@nulvless/nulvless-js 0.1.5 → 0.1.7

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 type SdkErrorCode = 'no_session' | 'request_timeout' | 'network_error' | 'invalid_path' | 'unknown_error';
 type GatewayErrorCode = 'rate_limit_exceeded' | 'service_not_enabled' | 'service_unavailable' | 'project_not_ready' | 'project_paused' | 'project_unavailable' | 'bad_gateway' | 'upstream_timeout' | 'idle_timeout' | 'deadline_exceeded' | 'internal_error';
-type AuthErrorCode = 'unauthorized' | 'not_allowed' | 'unavailable' | 'invalid_credentials' | 'mfa_required' | 'refresh_token_not_found' | 'refresh_token_already_used' | 'refresh_token_not_issued_here' | 'registration_closed' | 'user_not_confirmed' | 'user_already_confirmed' | 'user_banned' | 'user_already_banned' | 'user_not_banned' | 'user_missing_email' | 'user_missing_phone' | 'email_already_exists' | 'phone_already_exists' | 'username_already_exists' | 'password_weak' | 'password_leaked' | 'captcha_required' | 'captcha_verification_failed' | 'protected_action_denied' | 'action_verification_failed' | 'forbidden_resource_access' | 'forbidden_access_waiting_accept' | 'forbidden_special_role_required' | 'cannot_leave_owner_access' | 'permission_already_granted' | 'bad_oauth_state' | 'bad_oauth_callback' | 'redirect_uri_mismatch' | 'provider_unavailable' | 'provider_unsupported_method' | 'oauth_email_missing' | 'oauth_email_not_verified' | 'oauth_account_link_required' | 'rate_limit_exceeded';
+type AuthErrorCode = 'unauthorized' | 'not_allowed' | 'unavailable' | 'invalid_credentials' | 'mfa_required' | 'mfa_factors_limit_reached' | 'mfa_phone_already_enrolled' | 'mfa_phone_not_supported' | 'refresh_token_not_found' | 'refresh_token_already_used' | 'refresh_token_not_issued_here' | 'registration_closed' | 'user_not_confirmed' | 'user_already_confirmed' | 'user_banned' | 'user_already_banned' | 'user_not_banned' | 'user_missing_email' | 'user_missing_phone' | 'email_already_exists' | 'phone_already_exists' | 'username_already_exists' | 'password_weak' | 'password_leaked' | 'captcha_required' | 'captcha_verification_failed' | 'protected_action_denied' | 'login_required' | 'action_verification_failed' | 'forbidden_resource_access' | 'forbidden_access_waiting_accept' | 'forbidden_special_role_required' | 'cannot_leave_owner_access' | 'permission_already_granted' | 'bad_oauth_state' | 'bad_oauth_callback' | 'redirect_uri_mismatch' | 'provider_unavailable' | 'provider_unsupported_method' | 'oauth_email_missing' | 'oauth_email_not_verified' | 'oauth_account_link_required' | 'rate_limit_exceeded';
 type CommsErrorCode = 'unauthorized_platform' | 'rate_limit_exceeded';
 type EdgeFunctionErrorCode = 'function_not_found' | 'function_unavailable' | 'boot_failed' | 'execution_timeout' | 'cpu_time_limit_exceeded' | 'memory_limit_exceeded' | 'resource_unavailable' | 'internal_server_error';
 type ErrorCode = SdkErrorCode | GatewayErrorCode | AuthErrorCode | CommsErrorCode | (string & {});
@@ -343,6 +343,20 @@ interface ChangeChallengeParams {
     token: string;
     /** MFA method to switch to. */
     type: MFAMethod;
+    /**
+     * For `sms_otp`, which SMS factor receives the code — an `id` from
+     * `challenge.mfas`. Defaults to the oldest SMS factor.
+     */
+    factor_id?: string;
+}
+interface CreateChallengeParams {
+    /** MFA method to verify with. */
+    type: MFAMethod;
+    /**
+     * For `sms_otp`, which SMS factor receives the code — an `id` from
+     * `factors.list()`. Defaults to the oldest SMS factor.
+     */
+    factor_id?: string;
 }
 type AuthFactorStatus = 'configured' | 'not_configured';
 interface AuthMethod {
@@ -379,6 +393,11 @@ interface EnableFactorParams {
 interface EnrollFactorParams extends Nonce {
     type: MFAMethod;
     name?: string;
+    /**
+     * For `sms_otp`, the phone that receives the codes. Defaults to the user's
+     * phone. It may match the user's phone but not another SMS factor.
+     */
+    phone?: Phone;
 }
 interface UnenrollFactorParams extends Nonce {
     id: string;
@@ -471,11 +490,6 @@ interface ChangePasswordParams extends Nonce {
     password: string;
     new_password: string;
 }
-interface PlatformInfo {
-    id: string;
-    name: string;
-    slug: string;
-}
 type PaginationSort = 'asc' | 'desc';
 interface Paginated<T> {
     items: T[];
@@ -704,7 +718,10 @@ interface OAuthAuthorizeParams {
     state?: string;
     resource?: string;
     nonce?: string;
+    prompt?: OAuthPrompt | `${OAuthPrompt} ${OAuthPrompt}`;
+    max_age?: number;
 }
+type OAuthPrompt = 'none' | 'login' | 'consent' | 'select_account';
 interface ExchangeOAuthCodeParams {
     code: string;
     code_verifier: string;
@@ -736,6 +753,8 @@ interface OAuthAuthorization {
         uri?: string;
     };
     scope: string[];
+    prompt: OAuthPrompt[];
+    max_age: number | null;
     auto_approved: boolean;
     redirect?: {
         uri: string;
@@ -906,6 +925,10 @@ declare class FactorsClient extends AuthSubClient {
      * the factor on the user's device.
      *
      * For TOTP: use `secret` for manual entry or `url` to generate a QR code.
+     * For SMS: pass `phone` to send the codes to a number other than the user's.
+     *
+     * A user holds up to 10 authenticator apps and SMS factors combined, and one
+     * email factor and one set of recovery codes.
      *
      * After the user configures their device, call `enable` with the `token` and
      * the first OTP code to activate the factor.
@@ -1142,10 +1165,14 @@ declare class ChallengesClient extends AuthSubClient {
      * Requires an authenticated session. Prompt the user for the code, then call
      * `verify({ token, code })`.
      *
+     * A `totp` challenge accepts a code from any of the user's authenticator
+     * apps. For `sms_otp`, pass `factor_id` to pick which phone receives it.
+     *
      * @example
-     * const { data } = await nulvless.auth.challenges.create('totp')
+     * const { data } = await nulvless.auth.challenges.create({ type: 'totp' })
+     * const { data: sms } = await nulvless.auth.challenges.create({ type: 'sms_otp', factor_id })
      */
-    create(targetType: MFAMethod, options?: RequestOptions): Promise<NulvlessResult<{
+    create(params: CreateChallengeParams, options?: RequestOptions): Promise<NulvlessResult<{
         challenge: Challenge;
     }>>;
     /**
@@ -1263,8 +1290,7 @@ declare class OAuthGrantsClient extends AuthSubClient {
  * The project's OAuth 2.1 / OpenID Connect provider surface — the project
  * acting as an identity provider for third-party applications.
  *
- * Available with both public (`pk_`) and private (`sk_`) keys
- * (`@SetPlatformGuardRoles([PUBLIC, PRIVATE])`).
+ * Available with both public (`pk_`) and private (`sk_`) keys.
  *
  * Method scopes:
  * - `token`, `register` — platform key only (no bearer token).
@@ -1529,16 +1555,11 @@ declare class AdminClient {
     readonly grants: AdminGrantsClient;
     readonly oauthClients: AdminOAuthClientsClient;
     constructor(http: HttpClient);
-    /**
-     * Returns basic platform information (id, name, slug).
-     */
-    getPlatform(options?: RequestOptions): Promise<NulvlessResult<PlatformInfo>>;
 }
 
 interface AccountEntry {
     userId: string;
     access_token: string;
-    /** Seconds remaining until the token expires. May be negative if already expired. */
     expires_in: number;
     refresh_token?: string;
     user?: User;
@@ -1587,7 +1608,6 @@ declare class AuthEventEmitter {
 
 /**
  * Auth methods accessible with both public (`pk_`) and private (`sk_`) keys.
- * Corresponds to endpoints decorated with `@SetPlatformGuardRoles([PUBLIC, PRIVATE])`.
  */
 declare class AuthClient {
     protected readonly http: HttpClient;
@@ -2331,4 +2351,4 @@ declare function createClient(url: string, publicKey: string, options?: ClientOp
  */
 declare function createServerClient(url: string, privateKey: string, options?: ServerClientOptions): NulvlessServerClient;
 
-export { AUTH_CACHE_HEADERS, type AccountEntry, type AddEmailIdentityParams, type AddPhoneIdentityParams, AdminClient, type AdminCreateUserParams, type AdminUpdateUserParams, type AssuranceLevel, AuthBrowserClient, AuthClient, type AuthErrorCode, AuthEventEmitter, type AuthEvents, type AuthFactorStatus, type AuthMethod, type AuthMethods, type AuthOptions, AuthServerClient, type Authenticated, type BlockGrantParams, type Challenge, type ChallengeSubject, type ChangeChallengeParams, type ChangePasswordParams, type ClientOptions, CommsClient, type CommsErrorCode, type ConfirmationType, type CreateRoleParams, type CreateTemplateParams, type EdgeFunctionErrorCode, EmailClient, type EnableFactorParams, type EnrollFactorParams, type ErrorCode, type ExchangeOAuthCodeParams, type FactorEnrollment, FactorsClient, type GatewayErrorCode, type Grant, type GrantMembers, type GrantStatus, GrantsClient, HttpClient, type Identity, type IdentityType, type Invite, type InviteParams, type Language, type LeaveGrantParams, type LookupMatch, type LookupParams, type LookupResult, type MFAMethod, type Nonce, type NotificationChannel, NulvlessClient, type NulvlessError, NulvlessException, type NulvlessResult, NulvlessServerClient, type NulvlessStorage, type OAuthApp, type OAuthAppGrantType, type OAuthAppTokenEndpointAuthMethod, type OAuthAppType, type OAuthAuthorization, type OAuthAuthorizeParams, OAuthClient, type OAuthConsentAction, type OAuthConsentResult, type OAuthDiscovery, OAuthGrantsClient, type OAuthJWKS, type OAuthProvider, type OAuthTokenResponse, type OAuthUserGrant, type OAuthUserInfo, type PaginateGrantsParams, type PaginateUsersParams, type Paginated, type PaginatedTemplates, type PaginationSort, type Phone, type PlatformInfo, type RecoverParams, type RefreshOAuthTokenParams, type RefreshTokenParams, type RegisterOAuthAppParams, type RemoveIdentityParams, type RequestOptions, type ResetPasswordParams, type RevokeGrantParams, type RevokeSessionParams, type Role, type SdkErrorCode, SecurityClient, type SendEmailParams, type SendOTPToUpdateEmailParams, type SendOTPToUpdatePhoneParams, type SendSMSParams, type ServerClientOptions, type Session, type SessionFingerPrint, SessionManager, SessionsClient, type SetGrantParams, type SignInMethod, type SignInParams, type SignInWithOTPParams, type SignOutScope, type SignUpParams, SmsClient, Storage, type StoredSession, type SudoMethod, type Template, type TemplateFilters, type TemplateLanguage, TemplatesClient, type TokenType, type UnenrollFactorParams, type UpdateGrantParams, type UpdateIdentityParams, type UpdateOAuthAppParams, type UpdateRoleParams, type UpdateTemplateParams, type User, type UserGender, type UserProfile, UsersClient, type Verified, type VerifyChallengeParams, type VerifyParams, type VerifyReason, applyAuthCacheHeaders, createClient, createServerClient, forwardUserHeaders };
+export { AUTH_CACHE_HEADERS, type AccountEntry, type AddEmailIdentityParams, type AddPhoneIdentityParams, AdminClient, type AdminCreateUserParams, type AdminUpdateUserParams, type AssuranceLevel, AuthBrowserClient, AuthClient, type AuthErrorCode, AuthEventEmitter, type AuthEvents, type AuthFactorStatus, type AuthMethod, type AuthMethods, type AuthOptions, AuthServerClient, type Authenticated, type BlockGrantParams, type Challenge, type ChallengeSubject, type ChangeChallengeParams, type ChangePasswordParams, type ClientOptions, CommsClient, type CommsErrorCode, type ConfirmationType, type CreateChallengeParams, type CreateRoleParams, type CreateTemplateParams, type EdgeFunctionErrorCode, EmailClient, type EnableFactorParams, type EnrollFactorParams, type ErrorCode, type ExchangeOAuthCodeParams, type FactorEnrollment, FactorsClient, type GatewayErrorCode, type Grant, type GrantMembers, type GrantStatus, GrantsClient, HttpClient, type Identity, type IdentityType, type Invite, type InviteParams, type Language, type LeaveGrantParams, type LookupMatch, type LookupParams, type LookupResult, type MFAMethod, type Nonce, type NotificationChannel, NulvlessClient, type NulvlessError, NulvlessException, type NulvlessResult, NulvlessServerClient, type NulvlessStorage, type OAuthApp, type OAuthAppGrantType, type OAuthAppTokenEndpointAuthMethod, type OAuthAppType, type OAuthAuthorization, type OAuthAuthorizeParams, OAuthClient, type OAuthConsentAction, type OAuthConsentResult, type OAuthDiscovery, OAuthGrantsClient, type OAuthJWKS, type OAuthPrompt, type OAuthProvider, type OAuthTokenResponse, type OAuthUserGrant, type OAuthUserInfo, type PaginateGrantsParams, type PaginateUsersParams, type Paginated, type PaginatedTemplates, type PaginationSort, type Phone, type RecoverParams, type RefreshOAuthTokenParams, type RefreshTokenParams, type RegisterOAuthAppParams, type RemoveIdentityParams, type RequestOptions, type ResetPasswordParams, type RevokeGrantParams, type RevokeSessionParams, type Role, type SdkErrorCode, SecurityClient, type SendEmailParams, type SendOTPToUpdateEmailParams, type SendOTPToUpdatePhoneParams, type SendSMSParams, type ServerClientOptions, type Session, type SessionFingerPrint, SessionManager, SessionsClient, type SetGrantParams, type SignInMethod, type SignInParams, type SignInWithOTPParams, type SignOutScope, type SignUpParams, SmsClient, Storage, type StoredSession, type SudoMethod, type Template, type TemplateFilters, type TemplateLanguage, TemplatesClient, type TokenType, type UnenrollFactorParams, type UpdateGrantParams, type UpdateIdentityParams, type UpdateOAuthAppParams, type UpdateRoleParams, type UpdateTemplateParams, type User, type UserGender, type UserProfile, UsersClient, type Verified, type VerifyChallengeParams, type VerifyParams, type VerifyReason, applyAuthCacheHeaders, createClient, createServerClient, forwardUserHeaders };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 type SdkErrorCode = 'no_session' | 'request_timeout' | 'network_error' | 'invalid_path' | 'unknown_error';
 type GatewayErrorCode = 'rate_limit_exceeded' | 'service_not_enabled' | 'service_unavailable' | 'project_not_ready' | 'project_paused' | 'project_unavailable' | 'bad_gateway' | 'upstream_timeout' | 'idle_timeout' | 'deadline_exceeded' | 'internal_error';
-type AuthErrorCode = 'unauthorized' | 'not_allowed' | 'unavailable' | 'invalid_credentials' | 'mfa_required' | 'refresh_token_not_found' | 'refresh_token_already_used' | 'refresh_token_not_issued_here' | 'registration_closed' | 'user_not_confirmed' | 'user_already_confirmed' | 'user_banned' | 'user_already_banned' | 'user_not_banned' | 'user_missing_email' | 'user_missing_phone' | 'email_already_exists' | 'phone_already_exists' | 'username_already_exists' | 'password_weak' | 'password_leaked' | 'captcha_required' | 'captcha_verification_failed' | 'protected_action_denied' | 'action_verification_failed' | 'forbidden_resource_access' | 'forbidden_access_waiting_accept' | 'forbidden_special_role_required' | 'cannot_leave_owner_access' | 'permission_already_granted' | 'bad_oauth_state' | 'bad_oauth_callback' | 'redirect_uri_mismatch' | 'provider_unavailable' | 'provider_unsupported_method' | 'oauth_email_missing' | 'oauth_email_not_verified' | 'oauth_account_link_required' | 'rate_limit_exceeded';
+type AuthErrorCode = 'unauthorized' | 'not_allowed' | 'unavailable' | 'invalid_credentials' | 'mfa_required' | 'mfa_factors_limit_reached' | 'mfa_phone_already_enrolled' | 'mfa_phone_not_supported' | 'refresh_token_not_found' | 'refresh_token_already_used' | 'refresh_token_not_issued_here' | 'registration_closed' | 'user_not_confirmed' | 'user_already_confirmed' | 'user_banned' | 'user_already_banned' | 'user_not_banned' | 'user_missing_email' | 'user_missing_phone' | 'email_already_exists' | 'phone_already_exists' | 'username_already_exists' | 'password_weak' | 'password_leaked' | 'captcha_required' | 'captcha_verification_failed' | 'protected_action_denied' | 'login_required' | 'action_verification_failed' | 'forbidden_resource_access' | 'forbidden_access_waiting_accept' | 'forbidden_special_role_required' | 'cannot_leave_owner_access' | 'permission_already_granted' | 'bad_oauth_state' | 'bad_oauth_callback' | 'redirect_uri_mismatch' | 'provider_unavailable' | 'provider_unsupported_method' | 'oauth_email_missing' | 'oauth_email_not_verified' | 'oauth_account_link_required' | 'rate_limit_exceeded';
 type CommsErrorCode = 'unauthorized_platform' | 'rate_limit_exceeded';
 type EdgeFunctionErrorCode = 'function_not_found' | 'function_unavailable' | 'boot_failed' | 'execution_timeout' | 'cpu_time_limit_exceeded' | 'memory_limit_exceeded' | 'resource_unavailable' | 'internal_server_error';
 type ErrorCode = SdkErrorCode | GatewayErrorCode | AuthErrorCode | CommsErrorCode | (string & {});
@@ -343,6 +343,20 @@ interface ChangeChallengeParams {
     token: string;
     /** MFA method to switch to. */
     type: MFAMethod;
+    /**
+     * For `sms_otp`, which SMS factor receives the code — an `id` from
+     * `challenge.mfas`. Defaults to the oldest SMS factor.
+     */
+    factor_id?: string;
+}
+interface CreateChallengeParams {
+    /** MFA method to verify with. */
+    type: MFAMethod;
+    /**
+     * For `sms_otp`, which SMS factor receives the code — an `id` from
+     * `factors.list()`. Defaults to the oldest SMS factor.
+     */
+    factor_id?: string;
 }
 type AuthFactorStatus = 'configured' | 'not_configured';
 interface AuthMethod {
@@ -379,6 +393,11 @@ interface EnableFactorParams {
 interface EnrollFactorParams extends Nonce {
     type: MFAMethod;
     name?: string;
+    /**
+     * For `sms_otp`, the phone that receives the codes. Defaults to the user's
+     * phone. It may match the user's phone but not another SMS factor.
+     */
+    phone?: Phone;
 }
 interface UnenrollFactorParams extends Nonce {
     id: string;
@@ -471,11 +490,6 @@ interface ChangePasswordParams extends Nonce {
     password: string;
     new_password: string;
 }
-interface PlatformInfo {
-    id: string;
-    name: string;
-    slug: string;
-}
 type PaginationSort = 'asc' | 'desc';
 interface Paginated<T> {
     items: T[];
@@ -704,7 +718,10 @@ interface OAuthAuthorizeParams {
     state?: string;
     resource?: string;
     nonce?: string;
+    prompt?: OAuthPrompt | `${OAuthPrompt} ${OAuthPrompt}`;
+    max_age?: number;
 }
+type OAuthPrompt = 'none' | 'login' | 'consent' | 'select_account';
 interface ExchangeOAuthCodeParams {
     code: string;
     code_verifier: string;
@@ -736,6 +753,8 @@ interface OAuthAuthorization {
         uri?: string;
     };
     scope: string[];
+    prompt: OAuthPrompt[];
+    max_age: number | null;
     auto_approved: boolean;
     redirect?: {
         uri: string;
@@ -906,6 +925,10 @@ declare class FactorsClient extends AuthSubClient {
      * the factor on the user's device.
      *
      * For TOTP: use `secret` for manual entry or `url` to generate a QR code.
+     * For SMS: pass `phone` to send the codes to a number other than the user's.
+     *
+     * A user holds up to 10 authenticator apps and SMS factors combined, and one
+     * email factor and one set of recovery codes.
      *
      * After the user configures their device, call `enable` with the `token` and
      * the first OTP code to activate the factor.
@@ -1142,10 +1165,14 @@ declare class ChallengesClient extends AuthSubClient {
      * Requires an authenticated session. Prompt the user for the code, then call
      * `verify({ token, code })`.
      *
+     * A `totp` challenge accepts a code from any of the user's authenticator
+     * apps. For `sms_otp`, pass `factor_id` to pick which phone receives it.
+     *
      * @example
-     * const { data } = await nulvless.auth.challenges.create('totp')
+     * const { data } = await nulvless.auth.challenges.create({ type: 'totp' })
+     * const { data: sms } = await nulvless.auth.challenges.create({ type: 'sms_otp', factor_id })
      */
-    create(targetType: MFAMethod, options?: RequestOptions): Promise<NulvlessResult<{
+    create(params: CreateChallengeParams, options?: RequestOptions): Promise<NulvlessResult<{
         challenge: Challenge;
     }>>;
     /**
@@ -1263,8 +1290,7 @@ declare class OAuthGrantsClient extends AuthSubClient {
  * The project's OAuth 2.1 / OpenID Connect provider surface — the project
  * acting as an identity provider for third-party applications.
  *
- * Available with both public (`pk_`) and private (`sk_`) keys
- * (`@SetPlatformGuardRoles([PUBLIC, PRIVATE])`).
+ * Available with both public (`pk_`) and private (`sk_`) keys.
  *
  * Method scopes:
  * - `token`, `register` — platform key only (no bearer token).
@@ -1529,16 +1555,11 @@ declare class AdminClient {
     readonly grants: AdminGrantsClient;
     readonly oauthClients: AdminOAuthClientsClient;
     constructor(http: HttpClient);
-    /**
-     * Returns basic platform information (id, name, slug).
-     */
-    getPlatform(options?: RequestOptions): Promise<NulvlessResult<PlatformInfo>>;
 }
 
 interface AccountEntry {
     userId: string;
     access_token: string;
-    /** Seconds remaining until the token expires. May be negative if already expired. */
     expires_in: number;
     refresh_token?: string;
     user?: User;
@@ -1587,7 +1608,6 @@ declare class AuthEventEmitter {
 
 /**
  * Auth methods accessible with both public (`pk_`) and private (`sk_`) keys.
- * Corresponds to endpoints decorated with `@SetPlatformGuardRoles([PUBLIC, PRIVATE])`.
  */
 declare class AuthClient {
     protected readonly http: HttpClient;
@@ -2331,4 +2351,4 @@ declare function createClient(url: string, publicKey: string, options?: ClientOp
  */
 declare function createServerClient(url: string, privateKey: string, options?: ServerClientOptions): NulvlessServerClient;
 
-export { AUTH_CACHE_HEADERS, type AccountEntry, type AddEmailIdentityParams, type AddPhoneIdentityParams, AdminClient, type AdminCreateUserParams, type AdminUpdateUserParams, type AssuranceLevel, AuthBrowserClient, AuthClient, type AuthErrorCode, AuthEventEmitter, type AuthEvents, type AuthFactorStatus, type AuthMethod, type AuthMethods, type AuthOptions, AuthServerClient, type Authenticated, type BlockGrantParams, type Challenge, type ChallengeSubject, type ChangeChallengeParams, type ChangePasswordParams, type ClientOptions, CommsClient, type CommsErrorCode, type ConfirmationType, type CreateRoleParams, type CreateTemplateParams, type EdgeFunctionErrorCode, EmailClient, type EnableFactorParams, type EnrollFactorParams, type ErrorCode, type ExchangeOAuthCodeParams, type FactorEnrollment, FactorsClient, type GatewayErrorCode, type Grant, type GrantMembers, type GrantStatus, GrantsClient, HttpClient, type Identity, type IdentityType, type Invite, type InviteParams, type Language, type LeaveGrantParams, type LookupMatch, type LookupParams, type LookupResult, type MFAMethod, type Nonce, type NotificationChannel, NulvlessClient, type NulvlessError, NulvlessException, type NulvlessResult, NulvlessServerClient, type NulvlessStorage, type OAuthApp, type OAuthAppGrantType, type OAuthAppTokenEndpointAuthMethod, type OAuthAppType, type OAuthAuthorization, type OAuthAuthorizeParams, OAuthClient, type OAuthConsentAction, type OAuthConsentResult, type OAuthDiscovery, OAuthGrantsClient, type OAuthJWKS, type OAuthProvider, type OAuthTokenResponse, type OAuthUserGrant, type OAuthUserInfo, type PaginateGrantsParams, type PaginateUsersParams, type Paginated, type PaginatedTemplates, type PaginationSort, type Phone, type PlatformInfo, type RecoverParams, type RefreshOAuthTokenParams, type RefreshTokenParams, type RegisterOAuthAppParams, type RemoveIdentityParams, type RequestOptions, type ResetPasswordParams, type RevokeGrantParams, type RevokeSessionParams, type Role, type SdkErrorCode, SecurityClient, type SendEmailParams, type SendOTPToUpdateEmailParams, type SendOTPToUpdatePhoneParams, type SendSMSParams, type ServerClientOptions, type Session, type SessionFingerPrint, SessionManager, SessionsClient, type SetGrantParams, type SignInMethod, type SignInParams, type SignInWithOTPParams, type SignOutScope, type SignUpParams, SmsClient, Storage, type StoredSession, type SudoMethod, type Template, type TemplateFilters, type TemplateLanguage, TemplatesClient, type TokenType, type UnenrollFactorParams, type UpdateGrantParams, type UpdateIdentityParams, type UpdateOAuthAppParams, type UpdateRoleParams, type UpdateTemplateParams, type User, type UserGender, type UserProfile, UsersClient, type Verified, type VerifyChallengeParams, type VerifyParams, type VerifyReason, applyAuthCacheHeaders, createClient, createServerClient, forwardUserHeaders };
+export { AUTH_CACHE_HEADERS, type AccountEntry, type AddEmailIdentityParams, type AddPhoneIdentityParams, AdminClient, type AdminCreateUserParams, type AdminUpdateUserParams, type AssuranceLevel, AuthBrowserClient, AuthClient, type AuthErrorCode, AuthEventEmitter, type AuthEvents, type AuthFactorStatus, type AuthMethod, type AuthMethods, type AuthOptions, AuthServerClient, type Authenticated, type BlockGrantParams, type Challenge, type ChallengeSubject, type ChangeChallengeParams, type ChangePasswordParams, type ClientOptions, CommsClient, type CommsErrorCode, type ConfirmationType, type CreateChallengeParams, type CreateRoleParams, type CreateTemplateParams, type EdgeFunctionErrorCode, EmailClient, type EnableFactorParams, type EnrollFactorParams, type ErrorCode, type ExchangeOAuthCodeParams, type FactorEnrollment, FactorsClient, type GatewayErrorCode, type Grant, type GrantMembers, type GrantStatus, GrantsClient, HttpClient, type Identity, type IdentityType, type Invite, type InviteParams, type Language, type LeaveGrantParams, type LookupMatch, type LookupParams, type LookupResult, type MFAMethod, type Nonce, type NotificationChannel, NulvlessClient, type NulvlessError, NulvlessException, type NulvlessResult, NulvlessServerClient, type NulvlessStorage, type OAuthApp, type OAuthAppGrantType, type OAuthAppTokenEndpointAuthMethod, type OAuthAppType, type OAuthAuthorization, type OAuthAuthorizeParams, OAuthClient, type OAuthConsentAction, type OAuthConsentResult, type OAuthDiscovery, OAuthGrantsClient, type OAuthJWKS, type OAuthPrompt, type OAuthProvider, type OAuthTokenResponse, type OAuthUserGrant, type OAuthUserInfo, type PaginateGrantsParams, type PaginateUsersParams, type Paginated, type PaginatedTemplates, type PaginationSort, type Phone, type RecoverParams, type RefreshOAuthTokenParams, type RefreshTokenParams, type RegisterOAuthAppParams, type RemoveIdentityParams, type RequestOptions, type ResetPasswordParams, type RevokeGrantParams, type RevokeSessionParams, type Role, type SdkErrorCode, SecurityClient, type SendEmailParams, type SendOTPToUpdateEmailParams, type SendOTPToUpdatePhoneParams, type SendSMSParams, type ServerClientOptions, type Session, type SessionFingerPrint, SessionManager, SessionsClient, type SetGrantParams, type SignInMethod, type SignInParams, type SignInWithOTPParams, type SignOutScope, type SignUpParams, SmsClient, Storage, type StoredSession, type SudoMethod, type Template, type TemplateFilters, type TemplateLanguage, TemplatesClient, type TokenType, type UnenrollFactorParams, type UpdateGrantParams, type UpdateIdentityParams, type UpdateOAuthAppParams, type UpdateRoleParams, type UpdateTemplateParams, type User, type UserGender, type UserProfile, UsersClient, type Verified, type VerifyChallengeParams, type VerifyParams, type VerifyReason, applyAuthCacheHeaders, createClient, createServerClient, forwardUserHeaders };

package/dist/index.mjs

@@ -315,6 +315,10 @@ var FactorsClient = class extends AuthSubClient {
    * the factor on the user's device.
    *
    * For TOTP: use `secret` for manual entry or `url` to generate a QR code.
+   * For SMS: pass `phone` to send the codes to a number other than the user's.
+   *
+   * A user holds up to 10 authenticator apps and SMS factors combined, and one
+   * email factor and one set of recovery codes.
    *
    * After the user configures their device, call `enable` with the `token` and
    * the first OTP code to activate the factor.
@@ -330,8 +334,9 @@ var FactorsClient = class extends AuthSubClient {
   async enroll(params, options) {
     const auth = await this.bearer(options);
     if (!auth.ok) return { data: null, error: auth.error };
-    const { nonce, type, name } = params;
-    return this.http.post(route`/factors/${type}`, name ? { name } : {}, {
+    const { nonce, type, name, phone } = params;
+    const body = { ...name ? { name } : {}, ...phone ? { phone } : {} };
+    return this.http.post(route`/factors/${type}`, body, {
       ...options,
       nonce,
       headers: { ...options?.headers, ...auth.headers }
@@ -377,7 +382,6 @@ var FactorsClient = class extends AuthSubClient {
 
 // src/auth/users/index.ts
 var UsersClient = class extends AuthSubClient {
-  // ─── Profile ────────────────────────────────────────────────────────────────
   /**
    * Returns the authenticated user's full profile.
    */
@@ -402,7 +406,6 @@ var UsersClient = class extends AuthSubClient {
       headers: { ...options?.headers, ...auth.headers }
     });
   }
-  // ─── Identities ─────────────────────────────────────────────────────────────
   /**
    * Lists all identities (email, phone, OAuth) linked to the authenticated user.
    *
@@ -493,7 +496,6 @@ var UsersClient = class extends AuthSubClient {
       headers: { ...options?.headers, ...auth.headers }
     });
   }
-  // ─── Credential updates ──────────────────────────────────────────────────────
   /**
    * Sends an OTP to the new email address to initiate an email change.
    *
@@ -693,14 +695,19 @@ var ChallengesClient = class extends AuthSubClient {
    * Requires an authenticated session. Prompt the user for the code, then call
    * `verify({ token, code })`.
    *
+   * A `totp` challenge accepts a code from any of the user's authenticator
+   * apps. For `sms_otp`, pass `factor_id` to pick which phone receives it.
+   *
    * @example
-   * const { data } = await nulvless.auth.challenges.create('totp')
+   * const { data } = await nulvless.auth.challenges.create({ type: 'totp' })
+   * const { data: sms } = await nulvless.auth.challenges.create({ type: 'sms_otp', factor_id })
    */
-  async create(targetType, options) {
+  async create(params, options) {
     const auth = await this.bearer(options);
     if (!auth.ok) return { data: null, error: auth.error };
-    return this.http.post(route`/challenges/${targetType}`, void 0, {
+    return this.http.post(route`/challenges/${params.type}`, void 0, {
       ...options,
+      ...params.factor_id ? { query: { factor_id: params.factor_id } } : {},
       headers: { ...options?.headers, ...auth.headers }
     });
   }
@@ -720,7 +727,7 @@ var ChallengesClient = class extends AuthSubClient {
     return this.http.patch(
       route`/challenges/${params.type}`,
       { token: params.token },
-      options
+      params.factor_id ? { ...options, query: { factor_id: params.factor_id } } : options
     );
   }
   /**
@@ -920,7 +927,6 @@ var OAuthClient = class extends AuthSubClient {
     super(http, getToken);
     this.grants = new OAuthGrantsClient(http, getToken);
   }
-  // ─── Authorization redirect (platform key) ──────────────────────────────────
   /**
    * Builds the OAuth authorization URL and, in the browser, redirects the user
    * agent to it. On the server the URL is returned for manual handling.
@@ -955,7 +961,9 @@ var OAuthClient = class extends AuthSubClient {
       scope: params.scope,
       state: params.state,
       resource: params.resource,
-      nonce: params.nonce
+      nonce: params.nonce,
+      prompt: params.prompt,
+      max_age: params.max_age === void 0 ? void 0 : String(params.max_age)
     };
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) url.searchParams.set(key, value);
@@ -965,7 +973,6 @@ var OAuthClient = class extends AuthSubClient {
     }
     return { data: { url: url.toString() }, error: null };
   }
-  // ─── Token endpoint (public) ────────────────────────────────────────────────
   /**
    * Exchanges an authorization code for tokens
    * (`POST /oauth/token`, `grant_type=authorization_code`).
@@ -995,7 +1002,6 @@ var OAuthClient = class extends AuthSubClient {
       { ...options, skipApiKey: true }
     );
   }
-  // ─── Dynamic registration (platform key) ────────────────────────────────────
   /**
    * Dynamically registers a new OAuth app (RFC 7591, `POST /oauth/register`).
    *
@@ -1005,7 +1011,6 @@ var OAuthClient = class extends AuthSubClient {
   register(params, options) {
     return this.http.post("/oauth/register", params, { ...options, skipApiKey: true });
   }
-  // ─── Consent flow (authenticated user) ──────────────────────────────────────
   /**
    * Loads a pending authorization for the consent screen
    * (`GET /oauth/authorizations/:id`).
@@ -1040,7 +1045,6 @@ var OAuthClient = class extends AuthSubClient {
       headers: { ...options?.headers, ...auth.headers }
     });
   }
-  // ─── UserInfo (authenticated user) ──────────────────────────────────────────
   /**
    * Returns OIDC UserInfo claims for the access token (`GET /oauth/userinfo`).
    *
@@ -1056,7 +1060,6 @@ var OAuthClient = class extends AuthSubClient {
       headers: { ...options?.headers, ...auth.headers }
     });
   }
-  // ─── Public OIDC metadata (no auth) ─────────────────────────────────────────
   /**
    * Returns the OpenID Connect discovery document
    * (`GET /.well-known/openid-configuration`). Public — no auth required.
@@ -1281,12 +1284,6 @@ var AdminClient = class {
   roles;
   grants;
   oauthClients;
-  /**
-   * Returns basic platform information (id, name, slug).
-   */
-  getPlatform(options) {
-    return this.http.get("/admin/platform", options);
-  }
 };
 
 // src/session/stored.ts
@@ -1461,14 +1458,12 @@ var AuthClient = class {
   async getAccessToken() {
     return this.session?.getValidToken() ?? null;
   }
-  // ─── Helpers ──────────────────────────────────────────────────────────────
   async persistSession(result) {
     if (!result.error && result.data.access_token && this.session) {
       await this.session.save(result.data);
     }
     return result;
   }
-  // ─── Sign-up / Sign-in ─────────────────────────────────────────────────────
   /**
    * Creates a new user account.
    *
@@ -1629,7 +1624,6 @@ var AuthClient = class {
       headers: { ...options?.headers, ...auth.headers }
     });
   }
-  // ─── Challenge ─────────────────────────────────────────────────────────────
   /**
    * Looks up whether an identifier exists and which sign-in method applies.
    *
@@ -1656,7 +1650,6 @@ var AuthClient = class {
   async verifyChallenge(params, options) {
     return this.challenges.verify(params, options);
   }
-  // ─── Account lifecycle ─────────────────────────────────────────────────────
   /**
    * Activates an account via the confirmation link sent to the user's email/phone.
    */
@@ -1690,7 +1683,6 @@ var AuthClient = class {
   resetPassword(params, options) {
     return this.http.post("/recover/reset-password", params, options);
   }
-  // ─── Session ───────────────────────────────────────────────────────────────
   /**
    * Validates the current session and optionally checks a grant.
    *
@@ -1809,7 +1801,6 @@ var AuthBrowserClient = class extends AuthClient {
   on(event, handler) {
     return this.emitter.on(event, handler);
   }
-  // ─── Session persistence override ─────────────────────────────────────────
   async persistSession(result) {
     const out = await super.persistSession(result);
     if (!out.error) {
@@ -1824,7 +1815,6 @@ var AuthBrowserClient = class extends AuthClient {
     }
     return out;
   }
-  // ─── Active session helpers ────────────────────────────────────────────────
   /**
    * Returns the session currently stored in storage, or `null` if there is none.
    *
@@ -1856,7 +1846,6 @@ var AuthBrowserClient = class extends AuthClient {
       await this.session?.save(data);
     }
   }
-  // ─── Multi-account ─────────────────────────────────────────────────────────
   /**
    * Adds an account to the accounts store without switching the active session.
    *
@@ -1935,7 +1924,6 @@ var AuthBrowserClient = class extends AuthClient {
     }
     await this.session?.clear();
   }
-  // ─── signOut override ──────────────────────────────────────────────────────
   async signOut(scope, options) {
     const stored = await this.session?.get();
     const userId = stored ? stored.user?.id ?? extractUserId({ access_token: stored.access_token }) : null;