npm - @metamask/profile-sync-controller - Versions diffs - 34.1.0 → 35.0.0 - Mend

@metamask/profile-sync-controller 34.1.0 → 35.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/dist/sdk/authentication-jwt-bearer/mfa/services.js CHANGED Viewed

@@ -11,23 +11,63 @@ export const MFA_VERIFY_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa
 export const MFA_VERIFY_COMPLETE_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;
 export const MFA_CREDENTIALS_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;
 /**
- * Reads a credential's enrollment date. Unlike flow deadlines, this is display
- * metadata, so an unparsable value is dropped instead of rejecting the whole
- * credential list.
+ * Name an authenticator app shows for the account added from `setupUri`.
  *
- * @param value - The raw `enrolled_at` value, if the server sent one.
+ * The server's QR code names the account after its own Kratos config (issuer
+ * "MetaMask Identity", account "MetaMask <8 hex>" from the identity's
+ * username), which is not sent in the enrollment response. A different name
+ * is harmless: users add the account once, through either the QR code or this
+ * link, and the codes only depend on the secret and `TOTP_SETTINGS`.
+ */
+const TOTP_SETUP_LABEL = 'MetaMask';
+/**
+ * Settings Kratos uses for every TOTP key: its `NewKey` hard-codes 6 digits
+ * and a 30-second period, and leaves the algorithm at the library default,
+ * SHA1. They are not part of the server's configuration, and changing them
+ * would break every authenticator app already set up, so they are stable
+ * enough to copy here.
+ */
+const TOTP_SETTINGS = { algorithm: 'SHA1', digits: '6', period: '30' };
+/**
+ * Builds the `otpauth://` link that opens an authenticator app with the
+ * account to add, for devices that cannot scan their own screen.
+ *
+ * It is built here rather than sent by the server because Kratos does not
+ * expose it: its settings flow returns only the secret and the QR code image,
+ * and keeps the link in internal flow data that its API never returns. The
+ * server could only rebuild it the same way, from the same fixed settings, or
+ * by decoding its own QR code.
+ *
+ * @param secret - Base32 secret from the enrollment response.
+ * @returns The setup link. It contains the secret: never log or persist it.
+ */
+export function buildTotpSetupUri(secret) {
+    const params = new URLSearchParams({
+        secret,
+        issuer: TOTP_SETUP_LABEL,
+        ...TOTP_SETTINGS,
+    });
+    return `otpauth://totp/${encodeURIComponent(TOTP_SETUP_LABEL)}?${params.toString()}`;
+}
+/**
+ * Reads a credential date (`enrolled_at`, `last_used_at`). Unlike flow
+ * deadlines, these are display metadata, so an unparsable value is dropped
+ * instead of rejecting the whole credential list.
+ *
+ * @param field - The field name, for the log.
+ * @param value - The raw value, if the server sent one.
  * @returns The epoch milliseconds, or undefined when absent or unparsable.
  */
-function parseEnrolledAt(value) {
+function parseCredentialDate(field, value) {
     if (!value) {
         return undefined;
     }
-    const enrolledAt = Date.parse(value);
-    if (Number.isNaN(enrolledAt)) {
-        log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);
+    const date = Date.parse(value);
+    if (Number.isNaN(date)) {
+        log.warn(`Ignoring unparsable MFA credential ${field}: ${value}`);
         return undefined;
     }
-    return enrolledAt;
+    return date;
 }
 function parseExpiresAt(value) {
     const expiresAt = Date.parse(value);
@@ -139,6 +179,7 @@ async function throwMfaError(response, errorPrefix) {
     switch (code) {
         case 'credential_already_enrolled':
         case 'email_already_enrolled':
+        case 'totp_already_enrolled':
         case 'email_socially_verified':
             throw new CredentialAlreadyEnrolledError(code, message, status);
         case 'credential_not_enrolled':
@@ -229,6 +270,15 @@ export async function mfaEnroll(env, accessToken, body) {
         ...(json.passkey_create_data
             ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }
             : {}),
+        ...(json.totp_secret && json.totp_qr
+            ? {
+                totp: {
+                    secret: json.totp_secret,
+                    qrCode: json.totp_qr,
+                    setupUri: buildTotpSetupUri(json.totp_secret),
+                },
+            }
+            : {}),
     };
 }
 /**
@@ -328,10 +378,12 @@ export function toEnrolledCredential(credential) {
         log.warn(`Ignoring MFA credential with unsupported status: ${status}`);
         return null;
     }
-    const enrolledAt = parseEnrolledAt(credential.enrolled_at);
+    const enrolledAt = parseCredentialDate('enrolled_at', credential.enrolled_at);
+    const lastUsedAt = parseCredentialDate('last_used_at', credential.last_used_at);
     const base = {
         status,
         ...(enrolledAt === undefined ? {} : { enrolledAt }),
+        ...(lastUsedAt === undefined ? {} : { lastUsedAt }),
     };
     if (type === 'passkey') {
         return {
@@ -353,6 +405,9 @@ export function toEnrolledCredential(credential) {
             verified: credential.email?.verified ?? status === 'active',
         };
     }
+    if (type === 'totp') {
+        return { type, ...base };
+    }
     log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);
     return null;
 }

package/dist/sdk/authentication-jwt-bearer/mfa/services.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AA2CzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAoBD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,IAA8B,EAC9B,QAAkB;IAElB,OAAO,IAAI,EAAE,mBAAmB,KAAK,SAAS;QAC5C,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB,CAAC;QAC9B,KAAK,yBAAyB;YAC5B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,eAAe;YAClB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,oEAAoE;QACpE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACpD,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n CredentialAlreadyEnrolledError,\n CredentialNotEnrolledError,\n MaxIdentifiersReachedError,\n MaxPasskeysReachedError,\n MfaError,\n MfaFlowExpiredError,\n MfaIdentityMissingError,\n MfaRateLimitedError,\n MfaUnavailableError,\n MfaVerificationFailedError,\n OtpResendCooldownError,\n StepUpRequiredError,\n TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n AuthenticationResponseJSONStruct,\n MfaCredentialsResponseStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaErrorResponseStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PasskeyCreateDataStruct,\n PasskeyRequestDataStruct,\n RegistrationResponseJSONStruct,\n assertValidMfaRequest,\n assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n AuthenticationResponseJSON,\n EnrolledCredential,\n MfaCredential,\n MfaCredentialStatus,\n MfaCredentialType,\n MfaEnrollCompleteRequest,\n MfaEnrollRequest,\n MfaVerifyCompleteRequest,\n MfaVerifyRequest,\n PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyCreationOptions;\n};\n\ntype VerificationServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaVerificationAssertion = {\n /** Assertion JWT to exchange at Hydra for an access token. /\n token: string;\n /* Assertion lifetime in seconds. /\n expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/\n Reads a credential's enrollment date. Unlike flow deadlines, this is display\n * metadata, so an unparsable value is dropped instead of rejecting the whole\n * credential list.\n \n @param value - The raw `enrolled_at` value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n /\nfunction parseEnrolledAt(value: string \| undefined): number \| undefined {\n if (!value) {\n return undefined;\n }\n const enrolledAt = Date.parse(value);\n if (Number.isNaN(enrolledAt)) {\n log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);\n return undefined;\n }\n return enrolledAt;\n}\n\nfunction parseExpiresAt(value: string): number {\n const expiresAt = Date.parse(value);\n if (Number.isNaN(expiresAt)) {\n throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n }\n return expiresAt;\n}\n\n/\n Parses passkey creation data embedded in an enrollment response.\n \n @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n /\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Parses passkey request data embedded in a verification response.\n \n @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n /\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n \n @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n /\nfunction parseRetryAfter(response: Response): number \| undefined {\n const header = response.headers.get('Retry-After');\n if (!header) {\n return undefined;\n }\n const seconds = Number(header);\n if (Number.isInteger(seconds)) {\n return Math.max(0, seconds 1000);\n }\n const date = Date.parse(header);\n return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/*\n Reads and validates the JSON error body of a failed MFA request.\n \n When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n \n @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n /\ntype MfaErrorBody = {\n code?: string;\n message: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n retry_after_seconds?: number;\n};\n\n/\n Prefers the documented `retry_after_seconds` error field over the\n * `Retry-After` header.\n \n @param body - The parsed error body, if any.\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined when neither is usable.\n /\nfunction resolveRetryAfterMs(\n body: MfaErrorBody \| undefined,\n response: Response,\n): number \| undefined {\n return body?.retry_after_seconds === undefined\n ? parseRetryAfter(response)\n : body.retry_after_seconds 1000;\n}\n\nasync function readErrorBody(\n response: Response,\n): Promise<MfaErrorBody \| undefined> {\n let body: unknown;\n try {\n body = await response.json();\n } catch {\n return undefined;\n }\n\n try {\n assertValidMfaResponse(body, MfaErrorResponseStruct);\n return body;\n } catch {\n const message = asRecord(body)?.message;\n return typeof message === 'string' ? { message } : undefined;\n }\n}\n\nasync function throwMfaError(\n response: Response,\n errorPrefix: string,\n): Promise<never> {\n const { status } = response;\n const body = await readErrorBody(response);\n const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n // Status-only classification first: gateways and load balancers answer\n // 401/429/502 without the service's JSON body, and the caller still needs\n // to invalidate its session, honour Retry-After, or back off.\n if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n throw new MfaError('authentication_required', message, { status });\n }\n\n const code = body?.code;\n switch (code) {\n case 'credential_already_enrolled':\n case 'email_already_enrolled':\n case 'email_socially_verified':\n throw new CredentialAlreadyEnrolledError(code, message, status);\n case 'credential_not_enrolled':\n throw new CredentialNotEnrolledError(message, status);\n case 'aal2_required':\n throw new StepUpRequiredError(message, status);\n case 'flow_expired':\n case 'invalid_flow':\n throw new MfaFlowExpiredError(code, message, status);\n case 'mfa_identity_missing':\n throw new MfaIdentityMissingError(message, status);\n case 'invalid_code':\n case 'invalid_attestation':\n case 'invalid_assertion':\n throw new MfaVerificationFailedError(code, message, status);\n case 'too_many_attempts':\n throw new TooManyAttemptsError(message, status);\n case 'max_passkeys_reached':\n throw new MaxPasskeysReachedError(message, status);\n case 'max_identifiers_reached':\n throw new MaxIdentifiersReachedError(message, status);\n case 'otp_resend_cooldown':\n throw new OtpResendCooldownError(\n message,\n resolveRetryAfterMs(body, response),\n status,\n );\n case 'kratos_unavailable':\n throw new MfaUnavailableError(message, status);\n default:\n break;\n }\n\n if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n throw new MfaRateLimitedError(\n message,\n resolveRetryAfterMs(body, response),\n status,\n );\n }\n if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n throw new MfaUnavailableError(message, status);\n }\n if (!body) {\n throw new MfaError(\n 'invalid_response',\n `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n { status },\n );\n }\n throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n url: string,\n accessToken: string,\n init?: { method?: 'GET' \| 'POST'; body?: Json },\n): Promise<Json> {\n let response: Response;\n try {\n response = await fetch(url, {\n method: init?.method ?? 'GET',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n ...(init?.body === undefined\n ? {}\n : { 'Content-Type': 'application/json' }),\n },\n ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n });\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaUnavailableError(`MFA request failed: ${message}`);\n }\n\n if (!response.ok) {\n return await throwMfaError(response, 'MFA request failed');\n }\n\n try {\n return await response.json();\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message, {\n status: response.status,\n });\n }\n}\n\n/*\n Begins enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n /\nexport async function mfaEnroll(\n env: Env,\n accessToken: string,\n body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_create_data\n ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n : {}),\n };\n}\n\n/\n Completes enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n * @returns The assertion JWT proving the enrolled credential, and its lifetime\n * in seconds.\n /\nexport async function mfaEnrollComplete(\n env: Env,\n accessToken: string,\n params: EnrollmentCompletionParams,\n): Promise<MfaVerificationAssertion> {\n let body: MfaEnrollCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_attestation) {\n assertValidMfaRequest(\n params.passkey_attestation,\n RegistrationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_attestation: JSON.stringify(params.passkey_attestation),\n };\n }\n\n const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n return { token: json.token, expiresIn: json.expires_in };\n}\n\n/\n Begins verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n /\nexport async function mfaVerify(\n env: Env,\n accessToken: string,\n body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_request_data\n ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n : {}),\n };\n}\n\n/\n Completes verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The assertion JWT and its lifetime in seconds.\n /\nexport async function mfaVerifyComplete(\n env: Env,\n accessToken: string,\n params: VerificationCompletionParams,\n): Promise<MfaVerificationAssertion> {\n let body: MfaVerifyCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_assertion) {\n assertValidMfaRequest(\n params.passkey_assertion,\n AuthenticationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_assertion: JSON.stringify(params.passkey_assertion),\n };\n }\n\n const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n return status === 'active' \|\| status === 'pending';\n}\n\n/\n Maps a server credential to its public controller representation.\n \n Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n \n @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n /\nexport function toEnrolledCredential(\n credential: MfaCredential,\n): EnrolledCredential \| null {\n const { credential_type: type, status } = credential;\n if (!isSupportedStatus(status)) {\n log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n return null;\n }\n\n const enrolledAt = parseEnrolledAt(credential.enrolled_at);\n const base = {\n status,\n ...(enrolledAt === undefined ? {} : { enrolledAt }),\n };\n\n if (type === 'passkey') {\n return {\n type,\n ...base,\n ...(credential.passkey?.display_name\n ? { displayName: credential.passkey.display_name }\n : {}),\n };\n }\n\n if (type === 'email_otp') {\n // The API marks the address optional, so a row without one is kept.\n const address = credential.email?.address;\n return {\n type,\n ...base,\n ...(address === undefined ? {} : { email: address }),\n // The spec marks `verified` optional; an active row is verified.\n verified: credential.email?.verified ?? status === 'active',\n };\n }\n\n log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n return null;\n}\n\n/\n Gets the credentials enrolled on the canonical profile.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n env: Env,\n accessToken: string,\n): Promise<EnrolledCredential[]> {\n const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n return json.credentials\n .map(toEnrolledCredential)\n .filter((credential): credential is EnrolledCredential =>\n Boolean(credential),\n );\n}\n"]}
1	+ {"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AASzD;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,GAAG,aAAa;KACjB,CAAC,CAAC;IACH,OAAO,kBAAkB,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvF,CAAC;AAqCD;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAAa,EACb,KAAyB;IAEzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,sCAAsC,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAoBD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,IAA8B,EAC9B,QAAkB;IAElB,OAAO,IAAI,EAAE,mBAAmB,KAAK,SAAS;QAC5C,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB,CAAC;QAC9B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,yBAAyB;YAC5B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,eAAe;YAClB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO;YAClC,CAAC,CAAC;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE,IAAI,CAAC,WAAW;oBACxB,MAAM,EAAE,IAAI,CAAC,OAAO;oBACpB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;iBAC9C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,cAAc,EACd,UAAU,CAAC,YAAY,CACxB,CAAC;IACF,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,oEAAoE;QACpE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACpD,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n CredentialAlreadyEnrolledError,\n CredentialNotEnrolledError,\n MaxIdentifiersReachedError,\n MaxPasskeysReachedError,\n MfaError,\n MfaFlowExpiredError,\n MfaIdentityMissingError,\n MfaRateLimitedError,\n MfaUnavailableError,\n MfaVerificationFailedError,\n OtpResendCooldownError,\n StepUpRequiredError,\n TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n AuthenticationResponseJSONStruct,\n MfaCredentialsResponseStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaErrorResponseStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PasskeyCreateDataStruct,\n PasskeyRequestDataStruct,\n RegistrationResponseJSONStruct,\n assertValidMfaRequest,\n assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n AuthenticationResponseJSON,\n EnrolledCredential,\n MfaCredential,\n MfaCredentialStatus,\n MfaCredentialType,\n MfaEnrollCompleteRequest,\n MfaEnrollRequest,\n MfaVerifyCompleteRequest,\n MfaVerifyRequest,\n PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyCreationOptions;\n totp?: { secret: string; qrCode: string; setupUri: string };\n};\n\n/*\n Name an authenticator app shows for the account added from `setupUri`.\n \n The server's QR code names the account after its own Kratos config (issuer\n * \"MetaMask Identity\", account \"MetaMask <8 hex>\" from the identity's\n * username), which is not sent in the enrollment response. A different name\n * is harmless: users add the account once, through either the QR code or this\n * link, and the codes only depend on the secret and `TOTP_SETTINGS`.\n /\nconst TOTP_SETUP_LABEL = 'MetaMask';\n\n/\n Settings Kratos uses for every TOTP key: its `NewKey` hard-codes 6 digits\n * and a 30-second period, and leaves the algorithm at the library default,\n * SHA1. They are not part of the server's configuration, and changing them\n * would break every authenticator app already set up, so they are stable\n * enough to copy here.\n /\nconst TOTP_SETTINGS = { algorithm: 'SHA1', digits: '6', period: '30' };\n\n/\n Builds the `otpauth://` link that opens an authenticator app with the\n * account to add, for devices that cannot scan their own screen.\n \n It is built here rather than sent by the server because Kratos does not\n * expose it: its settings flow returns only the secret and the QR code image,\n * and keeps the link in internal flow data that its API never returns. The\n * server could only rebuild it the same way, from the same fixed settings, or\n * by decoding its own QR code.\n \n @param secret - Base32 secret from the enrollment response.\n * @returns The setup link. It contains the secret: never log or persist it.\n /\nexport function buildTotpSetupUri(secret: string): string {\n const params = new URLSearchParams({\n secret,\n issuer: TOTP_SETUP_LABEL,\n ...TOTP_SETTINGS,\n });\n return `otpauth://totp/${encodeURIComponent(TOTP_SETUP_LABEL)}?${params.toString()}`;\n}\n\ntype VerificationServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaVerificationAssertion = {\n /* Assertion JWT to exchange at Hydra for an access token. /\n token: string;\n /* Assertion lifetime in seconds. /\n expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/\n Reads a credential date (`enrolled_at`, `last_used_at`). Unlike flow\n * deadlines, these are display metadata, so an unparsable value is dropped\n * instead of rejecting the whole credential list.\n \n @param field - The field name, for the log.\n * @param value - The raw value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n /\nfunction parseCredentialDate(\n field: string,\n value: string \| undefined,\n): number \| undefined {\n if (!value) {\n return undefined;\n }\n const date = Date.parse(value);\n if (Number.isNaN(date)) {\n log.warn(`Ignoring unparsable MFA credential ${field}: ${value}`);\n return undefined;\n }\n return date;\n}\n\nfunction parseExpiresAt(value: string): number {\n const expiresAt = Date.parse(value);\n if (Number.isNaN(expiresAt)) {\n throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n }\n return expiresAt;\n}\n\n/\n Parses passkey creation data embedded in an enrollment response.\n \n @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n /\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Parses passkey request data embedded in a verification response.\n \n @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n /\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n \n @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n /\nfunction parseRetryAfter(response: Response): number \| undefined {\n const header = response.headers.get('Retry-After');\n if (!header) {\n return undefined;\n }\n const seconds = Number(header);\n if (Number.isInteger(seconds)) {\n return Math.max(0, seconds 1000);\n }\n const date = Date.parse(header);\n return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/*\n Reads and validates the JSON error body of a failed MFA request.\n \n When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n \n @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n /\ntype MfaErrorBody = {\n code?: string;\n message: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n retry_after_seconds?: number;\n};\n\n/\n Prefers the documented `retry_after_seconds` error field over the\n * `Retry-After` header.\n \n @param body - The parsed error body, if any.\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined when neither is usable.\n /\nfunction resolveRetryAfterMs(\n body: MfaErrorBody \| undefined,\n response: Response,\n): number \| undefined {\n return body?.retry_after_seconds === undefined\n ? parseRetryAfter(response)\n : body.retry_after_seconds 1000;\n}\n\nasync function readErrorBody(\n response: Response,\n): Promise<MfaErrorBody \| undefined> {\n let body: unknown;\n try {\n body = await response.json();\n } catch {\n return undefined;\n }\n\n try {\n assertValidMfaResponse(body, MfaErrorResponseStruct);\n return body;\n } catch {\n const message = asRecord(body)?.message;\n return typeof message === 'string' ? { message } : undefined;\n }\n}\n\nasync function throwMfaError(\n response: Response,\n errorPrefix: string,\n): Promise<never> {\n const { status } = response;\n const body = await readErrorBody(response);\n const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n // Status-only classification first: gateways and load balancers answer\n // 401/429/502 without the service's JSON body, and the caller still needs\n // to invalidate its session, honour Retry-After, or back off.\n if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n throw new MfaError('authentication_required', message, { status });\n }\n\n const code = body?.code;\n switch (code) {\n case 'credential_already_enrolled':\n case 'email_already_enrolled':\n case 'totp_already_enrolled':\n case 'email_socially_verified':\n throw new CredentialAlreadyEnrolledError(code, message, status);\n case 'credential_not_enrolled':\n throw new CredentialNotEnrolledError(message, status);\n case 'aal2_required':\n throw new StepUpRequiredError(message, status);\n case 'flow_expired':\n case 'invalid_flow':\n throw new MfaFlowExpiredError(code, message, status);\n case 'mfa_identity_missing':\n throw new MfaIdentityMissingError(message, status);\n case 'invalid_code':\n case 'invalid_attestation':\n case 'invalid_assertion':\n throw new MfaVerificationFailedError(code, message, status);\n case 'too_many_attempts':\n throw new TooManyAttemptsError(message, status);\n case 'max_passkeys_reached':\n throw new MaxPasskeysReachedError(message, status);\n case 'max_identifiers_reached':\n throw new MaxIdentifiersReachedError(message, status);\n case 'otp_resend_cooldown':\n throw new OtpResendCooldownError(\n message,\n resolveRetryAfterMs(body, response),\n status,\n );\n case 'kratos_unavailable':\n throw new MfaUnavailableError(message, status);\n default:\n break;\n }\n\n if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n throw new MfaRateLimitedError(\n message,\n resolveRetryAfterMs(body, response),\n status,\n );\n }\n if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n throw new MfaUnavailableError(message, status);\n }\n if (!body) {\n throw new MfaError(\n 'invalid_response',\n `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n { status },\n );\n }\n throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n url: string,\n accessToken: string,\n init?: { method?: 'GET' \| 'POST'; body?: Json },\n): Promise<Json> {\n let response: Response;\n try {\n response = await fetch(url, {\n method: init?.method ?? 'GET',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n ...(init?.body === undefined\n ? {}\n : { 'Content-Type': 'application/json' }),\n },\n ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n });\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaUnavailableError(`MFA request failed: ${message}`);\n }\n\n if (!response.ok) {\n return await throwMfaError(response, 'MFA request failed');\n }\n\n try {\n return await response.json();\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message, {\n status: response.status,\n });\n }\n}\n\n/*\n Begins enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n /\nexport async function mfaEnroll(\n env: Env,\n accessToken: string,\n body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_create_data\n ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n : {}),\n ...(json.totp_secret && json.totp_qr\n ? {\n totp: {\n secret: json.totp_secret,\n qrCode: json.totp_qr,\n setupUri: buildTotpSetupUri(json.totp_secret),\n },\n }\n : {}),\n };\n}\n\n/\n Completes enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n * @returns The assertion JWT proving the enrolled credential, and its lifetime\n * in seconds.\n /\nexport async function mfaEnrollComplete(\n env: Env,\n accessToken: string,\n params: EnrollmentCompletionParams,\n): Promise<MfaVerificationAssertion> {\n let body: MfaEnrollCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_attestation) {\n assertValidMfaRequest(\n params.passkey_attestation,\n RegistrationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_attestation: JSON.stringify(params.passkey_attestation),\n };\n }\n\n const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n return { token: json.token, expiresIn: json.expires_in };\n}\n\n/\n Begins verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n /\nexport async function mfaVerify(\n env: Env,\n accessToken: string,\n body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_request_data\n ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n : {}),\n };\n}\n\n/\n Completes verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The assertion JWT and its lifetime in seconds.\n /\nexport async function mfaVerifyComplete(\n env: Env,\n accessToken: string,\n params: VerificationCompletionParams,\n): Promise<MfaVerificationAssertion> {\n let body: MfaVerifyCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_assertion) {\n assertValidMfaRequest(\n params.passkey_assertion,\n AuthenticationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_assertion: JSON.stringify(params.passkey_assertion),\n };\n }\n\n const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n return status === 'active' \|\| status === 'pending';\n}\n\n/\n Maps a server credential to its public controller representation.\n \n Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n \n @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n /\nexport function toEnrolledCredential(\n credential: MfaCredential,\n): EnrolledCredential \| null {\n const { credential_type: type, status } = credential;\n if (!isSupportedStatus(status)) {\n log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n return null;\n }\n\n const enrolledAt = parseCredentialDate('enrolled_at', credential.enrolled_at);\n const lastUsedAt = parseCredentialDate(\n 'last_used_at',\n credential.last_used_at,\n );\n const base = {\n status,\n ...(enrolledAt === undefined ? {} : { enrolledAt }),\n ...(lastUsedAt === undefined ? {} : { lastUsedAt }),\n };\n\n if (type === 'passkey') {\n return {\n type,\n ...base,\n ...(credential.passkey?.display_name\n ? { displayName: credential.passkey.display_name }\n : {}),\n };\n }\n\n if (type === 'email_otp') {\n // The API marks the address optional, so a row without one is kept.\n const address = credential.email?.address;\n return {\n type,\n ...base,\n ...(address === undefined ? {} : { email: address }),\n // The spec marks `verified` optional; an active row is verified.\n verified: credential.email?.verified ?? status === 'active',\n };\n }\n\n if (type === 'totp') {\n return { type, ...base };\n }\n\n log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n return null;\n}\n\n/\n Gets the credentials enrolled on the canonical profile.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n env: Env,\n accessToken: string,\n): Promise<EnrolledCredential[]> {\n const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n return json.credentials\n .map(toEnrolledCredential)\n .filter((credential): credential is EnrolledCredential =>\n Boolean(credential),\n );\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts CHANGED Viewed

@@ -35,22 +35,27 @@ export type MfaVerifyCompleteRequest = {
     passkey_assertion?: string;
     otp_code?: string;
 };
-export type EnrolledCredential = {
-    type: 'passkey';
+type EnrolledCredentialBase = {
     status: MfaCredentialStatus;
+    /** Epoch milliseconds, when the server sent a valid date. */
     enrolledAt?: number;
+    /** Epoch milliseconds of the last verification, when the server sent one. */
+    lastUsedAt?: number;
+};
+export type EnrolledCredential = EnrolledCredentialBase & ({
+    type: 'passkey';
     displayName?: string;
 } | {
     type: 'email_otp';
-    status: MfaCredentialStatus;
-    enrolledAt?: number;
     /**
-     * Absent when the server lists an email method without its address; the
-     * API marks the address optional.
+     * Absent when the server lists an email method without its address;
+     * the API marks the address optional.
      */
     email?: string;
     verified: boolean;
-};
+} | {
+    type: 'totp';
+});
 /**
  * Caller-supplied context attached to MFA trace spans. `operation` names the
  * client flow that needs the credential (for example `money.signTransaction`).
@@ -58,38 +63,55 @@ export type EnrolledCredential = {
 export type TokenReason = {
     operation: string;
 };
-export type EnrollmentChallenge = {
-    type: 'passkey';
+/** Fields every enrollment or verification challenge carries. */
+type MfaChallengeBase = {
+    /** Identifier to send back when completing the flow. */
     flowId: string;
+    /** Epoch milliseconds after which the flow can no longer be completed. */
     expiresAt: number;
+};
+export type EnrollmentChallenge = MfaChallengeBase & ({
+    type: 'passkey';
     publicKey: PublicKeyCredentialCreationOptionsJSON;
 } | {
     type: 'email_otp';
-    flowId: string;
-    expiresAt: number;
-};
+} | {
+    type: 'totp';
+    /**
+     * Base32 secret for the user's authenticator app, for manual entry or
+     * an `otpauth://` link. Never log or persist it.
+     */
+    secret: string;
+    /**
+     * PNG data URL of the QR code encoding the secret; render it as-is.
+     * Never log or persist it.
+     */
+    qrCode: string;
+    /**
+     * `otpauth://` link that opens an authenticator app on this device
+     * with the account to add, since a phone cannot scan its own screen.
+     * Contains the secret: never log or persist it.
+     */
+    setupUri: string;
+});
 export type EnrollmentProof = {
     type: 'passkey';
     attestation: RegistrationResponseJSON;
 } | {
-    type: 'email_otp';
+    type: 'email_otp' | 'totp';
     code: string;
 };
-export type VerificationChallenge = {
+export type VerificationChallenge = MfaChallengeBase & ({
     type: 'passkey';
-    flowId: string;
-    expiresAt: number;
     publicKey: PublicKeyCredentialRequestOptionsJSON;
 } | {
-    type: 'email_otp';
-    flowId: string;
-    expiresAt: number;
-};
+    type: 'email_otp' | 'totp';
+});
 export type VerificationProof = {
     type: 'passkey';
     assertion: AuthenticationResponseJSON;
 } | {
-    type: 'email_otp';
+    type: 'email_otp' | 'totp';
     code: string;
 };
 export type VerificationToken = {
@@ -135,5 +157,5 @@ export type CompleteVerificationRequest = {
 export type GetVerificationTokenRequest = {
     maxSessionAgeMs?: number;
 };
-export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'email_socially_verified' | 'mfa_identity_missing' | 'multi_primary_srp' | 'aal2_required' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'verification_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
+export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'totp_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'email_socially_verified' | 'mfa_identity_missing' | 'multi_primary_srp' | 'aal2_required' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'verification_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
 //# sourceMappingURL=types.d.ts.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,~~MAAM~~,~~MAAM~~,~~kBAAkB,GAC1B~~;~~IACE~~,~~IAAI,EAAE,SAAS,CAAC;IAChB,~~MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,~~WAAW~~,CAAC,EAAE,MAAM,CAAC;~~CACtB~~,~~GACD~~;IACE,IAAI,EAAE,~~WAAW~~,CAAC;~~IAClB~~,~~MAAM~~,EAAE,~~mBAAmB~~,CAAC;~~IAC5B~~,~~UAAU~~,~~CAAC~~,EAAE,~~MAAM~~,CAAC;~~IACpB~~;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;~~AAEN~~;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,~~MAAM~~,~~MAAM~~,~~mBAAmB~~,~~GAC3B~~;~~IACE~~,~~IAAI~~,EAAE,~~SAAS~~,CAAC;~~IAChB~~,~~MAAM~~,EAAE,MAAM,CAAC;~~IACf~~,~~SAAS~~,~~EAAE~~,MAAM,CAAC;~~IAClB~~,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;~~IAClB~~,MAAM,EAAE,MAAM,CAAC;IACf,~~SAAS~~,EAAE,MAAM,CAAC;~~CACnB~~,CAAC;~~AAEN~~,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;~~IAClB~~,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,qBAAqB,~~GAC7B~~;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,~~MAAM,EAAE,MAAM,CAAC;IACf,~~SAAS,EAAE,~~MAAM,CAAC;IAClB,SAAS,EAAE,~~qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,~~CAAC;IAClB~~,MAAM,~~EAAE,MAAM,~~CAAC;~~IACf~~,~~SAAS~~,~~EAAE,MAAM,~~CAAC;~~CACnB~~,~~CAAC;AAEN,~~MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;~~IAClB~~,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ;;;WAGG;QACH,GAAG,EAAE,CAAC,iBAAiB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,sBAAsB,GACtB,mBAAmB,GACnB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,4BAA4B,GAC5B,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GACrD,CACI;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;CACd,CACJ,CAAC;AAEJ;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,KAAK,gBAAgB,GAAG;IACtB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAChD,CACI;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;CACnB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CACJ,CAAC;AAEJ,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAClD,CACI;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;CAC5B,CACJ,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ;;;WAGG;QACH,GAAG,EAAE,CAAC,iBAAiB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,uBAAuB,GACvB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,sBAAsB,GACtB,mBAAmB,GACnB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,4BAA4B,GAC5B,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}

package/dist/sdk/authentication-jwt-bearer/mfa/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n AuthenticationResponseJSONStruct,\n MfaCredentialStruct,\n MfaCredentialsResponseStruct,\n MfaEmailDetailStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaPasskeyDetailStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PublicKeyCredentialCreationOptionsJSONStruct,\n PublicKeyCredentialRequestOptionsJSONStruct,\n RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' \| 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n};\n\~~nexport~~ ~~type~~ ~~EnrolledCredential~~ ~~=\n \|~~ {\n ~~type: 'passkey';\n~~ status: MfaCredentialStatus;\n enrolledAt?: number;\n ~~displayName~~?: ~~string~~;\n }\n \| {\n type: '~~email_otp~~';\n ~~status:~~ ~~MfaCredentialStatus~~;\n ~~enrolledAt?:~~ ~~number~~;\n /*\n Absent when the server lists an email method without its address~~; the\~~n * API marks the address optional.\n /\n email?: string;\n verified: boolean;\n };\n\n/\n Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n /\nexport type TokenReason = {\n operation: string;\n};\n\nexport type EnrollmentChallenge =\n \| {\n type: 'passkey';\n ~~flowId~~: ~~string~~;\n ~~expiresAt:~~ ~~number;\~~n ~~publicKey~~: ~~PublicKeyCredentialCreationOptionsJSON~~;\n }\n \| {\n type: '~~email_otp~~';\n ~~flowId~~: string;\n ~~expiresAt~~: ~~number~~;\n };\n\nexport type EnrollmentProof =\n \| {\n type: 'passkey';\n attestation: RegistrationResponseJSON;\n }\n \| {\n type: 'email_otp';\n code: string;\n };\n\nexport type VerificationChallenge =\n \| {\n type: 'passkey';\n ~~flowId: string;\n expiresAt: number;\n~~ publicKey: PublicKeyCredentialRequestOptionsJSON;\n }\n \| {\n type: 'email_otp'~~;\n flowId:~~ ~~string~~;\n ~~expiresAt: number;\~~n };\n\nexport type VerificationProof =\n \| {\n type: 'passkey';\n assertion: AuthenticationResponseJSON;\n }\n \| {\n type: 'email_otp';\n code: string;\n };\n\nexport type VerificationToken = {\n accessToken: string;\n expiresIn: number;\n obtainedAt: number;\n claims: {\n sub: string;\n /\n Methods the verification used. Usually an `MfaCredentialType`, but the\n * server may report other method names.\n /\n amr: (MfaCredentialType \| (string & Record<never, never>))[];\n exp: number;\n };\n};\n\nexport type BeginEnrollmentRequest = {\n type: MfaCredentialType;\n email?: string;\n reason: TokenReason;\n /\n Maximum age, in milliseconds, of a verification session that may authorize\n * this enrollment. Defaults to `ENROLLMENT_MAX_SESSION_AGE_MS`. A setup flow\n * that proved a factor itself may pass the time elapsed since it started.\n * Zero never uses the session.\n */\n maxSessionAgeMs?: number;\n};\n\nexport type CompleteEnrollmentRequest = {\n flowId: string;\n proof: EnrollmentProof;\n reason: TokenReason;\n};\n\nexport type BeginVerificationRequest = {\n type: MfaCredentialType;\n reason: TokenReason;\n};\n\nexport type CompleteVerificationRequest = {\n flowId: string;\n proof: VerificationProof;\n reason: TokenReason;\n};\n\nexport type GetVerificationTokenRequest = {\n maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n \| 'max_passkeys_reached'\n \| 'max_identifiers_reached'\n \| 'email_already_enrolled'\n \| 'credential_already_enrolled'\n \| 'credential_not_enrolled'\n \| 'email_socially_verified'\n \| 'mfa_identity_missing'\n \| 'multi_primary_srp'\n \| 'aal2_required'\n \| 'otp_resend_cooldown'\n \| 'rate_limited'\n \| 'kratos_unavailable'\n \| 'flow_expired'\n \| 'invalid_flow'\n \| 'invalid_attestation'\n \| 'invalid_code'\n \| 'invalid_assertion'\n \| 'too_many_attempts'\n \| 'verification_token_invalid'\n \| 'authentication_required'\n \| 'server_error'\n \| 'invalid_response'\n \| 'invalid_request';\n"]}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n AuthenticationResponseJSONStruct,\n MfaCredentialStruct,\n MfaCredentialsResponseStruct,\n MfaEmailDetailStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaPasskeyDetailStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PublicKeyCredentialCreationOptionsJSONStruct,\n PublicKeyCredentialRequestOptionsJSONStruct,\n RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' \| 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n};\n\ntype EnrolledCredentialBase = {\n status: MfaCredentialStatus;\n /** Epoch milliseconds, when the server sent a valid date. /\n enrolledAt?: number;\n /* Epoch milliseconds of the last verification, when the server sent one. /\n lastUsedAt?: number;\n};\n\nexport type EnrolledCredential = EnrolledCredentialBase &\n (\n \| {\n type: 'passkey';\n displayName?: string;\n }\n \| {\n type: 'email_otp';\n /\n Absent when the server lists an email method without its address;\n * the API marks the address optional.\n /\n email?: string;\n verified: boolean;\n }\n \| {\n type: 'totp';\n }\n );\n\n/\n Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n /\nexport type TokenReason = {\n operation: string;\n};\n\n/* Fields every enrollment or verification challenge carries. /\ntype MfaChallengeBase = {\n /* Identifier to send back when completing the flow. /\n flowId: string;\n /* Epoch milliseconds after which the flow can no longer be completed. /\n expiresAt: number;\n};\n\nexport type EnrollmentChallenge = MfaChallengeBase &\n (\n \| {\n type: 'passkey';\n publicKey: PublicKeyCredentialCreationOptionsJSON;\n }\n \| {\n type: 'email_otp';\n }\n \| {\n type: 'totp';\n /\n Base32 secret for the user's authenticator app, for manual entry or\n * an `otpauth://` link. Never log or persist it.\n /\n secret: string;\n /\n PNG data URL of the QR code encoding the secret; render it as-is.\n * Never log or persist it.\n /\n qrCode: string;\n /\n `otpauth://` link that opens an authenticator app on this device\n * with the account to add, since a phone cannot scan its own screen.\n * Contains the secret: never log or persist it.\n /\n setupUri: string;\n }\n );\n\nexport type EnrollmentProof =\n \| {\n type: 'passkey';\n attestation: RegistrationResponseJSON;\n }\n \| {\n type: 'email_otp' \| 'totp';\n code: string;\n };\n\nexport type VerificationChallenge = MfaChallengeBase &\n (\n \| {\n type: 'passkey';\n publicKey: PublicKeyCredentialRequestOptionsJSON;\n }\n \| {\n type: 'email_otp' \| 'totp';\n }\n );\n\nexport type VerificationProof =\n \| {\n type: 'passkey';\n assertion: AuthenticationResponseJSON;\n }\n \| {\n type: 'email_otp' \| 'totp';\n code: string;\n };\n\nexport type VerificationToken = {\n accessToken: string;\n expiresIn: number;\n obtainedAt: number;\n claims: {\n sub: string;\n /\n Methods the verification used. Usually an `MfaCredentialType`, but the\n * server may report other method names.\n /\n amr: (MfaCredentialType \| (string & Record<never, never>))[];\n exp: number;\n };\n};\n\nexport type BeginEnrollmentRequest = {\n type: MfaCredentialType;\n email?: string;\n reason: TokenReason;\n /\n Maximum age, in milliseconds, of a verification session that may authorize\n * this enrollment. Defaults to `ENROLLMENT_MAX_SESSION_AGE_MS`. A setup flow\n * that proved a factor itself may pass the time elapsed since it started.\n * Zero never uses the session.\n */\n maxSessionAgeMs?: number;\n};\n\nexport type CompleteEnrollmentRequest = {\n flowId: string;\n proof: EnrollmentProof;\n reason: TokenReason;\n};\n\nexport type BeginVerificationRequest = {\n type: MfaCredentialType;\n reason: TokenReason;\n};\n\nexport type CompleteVerificationRequest = {\n flowId: string;\n proof: VerificationProof;\n reason: TokenReason;\n};\n\nexport type GetVerificationTokenRequest = {\n maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n \| 'max_passkeys_reached'\n \| 'max_identifiers_reached'\n \| 'email_already_enrolled'\n \| 'totp_already_enrolled'\n \| 'credential_already_enrolled'\n \| 'credential_not_enrolled'\n \| 'email_socially_verified'\n \| 'mfa_identity_missing'\n \| 'multi_primary_srp'\n \| 'aal2_required'\n \| 'otp_resend_cooldown'\n \| 'rate_limited'\n \| 'kratos_unavailable'\n \| 'flow_expired'\n \| 'invalid_flow'\n \| 'invalid_attestation'\n \| 'invalid_code'\n \| 'invalid_assertion'\n \| 'too_many_attempts'\n \| 'verification_token_invalid'\n \| 'authentication_required'\n \| 'server_error'\n \| 'invalid_response'\n \| 'invalid_request';\n"]}

package/dist/sdk/errors.d.ts CHANGED Viewed

@@ -18,12 +18,13 @@ export declare class MfaError extends Error {
 /**
  * The credential cannot be enrolled because an equivalent one already exists:
  * `email_already_enrolled` (this profile already has a verified email),
+ * `totp_already_enrolled` (this profile already has an authenticator app),
  * `email_socially_verified` (the email is verified through a social login), or
  * `credential_already_enrolled` (the email or passkey is enrolled on another
  * profile; the profiles must be paired or the credential removed).
  */
 export declare class CredentialAlreadyEnrolledError extends MfaError {
-    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled' | 'email_socially_verified', message: string, status?: number);
+    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled' | 'totp_already_enrolled' | 'email_socially_verified', message: string, status?: number);
 }
 /**
  * The profile already has a credential that proves AAL2, so enrolling another

package/dist/sdk/errors.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED~~;;;;;;GAMG~~;AACH,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EACA,6BAA6B,GAC7B,wBAAwB,GACxB,yBAAyB,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA8B,EAGhE;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,6BAA8B,SAAQ,QAAQ;IACzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,QAAQ,CAAC,MAAM,SAA+B;IAE9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}
1	+ {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EACA,6BAA6B,GAC7B,wBAAwB,GACxB,uBAAuB,GACvB,yBAAyB,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA8B,EAGhE;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,6BAA8B,SAAQ,QAAQ;IACzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,QAAQ,CAAC,MAAM,SAA+B;IAE9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}

package/dist/sdk/errors.js CHANGED Viewed

@@ -21,6 +21,7 @@ export class MfaError extends Error {
 /**
  * The credential cannot be enrolled because an equivalent one already exists:
  * `email_already_enrolled` (this profile already has a verified email),
+ * `totp_already_enrolled` (this profile already has an authenticator app),
  * `email_socially_verified` (the email is verified through a social login), or
  * `credential_already_enrolled` (the email or passkey is enrolled on another
  * profile; the profiles must be paired or the credential removed).

package/dist/sdk/errors.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,OAAO,CAAyB;IAEhC,MAAM,CAAU;IAEhB,YAAY,CAAU;IAE/B,YACE,OAA+B,EAC/B,OAAe,EACf,OAAoD;QAEpD,KAAK,CAAC,OAAO,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAG6B,EAC7B,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAEnC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,SAAS;QAC/D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAqC,EACrC,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAkE,EAClE,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,oBAAoB;QAE/C,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,QAAQ;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,GAAG,KAA+B;IAElC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;QAC5C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpD,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';\nimport { HTTP_STATUS_CODES } from './constants.js';\nimport { asRecord } from './utils/as-record.js';\n\ntype ExtensibleMfaErrorCode = MfaErrorCode \| (string & {});\n\n/*\n Base error for MFA operations.\n \n The machine-readable code is an enumerable own property so it survives\n * JSON-RPC error serialization.\n /\nexport class MfaError extends Error {\n readonly mfaCode: ExtensibleMfaErrorCode;\n\n readonly status?: number;\n\n readonly retryAfterMs?: number;\n\n constructor(\n mfaCode: ExtensibleMfaErrorCode,\n message: string,\n options?: { status?: number; retryAfterMs?: number },\n ) {\n super(`MFA[${mfaCode}]: ${message}`);\n this.name = 'MfaError';\n this.mfaCode = mfaCode;\n this.status = options?.status;\n this.retryAfterMs = options?.retryAfterMs;\n }\n}\n\n/\n The credential cannot be enrolled because an equivalent one already exists:\n * `email_already_enrolled` (this profile already has a verified email),\n * `email_socially_verified` (the email is verified through a social login), or\n * `credential_already_enrolled` (the email or passkey is enrolled on another\n * profile; the profiles must be paired or the credential removed).\n /\nexport class CredentialAlreadyEnrolledError extends MfaError {\n constructor(\n code:\n \| 'credential_already_enrolled'\n \| 'email_already_enrolled'\n \| 'email_socially_verified',\n message: string,\n status = HTTP_STATUS_CODES.CONFLICT,\n ) {\n super(code, message, { status });\n this.name = 'CredentialAlreadyEnrolledError';\n }\n}\n\n/\n The profile already has a credential that proves AAL2, so enrolling another\n * requires an `aal:2` access token; the client must complete a verification\n * and retry with the same flow.\n /\nexport class StepUpRequiredError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.FORBIDDEN) {\n super('aal2_required', message, { status });\n this.name = 'StepUpRequiredError';\n }\n}\n\nexport class CredentialNotEnrolledError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n super('credential_not_enrolled', message, { status });\n this.name = 'CredentialNotEnrolledError';\n }\n}\n\n/\n The begin/complete flow is stale or unknown; the client must restart it.\n /\nexport class MfaFlowExpiredError extends MfaError {\n constructor(\n code: 'flow_expired' \| 'invalid_flow',\n message: string,\n status?: number,\n ) {\n super(code, message, { status });\n this.name = 'MfaFlowExpiredError';\n }\n}\n\n/\n The profile has no identity-provider record yet. Not a stale flow: the\n * user must enroll a first credential before verifying.\n /\nexport class MfaIdentityMissingError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n super('mfa_identity_missing', message, { status });\n this.name = 'MfaIdentityMissingError';\n }\n}\n\nexport class MfaVerificationFailedError extends MfaError {\n constructor(\n code: 'invalid_code' \| 'invalid_attestation' \| 'invalid_assertion',\n message: string,\n status?: number,\n ) {\n super(code, message, { status });\n this.name = 'MfaVerificationFailedError';\n }\n}\n\nexport class TooManyAttemptsError extends MfaError {\n constructor(message: string, status?: number) {\n super('too_many_attempts', message, { status });\n this.name = 'TooManyAttemptsError';\n }\n}\n\nexport class MaxPasskeysReachedError extends MfaError {\n constructor(\n message: string,\n status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY,\n ) {\n super('max_passkeys_reached', message, { status });\n this.name = 'MaxPasskeysReachedError';\n }\n}\n\nexport class MaxIdentifiersReachedError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n super('max_identifiers_reached', message, { status });\n this.name = 'MaxIdentifiersReachedError';\n }\n}\n\nexport class OtpResendCooldownError extends MfaError {\n constructor(\n message: string,\n retryAfterMs?: number,\n status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n ) {\n super('otp_resend_cooldown', message, { status, retryAfterMs });\n this.name = 'OtpResendCooldownError';\n }\n}\n\n/\n A 429 without an MFA-specific code: generic throttling, not an OTP resend\n * cooldown.\n /\nexport class MfaRateLimitedError extends MfaError {\n constructor(\n message: string,\n retryAfterMs?: number,\n status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n ) {\n super('rate_limited', message, { status, retryAfterMs });\n this.name = 'MfaRateLimitedError';\n }\n}\n\n/\n The identity provider or the network is unreachable. Safe to retry.\n * `status` is only set when the service answered.\n /\nexport class MfaUnavailableError extends MfaError {\n constructor(message: string, status?: number) {\n super('kratos_unavailable', message, { status });\n this.name = 'MfaUnavailableError';\n }\n}\n\nexport class VerificationTokenInvalidError extends MfaError {\n constructor(message: string) {\n super('verification_token_invalid', message);\n this.name = 'VerificationTokenInvalidError';\n }\n}\n\n/\n Gets an MFA code from direct, serialized, or message-only errors.\n \n @param error - Value to inspect.\n * @returns The stable code, if present.\n /\nexport function getMfaErrorCode(\n error: unknown,\n): ExtensibleMfaErrorCode \| undefined {\n const direct = asRecord(error);\n if (typeof direct?.mfaCode === 'string') {\n return direct.mfaCode;\n }\n\n const data = asRecord(direct?.data);\n const cause = asRecord(data?.cause);\n if (typeof cause?.mfaCode === 'string') {\n return cause.mfaCode;\n }\n\n const messages = [direct?.message, cause?.message];\n for (const message of messages) {\n if (typeof message === 'string') {\n const match = /^MFA\\[([^\\]]+)\\]:/u.exec(message);\n if (match?.[1]) {\n return match[1];\n }\n }\n }\n return undefined;\n}\n\n/\n Checks whether a value carries an MFA error code.\n \n @param error - Value to inspect.\n * @param codes - Optional codes to match.\n * @returns Whether the value is an MFA error with a requested code.\n /\nexport function isMfaError(\n error: unknown,\n ...codes: ExtensibleMfaErrorCode[]\n): boolean {\n const code = getMfaErrorCode(error);\n return code !== undefined && (codes.length === 0 \|\| codes.includes(code));\n}\n\n/\n Gets a retry delay from direct or serialized MFA errors.\n \n @param error - Value to inspect.\n * @returns Retry delay in milliseconds, if present.\n /\nexport function getMfaRetryAfterMs(error: unknown): number \| undefined {\n const direct = asRecord(error);\n if (typeof direct?.retryAfterMs === 'number') {\n return direct.retryAfterMs;\n }\n const data = asRecord(direct?.data);\n const cause = asRecord(data?.cause);\n return typeof cause?.retryAfterMs === 'number'\n ? cause.retryAfterMs\n : undefined;\n}\n\nexport class NonceRetrievalError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'NonceRetrievalError';\n }\n}\n\nexport class SignInError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'SignInError';\n }\n}\n\nexport class PairError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'PairError';\n }\n}\n\n/\n Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n /\nexport class PairConflictError extends PairError {\n readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n constructor(message: string) {\n super(message);\n this.name = 'PairConflictError';\n }\n}\n\n/\n Thrown when `POST /api/v2/social/login` returns 404: the social identifier\n * was never paired to a profile, so there is nothing to log in to.\n /\nexport class SocialIdentifierNotPairedError extends SignInError {\n readonly status = HTTP_STATUS_CODES.NOT_FOUND;\n\n constructor(message: string) {\n super(message);\n this.name = 'SocialIdentifierNotPairedError';\n }\n}\n\n/\n Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n /\nexport class EmailRequiredError extends Error {\n readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n constructor(message: string) {\n super(message);\n this.name = 'EmailRequiredError';\n }\n}\n\nexport class UserStorageError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'UserStorageError';\n }\n}\n\nexport class ValidationError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'ValidationError';\n }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'UnsupportedAuthTypeError';\n }\n}\n\nexport class NotFoundError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'NotFoundError';\n }\n}\n\nexport class RateLimitedError extends Error {\n readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n readonly retryAfterMs?: number;\n\n constructor(message: string, retryAfterMs?: number) {\n super(message);\n this.name = 'RateLimitedError';\n this.retryAfterMs = retryAfterMs;\n }\n\n /\n Check if an unknown error is a rate limit error (429 status).\n \n @param e - The error to check\n * @returns True if the error is a rate limit error\n */\n static isRateLimitError(e: unknown): e is RateLimitedError {\n return (\n e instanceof RateLimitedError \|\|\n (typeof e === 'object' &&\n e !== null &&\n 'status' in e &&\n e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n );\n }\n}\n"]}
1	+ {"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,OAAO,CAAyB;IAEhC,MAAM,CAAU;IAEhB,YAAY,CAAU;IAE/B,YACE,OAA+B,EAC/B,OAAe,EACf,OAAoD;QAEpD,KAAK,CAAC,OAAO,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAI6B,EAC7B,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAEnC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,SAAS;QAC/D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAqC,EACrC,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAkE,EAClE,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,oBAAoB;QAE/C,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,QAAQ;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,GAAG,KAA+B;IAElC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;QAC5C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpD,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';\nimport { HTTP_STATUS_CODES } from './constants.js';\nimport { asRecord } from './utils/as-record.js';\n\ntype ExtensibleMfaErrorCode = MfaErrorCode \| (string & {});\n\n/*\n Base error for MFA operations.\n \n The machine-readable code is an enumerable own property so it survives\n * JSON-RPC error serialization.\n /\nexport class MfaError extends Error {\n readonly mfaCode: ExtensibleMfaErrorCode;\n\n readonly status?: number;\n\n readonly retryAfterMs?: number;\n\n constructor(\n mfaCode: ExtensibleMfaErrorCode,\n message: string,\n options?: { status?: number; retryAfterMs?: number },\n ) {\n super(`MFA[${mfaCode}]: ${message}`);\n this.name = 'MfaError';\n this.mfaCode = mfaCode;\n this.status = options?.status;\n this.retryAfterMs = options?.retryAfterMs;\n }\n}\n\n/\n The credential cannot be enrolled because an equivalent one already exists:\n * `email_already_enrolled` (this profile already has a verified email),\n * `totp_already_enrolled` (this profile already has an authenticator app),\n * `email_socially_verified` (the email is verified through a social login), or\n * `credential_already_enrolled` (the email or passkey is enrolled on another\n * profile; the profiles must be paired or the credential removed).\n /\nexport class CredentialAlreadyEnrolledError extends MfaError {\n constructor(\n code:\n \| 'credential_already_enrolled'\n \| 'email_already_enrolled'\n \| 'totp_already_enrolled'\n \| 'email_socially_verified',\n message: string,\n status = HTTP_STATUS_CODES.CONFLICT,\n ) {\n super(code, message, { status });\n this.name = 'CredentialAlreadyEnrolledError';\n }\n}\n\n/\n The profile already has a credential that proves AAL2, so enrolling another\n * requires an `aal:2` access token; the client must complete a verification\n * and retry with the same flow.\n /\nexport class StepUpRequiredError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.FORBIDDEN) {\n super('aal2_required', message, { status });\n this.name = 'StepUpRequiredError';\n }\n}\n\nexport class CredentialNotEnrolledError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n super('credential_not_enrolled', message, { status });\n this.name = 'CredentialNotEnrolledError';\n }\n}\n\n/\n The begin/complete flow is stale or unknown; the client must restart it.\n /\nexport class MfaFlowExpiredError extends MfaError {\n constructor(\n code: 'flow_expired' \| 'invalid_flow',\n message: string,\n status?: number,\n ) {\n super(code, message, { status });\n this.name = 'MfaFlowExpiredError';\n }\n}\n\n/\n The profile has no identity-provider record yet. Not a stale flow: the\n * user must enroll a first credential before verifying.\n /\nexport class MfaIdentityMissingError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n super('mfa_identity_missing', message, { status });\n this.name = 'MfaIdentityMissingError';\n }\n}\n\nexport class MfaVerificationFailedError extends MfaError {\n constructor(\n code: 'invalid_code' \| 'invalid_attestation' \| 'invalid_assertion',\n message: string,\n status?: number,\n ) {\n super(code, message, { status });\n this.name = 'MfaVerificationFailedError';\n }\n}\n\nexport class TooManyAttemptsError extends MfaError {\n constructor(message: string, status?: number) {\n super('too_many_attempts', message, { status });\n this.name = 'TooManyAttemptsError';\n }\n}\n\nexport class MaxPasskeysReachedError extends MfaError {\n constructor(\n message: string,\n status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY,\n ) {\n super('max_passkeys_reached', message, { status });\n this.name = 'MaxPasskeysReachedError';\n }\n}\n\nexport class MaxIdentifiersReachedError extends MfaError {\n constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n super('max_identifiers_reached', message, { status });\n this.name = 'MaxIdentifiersReachedError';\n }\n}\n\nexport class OtpResendCooldownError extends MfaError {\n constructor(\n message: string,\n retryAfterMs?: number,\n status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n ) {\n super('otp_resend_cooldown', message, { status, retryAfterMs });\n this.name = 'OtpResendCooldownError';\n }\n}\n\n/\n A 429 without an MFA-specific code: generic throttling, not an OTP resend\n * cooldown.\n /\nexport class MfaRateLimitedError extends MfaError {\n constructor(\n message: string,\n retryAfterMs?: number,\n status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n ) {\n super('rate_limited', message, { status, retryAfterMs });\n this.name = 'MfaRateLimitedError';\n }\n}\n\n/\n The identity provider or the network is unreachable. Safe to retry.\n * `status` is only set when the service answered.\n /\nexport class MfaUnavailableError extends MfaError {\n constructor(message: string, status?: number) {\n super('kratos_unavailable', message, { status });\n this.name = 'MfaUnavailableError';\n }\n}\n\nexport class VerificationTokenInvalidError extends MfaError {\n constructor(message: string) {\n super('verification_token_invalid', message);\n this.name = 'VerificationTokenInvalidError';\n }\n}\n\n/\n Gets an MFA code from direct, serialized, or message-only errors.\n \n @param error - Value to inspect.\n * @returns The stable code, if present.\n /\nexport function getMfaErrorCode(\n error: unknown,\n): ExtensibleMfaErrorCode \| undefined {\n const direct = asRecord(error);\n if (typeof direct?.mfaCode === 'string') {\n return direct.mfaCode;\n }\n\n const data = asRecord(direct?.data);\n const cause = asRecord(data?.cause);\n if (typeof cause?.mfaCode === 'string') {\n return cause.mfaCode;\n }\n\n const messages = [direct?.message, cause?.message];\n for (const message of messages) {\n if (typeof message === 'string') {\n const match = /^MFA\\[([^\\]]+)\\]:/u.exec(message);\n if (match?.[1]) {\n return match[1];\n }\n }\n }\n return undefined;\n}\n\n/\n Checks whether a value carries an MFA error code.\n \n @param error - Value to inspect.\n * @param codes - Optional codes to match.\n * @returns Whether the value is an MFA error with a requested code.\n /\nexport function isMfaError(\n error: unknown,\n ...codes: ExtensibleMfaErrorCode[]\n): boolean {\n const code = getMfaErrorCode(error);\n return code !== undefined && (codes.length === 0 \|\| codes.includes(code));\n}\n\n/\n Gets a retry delay from direct or serialized MFA errors.\n \n @param error - Value to inspect.\n * @returns Retry delay in milliseconds, if present.\n /\nexport function getMfaRetryAfterMs(error: unknown): number \| undefined {\n const direct = asRecord(error);\n if (typeof direct?.retryAfterMs === 'number') {\n return direct.retryAfterMs;\n }\n const data = asRecord(direct?.data);\n const cause = asRecord(data?.cause);\n return typeof cause?.retryAfterMs === 'number'\n ? cause.retryAfterMs\n : undefined;\n}\n\nexport class NonceRetrievalError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'NonceRetrievalError';\n }\n}\n\nexport class SignInError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'SignInError';\n }\n}\n\nexport class PairError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'PairError';\n }\n}\n\n/\n Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n /\nexport class PairConflictError extends PairError {\n readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n constructor(message: string) {\n super(message);\n this.name = 'PairConflictError';\n }\n}\n\n/\n Thrown when `POST /api/v2/social/login` returns 404: the social identifier\n * was never paired to a profile, so there is nothing to log in to.\n /\nexport class SocialIdentifierNotPairedError extends SignInError {\n readonly status = HTTP_STATUS_CODES.NOT_FOUND;\n\n constructor(message: string) {\n super(message);\n this.name = 'SocialIdentifierNotPairedError';\n }\n}\n\n/\n Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n /\nexport class EmailRequiredError extends Error {\n readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n constructor(message: string) {\n super(message);\n this.name = 'EmailRequiredError';\n }\n}\n\nexport class UserStorageError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'UserStorageError';\n }\n}\n\nexport class ValidationError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'ValidationError';\n }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'UnsupportedAuthTypeError';\n }\n}\n\nexport class NotFoundError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'NotFoundError';\n }\n}\n\nexport class RateLimitedError extends Error {\n readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n readonly retryAfterMs?: number;\n\n constructor(message: string, retryAfterMs?: number) {\n super(message);\n this.name = 'RateLimitedError';\n this.retryAfterMs = retryAfterMs;\n }\n\n /\n Check if an unknown error is a rate limit error (429 status).\n \n @param e - The error to check\n * @returns True if the error is a rate limit error\n */\n static isRateLimitError(e: unknown): e is RateLimitedError {\n return (\n e instanceof RateLimitedError \|\|\n (typeof e === 'object' &&\n e !== null &&\n 'status' in e &&\n e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n );\n }\n}\n"]}

package/dist/sdk/mocks/auth.d.ts CHANGED Viewed

@@ -24,6 +24,12 @@ export declare const MOCK_MFA_ENROLL_EMAIL_RESPONSE: {
     flow_id: string;
     expires_at: string;
 };
+export declare const MOCK_MFA_ENROLL_TOTP_RESPONSE: {
+    flow_id: string;
+    expires_at: string;
+    totp_secret: string;
+    totp_qr: string;
+};
 export declare const MOCK_MFA_VERIFY_PASSKEY_RESPONSE: {
     flow_id: string;
     expires_at: string;

package/dist/sdk/mocks/auth.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAsBpD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AACjE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,qBAAqB,QAA4B,CAAC;AAC/D,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AACrE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AA6BrE,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,mBAAmB;CACpB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,oBAAoB;CACrB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,sBAAsB,uKACmI,CAAC;AAEvK,eAAO,MAAM,iCAAiC;;;;QAI1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;QAR1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAMgB,CAAC;AAEpC,eAAO,MAAM,6BAA6B;;;;;;YAOlC,YAAY;YACZ,QAAQ;;;;;;;;;YAQR,OAAO;YACP,QAAQ;;;CAIf,CAAC;AAEF,eAAO,MAAM,4BAA4B,0KACgI,CAAC;AAE1K,eAAO,MAAM,uCAAuC;;;CAGnD,CAAC;AAEF,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;IAC9B,KAAK;IACL,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;QAIjC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;CAExB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;QAIhC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;;CAGxB,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,2BAA2B;IACtC,OAAO;QACL,aAAa;QACb,cAAc;QACd,UAAU;;IAEZ,eAAe;CAChB,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;QAG7C,UAAU;QACV,aAAa;QACb,eAAe;QACf,UAAU;;;CAGb,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;QAInC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}
1	+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAsBpD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AACjE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,qBAAqB,QAA4B,CAAC;AAC/D,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AACrE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AA6BrE,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,mBAAmB;CACpB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,6BAA6B;IACxC,OAAO;IACP,UAAU;IACV,WAAW;IACX,OAAO;CACR,CAAC;AAEF,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,oBAAoB;CACrB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,sBAAsB,uKACmI,CAAC;AAEvK,eAAO,MAAM,iCAAiC;;;;QAI1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;QAR1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAMgB,CAAC;AAEpC,eAAO,MAAM,6BAA6B;;;;;;YAOlC,YAAY;YACZ,QAAQ;;;;;;;;;YAQR,OAAO;YACP,QAAQ;;;CAIf,CAAC;AAEF,eAAO,MAAM,4BAA4B,0KACgI,CAAC;AAE1K,eAAO,MAAM,uCAAuC;;;CAGnD,CAAC;AAEF,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;IAC9B,KAAK;IACL,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;QAIjC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;CAExB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;QAIhC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;;CAGxB,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,2BAA2B;IACtC,OAAO;QACL,aAAa;QACb,cAAc;QACd,UAAU;;IAEZ,eAAe;CAChB,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;QAG7C,UAAU;QACV,aAAa;QACb,eAAe;QACf,UAAU;;;CAGb,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;QAInC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}

package/dist/sdk/mocks/auth.js CHANGED Viewed

@@ -51,6 +51,12 @@ export const MOCK_MFA_ENROLL_EMAIL_RESPONSE = {
     flow_id: 'enroll-email-flow-id',
     expires_at: '2099-09-07T14:30:00Z',
 };
+export const MOCK_MFA_ENROLL_TOTP_RESPONSE = {
+    flow_id: 'enroll-totp-flow-id',
+    expires_at: '2099-09-07T14:30:00Z',
+    totp_secret: 'JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP',
+    totp_qr: 'data:image/png;base64,iVBORw0KGgo=',
+};
 export const MOCK_MFA_VERIFY_PASSKEY_RESPONSE = {
     flow_id: 'verify-passkey-flow-id',
     expires_at: '2099-09-07T14:30:00Z',