';
+describe('logtoAcrValues', () => {
+    it('advertises exactly the two Logto classes in order', () => {
+        expect(logtoAcrValues).toEqual(['urn:logto:acr:1fa', 'urn:logto:acr:mfa']);
+    });
+});
+describe('isLogtoAcr', () => {
+    it.each(logtoAcrValues)('accepts %s', (acr) => {
+        expect(isLogtoAcr(acr)).toBe(true);
+    });
+    it.each(['urn:logto:acr:2fa', 'phr', '', undefined, null, 1, ['urn:logto:acr:mfa']])('rejects %j', (value) => {
+        expect(isLogtoAcr(value)).toBe(false);
+    });
+});
+describe('acrSatisfies', () => {
+    it.each([
+        [LogtoAcr.FirstFactor, LogtoAcr.FirstFactor, true],
+        [LogtoAcr.Mfa, LogtoAcr.Mfa, true],
+        // `mfa` is a `1fa` context plus more, so it satisfies the weaker class as well.
+        [LogtoAcr.Mfa, LogtoAcr.FirstFactor, true],
+        [LogtoAcr.FirstFactor, LogtoAcr.Mfa, false],
+    ])('%s satisfies %s: %s', (achieved, required, expected) => {
+        expect(acrSatisfies(achieved, required)).toBe(expected);
+    });
+    it.each(['urn:logto:acr:2fa', 'phr', '', undefined])('never lets the unsupported achieved value %j satisfy a class', (achieved) => {
+        for (const required of logtoAcrValues) {
+            expect(acrSatisfies(achieved, required)).toBe(false);
+        }
+    });
+});
+describe('requestedAuthenticationContextGuard', () => {
+    it('accepts a sign-in context that carries only the requested values', () => {
+        expect(requestedAuthenticationContextGuard.parse({ requestedAcrValues: [LogtoAcr.Mfa] })).toEqual({ requestedAcrValues: [LogtoAcr.Mfa] });
+    });
+    it('accepts a step-up context', () => {
+        const context = {
+            requestedAcrValues: [LogtoAcr.Mfa, LogtoAcr.FirstFactor],
+            selectedAcr: LogtoAcr.Mfa,
+            mode: AuthenticationContextMode.StepUp,
+        };
+        expect(requestedAuthenticationContextGuard.parse(context)).toEqual(context);
+    });
+    it('rejects unsupported classes and modes', () => {
+        expect(requestedAuthenticationContextGuard.safeParse({ requestedAcrValues: ['urn:logto:acr:2fa'] })
+            .success).toBe(false);
+        expect(requestedAuthenticationContextGuard.safeParse({
+            requestedAcrValues: [LogtoAcr.Mfa],
+            mode: 'signIn',
+        }).success).toBe(false);
+    });
+});
+describe('getAuthenticationFactorClass', () => {
+    it.each([
+        VerificationType.Password,
+        VerificationType.EmailVerificationCode,
+        VerificationType.PhoneVerificationCode,
+        VerificationType.OneTimeToken,
+        VerificationType.NewPasswordIdentity,
+    ])('classifies %s as 1fa', (type) => {
+        expect(getAuthenticationFactorClass(type)).toBe(AuthenticationFactorClass.FirstFactor);
+    });
+    it.each([
+        VerificationType.TOTP,
+        VerificationType.MfaEmailVerificationCode,
+        VerificationType.MfaPhoneVerificationCode,
+        VerificationType.BackupCode,
+    ])('classifies %s as mfa', (type) => {
+        expect(getAuthenticationFactorClass(type)).toBe(AuthenticationFactorClass.Mfa);
+    });
+    // A user-verified WebAuthn authenticator is possession plus user verification in one act, and
+    // Logto requires user verification for the registration and the authentication ceremony alike.
+    it.each([VerificationType.WebAuthn, VerificationType.SignInPasskey])('classifies %s as both', (type) => {
+        expect(getAuthenticationFactorClass(type)).toBe(AuthenticationFactorClass.Both);
+    });
+    it.each([VerificationType.Social, VerificationType.EnterpriseSso])('gives %s no class', (type) => {
+        expect(getAuthenticationFactorClass(type)).toBeUndefined();
+    });
+});
+describe('getAuthenticationFactor', () => {
+    it.each([
+        [VerificationType.Password, AuthenticationFactor.Password],
+        [VerificationType.NewPasswordIdentity, AuthenticationFactor.Password],
+        [VerificationType.EmailVerificationCode, AuthenticationFactor.Email],
+        [VerificationType.MfaEmailVerificationCode, AuthenticationFactor.Email],
+        [VerificationType.OneTimeToken, AuthenticationFactor.Email],
+        [VerificationType.PhoneVerificationCode, AuthenticationFactor.Phone],
+        [VerificationType.MfaPhoneVerificationCode, AuthenticationFactor.Phone],
+        [VerificationType.TOTP, AuthenticationFactor.Totp],
+        [VerificationType.BackupCode, AuthenticationFactor.BackupCode],
+        [VerificationType.WebAuthn, AuthenticationFactor.WebAuthn],
+        [VerificationType.SignInPasskey, AuthenticationFactor.WebAuthn],
+        [VerificationType.Social, AuthenticationFactor.Federated],
+        [VerificationType.EnterpriseSso, AuthenticationFactor.Federated],
+    ])('maps %s to the %s factor', (type, expected) => {
+        expect(getAuthenticationFactor(type)).toBe(expected);
+    });
+});
+describe('getAuthenticationMethodReferences', () => {
+    it.each([
+        [VerificationType.Password, ['pwd']],
+        [VerificationType.NewPasswordIdentity, ['pwd']],
+        [VerificationType.EmailVerificationCode, ['otp']],
+        [VerificationType.OneTimeToken, ['otp']],
+        [VerificationType.TOTP, ['otp']],
+        [VerificationType.MfaEmailVerificationCode, ['otp']],
+        [VerificationType.BackupCode, ['otp']],
+        [VerificationType.PhoneVerificationCode, ['sms']],
+        [VerificationType.MfaPhoneVerificationCode, ['sms']],
+        [VerificationType.WebAuthn, ['pop', 'user', 'mfa']],
+        [VerificationType.SignInPasskey, ['pop', 'user', 'mfa']],
+        [VerificationType.Social, ['fed']],
+        [VerificationType.EnterpriseSso, ['fed']],
+    ])('maps %s to %j', (type, expected) => {
+        expect(getAuthenticationMethodReferences(type)).toEqual(expected);
+    });
+    it('maps every verification type', () => {
+        for (const type of Object.values(VerificationType)) {
+            expect(getAuthenticationMethodReferences(type).length).toBeGreaterThan(0);
+        }
+    });
+    it('emits `fed` as the only unregistered AMR value', () => {
+        // RFC 8176 / IANA registered values used by Logto.
+        const registered = new Set(['pwd', 'otp', 'sms', 'pop', 'user', 'mfa']);
+        const emitted = new Set(Object.values(VerificationType).flatMap((type) => getAuthenticationMethodReferences(type)));
+        expect([...emitted].filter((value) => !registered.has(value))).toEqual([
+            AuthenticationMethodReference.Federated,
+        ]);
+    });
+});
+const references = (...types) => types.map((type) => getAuthenticationMethodReferences(type));
+describe('buildAuthenticationMethodReferences', () => {
+    it('unions references in first-seen order without duplicates', () => {
+        expect(buildAuthenticationMethodReferences(references(VerificationType.Password, VerificationType.TOTP, VerificationType.BackupCode), LogtoAcr.FirstFactor)).toEqual(['pwd', 'otp']);
+    });
+    it('appends `mfa` when the achieved ACR is mfa', () => {
+        expect(buildAuthenticationMethodReferences(references(VerificationType.Password, VerificationType.TOTP), LogtoAcr.Mfa)).toEqual(['pwd', 'otp', 'mfa']);
+    });
+    it('does not duplicate `mfa` for WebAuthn', () => {
+        expect(buildAuthenticationMethodReferences(references(VerificationType.WebAuthn), LogtoAcr.Mfa)).toEqual(['pop', 'user', 'mfa']);
+    });
+    it('keeps `mfa` last when a WebAuthn record precedes another factor', () => {
+        expect(buildAuthenticationMethodReferences(references(VerificationType.WebAuthn, VerificationType.Password), LogtoAcr.Mfa)).toEqual(['pop', 'user', 'pwd', 'mfa']);
+        // WebAuthn carries `mfa` on its own even when no ACR is passed.
+        expect(buildAuthenticationMethodReferences(references(VerificationType.WebAuthn, VerificationType.Password))).toEqual(['pop', 'user', 'pwd', 'mfa']);
+    });
+    it('keeps `fed` next to an established factor without an ACR', () => {
+        expect(buildAuthenticationMethodReferences(references(VerificationType.Social, VerificationType.Password))).toEqual(['fed', 'pwd']);
+        expect(buildAuthenticationMethodReferences(references(VerificationType.Social))).toEqual([
+            'fed',
+        ]);
+    });
+    it('returns nothing for no references', () => {
+        expect(buildAuthenticationMethodReferences([])).toEqual([]);
+    });
+});
+describe('authenticationProofGuard', () => {
+    it.each([
+        { id: '', amr: ['otp'] },
+        { id: 'totp', amr: [] },
+    ])('rejects a proof with an empty id or AMR list: %j', ({ id, amr }) => {
+        expect(authenticationProofGuard.safeParse({
+            id,
+            factor: AuthenticationFactor.Totp,
+            class: AuthenticationFactorClass.Mfa,
+            amr,
+            role: AuthenticationProofRole.Mfa,
+        }).success).toBe(false);
+    });
+    it('accepts a proof with and without a class', () => {
+        expect(authenticationProofGuard.safeParse({
+            id: 'totp',
+            factor: AuthenticationFactor.Totp,
+            class: AuthenticationFactorClass.Mfa,
+            amr: ['otp'],
+            role: AuthenticationProofRole.Mfa,
+        }).success).toBe(true);
+        expect(authenticationProofGuard.safeParse({
+            id: 'social',
+            factor: AuthenticationFactor.Federated,
+            amr: ['fed'],
+            role: AuthenticationProofRole.Identify,
+        }).success).toBe(true);
+    });
+});

package/lib/types/cookie.d.ts

@@ -3,17 +3,21 @@ export type LogtoUiCookie = Partial<{
     appId: string;
     organizationId: string;
     uiLocales: string;
+    theme: string;
 }>;
 export declare const logtoUiCookieGuard: z.ZodObject<{
     appId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
     uiLocales: z.ZodOptional<z.ZodString>;
+    theme: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     organizationId?: string | undefined;
     appId?: string | undefined;
     uiLocales?: string | undefined;
+    theme?: string | undefined;
 }, {
     organizationId?: string | undefined;
     appId?: string | undefined;
     uiLocales?: string | undefined;
+    theme?: string | undefined;
 }>;

package/lib/types/cookie.js

@@ -1,4 +1,9 @@
 import { z } from 'zod';
 export const logtoUiCookieGuard = z
-    .object({ appId: z.string(), organizationId: z.string(), uiLocales: z.string() })
+    .object({
+    appId: z.string(),
+    organizationId: z.string(),
+    uiLocales: z.string(),
+    theme: z.string(),
+})
     .partial();

package/lib/types/index.d.ts

@@ -37,3 +37,4 @@ export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
 export * from './trusted-device.js';
+export * from './authentication-context.js';

package/lib/types/index.js

@@ -37,3 +37,4 @@ export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
 export * from './trusted-device.js';
+export * from './authentication-context.js';

package/lib/types/interactions.d.ts

@@ -1,7 +1,9 @@
 import { z } from 'zod';
 import { AdditionalIdentifier, MfaFactor, SignInIdentifier } from '../foundations/index.js';
+import { type RequestedAuthenticationContext } from './authentication-context.js';
 import { InteractionEvent } from './interaction-event.js';
 import type { EmailVerificationCodePayload, PhoneVerificationCodePayload } from './verification-code.js';
+import { VerificationType } from './verification-records/verification-type.js';
 export { eventGuard, InteractionEvent } from './interaction-event.js';
 export type VerificationIdentifier = {
     type: SignInIdentifier | AdditionalIdentifier;
@@ -57,6 +59,55 @@ export declare const verificationCodeIdentifierGuard: z.ZodDiscriminatedUnion<"t
     value: string;
     type: SignInIdentifier.Phone;
 }>]>;
+/**
+ * The subject-bound verification code identifier: the type alone. Accepted once the interaction
+ * carries a subject; core fills the value from that user's primary email / phone. A present
+ * `value` is rejected so a malformed full identifier is never mistaken for this shape.
+ */
+export type SubjectVerificationCodeIdentifier = {
+    type: VerificationCodeSignInIdentifier;
+    value?: undefined;
+};
+export declare const subjectVerificationCodeIdentifierGuard: z.ZodObject<{
+    type: z.ZodEnum<[SignInIdentifier.Email, SignInIdentifier.Phone]>;
+    value: z.ZodUndefined;
+}, "strip", z.ZodTypeAny, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}>;
+/** The full identifier, or the subject-bound shape. */
+export type VerificationCodeIdentifierPayload = VerificationCodeIdentifier | SubjectVerificationCodeIdentifier;
+export declare const verificationCodeIdentifierPayloadGuard: z.ZodUnion<[z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<SignInIdentifier.Email>;
+    value: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    type: SignInIdentifier.Email;
+}, {
+    value: string;
+    type: SignInIdentifier.Email;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<SignInIdentifier.Phone>;
+    value: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    type: SignInIdentifier.Phone;
+}, {
+    value: string;
+    type: SignInIdentifier.Phone;
+}>]>, z.ZodObject<{
+    type: z.ZodEnum<[SignInIdentifier.Email, SignInIdentifier.Phone]>;
+    value: z.ZodUndefined;
+}, "strip", z.ZodTypeAny, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}>]>;
 /** Payload type for `POST /api/experience/verification/{social|sso}/:connectorId/authorization-uri`. */
 export type SocialAuthorizationUrlPayload = {
     state: string;
@@ -128,6 +179,26 @@ export declare const passwordVerificationPayloadGuard: z.ZodObject<{
         type: SignInIdentifier;
     };
 }>;
+/**
+ * The subject-bound password payload: the password alone. Accepted only when the interaction
+ * carries a subject; the password is then verified against that user's credential.
+ */
+export type SubjectPasswordVerificationPayload = {
+    identifier?: undefined;
+    password: string;
+};
+export declare const subjectPasswordVerificationPayloadGuard: z.ZodObject<{
+    identifier: z.ZodUndefined;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    password: string;
+    identifier?: undefined;
+}, {
+    password: string;
+    identifier?: undefined;
+}>;
+/** The full password payload, or the subject-bound shape. */
+export type PasswordVerificationRequestBody = PasswordVerificationPayload | SubjectPasswordVerificationPayload;
 /** Payload type for `POST /api/experience/verification/totp/verify`. */
 export type TotpVerificationVerifyPayload = {
     code: string;
@@ -472,6 +543,96 @@ export declare enum MissingProfile {
     emailOrPhone = "emailOrPhone",
     extraProfile = "extraProfile"
 }
+/** A social or enterprise SSO connector linked to the pinned user that can serve as subject proof. */
+export type SubjectProofConnector = {
+    type: 'social' | 'sso';
+    connectorId: string;
+};
+/**
+ * The masked primary identifiers of the pinned user. Only the masked values ever leave the
+ * server: the step-up UI shows them as hints and never supplies a raw identifier.
+ */
+export type MaskedIdentifiers = {
+    email?: string;
+    phone?: string;
+};
+/**
+ * The authentication context `GET /api/experience/interaction` exposes when the interaction was
+ * created from a login prompt that carries requested `acr_values`. The requested part is copied
+ * verbatim from the prompt details at creation and never mutated; the lists are evaluated on
+ * every read from the pinned user's enrolled methods and the context the interaction achieved so
+ * far, and are never persisted, so a factor change during the interaction's lifetime is reflected.
+ */
+export type InteractionAuthenticationContext = RequestedAuthenticationContext & {
+    /** The methods that can still contribute to the selected class from where the interaction stands. */
+    availableMethods: VerificationType[];
+    /** The first factors the user may establish under a fresh subject proof; `[]` until enrollment lands. */
+    establishableMethods: MissingProfile[];
+    /** The MFA factors the user may enroll after a fresh first factor; `[]` until enrollment lands. */
+    enrollableFactors: MfaFactor[];
+    /** The linked connectors that can serve as subject proof in pure step-up; `[]` until enrollment lands. */
+    subjectProofConnectors: SubjectProofConnector[];
+    maskedIdentifiers: MaskedIdentifiers;
+};
+export declare const interactionAuthenticationContextGuard: z.ZodObject<{
+    requestedAcrValues: z.ZodArray<z.ZodNativeEnum<typeof import("./authentication-context.js").LogtoAcr>, "many">;
+    selectedAcr: z.ZodOptional<z.ZodNativeEnum<typeof import("./authentication-context.js").LogtoAcr>>;
+    mode: z.ZodOptional<z.ZodNativeEnum<typeof import("./authentication-context.js").AuthenticationContextMode>>;
+} & {
+    availableMethods: z.ZodArray<z.ZodNativeEnum<typeof VerificationType>, "many">;
+    establishableMethods: z.ZodArray<z.ZodNativeEnum<typeof MissingProfile>, "many">;
+    enrollableFactors: z.ZodArray<z.ZodNativeEnum<typeof MfaFactor>, "many">;
+    subjectProofConnectors: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["social", "sso"]>;
+        connectorId: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: "social" | "sso";
+        connectorId: string;
+    }, {
+        type: "social" | "sso";
+        connectorId: string;
+    }>, "many">;
+    maskedIdentifiers: z.ZodObject<{
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        email?: string | undefined;
+        phone?: string | undefined;
+    }, {
+        email?: string | undefined;
+        phone?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    requestedAcrValues: import("./authentication-context.js").LogtoAcr[];
+    availableMethods: VerificationType[];
+    establishableMethods: MissingProfile[];
+    enrollableFactors: MfaFactor[];
+    subjectProofConnectors: {
+        type: "social" | "sso";
+        connectorId: string;
+    }[];
+    maskedIdentifiers: {
+        email?: string | undefined;
+        phone?: string | undefined;
+    };
+    mode?: import("./authentication-context.js").AuthenticationContextMode | undefined;
+    selectedAcr?: import("./authentication-context.js").LogtoAcr | undefined;
+}, {
+    requestedAcrValues: import("./authentication-context.js").LogtoAcr[];
+    availableMethods: VerificationType[];
+    establishableMethods: MissingProfile[];
+    enrollableFactors: MfaFactor[];
+    subjectProofConnectors: {
+        type: "social" | "sso";
+        connectorId: string;
+    }[];
+    maskedIdentifiers: {
+        email?: string | undefined;
+        phone?: string | undefined;
+    };
+    mode?: import("./authentication-context.js").AuthenticationContextMode | undefined;
+    selectedAcr?: import("./authentication-context.js").LogtoAcr | undefined;
+}>;
 export declare const bindTotpPayloadGuard: z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
     code: z.ZodString;

package/lib/types/interactions.js

@@ -2,8 +2,10 @@
 import { emailRegEx, numberAndAlphabetRegEx, phoneRegEx, usernameRegEx } from '@logto/core-kit';
 import { z } from 'zod';
 import { AdditionalIdentifier, MfaFactor, SignInIdentifier, jsonObjectGuard, webAuthnTransportGuard, } from '../foundations/index.js';
+import { requestedAuthenticationContextGuard, } from './authentication-context.js';
 import { InteractionEvent } from './interaction-event.js';
 import { emailVerificationCodePayloadGuard, phoneVerificationCodePayloadGuard, } from './verification-code.js';
+import { VerificationType } from './verification-records/verification-type.js';
 export { eventGuard, InteractionEvent } from './interaction-event.js';
 export const verificationIdentifierGuard = z.object({
     type: z.union([z.nativeEnum(SignInIdentifier), z.nativeEnum(AdditionalIdentifier)]),
@@ -25,6 +27,14 @@ export const verificationCodeIdentifierGuard = z.discriminatedUnion('type', [
         value: z.string().regex(phoneRegEx),
     }),
 ]);
+export const subjectVerificationCodeIdentifierGuard = z.object({
+    type: z.enum([SignInIdentifier.Email, SignInIdentifier.Phone]),
+    value: z.undefined(),
+});
+export const verificationCodeIdentifierPayloadGuard = z.union([
+    verificationCodeIdentifierGuard,
+    subjectVerificationCodeIdentifierGuard,
+]);
 export const socialAuthorizationUrlPayloadGuard = z.object({
     state: z.string(),
     redirectUri: z.string(),
@@ -38,6 +48,10 @@ export const passwordVerificationPayloadGuard = z.object({
     identifier: interactionIdentifierGuard,
     password: z.string().min(1),
 });
+export const subjectPasswordVerificationPayloadGuard = z.object({
+    identifier: z.undefined(),
+    password: z.string().min(1),
+});
 export const totpVerificationVerifyPayloadGuard = z.object({
     code: z.string().min(1),
     verificationId: z.string().optional(),
@@ -149,6 +163,15 @@ export var MissingProfile;
     MissingProfile["emailOrPhone"] = "emailOrPhone";
     MissingProfile["extraProfile"] = "extraProfile";
 })(MissingProfile || (MissingProfile = {}));
+export const interactionAuthenticationContextGuard = requestedAuthenticationContextGuard.extend({
+    availableMethods: z.nativeEnum(VerificationType).array(),
+    establishableMethods: z.nativeEnum(MissingProfile).array(),
+    enrollableFactors: z.nativeEnum(MfaFactor).array(),
+    subjectProofConnectors: z
+        .object({ type: z.enum(['social', 'sso']), connectorId: z.string() })
+        .array(),
+    maskedIdentifiers: z.object({ email: z.string().optional(), phone: z.string().optional() }),
+});
 export const bindTotpPayloadGuard = z.object({
     // Unlike identifier payload which has indicator like "email",
     // mfa payload must have an additional type field to indicate type

package/lib/types/log/interaction.d.ts

@@ -13,7 +13,12 @@ export declare enum Field {
     Mfa = "Mfa",
     Verification = "Verification",
     Captcha = "Captcha",
-    SignInPasskey = "SignInPasskey"
+    SignInPasskey = "SignInPasskey",
+    /**
+     * A pure step-up submission: an authenticated session re-proved its subject to reach a requested
+     * authentication context class. Not a sign-in, so it never shares `SignIn.Submit`.
+     */
+    StepUp = "StepUp"
 }
 /** Method to verify the identifier */
 export declare enum Method {
@@ -74,5 +79,13 @@ export type DeprecatedInteractionLogKey = `${Prefix}.${InteractionEvent}.${Field
  * - Indicates an identifier method is being created or submitted to an interaction.
  *   - When {@link Method} is `VerificationCode`, {@link Action} can be `Create` (generate and send a code) or `Submit` (verify and submit to the identifiers);
  *   - Otherwise, {@link Action} is fixed to `Submit` (other methods can be verified on submitting).
+ *
+ * ```ts
+ * `Interaction.${InteractionEvent}.${Field.StepUp}.${Action.Submit}`
+ * ```
+ *
+ * - Indicates a pure step-up interaction is submitted: an authenticated session re-proved its
+ *   subject to reach the requested authentication context class. Its payload records the requested
+ *   and achieved classes and the factor families that were proved, never a credential.
  */
-export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.SignInPasskey}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}` | DeprecatedInteractionLogKey;
+export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.SignInPasskey}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.StepUp}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}` | DeprecatedInteractionLogKey;

package/lib/types/log/interaction.js

@@ -11,6 +11,11 @@ export var Field;
     Field["Verification"] = "Verification";
     Field["Captcha"] = "Captcha";
     Field["SignInPasskey"] = "SignInPasskey";
+    /**
+     * A pure step-up submission: an authenticated session re-proved its subject to reach a requested
+     * authentication context class. Not a sign-in, so it never shares `SignIn.Submit`.
+     */
+    Field["StepUp"] = "StepUp";
 })(Field || (Field = {}));
 /** Method to verify the identifier */
 export var Method;