@outseta/react 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outseta/react",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "React hooks and components for the Outseta API",
   "license": "MIT",
   "repository": {
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.0.0",
-    "@outseta/api-client": "0.3.0"
+    "@outseta/api-client": "0.3.1"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0"

package/src/generated/outsetaAPI.schemas.ts

@@ -2633,11 +2633,163 @@ export const EmailListSubscriberStatus = {
   Confirmed: 4,
 } as const;
 
+export interface TokenPayload {
+  /** @nullable */
+  access_token?: string | null;
+  /** @nullable */
+  authentication_callback_url?: string | null;
+  expires_in?: number;
+  /** @nullable */
+  id_token?: string | null;
+  /** @nullable */
+  token_type?: string | null;
+}
+
+/**
+ * Returned when a login cannot complete with a password alone because the
+user has two-factor authentication enabled. Carries the opaque challenge
+token that must be echoed back to POST /api/v1/tokens/two-factor
+(or the recovery / resend / switch-mechanism endpoints) along with enough
+metadata for a client to render the verification step without a second
+round-trip. The property names are snake_case to match the wire format of
+the other token endpoints (see TokenPayload).
+ */
+export interface TwoFactorChallengePayload {
+  /**
+   * Present and true on the 202 response from POST /api/v1/tokens
+when the user has at least one verified 2FA method. Absent on the
+resend / switch-mechanism responses, which only ever follow an
+already-issued login challenge.
+   * @nullable
+   */
+  two_factor_required?: boolean | null;
+  /**
+   * Present and true instead of two_factor_required
+when the tenant forces 2FA but the user has not yet enrolled any
+method. In that case only challenge_token and
+expires_in are populated and the client must route the
+user through the mid-login enrollment endpoints
+(/api/v1/tokens/two-factor/enroll/...) before a token can be issued.
+   * @nullable
+   */
+  two_factor_enrollment_required?: boolean | null;
+  /**
+   * Short-lived signed JWT (audience outseta:2fa-challenge) that
+identifies this challenge. Echo it back verbatim to complete the login.
+   * @nullable
+   */
+  challenge_token?: string | null;
+  /**
+   * The mechanism this challenge was issued against: Email or
+Totp (authenticator app). For Email a code has already
+been sent to the user; for Totp the user reads the current
+code from their authenticator app and nothing is sent.
+   * @nullable
+   */
+  mechanism?: string | null;
+  /**
+   * A masked view of where an emailed code was sent (e.g. b***@outseta.com),
+suitable for display. Empty when mechanism is Totp.
+   * @nullable
+   */
+  masked_destination?: string | null;
+  /** Seconds until the challenge expires (600). After this the
+challenge_token can no longer be verified and the login must restart. */
+  expires_in?: number;
+  /**
+   * Every verified mechanism enrolled for this user (excluding recovery
+codes), e.g. ["Totp", "Email"]. A client can offer a
+"use a different method" option for any value other than the current
+mechanism via POST /api/v1/tokens/two-factor/switch-mechanism.
+   * @nullable
+   */
+  available_mechanisms?: string[] | null;
+  /**
+   * true when the user has a batch of recovery codes on file, in
+which case POST /api/v1/tokens/two-factor/recovery can be used
+as a fallback if they cannot produce a primary code.
+   * @nullable
+   */
+  recovery_codes_available?: boolean | null;
+}
+
 export interface PasswordPayload {
   /** @nullable */
   Password?: string | null;
 }
 
+/**
+ * Returned from POST /api/v1/tokens/two-factor/enroll/totp/begin when a
+user forced into 2FA chooses to enroll an authenticator app. Carries the
+shared secret in the three forms a client may need to present it, plus the
+challenge token the user's first generated code is confirmed against. The
+property names are snake_case to match the wire format of the other token
+endpoints (see TokenPayload).
+ */
+export interface TwoFactorTotpEnrollmentPayload {
+  /**
+   * Short-lived signed JWT identifying the enrollment-test challenge.
+Echo it back to POST /api/v1/tokens/two-factor/enroll/totp/confirm
+along with the first code from the authenticator app.
+   * @nullable
+   */
+  challenge_token?: string | null;
+  /**
+   * The Base32-encoded shared secret. Offer this for manual entry by users
+who cannot scan the QR code.
+   * @nullable
+   */
+  secret?: string | null;
+  /**
+   * The full otpauth://totp/... URI encoding the secret, issuer and
+parameters. Most authenticator apps add an account directly from this.
+   * @nullable
+   */
+  otpauth_uri?: string | null;
+  /**
+   * A QR code rendering of otpauth_uri as a PNG, Base64
+encoded — render it as an <img> for the user to scan.
+   * @nullable
+   */
+  qr_code_png_base64?: string | null;
+  /** Seconds until the enrollment-test challenge expires (600). */
+  expires_in?: number;
+}
+
+/**
+ * Returned from the mid-login enrollment confirm endpoints
+(POST /api/v1/tokens/two-factor/enroll/{email|totp}/confirm) once the
+user has proven control of the new mechanism. Completes a forced-enrollment
+login: it both finalizes the JWT access token and surfaces the freshly
+generated recovery codes. The property names are snake_case to match the
+wire format of the other token endpoints (see TokenPayload).
+ */
+export interface TwoFactorEnrollmentConfirmationPayload {
+  /** Always true on a success response; the enrollment is now active. */
+  confirmed?: boolean;
+  /**
+   * The user's recovery codes, generated as part of first-time enrollment.
+These are shown once and never returned again — prompt the user
+to store them somewhere safe. Each code is single-use at
+POST /api/v1/tokens/two-factor/recovery.
+   * @nullable
+   */
+  recovery_codes?: string[] | null;
+  /**
+   * The JWT access token. Use it as Authorization: bearer {access_token}
+for subsequent API calls — login is complete.
+   * @nullable
+   */
+  access_token?: string | null;
+  /**
+   * Always Bearer.
+   * @nullable
+   */
+  token_type?: string | null;
+  /** Seconds until the access token expires. */
+  expires_in?: number;
+}
+
 /**
  * @nullable
  */
@@ -5658,6 +5810,69 @@ export interface PersonSegmentRemovedWebhookPayload {
   ActivityEventData?: PersonSegmentRemovedActivityData;
 }
 
+export type AuthGetTokenParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type AuthVerifyTwoFactorTokenParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type AuthResendTwoFactorParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type AuthSwitchTwoFactorMechanismParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type AuthVerifyTwoFactorRecoveryParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type TokenTwoFactorEnrollmentBeginEmailParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type TokenTwoFactorEnrollmentBeginTotpParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type TokenTwoFactorEnrollmentConfirmEmailParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
+export type TokenTwoFactorEnrollmentConfirmTotpParams = {
+/**
+ * @nullable
+ */
+data: unknown | null;
+};
+
 export type CaseGetAllCasesParams = {
 /**
  * Search string

package/src/generated/public/public.ts

@@ -0,0 +1,748 @@
+// @ts-nocheck
+import {
+  useMutation
+} from '@tanstack/react-query';
+import type {
+  MutationFunction,
+  UseMutationOptions,
+  UseMutationResult
+} from '@tanstack/react-query';
+
+import type {
+  AuthGetTokenParams,
+  AuthResendTwoFactorParams,
+  AuthSwitchTwoFactorMechanismParams,
+  AuthVerifyTwoFactorRecoveryParams,
+  AuthVerifyTwoFactorTokenParams,
+  TokenPayload,
+  TokenTwoFactorEnrollmentBeginEmailParams,
+  TokenTwoFactorEnrollmentBeginTotpParams,
+  TokenTwoFactorEnrollmentConfirmEmailParams,
+  TokenTwoFactorEnrollmentConfirmTotpParams,
+  TwoFactorChallengePayload,
+  TwoFactorEnrollmentConfirmationPayload,
+  TwoFactorTotpEnrollmentPayload
+} from '../outsetaAPI.schemas';
+
+import { customFetch } from '../../mutator';
+
+
+type SecondParameter<T extends (...args: never) => unknown> = Parameters<T>[1];
+
+
+
+/**
+ * Post a JSON body with the user's credentials:
+            
+    { "username": "user@example.com", "password": "their-password" }
+            
+On success the response is `200` with an access token:
+            
+    { "access_token": "eyJ...", "token_type": "Bearer", "expires_in": 31536000 }
+            
+**Two-factor authentication.** If the user has a verified 2FA method,
+the password alone is not enough. After verifying the password this
+endpoint instead returns `202 Accepted` with a challenge that must be
+satisfied via `POST /api/v1/tokens/two-factor`:
+            
+    {
+      "two_factor_required": true,
+      "challenge_token": "eyJ...",
+      "mechanism": "Totp",
+      "masked_destination": "",
+      "expires_in": 600,
+      "available_mechanisms": ["Totp", "Email"],
+      "recovery_codes_available": true
+    }
+            
+`mechanism` is the method this challenge targets. When it is `Email`,
+a one-time code has already been emailed to the user (see
+`masked_destination`); when it is `Totp`, the user reads the current
+code from their authenticator app and nothing is sent.
+`available_mechanisms` lists every method the user has enrolled so a
+client can offer a switch via `POST /api/v1/tokens/two-factor/switch-mechanism`.
+            
+If the tenant forces 2FA but the user has not enrolled yet, the `202`
+body instead contains `"two_factor_enrollment_required": true` with a
+`challenge_token` to drive the mid-login enrollment endpoints.
+            
+Invalid credentials return `400` with a body of `invalid_grant`.
+ * @summary Log a user in and obtain a JWT access token.
+ */
+export const authGetToken = (
+    params: AuthGetTokenParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TokenPayload | TwoFactorChallengePayload>(
+      {url: `/api/v1/tokens`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getAuthGetTokenMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authGetToken>>, TError,{params: AuthGetTokenParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof authGetToken>>, TError,{params: AuthGetTokenParams}, TContext> => {
+
+const mutationKey = ['authGetToken'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof authGetToken>>, {params: AuthGetTokenParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  authGetToken(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type AuthGetTokenMutationResult = NonNullable<Awaited<ReturnType<typeof authGetToken>>>
+    
+    export type AuthGetTokenMutationError = string
+
+    /**
+ * @summary Log a user in and obtain a JWT access token.
+ */
+export const useAuthGetToken = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authGetToken>>, TError,{params: AuthGetTokenParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof authGetToken>>,
+        TError,
+        {params: AuthGetTokenParams},
+        TContext
+      > => {
+
+      const mutationOptions = getAuthGetTokenMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * Call this after `POST /api/v1/tokens` returns `two_factor_required`.
+Post the challenge token from that response together with the user's
+one-time code (the emailed code, or the current code from their
+authenticator app):
+            
+    { "challenge_token": "eyJ...", "code": "123456" }
+            
+On success the response is `200` with the final access token, in the
+same shape as `POST /api/v1/tokens`:
+            
+    { "access_token": "eyJ...", "token_type": "Bearer", "expires_in": 31536000 }
+            
+An incorrect code returns `400` (`invalid_grant`). A code has at most
+five attempts before the challenge locks. An expired challenge returns
+`410` (`challenge_expired`) — restart at `POST /api/v1/tokens`. The
+endpoint is rate limited to 10 requests per minute (`429`).
+ * @summary Complete a two-factor login challenge and obtain a JWT access token.
+ */
+export const authVerifyTwoFactorToken = (
+    params: AuthVerifyTwoFactorTokenParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TokenPayload>(
+      {url: `/api/v1/tokens/two-factor`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getAuthVerifyTwoFactorTokenMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authVerifyTwoFactorToken>>, TError,{params: AuthVerifyTwoFactorTokenParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof authVerifyTwoFactorToken>>, TError,{params: AuthVerifyTwoFactorTokenParams}, TContext> => {
+
+const mutationKey = ['authVerifyTwoFactorToken'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof authVerifyTwoFactorToken>>, {params: AuthVerifyTwoFactorTokenParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  authVerifyTwoFactorToken(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type AuthVerifyTwoFactorTokenMutationResult = NonNullable<Awaited<ReturnType<typeof authVerifyTwoFactorToken>>>
+    
+    export type AuthVerifyTwoFactorTokenMutationError = string
+
+    /**
+ * @summary Complete a two-factor login challenge and obtain a JWT access token.
+ */
+export const useAuthVerifyTwoFactorToken = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authVerifyTwoFactorToken>>, TError,{params: AuthVerifyTwoFactorTokenParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof authVerifyTwoFactorToken>>,
+        TError,
+        {params: AuthVerifyTwoFactorTokenParams},
+        TContext
+      > => {
+
+      const mutationOptions = getAuthVerifyTwoFactorTokenMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * Post the challenge token from the original `POST /api/v1/tokens` response:
+            
+    { "challenge_token": "eyJ..." }
+            
+A fresh code is emailed and a new challenge is returned (superseding
+the previous one), in the same shape as the `202` from
+`POST /api/v1/tokens` minus `two_factor_required`. Only `Email`
+challenges can be resent — there is nothing to resend for `Totp`
+(the authenticator app generates codes locally), so a `Totp`
+challenge returns `400` with a body of `not_supported`. Rate limited
+to 3 requests per minute (`429`).
+ * @summary Re-send the one-time code for an in-progress email two-factor challenge.
+ */
+export const authResendTwoFactor = (
+    params: AuthResendTwoFactorParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TwoFactorChallengePayload>(
+      {url: `/api/v1/tokens/two-factor/resend`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getAuthResendTwoFactorMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authResendTwoFactor>>, TError,{params: AuthResendTwoFactorParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof authResendTwoFactor>>, TError,{params: AuthResendTwoFactorParams}, TContext> => {
+
+const mutationKey = ['authResendTwoFactor'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof authResendTwoFactor>>, {params: AuthResendTwoFactorParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  authResendTwoFactor(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type AuthResendTwoFactorMutationResult = NonNullable<Awaited<ReturnType<typeof authResendTwoFactor>>>
+    
+    export type AuthResendTwoFactorMutationError = string
+
+    /**
+ * @summary Re-send the one-time code for an in-progress email two-factor challenge.
+ */
+export const useAuthResendTwoFactor = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authResendTwoFactor>>, TError,{params: AuthResendTwoFactorParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof authResendTwoFactor>>,
+        TError,
+        {params: AuthResendTwoFactorParams},
+        TContext
+      > => {
+
+      const mutationOptions = getAuthResendTwoFactorMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * When a user has more than one method enrolled (see
+`available_mechanisms` on the login response) they can switch the
+active challenge — for example from `Totp` to `Email` when they have
+lost access to their authenticator. Post the current challenge token
+and the desired mechanism:
+            
+    { "challenge_token": "eyJ...", "mechanism": "Email" }
+            
+A fresh challenge for that mechanism is returned (and, for `Email`, a
+code is sent), in the same shape as the `202` from `POST /api/v1/tokens`
+minus `two_factor_required`. An unrecognized mechanism returns `400`
+(`invalid_mechanism`); a mechanism the user has not enrolled returns
+`400` (`not_enrolled`). Rate limited to 5 requests per minute (`429`).
+ * @summary Switch an in-progress login challenge to a different enrolled mechanism.
+ */
+export const authSwitchTwoFactorMechanism = (
+    params: AuthSwitchTwoFactorMechanismParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TwoFactorChallengePayload>(
+      {url: `/api/v1/tokens/two-factor/switch-mechanism`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getAuthSwitchTwoFactorMechanismMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authSwitchTwoFactorMechanism>>, TError,{params: AuthSwitchTwoFactorMechanismParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof authSwitchTwoFactorMechanism>>, TError,{params: AuthSwitchTwoFactorMechanismParams}, TContext> => {
+
+const mutationKey = ['authSwitchTwoFactorMechanism'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof authSwitchTwoFactorMechanism>>, {params: AuthSwitchTwoFactorMechanismParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  authSwitchTwoFactorMechanism(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type AuthSwitchTwoFactorMechanismMutationResult = NonNullable<Awaited<ReturnType<typeof authSwitchTwoFactorMechanism>>>
+    
+    export type AuthSwitchTwoFactorMechanismMutationError = string
+
+    /**
+ * @summary Switch an in-progress login challenge to a different enrolled mechanism.
+ */
+export const useAuthSwitchTwoFactorMechanism = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authSwitchTwoFactorMechanism>>, TError,{params: AuthSwitchTwoFactorMechanismParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof authSwitchTwoFactorMechanism>>,
+        TError,
+        {params: AuthSwitchTwoFactorMechanismParams},
+        TContext
+      > => {
+
+      const mutationOptions = getAuthSwitchTwoFactorMechanismMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * A fallback for users who cannot produce their primary code but still
+have a recovery code on file (see `recovery_codes_available` on the
+login response). Post the challenge token together with one recovery
+code:
+            
+    { "challenge_token": "eyJ...", "recovery_code": "abcd-efgh-ijkl" }
+            
+On success the response is `200` with the final access token, in the
+same shape as `POST /api/v1/tokens`. Each recovery code is single-use.
+An incorrect code returns `400` (`invalid_grant`); an expired
+challenge returns `410` (`challenge_expired`). Rate limited to 10
+requests per minute (`429`).
+            
+Used by the embed login widget; the hosted Razor flow has its own
+equivalent action on the AuthenticationController.
+ * @summary Complete a two-factor login challenge with a recovery code instead of
+the primary one-time code, and obtain a JWT access token.
+ */
+export const authVerifyTwoFactorRecovery = (
+    params: AuthVerifyTwoFactorRecoveryParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TokenPayload>(
+      {url: `/api/v1/tokens/two-factor/recovery`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getAuthVerifyTwoFactorRecoveryMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authVerifyTwoFactorRecovery>>, TError,{params: AuthVerifyTwoFactorRecoveryParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof authVerifyTwoFactorRecovery>>, TError,{params: AuthVerifyTwoFactorRecoveryParams}, TContext> => {
+
+const mutationKey = ['authVerifyTwoFactorRecovery'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof authVerifyTwoFactorRecovery>>, {params: AuthVerifyTwoFactorRecoveryParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  authVerifyTwoFactorRecovery(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type AuthVerifyTwoFactorRecoveryMutationResult = NonNullable<Awaited<ReturnType<typeof authVerifyTwoFactorRecovery>>>
+    
+    export type AuthVerifyTwoFactorRecoveryMutationError = string
+
+    /**
+ * @summary Complete a two-factor login challenge with a recovery code instead of
+the primary one-time code, and obtain a JWT access token.
+ */
+export const useAuthVerifyTwoFactorRecovery = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof authVerifyTwoFactorRecovery>>, TError,{params: AuthVerifyTwoFactorRecoveryParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof authVerifyTwoFactorRecovery>>,
+        TError,
+        {params: AuthVerifyTwoFactorRecoveryParams},
+        TContext
+      > => {
+
+      const mutationOptions = getAuthVerifyTwoFactorRecoveryMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * Call this when `POST /api/v1/tokens` returned
+`two_factor_enrollment_required` and the user chooses email. Post the
+enrollment token from that response:
+            
+    { "enrollment_token": "eyJ..." }
+            
+A verification code is emailed to the user and a challenge is returned:
+            
+    {
+      "challenge_token": "eyJ...",
+      "mechanism": "Email",
+      "masked_destination": "b***@outseta.com",
+      "expires_in": 600
+    }
+            
+Confirm the code via `POST /api/v1/tokens/two-factor/enroll/email/confirm`.
+Returns `401` if the enrollment token is invalid/expired and `403` if
+forced enrollment does not apply to this user. Rate limited to 5
+requests per minute (`429`).
+ * @summary Begin email enrollment during a forced-2FA login.
+ */
+export const tokenTwoFactorEnrollmentBeginEmail = (
+    params: TokenTwoFactorEnrollmentBeginEmailParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TwoFactorChallengePayload>(
+      {url: `/api/v1/tokens/two-factor/enroll/email/begin`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getTokenTwoFactorEnrollmentBeginEmailMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginEmail>>, TError,{params: TokenTwoFactorEnrollmentBeginEmailParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginEmail>>, TError,{params: TokenTwoFactorEnrollmentBeginEmailParams}, TContext> => {
+
+const mutationKey = ['tokenTwoFactorEnrollmentBeginEmail'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginEmail>>, {params: TokenTwoFactorEnrollmentBeginEmailParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  tokenTwoFactorEnrollmentBeginEmail(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type TokenTwoFactorEnrollmentBeginEmailMutationResult = NonNullable<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginEmail>>>
+    
+    export type TokenTwoFactorEnrollmentBeginEmailMutationError = string
+
+    /**
+ * @summary Begin email enrollment during a forced-2FA login.
+ */
+export const useTokenTwoFactorEnrollmentBeginEmail = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginEmail>>, TError,{params: TokenTwoFactorEnrollmentBeginEmailParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginEmail>>,
+        TError,
+        {params: TokenTwoFactorEnrollmentBeginEmailParams},
+        TContext
+      > => {
+
+      const mutationOptions = getTokenTwoFactorEnrollmentBeginEmailMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    export const tokenTwoFactorEnrollmentBeginTotp = (
+    params: TokenTwoFactorEnrollmentBeginTotpParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TwoFactorTotpEnrollmentPayload>(
+      {url: `/api/v1/tokens/two-factor/enroll/totp/begin`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getTokenTwoFactorEnrollmentBeginTotpMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginTotp>>, TError,{params: TokenTwoFactorEnrollmentBeginTotpParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginTotp>>, TError,{params: TokenTwoFactorEnrollmentBeginTotpParams}, TContext> => {
+
+const mutationKey = ['tokenTwoFactorEnrollmentBeginTotp'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginTotp>>, {params: TokenTwoFactorEnrollmentBeginTotpParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  tokenTwoFactorEnrollmentBeginTotp(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type TokenTwoFactorEnrollmentBeginTotpMutationResult = NonNullable<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginTotp>>>
+    
+    export type TokenTwoFactorEnrollmentBeginTotpMutationError = string
+
+    export const useTokenTwoFactorEnrollmentBeginTotp = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginTotp>>, TError,{params: TokenTwoFactorEnrollmentBeginTotpParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof tokenTwoFactorEnrollmentBeginTotp>>,
+        TError,
+        {params: TokenTwoFactorEnrollmentBeginTotpParams},
+        TContext
+      > => {
+
+      const mutationOptions = getTokenTwoFactorEnrollmentBeginTotpMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * Post the enrollment token (from `POST /api/v1/tokens`), the challenge
+token (from `.../enroll/email/begin`), and the emailed code:
+            
+    { "enrollment_token": "eyJ...", "challenge_token": "eyJ...", "code": "123456" }
+            
+On success email 2FA is enabled and login completes — the response
+carries the final access token plus the user's one-time recovery codes:
+            
+    {
+      "confirmed": true,
+      "recovery_codes": ["abcd-efgh-ijkl", "..."],
+      "access_token": "eyJ...",
+      "token_type": "Bearer",
+      "expires_in": 31536000
+    }
+            
+Show the `recovery_codes` to the user once — they are not returned
+again. An incorrect code returns `400` (`invalid_grant`); an expired
+challenge returns `410` (`challenge_expired`). Rate limited to 10
+requests per minute (`429`).
+ * @summary Confirm email enrollment and complete a forced-2FA login.
+ */
+export const tokenTwoFactorEnrollmentConfirmEmail = (
+    params: TokenTwoFactorEnrollmentConfirmEmailParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TwoFactorEnrollmentConfirmationPayload>(
+      {url: `/api/v1/tokens/two-factor/enroll/email/confirm`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getTokenTwoFactorEnrollmentConfirmEmailMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmEmail>>, TError,{params: TokenTwoFactorEnrollmentConfirmEmailParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmEmail>>, TError,{params: TokenTwoFactorEnrollmentConfirmEmailParams}, TContext> => {
+
+const mutationKey = ['tokenTwoFactorEnrollmentConfirmEmail'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmEmail>>, {params: TokenTwoFactorEnrollmentConfirmEmailParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  tokenTwoFactorEnrollmentConfirmEmail(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type TokenTwoFactorEnrollmentConfirmEmailMutationResult = NonNullable<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmEmail>>>
+    
+    export type TokenTwoFactorEnrollmentConfirmEmailMutationError = string
+
+    /**
+ * @summary Confirm email enrollment and complete a forced-2FA login.
+ */
+export const useTokenTwoFactorEnrollmentConfirmEmail = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmEmail>>, TError,{params: TokenTwoFactorEnrollmentConfirmEmailParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmEmail>>,
+        TError,
+        {params: TokenTwoFactorEnrollmentConfirmEmailParams},
+        TContext
+      > => {
+
+      const mutationOptions = getTokenTwoFactorEnrollmentConfirmEmailMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+    /**
+ * Post the enrollment token (from `POST /api/v1/tokens`), the challenge
+token (from `.../enroll/totp/begin`), and the current code from the
+user's authenticator app:
+            
+    { "enrollment_token": "eyJ...", "challenge_token": "eyJ...", "code": "123456" }
+            
+On success authenticator-app 2FA is enabled and login completes — the
+response carries the final access token plus the user's one-time
+recovery codes:
+            
+    {
+      "confirmed": true,
+      "recovery_codes": ["abcd-efgh-ijkl", "..."],
+      "access_token": "eyJ...",
+      "token_type": "Bearer",
+      "expires_in": 31536000
+    }
+            
+Show the `recovery_codes` to the user once — they are not returned
+again. An incorrect code returns `400` (`invalid_grant`); an expired
+challenge returns `410` (`challenge_expired`). Rate limited to 10
+requests per minute (`429`).
+ * @summary Confirm authenticator-app (TOTP) enrollment and complete a forced-2FA login.
+ */
+export const tokenTwoFactorEnrollmentConfirmTotp = (
+    params: TokenTwoFactorEnrollmentConfirmTotpParams,
+ options?: SecondParameter<typeof customFetch>,signal?: AbortSignal
+) => {
+      
+      
+      return customFetch<TwoFactorEnrollmentConfirmationPayload>(
+      {url: `/api/v1/tokens/two-factor/enroll/totp/confirm`, method: 'POST',
+        params, signal
+    },
+      options);
+    }
+  
+
+
+export const getTokenTwoFactorEnrollmentConfirmTotpMutationOptions = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmTotp>>, TError,{params: TokenTwoFactorEnrollmentConfirmTotpParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+): UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmTotp>>, TError,{params: TokenTwoFactorEnrollmentConfirmTotpParams}, TContext> => {
+
+const mutationKey = ['tokenTwoFactorEnrollmentConfirmTotp'];
+const {mutation: mutationOptions, request: requestOptions} = options ?
+      options.mutation && 'mutationKey' in options.mutation && options.mutation.mutationKey ?
+      options
+      : {...options, mutation: {...options.mutation, mutationKey}}
+      : {mutation: { mutationKey, }, request: undefined};
+
+      
+
+
+      const mutationFn: MutationFunction<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmTotp>>, {params: TokenTwoFactorEnrollmentConfirmTotpParams}> = (props) => {
+          const {params} = props ?? {};
+
+          return  tokenTwoFactorEnrollmentConfirmTotp(params,requestOptions)
+        }
+
+        
+
+
+  return  { mutationFn, ...mutationOptions }}
+
+    export type TokenTwoFactorEnrollmentConfirmTotpMutationResult = NonNullable<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmTotp>>>
+    
+    export type TokenTwoFactorEnrollmentConfirmTotpMutationError = string
+
+    /**
+ * @summary Confirm authenticator-app (TOTP) enrollment and complete a forced-2FA login.
+ */
+export const useTokenTwoFactorEnrollmentConfirmTotp = <TError = string,
+    TContext = unknown>(options?: { mutation?:UseMutationOptions<Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmTotp>>, TError,{params: TokenTwoFactorEnrollmentConfirmTotpParams}, TContext>, request?: SecondParameter<typeof customFetch>}
+ ): UseMutationResult<
+        Awaited<ReturnType<typeof tokenTwoFactorEnrollmentConfirmTotp>>,
+        TError,
+        {params: TokenTwoFactorEnrollmentConfirmTotpParams},
+        TContext
+      > => {
+
+      const mutationOptions = getTokenTwoFactorEnrollmentConfirmTotpMutationOptions(options);
+
+      return useMutation(mutationOptions);
+    }
+