@schemavaults/auth-common 0.10.15 → 0.12.0

package/dist/authenticate_result.d.ts

@@ -1,15 +1,125 @@
 import { z } from "zod";
-export declare const authenticateResultSchema: z.ZodObject<{
+export declare const authenticatedAuthenticateResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"authenticated">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    authorization_code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}>;
+export type AuthenticatedAuthenticateResult = z.infer<typeof authenticatedAuthenticateResultSchema>;
+export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"mfa_required">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    challenge_id: z.ZodString;
+    expires_at: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}>;
+export type MfaRequiredAuthenticateResult = z.infer<typeof mfaRequiredAuthenticateResultSchema>;
+export declare const authenticateFailureResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"failure">;
+    success: z.ZodBoolean;
     message: z.ZodString;
-    authorization_code: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}>;
+export type AuthenticateFailureResult = z.infer<typeof authenticateFailureResultSchema>;
+export declare const challengeExpiredAuthenticateResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"challenge_expired">;
     success: z.ZodBoolean;
+    message: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     message: string;
+    kind: "challenge_expired";
     success: boolean;
-    authorization_code?: string | undefined;
 }, {
     message: string;
+    kind: "challenge_expired";
     success: boolean;
-    authorization_code?: string | undefined;
 }>;
+export type ChallengeExpiredAuthenticateResult = z.infer<typeof challengeExpiredAuthenticateResultSchema>;
+export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"authenticated">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    authorization_code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"mfa_required">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    challenge_id: z.ZodString;
+    expires_at: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"failure">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"challenge_expired">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    kind: "challenge_expired";
+    success: boolean;
+}, {
+    message: string;
+    kind: "challenge_expired";
+    success: boolean;
+}>]>;
 export type AuthenticateResult = z.infer<typeof authenticateResultSchema>;

package/dist/authenticate_result.js

@@ -1,12 +1,46 @@
 import { z } from "zod";
-export const authenticateResultSchema = z.object({
+export const authenticatedAuthenticateResultSchema = z
+    .object({
+    kind: z.literal("authenticated"),
     success: z.boolean(),
     message: z.string(),
-    authorization_code: z.string()
-        .min(43, 'Authorization code must be at least 43 characters long')
-        .optional()
-}).required({
-    success: true,
-    message: true
-}).strict();
+    authorization_code: z
+        .string()
+        .min(43, "Authorization code must be at least 43 characters long"),
+})
+    .strict();
+export const mfaRequiredAuthenticateResultSchema = z
+    .object({
+    kind: z.literal("mfa_required"),
+    success: z.boolean(),
+    message: z.string(),
+    challenge_id: z.string().uuid(),
+    expires_at: z.number().int().positive(),
+})
+    .strict();
+export const authenticateFailureResultSchema = z
+    .object({
+    kind: z.literal("failure"),
+    success: z.boolean(),
+    message: z.string(),
+})
+    .strict();
+// Returned by /api/auth/mfa/verify with HTTP 410 when an in-flight MFA
+// challenge has been invalidated — either by exhausting the per-challenge
+// attempt cap or by expiring (TTL elapsed). Distinct from `failure` so
+// clients can navigate the user back to the login page rather than letting
+// them retry against a key that no longer exists in Redis.
+export const challengeExpiredAuthenticateResultSchema = z
+    .object({
+    kind: z.literal("challenge_expired"),
+    success: z.boolean(),
+    message: z.string(),
+})
+    .strict();
+export const authenticateResultSchema = z.discriminatedUnion("kind", [
+    authenticatedAuthenticateResultSchema,
+    mfaRequiredAuthenticateResultSchema,
+    authenticateFailureResultSchema,
+    challengeExpiredAuthenticateResultSchema,
+]);
 //# sourceMappingURL=authenticate_result.js.map

package/dist/authenticate_result.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC3B,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;SACjE,QAAQ,EAAE;CACd,CAAC,CAAC,QAAQ,CAAC;IACV,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;CACd,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -10,7 +10,8 @@ export * from "./middleware";
 export type * from "./middleware";
 export * from "./pkce";
 export type * from "./pkce";
-export { authenticateResultSchema, type AuthenticateResult, } from "./authenticate_result";
+export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, } from "./authenticate_result";
+export * from "./mfa";
 export { requestTokensResultSchema, type RequestTokensResult, successfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";
 export type * from "./auth_acquire_tokens_grant_types";

package/dist/index.js

@@ -5,7 +5,8 @@ export * from "./credentials";
 export * from "./token-data";
 export * from "./middleware";
 export * from "./pkce";
-export { authenticateResultSchema, } from "./authenticate_result";
+export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, } from "./authenticate_result";
+export * from "./mfa";
 export { requestTokensResultSchema, successfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";
 export { PRODUCTION_AUTH_SERVER_URL } from "@schemavaults/app-definitions";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAczB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,GAMzC,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAczB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/mfa/index.d.ts

@@ -0,0 +1,3 @@
+export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, type MfaFactorType, } from "./mfa-factor-type";
+export { mfaChallengeSchema, type MfaChallengeDescriptor, } from "./mfa-challenge";
+export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaCodeOnlyBody, } from "./mfa-verify-body";

package/dist/mfa/index.js

@@ -0,0 +1,4 @@
+export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, } from "./mfa-factor-type";
+export { mfaChallengeSchema, } from "./mfa-challenge";
+export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, } from "./mfa-verify-body";
+//# sourceMappingURL=index.js.map

package/dist/mfa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,qBAAqB,GAOtB,MAAM,mBAAmB,CAAC"}

package/dist/mfa/mfa-challenge.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+export declare const mfaChallengeSchema: z.ZodObject<{
+    challenge_id: z.ZodString;
+    expires_at: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    expires_at: number;
+    challenge_id: string;
+}, {
+    expires_at: number;
+    challenge_id: string;
+}>;
+export type MfaChallengeDescriptor = z.infer<typeof mfaChallengeSchema>;

package/dist/mfa/mfa-challenge.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+export const mfaChallengeSchema = z
+    .object({
+    challenge_id: z.string().uuid(),
+    expires_at: z.number().int().positive(),
+})
+    .strict();
+//# sourceMappingURL=mfa-challenge.js.map

package/dist/mfa/mfa-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-challenge.js","sourceRoot":"","sources":["../../src/mfa/mfa-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/mfa/mfa-factor-type.d.ts

@@ -0,0 +1,5 @@
+import { z } from "zod";
+export declare const mfaFactorTypes: readonly ["totp"];
+export declare const mfaFactorTypeSchema: z.ZodEnum<["totp"]>;
+export type MfaFactorType = z.infer<typeof mfaFactorTypeSchema>;
+export declare function isValidMfaFactorType(value: unknown): value is MfaFactorType;

package/dist/mfa/mfa-factor-type.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export const mfaFactorTypes = ["totp"];
+export const mfaFactorTypeSchema = z.enum(mfaFactorTypes);
+export function isValidMfaFactorType(value) {
+    return mfaFactorTypeSchema.safeParse(value).success;
+}
+//# sourceMappingURL=mfa-factor-type.js.map

package/dist/mfa/mfa-factor-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}

package/dist/mfa/mfa-verify-body.d.ts

@@ -0,0 +1,117 @@
+import { z } from "zod";
+export declare const totpCodeSchema: z.ZodString;
+export declare const recoveryCodeSchema: z.ZodString;
+export declare const mfaVerifyBodySchema: z.ZodObject<{
+    challenge_id: z.ZodString;
+    client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
+    proof: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"totp">;
+        code: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        code: string;
+        type: "totp";
+    }, {
+        code: string;
+        type: "totp";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"recovery_code">;
+        recovery_code: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "recovery_code";
+        recovery_code: string;
+    }, {
+        type: "recovery_code";
+        recovery_code: string;
+    }>]>;
+}, "strict", z.ZodTypeAny, {
+    client_app_id: string;
+    challenge_id: string;
+    proof: {
+        code: string;
+        type: "totp";
+    } | {
+        type: "recovery_code";
+        recovery_code: string;
+    };
+}, {
+    client_app_id: string;
+    challenge_id: string;
+    proof: {
+        code: string;
+        type: "totp";
+    } | {
+        type: "recovery_code";
+        recovery_code: string;
+    };
+}>;
+export type MfaVerifyBody = z.infer<typeof mfaVerifyBodySchema>;
+export declare const mfaEnrollResponseSchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    factor_type: z.ZodLiteral<"totp">;
+    otpauth_url: z.ZodString;
+    qr_code_data_url: z.ZodString;
+    secret: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    factor_id: string;
+    factor_type: "totp";
+    otpauth_url: string;
+    qr_code_data_url: string;
+    secret: string;
+}, {
+    factor_id: string;
+    factor_type: "totp";
+    otpauth_url: string;
+    qr_code_data_url: string;
+    secret: string;
+}>;
+export type MfaEnrollResponse = z.infer<typeof mfaEnrollResponseSchema>;
+export declare const mfaVerifyEnrollmentBodySchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    factor_id: string;
+}, {
+    code: string;
+    factor_id: string;
+}>;
+export type MfaVerifyEnrollmentBody = z.infer<typeof mfaVerifyEnrollmentBodySchema>;
+export declare const mfaVerifyEnrollmentResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    recovery_codes: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    success: true;
+    recovery_codes: string[];
+}, {
+    success: true;
+    recovery_codes: string[];
+}>;
+export type MfaVerifyEnrollmentResponse = z.infer<typeof mfaVerifyEnrollmentResponseSchema>;
+export declare const mfaStatusResponseSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    factor_id: z.ZodOptional<z.ZodString>;
+    factor_type: z.ZodOptional<z.ZodLiteral<"totp">>;
+    verified_at: z.ZodOptional<z.ZodNumber>;
+    recovery_codes_remaining: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    factor_id?: string | undefined;
+    factor_type?: "totp" | undefined;
+    verified_at?: number | undefined;
+    recovery_codes_remaining?: number | undefined;
+}, {
+    enabled: boolean;
+    factor_id?: string | undefined;
+    factor_type?: "totp" | undefined;
+    verified_at?: number | undefined;
+    recovery_codes_remaining?: number | undefined;
+}>;
+export type MfaStatusResponse = z.infer<typeof mfaStatusResponseSchema>;
+export declare const mfaCodeOnlyBodySchema: z.ZodObject<{
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+}, {
+    code: string;
+}>;
+export type MfaCodeOnlyBody = z.infer<typeof mfaCodeOnlyBodySchema>;

package/dist/mfa/mfa-verify-body.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+import { appIdSchema } from "@schemavaults/app-definitions";
+export const totpCodeSchema = z
+    .string()
+    .regex(/^\d{6}$/u, "TOTP code must be exactly 6 digits");
+export const recoveryCodeSchema = z
+    .string()
+    .min(8)
+    .max(64);
+export const mfaVerifyBodySchema = z
+    .object({
+    challenge_id: z.string().uuid(),
+    client_app_id: appIdSchema,
+    proof: z.discriminatedUnion("type", [
+        z.object({ type: z.literal("totp"), code: totpCodeSchema }).strict(),
+        z
+            .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
+            .strict(),
+    ]),
+})
+    .strict();
+export const mfaEnrollResponseSchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    factor_type: z.literal("totp"),
+    otpauth_url: z.string().url(),
+    qr_code_data_url: z.string().min(1),
+    secret: z.string().min(16),
+})
+    .strict();
+export const mfaVerifyEnrollmentBodySchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    code: totpCodeSchema,
+})
+    .strict();
+export const mfaVerifyEnrollmentResponseSchema = z
+    .object({
+    success: z.literal(true),
+    recovery_codes: z.array(recoveryCodeSchema).min(1),
+})
+    .strict();
+export const mfaStatusResponseSchema = z
+    .object({
+    enabled: z.boolean(),
+    factor_id: z.string().uuid().optional(),
+    factor_type: z.literal("totp").optional(),
+    verified_at: z.number().int().positive().optional(),
+    recovery_codes_remaining: z.number().int().nonnegative().optional(),
+})
+    .strict();
+export const mfaCodeOnlyBodySchema = z
+    .object({
+    code: totpCodeSchema,
+})
+    .strict();
+//# sourceMappingURL=mfa-verify-body.js.map

package/dist/mfa/mfa-verify-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACpE,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.10.15",
+  "version": "0.12.0",
   "license": "UNLICENSED",
   "private": false,
   "repository": {