@openora/core 0.4.1-canary.17 → 0.4.1-canary.171

package/dist/contracts/schemas/identity.d.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 export declare const THEMES: readonly ["light", "dark", "system"];
+export declare const OTP_CODE_LENGTH = 6;
+export declare const OTP_EXPIRES_IN_SEC = 3600;
 export declare const ThemeSchema: z.ZodEnum<{
     light: "light";
     dark: "dark";
@@ -7,10 +9,12 @@ export declare const ThemeSchema: z.ZodEnum<{
 }>;
 export type Theme = z.infer<typeof ThemeSchema>;
 export declare const LanguageSchema: z.ZodString;
+export declare const UsernameSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
 export declare const UserSchema: z.ZodObject<{
     id: z.ZodUUID;
     email: z.ZodEmail;
     name: z.ZodString;
+    username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     emailVerified: z.ZodBoolean;
     image: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
     theme: z.ZodEnum<{
@@ -19,9 +23,51 @@ export declare const UserSchema: z.ZodObject<{
         system: "system";
     }>;
     language: z.ZodString;
+    phoneNumber: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    phoneVerified: z.ZodOptional<z.ZodBoolean>;
+    twoFactorEnabled: z.ZodBoolean;
     createdAt: z.ZodISODateTime;
     updatedAt: z.ZodISODateTime;
 }, z.core.$strip>;
+export declare const E164PhoneSchema: z.ZodString;
+export declare const PhoneLoginRequestInputSchema: z.ZodObject<{
+    phone: z.ZodString;
+}, z.core.$strip>;
+export declare const PhoneLoginRequestOutputSchema: z.ZodObject<{
+    expiresAt: z.ZodISODateTime;
+    resendAfter: z.ZodISODateTime;
+}, z.core.$strip>;
+export declare const PhoneLoginVerifyInputSchema: z.ZodObject<{
+    phone: z.ZodString;
+    code: z.ZodString;
+    rememberMe: z.ZodOptional<z.ZodBoolean>;
+    timezone: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const PHONE_LOGIN_ERROR_REASONS: readonly ["otp_cancelled", "rg_blocked", "account_suspended"];
+export declare const PhoneLoginErrorReasonSchema: z.ZodEnum<{
+    otp_cancelled: "otp_cancelled";
+    rg_blocked: "rg_blocked";
+    account_suspended: "account_suspended";
+}>;
+export declare const PHONE_LOGIN_OTP_INVALID_REASONS: readonly ["expired", "wrong_code"];
+export declare const PhoneLoginOtpInvalidReasonSchema: z.ZodEnum<{
+    expired: "expired";
+    wrong_code: "wrong_code";
+}>;
+/**
+ * Why a registration attempt produced no account. `email_already_registered` is the odd
+ * one out: the caller is deliberately told the attempt succeeded, because saying otherwise
+ * is an account-enumeration oracle. The audit trail records what actually happened.
+ */
+export declare const REGISTRATION_FAILURE_REASONS: readonly ["registration_disabled", "rate_limited", "geo_blocked", "username_taken", "email_already_registered", "error"];
+export declare const RegistrationFailureReasonSchema: z.ZodEnum<{
+    error: "error";
+    registration_disabled: "registration_disabled";
+    rate_limited: "rate_limited";
+    geo_blocked: "geo_blocked";
+    username_taken: "username_taken";
+    email_already_registered: "email_already_registered";
+}>;
 export declare const OrganizationSchema: z.ZodObject<{
     id: z.ZodUUID;
     name: z.ZodString;
@@ -41,38 +87,195 @@ export declare const MemberSchema: z.ZodObject<{
     }>;
     createdAt: z.ZodISODateTime;
 }, z.core.$strip>;
+/**
+ * The rule for every password the platform *sets* (register, reset, and the new
+ * password on change): minimum 12 characters, the platform password policy.
+ * Upper-bounded to better-auth's own
+ * `maxPasswordLength` default (128), which it enforces itself but only after the fact -
+ * on sign-up that surfaces as a generic "Registration is unavailable", and on reset it
+ * burns a valid one-time code before rejecting. Bounding it here fails the caller with
+ * the real reason instead.
+ *
+ * Sign-in deliberately does NOT use this: capping the input cannot help (no longer
+ * password was ever storable) and would only narrow an existing contract.
+ */
+export declare const PasswordSchema: z.ZodString;
 export declare const LoginInputSchema: z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
     rememberMe: z.ZodOptional<z.ZodBoolean>;
+    timezone: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const LoginSecurityStateSchema: z.ZodObject<{
+    attemptsRemaining: z.ZodNumber;
+    lockoutUntil: z.ZodNullable<z.ZodISODateTime>;
 }, z.core.$strip>;
 export declare const RegisterInputSchema: z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
-    name: z.ZodString;
+    username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    acceptedTerms: z.ZodLiteral<true>;
+    acceptedAge: z.ZodLiteral<true>;
+    timezone: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const RegisterOutputSchema: z.ZodObject<{
+    status: z.ZodLiteral<"check-email">;
+}, z.core.$strip>;
+export declare const UsernameAvailabilityInputSchema: z.ZodObject<{
+    username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
 }, z.core.$strip>;
+export declare const UsernameAvailabilityOutputSchema: z.ZodObject<{
+    available: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const TWO_FACTOR_DELIVERY_METHODS: readonly ["app", "email", "sms"];
+export declare const TwoFactorDeliveryMethodSchema: z.ZodEnum<{
+    email: "email";
+    app: "app";
+    sms: "sms";
+}>;
 export declare const Enable2faInputSchema: z.ZodObject<{
     password: z.ZodString;
+    method: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        app: "app";
+        sms: "sms";
+    }>>;
 }, z.core.$strip>;
 export declare const Enable2faResultSchema: z.ZodObject<{
-    totpUri: z.ZodString;
+    totpUri: z.ZodOptional<z.ZodString>;
     backupCodes: z.ZodArray<z.ZodString>;
+    maskedDestination: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+export declare const TwoFactorChallengeMethodSchema: z.ZodEnum<{
+    totp: "totp";
+    backup_code: "backup_code";
+    otp: "otp";
+}>;
+export declare const TotpStepUpCodeSchema: z.ZodString;
 export declare const Verify2faInputSchema: z.ZodObject<{
     code: z.ZodString;
+    method: z.ZodDefault<z.ZodEnum<{
+        totp: "totp";
+        backup_code: "backup_code";
+        otp: "otp";
+    }>>;
+    trustDevice: z.ZodDefault<z.ZodBoolean>;
+    timezone: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const RegenerateBackupCodesInputSchema: z.ZodObject<{
+    password: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strip>;
+export declare const TrustCurrentDeviceInputSchema: z.ZodObject<{
+    code: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const BackupCodesResultSchema: z.ZodObject<{
+    backupCodes: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const SendTwoFactorOtpResultSchema: z.ZodObject<{
+    maskedDestination: z.ZodString;
+}, z.core.$strip>;
+export declare const TwoFactorStatusSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    method: z.ZodNullable<z.ZodEnum<{
+        email: "email";
+        app: "app";
+        sms: "sms";
+    }>>;
+    maskedEmail: z.ZodString;
+    maskedPhone: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export declare const Disable2faInputSchema: z.ZodObject<{
     password: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strip>;
+export declare const AUTO_LOGOUT_DURATIONS: readonly ["15m", "1h", "24h", "7d", "30d"];
+export declare const AutoLogoutDurationSchema: z.ZodEnum<{
+    "15m": "15m";
+    "1h": "1h";
+    "24h": "24h";
+    "7d": "7d";
+    "30d": "30d";
+}>;
+export type AutoLogoutDuration = z.infer<typeof AutoLogoutDurationSchema>;
+export declare const AUTO_LOGOUT_MINUTES: Record<AutoLogoutDuration, number>;
+export declare const SecurityControlsSchema: z.ZodObject<{
+    passwordMeetsPolicy: z.ZodBoolean;
+    emailVerified: z.ZodBoolean;
+    phoneNumber: z.ZodNullable<z.ZodString>;
+    phoneVerified: z.ZodBoolean;
+    twoFactorEnabled: z.ZodBoolean;
+    loginWithdrawalAlertsEnabled: z.ZodBoolean;
+    withdrawalPinSet: z.ZodBoolean;
+    autoLogoutDuration: z.ZodEnum<{
+        "15m": "15m";
+        "1h": "1h";
+        "24h": "24h";
+        "7d": "7d";
+        "30d": "30d";
+    }>;
+    requireTwoFactorOnLogin: z.ZodBoolean;
+    trustedDeviceDays: z.ZodNumber;
+    antiPhishingCode: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const SetLoginWithdrawalAlertsInputSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const SetAutoLogoutInputSchema: z.ZodObject<{
+    duration: z.ZodEnum<{
+        "15m": "15m";
+        "1h": "1h";
+        "24h": "24h";
+        "7d": "7d";
+        "30d": "30d";
+    }>;
+}, z.core.$strip>;
+export declare const SetRequireTwoFactorOnLoginInputSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const SetAntiPhishingCodeInputSchema: z.ZodObject<{
+    code: z.ZodString;
+}, z.core.$strip>;
+export declare const WithdrawalPinSchema: z.ZodString;
+export declare const SetWithdrawalPinInputSchema: z.ZodObject<{
+    pin: z.ZodString;
+    confirmPin: z.ZodString;
+    currentPassword: z.ZodString;
+    totpCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const PhoneVerificationRequestInputSchema: z.ZodObject<{
+    phone: z.ZodString;
+    currentPassword: z.ZodString;
+    totpCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const PhoneVerificationRequestOutputSchema: z.ZodObject<{
+    expiresAt: z.ZodISODateTime;
+    resendAfter: z.ZodISODateTime;
+}, z.core.$strip>;
+export declare const PhoneVerificationConfirmInputSchema: z.ZodObject<{
+    code: z.ZodString;
 }, z.core.$strip>;
 export declare const RequestPasswordResetInputSchema: z.ZodObject<{
     email: z.ZodEmail;
 }, z.core.$strip>;
 export declare const ResetPasswordInputSchema: z.ZodObject<{
-    token: z.ZodString;
+    email: z.ZodEmail;
+    otp: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
     newPassword: z.ZodString;
 }, z.core.$strip>;
+export declare const VerifyPasswordResetOtpInputSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    otp: z.ZodString;
+}, z.core.$strip>;
+export declare const ResendEmailVerificationInputSchema: z.ZodObject<{
+    email: z.ZodEmail;
+}, z.core.$strip>;
 export declare const VerifyEmailInputSchema: z.ZodObject<{
-    token: z.ZodString;
+    email: z.ZodEmail;
+    otp: z.ZodString;
+    timezone: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const UpdateProfileInputSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
@@ -88,25 +291,66 @@ export declare const ChangePasswordInputSchema: z.ZodObject<{
     currentPassword: z.ZodString;
     newPassword: z.ZodString;
 }, z.core.$strip>;
-export declare const ChangeEmailInputSchema: z.ZodObject<{
+export declare const RequestEmailChangeInputSchema: z.ZodObject<{
     newEmail: z.ZodEmail;
+    currentPassword: z.ZodString;
+    totpCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ConfirmEmailChangeInputSchema: z.ZodObject<{
+    newEmail: z.ZodEmail;
+    otp: z.ZodString;
 }, z.core.$strip>;
 export declare const IdentitySuccessSchema: z.ZodObject<{
     success: z.ZodLiteral<true>;
 }, z.core.$strip>;
+export declare const Verify2faOutputSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    trustGranted: z.ZodBoolean;
+}, z.core.$strip>;
+export type IdentitySuccess = z.infer<typeof IdentitySuccessSchema>;
+export type Verify2faOutput = z.infer<typeof Verify2faOutputSchema>;
 export type User = z.infer<typeof UserSchema>;
 export type Organization = z.infer<typeof OrganizationSchema>;
 export type Member = z.infer<typeof MemberSchema>;
 export type LoginInput = z.infer<typeof LoginInputSchema>;
+export type LoginSecurityState = z.infer<typeof LoginSecurityStateSchema>;
 export type RegisterInput = z.infer<typeof RegisterInputSchema>;
+export type RegisterOutput = z.infer<typeof RegisterOutputSchema>;
+export type UsernameAvailabilityInput = z.infer<typeof UsernameAvailabilityInputSchema>;
+export type UsernameAvailabilityOutput = z.infer<typeof UsernameAvailabilityOutputSchema>;
 export type Enable2faInput = z.infer<typeof Enable2faInputSchema>;
 export type Enable2faResult = z.infer<typeof Enable2faResultSchema>;
 export type Verify2faInput = z.infer<typeof Verify2faInputSchema>;
+export type TwoFactorChallengeMethod = z.infer<typeof TwoFactorChallengeMethodSchema>;
+export type TwoFactorDeliveryMethod = z.infer<typeof TwoFactorDeliveryMethodSchema>;
+export type TwoFactorStatus = z.infer<typeof TwoFactorStatusSchema>;
+export type SendTwoFactorOtpResult = z.infer<typeof SendTwoFactorOtpResultSchema>;
+export type RegenerateBackupCodesInput = z.infer<typeof RegenerateBackupCodesInputSchema>;
+export type TrustCurrentDeviceInput = z.infer<typeof TrustCurrentDeviceInputSchema>;
 export type Disable2faInput = z.infer<typeof Disable2faInputSchema>;
 export type RequestPasswordResetInput = z.infer<typeof RequestPasswordResetInputSchema>;
 export type ResetPasswordInput = z.infer<typeof ResetPasswordInputSchema>;
+export type VerifyPasswordResetOtpInput = z.infer<typeof VerifyPasswordResetOtpInputSchema>;
+export type ResendEmailVerificationInput = z.infer<typeof ResendEmailVerificationInputSchema>;
 export type VerifyEmailInput = z.infer<typeof VerifyEmailInputSchema>;
 export type UpdateProfileInput = z.infer<typeof UpdateProfileInputSchema>;
 export type ChangePasswordInput = z.infer<typeof ChangePasswordInputSchema>;
-export type ChangeEmailInput = z.infer<typeof ChangeEmailInputSchema>;
+export type RequestEmailChangeInput = z.infer<typeof RequestEmailChangeInputSchema>;
+export type ConfirmEmailChangeInput = z.infer<typeof ConfirmEmailChangeInputSchema>;
+export type E164Phone = z.infer<typeof E164PhoneSchema>;
+export type PhoneLoginRequestInput = z.infer<typeof PhoneLoginRequestInputSchema>;
+export type PhoneLoginRequestOutput = z.infer<typeof PhoneLoginRequestOutputSchema>;
+export type PhoneLoginVerifyInput = z.infer<typeof PhoneLoginVerifyInputSchema>;
+export type SecurityControls = z.infer<typeof SecurityControlsSchema>;
+export type SetLoginWithdrawalAlertsInput = z.infer<typeof SetLoginWithdrawalAlertsInputSchema>;
+export type SetAutoLogoutInput = z.infer<typeof SetAutoLogoutInputSchema>;
+export type SetRequireTwoFactorOnLoginInput = z.infer<typeof SetRequireTwoFactorOnLoginInputSchema>;
+export type SetWithdrawalPinInput = z.infer<typeof SetWithdrawalPinInputSchema>;
+export type SetAntiPhishingCodeInput = z.infer<typeof SetAntiPhishingCodeInputSchema>;
+export type PhoneVerificationRequestInput = z.infer<typeof PhoneVerificationRequestInputSchema>;
+export type PhoneVerificationRequestOutput = z.infer<typeof PhoneVerificationRequestOutputSchema>;
+export type PhoneVerificationConfirmInput = z.infer<typeof PhoneVerificationConfirmInputSchema>;
+export type PhoneLoginErrorReason = z.infer<typeof PhoneLoginErrorReasonSchema>;
+export type PhoneLoginOtpInvalidReason = z.infer<typeof PhoneLoginOtpInvalidReasonSchema>;
+export type RegistrationFailureReason = z.infer<typeof RegistrationFailureReasonSchema>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/contracts/schemas/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/contracts/schemas/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,MAAM,sCAAuC,CAAC;AAC3D,eAAO,MAAM,WAAW;;;;EAAiB,CAAC;AAC1C,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGhD,eAAO,MAAM,cAAc,aAAqB,CAAC;AAEjD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;iBAMvB,CAAC;AAOH,eAAO,MAAM,gBAAgB;;;;iBAE3B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;iBAE9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;iBASjC,CAAC;AAEL,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAAyC,CAAC;AAE5E,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAC9C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/contracts/schemas/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,MAAM,sCAAuC,CAAC;AAC3D,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,WAAW;;;;EAAiB,CAAC;AAC1C,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGhD,eAAO,MAAM,cAAc,aAAqB,CAAC;AAEjD,eAAO,MAAM,cAAc,wDAKiB,CAAC;AAE7C,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;iBAcrB,CAAC;AAEH,eAAO,MAAM,eAAe,aAA2C,CAAC;AAExE,eAAO,MAAM,4BAA4B;;iBAAuC,CAAC;AAEjF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;iBAKtC,CAAC;AAEH,eAAO,MAAM,yBAAyB,+DAI5B,CAAC;AACX,eAAO,MAAM,2BAA2B;;;;EAAoC,CAAC;AAE7E,eAAO,MAAM,+BAA+B,oCAAqC,CAAC;AAClF,eAAO,MAAM,gCAAgC;;;EAA0C,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,0HAO/B,CAAC;AACX,eAAO,MAAM,+BAA+B;;;;;;;EAAuC,CAAC;AAEpF,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;iBAMvB,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,aAA8B,CAAC;AAO1D,eAAO,MAAM,gBAAgB;;;;;iBAG3B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;iBAM9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;iBAAiD,CAAC;AAEnF,eAAO,MAAM,+BAA+B;;iBAAyC,CAAC;AAEtF,eAAO,MAAM,gCAAgC;;iBAAuC,CAAC;AAMrF,eAAO,MAAM,2BAA2B,kCAAmC,CAAC;AAC5E,eAAO,MAAM,6BAA6B;;;;EAAsC,CAAC;AAEjF,eAAO,MAAM,oBAAoB;;;;;;;iBAG/B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;iBAOhC,CAAC;AAKH,eAAO,MAAM,8BAA8B;;;;EAAyC,CAAC;AAMrF,eAAO,MAAM,oBAAoB,aAAuB,CAAC;AAEzD,eAAO,MAAM,oBAAoB;;;;;;;;;iBAS/B,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;iBAK3C,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAKH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH,eAAO,MAAM,qBAAqB;;;;;;;;;iBAMhC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAMhC,CAAC;AAKH,eAAO,MAAM,qBAAqB,4CAA6C,CAAC;AAChF,eAAO,MAAM,wBAAwB;;;;;;EAAgC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAMlE,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;iBAqBjC,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAAqC,CAAC;AAEtF,eAAO,MAAM,wBAAwB;;;;;;;;iBAAmD,CAAC;AAEzF,eAAO,MAAM,qCAAqC;;iBAAqC,CAAC;AAIxF,eAAO,MAAM,8BAA8B;;iBAAwD,CAAC;AAEpG,eAAO,MAAM,mBAAmB,aAAiC,CAAC;AAIlE,eAAO,MAAM,2BAA2B;;;;;iBAUpC,CAAC;AAEL,eAAO,MAAM,mCAAmC;;;;iBAI9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;iBAG/C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;iBAKnC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AAEH,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;iBAMjC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;iBASjC,CAAC;AAEL,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAIH,eAAO,MAAM,6BAA6B;;;;iBAIxC,CAAC;AAGH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAAyC,CAAC;AAM5E,eAAO,MAAM,qBAAqB;;;iBAEhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAC9C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/contracts/schemas/identity.js

@@ -1,20 +1,66 @@
 import { z } from 'zod';
-import { UuidSchema, TimestampSchema } from './common.js';
+import { UuidSchema, TimestampSchema, TimezoneSchema } from './common.js';
 export const THEMES = ['light', 'dark', 'system'];
+export const OTP_CODE_LENGTH = 6;
+export const OTP_EXPIRES_IN_SEC = 3600;
 export const ThemeSchema = z.enum(THEMES);
 // BCP 47 upper bound - the longest real-world tags stay well under this.
 export const LanguageSchema = z.string().max(35);
+export const UsernameSchema = z
+    .string()
+    .min(3)
+    .max(20)
+    .regex(/^[a-zA-Z0-9_]+$/)
+    .transform((value) => value.toLowerCase());
 export const UserSchema = z.object({
     id: UuidSchema,
     email: z.email(),
     name: z.string().min(1).max(255),
+    username: UsernameSchema,
     emailVerified: z.boolean(),
     image: z.url().nullable().optional(),
     theme: ThemeSchema,
     language: LanguageSchema,
+    phoneNumber: z.string().nullable().optional(),
+    phoneVerified: z.boolean().optional(),
+    twoFactorEnabled: z.boolean(),
     createdAt: TimestampSchema,
     updatedAt: TimestampSchema,
 });
+export const E164PhoneSchema = z.string().regex(/^\+[1-9][0-9]{7,14}$/);
+export const PhoneLoginRequestInputSchema = z.object({ phone: E164PhoneSchema });
+export const PhoneLoginRequestOutputSchema = z.object({
+    expiresAt: TimestampSchema,
+    resendAfter: TimestampSchema,
+});
+export const PhoneLoginVerifyInputSchema = z.object({
+    phone: E164PhoneSchema,
+    code: z.string().regex(/^[0-9]{6}$/),
+    rememberMe: z.boolean().optional(),
+    timezone: TimezoneSchema.optional(),
+});
+export const PHONE_LOGIN_ERROR_REASONS = [
+    'otp_cancelled',
+    'rg_blocked',
+    'account_suspended',
+];
+export const PhoneLoginErrorReasonSchema = z.enum(PHONE_LOGIN_ERROR_REASONS);
+export const PHONE_LOGIN_OTP_INVALID_REASONS = ['expired', 'wrong_code'];
+export const PhoneLoginOtpInvalidReasonSchema = z.enum(PHONE_LOGIN_OTP_INVALID_REASONS);
+/**
+ * Why a registration attempt produced no account. `email_already_registered` is the odd
+ * one out: the caller is deliberately told the attempt succeeded, because saying otherwise
+ * is an account-enumeration oracle. The audit trail records what actually happened.
+ */
+export const REGISTRATION_FAILURE_REASONS = [
+    'registration_disabled',
+    'rate_limited',
+    'geo_blocked',
+    'username_taken',
+    'email_already_registered',
+    'error',
+];
+export const RegistrationFailureReasonSchema = z.enum(REGISTRATION_FAILURE_REASONS);
 export const OrganizationSchema = z.object({
     id: UuidSchema,
     name: z.string().min(1).max(255),
@@ -30,38 +76,203 @@ export const MemberSchema = z.object({
     role: z.enum(['owner', 'admin', 'member']),
     createdAt: TimestampSchema,
 });
+/**
+ * The rule for every password the platform *sets* (register, reset, and the new
+ * password on change): minimum 12 characters, the platform password policy.
+ * Upper-bounded to better-auth's own
+ * `maxPasswordLength` default (128), which it enforces itself but only after the fact -
+ * on sign-up that surfaces as a generic "Registration is unavailable", and on reset it
+ * burns a valid one-time code before rejecting. Bounding it here fails the caller with
+ * the real reason instead.
+ *
+ * Sign-in deliberately does NOT use this: capping the input cannot help (no longer
+ * password was ever storable) and would only narrow an existing contract.
+ */
+export const PasswordSchema = z.string().min(12).max(128);
 const credentialsBase = z.object({
     email: z.email(),
     password: z.string().min(8),
 });
 export const LoginInputSchema = credentialsBase.extend({
     rememberMe: z.boolean().optional(),
+    timezone: TimezoneSchema.optional(),
+});
+export const LoginSecurityStateSchema = z.object({
+    attemptsRemaining: z.number().int().nonnegative(),
+    lockoutUntil: TimestampSchema.nullable(),
 });
 export const RegisterInputSchema = credentialsBase.extend({
-    name: z.string().min(1).max(255),
+    password: PasswordSchema,
+    username: UsernameSchema,
+    acceptedTerms: z.literal(true),
+    acceptedAge: z.literal(true),
+    timezone: TimezoneSchema.optional(),
 });
+export const RegisterOutputSchema = z.object({ status: z.literal('check-email') });
+export const UsernameAvailabilityInputSchema = z.object({ username: UsernameSchema });
+export const UsernameAvailabilityOutputSchema = z.object({ available: z.boolean() });
+// How the account receives its second factor. All three share one enrolment - the
+// secret and backup codes better-auth mints on enable - and differ only in delivery:
+// `app` reads a TOTP off the shared secret, `email` and `sms` have a one-time code
+// pushed to the registered address. The account holds exactly one at a time.
+export const TWO_FACTOR_DELIVERY_METHODS = ['app', 'email', 'sms'];
+export const TwoFactorDeliveryMethodSchema = z.enum(TWO_FACTOR_DELIVERY_METHODS);
 export const Enable2faInputSchema = z.object({
     password: z.string().min(8),
+    method: TwoFactorDeliveryMethodSchema.default('app'),
 });
 export const Enable2faResultSchema = z.object({
-    totpUri: z.string().min(1),
+    // Only the authenticator method has a URI to render as a QR code; `email` and `sms`
+    // get their code pushed instead, so there is nothing for the client to display.
+    totpUri: z.string().min(1).optional(),
     backupCodes: z.array(z.string()),
+    // Where an `email`/`sms` code was sent, masked for display (p***@example.com).
+    maskedDestination: z.string().min(1).optional(),
 });
+// The credentials that clear a challenge. A backup code is single-use and spends
+// itself, which is what makes it the recovery path off a lost authenticator; `otp`
+// is the pushed code the `email` and `sms` methods deliver.
+export const TwoFactorChallengeMethodSchema = z.enum(['totp', 'backup_code', 'otp']);
+// A live second-factor code, six digits: a TOTP for the `app` method, a pushed
+// one-time code for `email`/`sms`. Used as the fresh factor a step-up action
+// (disable 2FA, regenerate backup codes, trust this device) has to clear on top of
+// the account password - a backup code is deliberately not accepted here.
+export const TotpStepUpCodeSchema = z.string().length(6);
 export const Verify2faInputSchema = z.object({
-    code: z.string().min(6).max(10),
+    // A TOTP code is six digits; a backup code is ten characters split by a hyphen.
+    code: z.string().min(6).max(11),
+    method: TwoFactorChallengeMethodSchema.default('totp'),
+    // Suppresses the second factor on this browser until the trust window lapses.
+    // Honoured only for `method: 'totp'` - a spent recovery code buys a session, not
+    // a 30-day bypass - and only while the operator allows a non-zero window.
+    trustDevice: z.boolean().default(false),
+    timezone: TimezoneSchema.optional(),
+});
+export const RegenerateBackupCodesInputSchema = z.object({
+    password: z.string().min(8),
+    // A fresh authenticator code: rotating the standing recovery credentials is a
+    // step-up action, not something a stolen session plus a reused password can do.
+    code: TotpStepUpCodeSchema,
+});
+export const TrustCurrentDeviceInputSchema = z.object({
+    code: TotpStepUpCodeSchema,
+    password: z.string().min(8),
+});
+export const BackupCodesResultSchema = z.object({
+    backupCodes: z.array(z.string()),
+});
+// Pushes a one-time code to the account's registered address. Serves both the
+// "Resend code" action during enrolment and the send leg of an `email`/`sms`
+// challenge at login, so it answers from a live session or a pending challenge alike.
+export const SendTwoFactorOtpResultSchema = z.object({
+    maskedDestination: z.string().min(1),
+});
+// What the Security page renders: whether a second factor is active, which one, and
+// the addresses a code could go to - masked, because this is read from the session
+// rather than re-proved, so it must not hand back a full address or phone number.
+export const TwoFactorStatusSchema = z.object({
+    enabled: z.boolean(),
+    method: TwoFactorDeliveryMethodSchema.nullable(),
+    maskedEmail: z.string().min(1),
+    // Null when the account has no verified phone - the `sms` method is unavailable then.
+    maskedPhone: z.string().min(1).nullable(),
 });
 export const Disable2faInputSchema = z.object({
     password: z.string().min(8),
+    // Disabling the second factor tears down every standing bypass with it, so it
+    // takes a fresh authenticator code on top of the password - the same bar as a
+    // Super Admin reset, just self-served.
+    code: TotpStepUpCodeSchema,
+});
+// How long a session may sit idle before it is cut. Every account has a window - there
+// is deliberately no "off": the longest option already coincides with better-auth's
+// absolute 30-day expiry, which this setting does not touch.
+export const AUTO_LOGOUT_DURATIONS = ['15m', '1h', '24h', '7d', '30d'];
+export const AutoLogoutDurationSchema = z.enum(AUTO_LOGOUT_DURATIONS);
+// The window behind each option, in minutes.
+export const AUTO_LOGOUT_MINUTES = {
+    '15m': 15,
+    '1h': 60,
+    '24h': 24 * 60,
+    '7d': 7 * 24 * 60,
+    '30d': 30 * 24 * 60,
+};
+export const SecurityControlsSchema = z.object({
+    passwordMeetsPolicy: z.boolean(),
+    emailVerified: z.boolean(),
+    phoneNumber: E164PhoneSchema.nullable(),
+    phoneVerified: z.boolean(),
+    twoFactorEnabled: z.boolean(),
+    loginWithdrawalAlertsEnabled: z.boolean(),
+    withdrawalPinSet: z.boolean(),
+    autoLogoutDuration: AutoLogoutDurationSchema,
+    // When set, a trusted device buys nothing: the second factor is asked for on every
+    // login regardless of how recently this browser cleared one.
+    requireTwoFactorOnLogin: z.boolean(),
+    // The operator-configured trust window (`adminSecurityConfig.trustedDeviceDays`), so a
+    // client's "trust this device for N days" copy names the real value instead of a
+    // hardcoded guess that goes stale the moment an operator changes it. Zero means
+    // trusting a device is disabled platform-wide.
+    trustedDeviceDays: z.number().int().nonnegative(),
+    // Raw value, not a boolean - this code authorizes nothing (unlike the withdrawal PIN), it's
+    // a recognition signal readable only by the authenticated player it belongs to, same gate as
+    // the rest of this schema.
+    antiPhishingCode: z.string().nullable(),
+});
+export const SetLoginWithdrawalAlertsInputSchema = z.object({ enabled: z.boolean() });
+export const SetAutoLogoutInputSchema = z.object({ duration: AutoLogoutDurationSchema });
+export const SetRequireTwoFactorOnLoginInputSchema = z.object({ enabled: z.boolean() });
+// Non-empty after trimming incidental leading/trailing whitespace (eg from copy-paste),
+// case-sensitive, and capped to keep every delivered email bounded - no reauth, set/overwrite only.
+export const SetAntiPhishingCodeInputSchema = z.object({ code: z.string().trim().min(1).max(255) });
+export const WithdrawalPinSchema = z.string().regex(/^[0-9]{4}$/);
+// Set and Change share this one shape - Change asks for a fresh password/TOTP the same
+// as Set, never the current PIN (matches the product's identical Set/Change UX).
+export const SetWithdrawalPinInputSchema = z
+    .object({
+    pin: WithdrawalPinSchema,
+    confirmPin: WithdrawalPinSchema,
+    currentPassword: z.string().min(8),
+    totpCode: TotpStepUpCodeSchema.optional(),
+})
+    .refine((v) => v.pin === v.confirmPin, {
+    message: 'PIN and confirmation must match.',
+    path: ['confirmPin'],
+});
+export const PhoneVerificationRequestInputSchema = z.object({
+    phone: E164PhoneSchema,
+    currentPassword: z.string().min(8),
+    totpCode: TotpStepUpCodeSchema.optional(),
+});
+export const PhoneVerificationRequestOutputSchema = z.object({
+    expiresAt: TimestampSchema,
+    resendAfter: TimestampSchema,
+});
+export const PhoneVerificationConfirmInputSchema = z.object({
+    code: z.string().regex(/^[0-9]{6}$/),
 });
 export const RequestPasswordResetInputSchema = z.object({
     email: z.email(),
 });
 export const ResetPasswordInputSchema = z.object({
-    token: z.string().min(1),
-    newPassword: z.string().min(8),
+    email: z.email(),
+    otp: z.string().length(OTP_CODE_LENGTH),
+    token: z.string().min(1).optional(),
+    newPassword: PasswordSchema,
+});
+export const VerifyPasswordResetOtpInputSchema = ResetPasswordInputSchema.pick({
+    email: true,
+    otp: true,
+});
+export const ResendEmailVerificationInputSchema = z.object({
+    email: z.email(),
 });
 export const VerifyEmailInputSchema = z.object({
-    token: z.string().min(1),
+    email: z.email(),
+    otp: z.string().length(OTP_CODE_LENGTH),
+    // Carried here too: `autoSignInAfterVerification` mints the first session on this route,
+    // and verification may come from a different device than sign-up.
+    timezone: TimezoneSchema.optional(),
 });
 export const UpdateProfileInputSchema = z
     .object({
@@ -75,10 +286,26 @@ export const UpdateProfileInputSchema = z
 });
 export const ChangePasswordInputSchema = z.object({
     currentPassword: z.string().min(8),
-    newPassword: z.string().min(8),
+    newPassword: PasswordSchema,
 });
-export const ChangeEmailInputSchema = z.object({
+// Step 1: request a change. The OTP is mailed to `newEmail`; `currentPassword`/`totpCode`
+// feed `assertFreshReauthentication` - a live session alone must not be enough.
+export const RequestEmailChangeInputSchema = z.object({
     newEmail: z.email(),
+    currentPassword: z.string().min(8),
+    totpCode: TotpStepUpCodeSchema.optional(),
+});
+// Step 2: confirm with the code that was mailed to `newEmail`.
+export const ConfirmEmailChangeInputSchema = z.object({
+    newEmail: z.email(),
+    otp: z.string().length(OTP_CODE_LENGTH),
 });
 export const IdentitySuccessSchema = z.object({ success: z.literal(true) });
+// The caller may have asked to trust this device and not gotten it: a backup code, an
+// account requiring 2FA on every login, or a challenge that never resolved to a session
+// all suppress the grant while the challenge itself still succeeds. `trustGranted` is
+// the one field client copy promising "you won't be asked again" can trust.
+export const Verify2faOutputSchema = IdentitySuccessSchema.extend({
+    trustGranted: z.boolean(),
+});
 //# sourceMappingURL=identity.js.map