@schemavaults/auth-common 0.12.15 → 0.13.0

package/dist/authenticate_result.d.ts

@@ -1,15 +1,15 @@
 import { z } from "zod";
 export declare const availableMfaFactorSchema: z.ZodObject<{
     factor_id: z.ZodString;
-    factor_type: z.ZodEnum<["totp"]>;
+    factor_type: z.ZodEnum<["totp", "webauthn"]>;
     last_used_at: z.ZodNullable<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     factor_id: string;
-    factor_type: "totp";
+    factor_type: "totp" | "webauthn";
     last_used_at: number | null;
 }, {
     factor_id: string;
-    factor_type: "totp";
+    factor_type: "totp" | "webauthn";
     last_used_at: number | null;
 }>;
 export type AvailableMfaFactor = z.infer<typeof availableMfaFactorSchema>;
@@ -38,15 +38,15 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
     expires_at: z.ZodNumber;
     available_factors: z.ZodArray<z.ZodObject<{
         factor_id: z.ZodString;
-        factor_type: z.ZodEnum<["totp"]>;
+        factor_type: z.ZodEnum<["totp", "webauthn"]>;
         last_used_at: z.ZodNullable<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }>, "many">;
     recovery_codes_available: z.ZodBoolean;
@@ -58,7 +58,7 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
     challenge_id: string;
     available_factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }[];
     recovery_codes_available: boolean;
@@ -70,7 +70,7 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
     challenge_id: string;
     available_factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }[];
     recovery_codes_available: boolean;
@@ -127,15 +127,15 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
     expires_at: z.ZodNumber;
     available_factors: z.ZodArray<z.ZodObject<{
         factor_id: z.ZodString;
-        factor_type: z.ZodEnum<["totp"]>;
+        factor_type: z.ZodEnum<["totp", "webauthn"]>;
         last_used_at: z.ZodNullable<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }>, "many">;
     recovery_codes_available: z.ZodBoolean;
@@ -147,7 +147,7 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
     challenge_id: string;
     available_factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }[];
     recovery_codes_available: boolean;
@@ -159,7 +159,7 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
     challenge_id: string;
     available_factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }[];
     recovery_codes_available: boolean;

package/dist/mfa/index.d.ts

@@ -1,3 +1,4 @@
 export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, type MfaFactorType, } from "./mfa-factor-type";
 export { mfaChallengeSchema, type MfaChallengeDescriptor, } from "./mfa-challenge";
-export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaFactorStatusResponse, type MfaEnrolledFactor, type MfaCodeOnlyBody, type MfaTotpProofBody, type MfaChallengeFactorsPayload, } from "./mfa-verify-body";
+export { totpCodeSchema, recoveryCodeSchema, mfaProofSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, type MfaProof, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaFactorStatusResponse, type MfaEnrolledFactor, type MfaCodeOnlyBody, type MfaTotpProofBody, type MfaChallengeFactorsPayload, } from "./mfa-verify-body";
+export { webauthnRegistrationResponseSchema, webauthnAuthenticationResponseSchema, webauthnLabelSchema, webauthnEnrollOptionsResponseSchema, webauthnVerifyEnrollmentBodySchema, webauthnAuthenticationOptionsResponseSchema, webauthnCredentialSummarySchema, webauthnCredentialListResponseSchema, type WebauthnRegistrationResponse, type WebauthnAuthenticationResponse, type WebauthnEnrollOptionsResponse, type WebauthnVerifyEnrollmentBody, type WebauthnAuthenticationOptionsResponse, type WebauthnCredentialSummary, type WebauthnCredentialListResponse, } from "./webauthn";

package/dist/mfa/index.js

@@ -1,4 +1,5 @@
 export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, } from "./mfa-factor-type";
 export { mfaChallengeSchema, } from "./mfa-challenge";
-export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, } from "./mfa-verify-body";
+export { totpCodeSchema, recoveryCodeSchema, mfaProofSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, } from "./mfa-verify-body";
+export { webauthnRegistrationResponseSchema, webauthnAuthenticationResponseSchema, webauthnLabelSchema, webauthnEnrollOptionsResponseSchema, webauthnVerifyEnrollmentBodySchema, webauthnAuthenticationOptionsResponseSchema, webauthnCredentialSummarySchema, webauthnCredentialListResponseSchema, } from "./webauthn";
 //# sourceMappingURL=index.js.map

package/dist/mfa/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GAWjC,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GAYjC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kCAAkC,EAClC,oCAAoC,EACpC,mBAAmB,EACnB,mCAAmC,EACnC,kCAAkC,EAClC,2CAA2C,EAC3C,+BAA+B,EAC/B,oCAAoC,GAQrC,MAAM,YAAY,CAAC"}

package/dist/mfa/mfa-factor-type.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const mfaFactorTypes: readonly ["totp"];
-export declare const mfaFactorTypeSchema: z.ZodEnum<["totp"]>;
+export declare const mfaFactorTypes: readonly ["totp", "webauthn"];
+export declare const mfaFactorTypeSchema: z.ZodEnum<["totp", "webauthn"]>;
 export type MfaFactorType = z.infer<typeof mfaFactorTypeSchema>;
 export declare function isValidMfaFactorType(value: unknown): value is MfaFactorType;

package/dist/mfa/mfa-factor-type.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export const mfaFactorTypes = ["totp"];
+export const mfaFactorTypes = ["totp", "webauthn"];
 export const mfaFactorTypeSchema = z.enum(mfaFactorTypes);
 export function isValidMfaFactorType(value) {
     return mfaFactorTypeSchema.safeParse(value).success;

package/dist/mfa/mfa-factor-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}
+{"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}

package/dist/mfa/mfa-verify-body.d.ts

@@ -1,6 +1,84 @@
 import { z } from "zod";
 export declare const totpCodeSchema: z.ZodString;
 export declare const recoveryCodeSchema: z.ZodString;
+export declare const mfaProofSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"totp">;
+    factor_id: z.ZodString;
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    type: "totp";
+    factor_id: string;
+}, {
+    code: string;
+    type: "totp";
+    factor_id: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"webauthn">;
+    factor_id: z.ZodString;
+    assertion: z.ZodObject<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+        clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+        type: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+        clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+        type: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+        clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+        type: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>;
+}, "strict", z.ZodTypeAny, {
+    type: "webauthn";
+    factor_id: string;
+    assertion: {
+        type: string;
+        id: string;
+        rawId: string;
+        response: {} & {
+            [k: string]: unknown;
+        };
+        authenticatorAttachment?: string | undefined;
+        clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+}, {
+    type: "webauthn";
+    factor_id: string;
+    assertion: {
+        type: string;
+        id: string;
+        rawId: string;
+        response: {} & {
+            [k: string]: unknown;
+        };
+        authenticatorAttachment?: string | undefined;
+        clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"recovery_code">;
+    recovery_code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "recovery_code";
+    recovery_code: string;
+}, {
+    type: "recovery_code";
+    recovery_code: string;
+}>]>;
+export type MfaProof = z.infer<typeof mfaProofSchema>;
 export declare const mfaVerifyBodySchema: z.ZodObject<{
     challenge_id: z.ZodString;
     client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
@@ -16,6 +94,61 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
         code: string;
         type: "totp";
         factor_id: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"webauthn">;
+        factor_id: z.ZodString;
+        assertion: z.ZodObject<{
+            id: z.ZodString;
+            rawId: z.ZodString;
+            response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+            authenticatorAttachment: z.ZodOptional<z.ZodString>;
+            clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+            type: z.ZodString;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            id: z.ZodString;
+            rawId: z.ZodString;
+            response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+            authenticatorAttachment: z.ZodOptional<z.ZodString>;
+            clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+            type: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            id: z.ZodString;
+            rawId: z.ZodString;
+            response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+            authenticatorAttachment: z.ZodOptional<z.ZodString>;
+            clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+            type: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">>;
+    }, "strict", z.ZodTypeAny, {
+        type: "webauthn";
+        factor_id: string;
+        assertion: {
+            type: string;
+            id: string;
+            rawId: string;
+            response: {} & {
+                [k: string]: unknown;
+            };
+            authenticatorAttachment?: string | undefined;
+            clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+    }, {
+        type: "webauthn";
+        factor_id: string;
+        assertion: {
+            type: string;
+            id: string;
+            rawId: string;
+            response: {} & {
+                [k: string]: unknown;
+            };
+            authenticatorAttachment?: string | undefined;
+            clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+        } & {
+            [k: string]: unknown;
+        };
     }>, z.ZodObject<{
         type: z.ZodLiteral<"recovery_code">;
         recovery_code: z.ZodString;
@@ -33,6 +166,21 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
         code: string;
         type: "totp";
         factor_id: string;
+    } | {
+        type: "webauthn";
+        factor_id: string;
+        assertion: {
+            type: string;
+            id: string;
+            rawId: string;
+            response: {} & {
+                [k: string]: unknown;
+            };
+            authenticatorAttachment?: string | undefined;
+            clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+        } & {
+            [k: string]: unknown;
+        };
     } | {
         type: "recovery_code";
         recovery_code: string;
@@ -44,6 +192,21 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
         code: string;
         type: "totp";
         factor_id: string;
+    } | {
+        type: "webauthn";
+        factor_id: string;
+        assertion: {
+            type: string;
+            id: string;
+            rawId: string;
+            response: {} & {
+                [k: string]: unknown;
+            };
+            authenticatorAttachment?: string | undefined;
+            clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+        } & {
+            [k: string]: unknown;
+        };
     } | {
         type: "recovery_code";
         recovery_code: string;
@@ -84,45 +247,48 @@ export type MfaVerifyEnrollmentBody = z.infer<typeof mfaVerifyEnrollmentBodySche
 export declare const mfaVerifyEnrollmentResponseSchema: z.ZodObject<{
     success: z.ZodLiteral<true>;
     recovery_codes: z.ZodArray<z.ZodString, "many">;
+    recovery_codes_issued: z.ZodBoolean;
 }, "strict", z.ZodTypeAny, {
     success: true;
     recovery_codes: string[];
+    recovery_codes_issued: boolean;
 }, {
     success: true;
     recovery_codes: string[];
+    recovery_codes_issued: boolean;
 }>;
 export type MfaVerifyEnrollmentResponse = z.infer<typeof mfaVerifyEnrollmentResponseSchema>;
 export declare const mfaFactorStatusResponseSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
     pending: z.ZodBoolean;
     factor_id: z.ZodOptional<z.ZodString>;
-    factor_type: z.ZodOptional<z.ZodEnum<["totp"]>>;
+    factor_type: z.ZodOptional<z.ZodEnum<["totp", "webauthn"]>>;
     verified_at: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     enabled: boolean;
     pending: boolean;
     factor_id?: string | undefined;
-    factor_type?: "totp" | undefined;
+    factor_type?: "totp" | "webauthn" | undefined;
     verified_at?: number | undefined;
 }, {
     enabled: boolean;
     pending: boolean;
     factor_id?: string | undefined;
-    factor_type?: "totp" | undefined;
+    factor_type?: "totp" | "webauthn" | undefined;
     verified_at?: number | undefined;
 }>;
 export type MfaFactorStatusResponse = z.infer<typeof mfaFactorStatusResponseSchema>;
 export declare const mfaEnrolledFactorSchema: z.ZodObject<{
     factor_id: z.ZodString;
-    factor_type: z.ZodEnum<["totp"]>;
+    factor_type: z.ZodEnum<["totp", "webauthn"]>;
     verified_at: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     factor_id: string;
-    factor_type: "totp";
+    factor_type: "totp" | "webauthn";
     verified_at?: number | undefined;
 }, {
     factor_id: string;
-    factor_type: "totp";
+    factor_type: "totp" | "webauthn";
     verified_at?: number | undefined;
 }>;
 export type MfaEnrolledFactor = z.infer<typeof mfaEnrolledFactorSchema>;
@@ -130,15 +296,15 @@ export declare const mfaStatusResponseSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
     factors: z.ZodArray<z.ZodObject<{
         factor_id: z.ZodString;
-        factor_type: z.ZodEnum<["totp"]>;
+        factor_type: z.ZodEnum<["totp", "webauthn"]>;
         verified_at: z.ZodOptional<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         verified_at?: number | undefined;
     }, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         verified_at?: number | undefined;
     }>, "many">;
     recovery_codes_remaining: z.ZodNumber;
@@ -146,7 +312,7 @@ export declare const mfaStatusResponseSchema: z.ZodObject<{
     enabled: boolean;
     factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         verified_at?: number | undefined;
     }[];
     recovery_codes_remaining: number;
@@ -154,7 +320,7 @@ export declare const mfaStatusResponseSchema: z.ZodObject<{
     enabled: boolean;
     factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         verified_at?: number | undefined;
     }[];
     recovery_codes_remaining: number;
@@ -182,29 +348,29 @@ export type MfaTotpProofBody = z.infer<typeof mfaTotpProofBodySchema>;
 export declare const mfaChallengeFactorsPayloadSchema: z.ZodObject<{
     available_factors: z.ZodArray<z.ZodObject<{
         factor_id: z.ZodString;
-        factor_type: z.ZodEnum<["totp"]>;
+        factor_type: z.ZodEnum<["totp", "webauthn"]>;
         last_used_at: z.ZodNullable<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }, {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }>, "many">;
     recovery_codes_available: z.ZodBoolean;
 }, "strict", z.ZodTypeAny, {
     available_factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }[];
     recovery_codes_available: boolean;
 }, {
     available_factors: {
         factor_id: string;
-        factor_type: "totp";
+        factor_type: "totp" | "webauthn";
         last_used_at: number | null;
     }[];
     recovery_codes_available: boolean;

package/dist/mfa/mfa-verify-body.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { appIdSchema } from "@schemavaults/app-definitions";
 import { availableMfaFactorSchema } from "../authenticate_result";
 import { mfaFactorTypeSchema } from "./mfa-factor-type";
+import { webauthnAuthenticationResponseSchema } from "./webauthn";
 export const totpCodeSchema = z
     .string()
     .regex(/^\d{6}$/u, "TOTP code must be exactly 6 digits");
@@ -9,22 +10,35 @@ export const recoveryCodeSchema = z
     .string()
     .min(8)
     .max(64);
+// The proof a user presents to satisfy an MFA gate. Shared between the
+// login second-factor exchange (POST /api/auth/mfa/verify) and step-up
+// authorization for destructive account actions (e.g. removing a passkey).
+// `totp`/`recovery_code` mirror the original v1 factors; `webauthn` carries
+// a passkey assertion bound to a server-issued challenge.
+export const mfaProofSchema = z.discriminatedUnion("type", [
+    z
+        .object({
+        type: z.literal("totp"),
+        factor_id: z.string().uuid(),
+        code: totpCodeSchema,
+    })
+        .strict(),
+    z
+        .object({
+        type: z.literal("webauthn"),
+        factor_id: z.string().uuid(),
+        assertion: webauthnAuthenticationResponseSchema,
+    })
+        .strict(),
+    z
+        .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
+        .strict(),
+]);
 export const mfaVerifyBodySchema = z
     .object({
     challenge_id: z.string().uuid(),
     client_app_id: appIdSchema,
-    proof: z.discriminatedUnion("type", [
-        z
-            .object({
-            type: z.literal("totp"),
-            factor_id: z.string().uuid(),
-            code: totpCodeSchema,
-        })
-            .strict(),
-        z
-            .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
-            .strict(),
-    ]),
+    proof: mfaProofSchema,
 })
     .strict();
 export const mfaEnrollResponseSchema = z
@@ -42,10 +56,19 @@ export const mfaVerifyEnrollmentBodySchema = z
     code: totpCodeSchema,
 })
     .strict();
+// Returned by both the TOTP and WebAuthn verify-enrollment endpoints after
+// a factor is confirmed. Recovery codes are an account-wide fallback issued
+// only when the user gains their *first* verified factor — enrolling a
+// second factor (e.g. a passkey on top of existing TOTP) must NOT rotate
+// the codes the user already saved. `recovery_codes_issued` tells the
+// client whether `recovery_codes` carries freshly minted codes to display
+// (true) or whether the existing codes still apply and the array is empty
+// (false).
 export const mfaVerifyEnrollmentResponseSchema = z
     .object({
     success: z.literal(true),
-    recovery_codes: z.array(recoveryCodeSchema).min(1),
+    recovery_codes: z.array(recoveryCodeSchema),
+    recovery_codes_issued: z.boolean(),
 })
     .strict();
 // Status of a single MFA factor type — returned by

package/dist/mfa/mfa-verify-body.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;YAC5B,IAAI,EAAE,cAAc;SACrB,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,mDAAmD;AACnD,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC5B,IAAI,EAAE,cAAc;KACrB,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC5B,SAAS,EAAE,oCAAoC;KAChD,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;SAC/E,MAAM,EAAE;CACZ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,cAAc;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,WAAW;AACX,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,mDAAmD;AACnD,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/mfa/webauthn.d.ts

@@ -0,0 +1,182 @@
+import { z } from "zod";
+export declare const webauthnRegistrationResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    type: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    type: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    type: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export type WebauthnRegistrationResponse = z.infer<typeof webauthnRegistrationResponseSchema>;
+export declare const webauthnAuthenticationResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    type: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    type: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    type: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export type WebauthnAuthenticationResponse = z.infer<typeof webauthnAuthenticationResponseSchema>;
+export declare const webauthnLabelSchema: z.ZodString;
+export declare const webauthnEnrollOptionsResponseSchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    options: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+}, "strict", z.ZodTypeAny, {
+    options: {} & {
+        [k: string]: unknown;
+    };
+    factor_id: string;
+}, {
+    options: {} & {
+        [k: string]: unknown;
+    };
+    factor_id: string;
+}>;
+export type WebauthnEnrollOptionsResponse = z.infer<typeof webauthnEnrollOptionsResponseSchema>;
+export declare const webauthnVerifyEnrollmentBodySchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    attestation: z.ZodObject<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+        clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+        type: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+        clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+        type: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+        clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+        type: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>;
+}, "strict", z.ZodTypeAny, {
+    factor_id: string;
+    attestation: {
+        type: string;
+        id: string;
+        rawId: string;
+        response: {} & {
+            [k: string]: unknown;
+        };
+        authenticatorAttachment?: string | undefined;
+        clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    label?: string | undefined;
+}, {
+    factor_id: string;
+    attestation: {
+        type: string;
+        id: string;
+        rawId: string;
+        response: {} & {
+            [k: string]: unknown;
+        };
+        authenticatorAttachment?: string | undefined;
+        clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    label?: string | undefined;
+}>;
+export type WebauthnVerifyEnrollmentBody = z.infer<typeof webauthnVerifyEnrollmentBodySchema>;
+export declare const webauthnAuthenticationOptionsResponseSchema: z.ZodObject<{
+    options: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+}, "strict", z.ZodTypeAny, {
+    options: {} & {
+        [k: string]: unknown;
+    };
+}, {
+    options: {} & {
+        [k: string]: unknown;
+    };
+}>;
+export type WebauthnAuthenticationOptionsResponse = z.infer<typeof webauthnAuthenticationOptionsResponseSchema>;
+export declare const webauthnCredentialSummarySchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    label: z.ZodNullable<z.ZodString>;
+    created_at: z.ZodNumber;
+    last_used_at: z.ZodNullable<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    factor_id: string;
+    last_used_at: number | null;
+    created_at: number;
+    label: string | null;
+}, {
+    factor_id: string;
+    last_used_at: number | null;
+    created_at: number;
+    label: string | null;
+}>;
+export type WebauthnCredentialSummary = z.infer<typeof webauthnCredentialSummarySchema>;
+export declare const webauthnCredentialListResponseSchema: z.ZodObject<{
+    credentials: z.ZodArray<z.ZodObject<{
+        factor_id: z.ZodString;
+        label: z.ZodNullable<z.ZodString>;
+        created_at: z.ZodNumber;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        factor_id: string;
+        last_used_at: number | null;
+        created_at: number;
+        label: string | null;
+    }, {
+        factor_id: string;
+        last_used_at: number | null;
+        created_at: number;
+        label: string | null;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    credentials: {
+        factor_id: string;
+        last_used_at: number | null;
+        created_at: number;
+        label: string | null;
+    }[];
+}, {
+    credentials: {
+        factor_id: string;
+        last_used_at: number | null;
+        created_at: number;
+        label: string | null;
+    }[];
+}>;
+export type WebauthnCredentialListResponse = z.infer<typeof webauthnCredentialListResponseSchema>;

package/dist/mfa/webauthn.js

@@ -0,0 +1,81 @@
+import { z } from "zod";
+// WebAuthn ceremony payloads exchanged between the browser and the auth
+// server. The browser uses @simplewebauthn/browser to produce these and
+// the server uses @simplewebauthn/server to verify them; the heavy lifting
+// (signature checks, challenge binding, RP-ID/origin validation) lives in
+// those libraries. These schemas therefore only assert that the payloads
+// are structurally well-formed JSON of the expected shape — verification is
+// delegated, not duplicated here. `.passthrough()` keeps forward-compat with
+// fields newer @simplewebauthn versions may add.
+// Mirrors @simplewebauthn/browser's RegistrationResponseJSON.
+export const webauthnRegistrationResponseSchema = z
+    .object({
+    id: z.string().min(1),
+    rawId: z.string().min(1),
+    response: z.object({}).passthrough(),
+    authenticatorAttachment: z.string().optional(),
+    clientExtensionResults: z.object({}).passthrough().optional(),
+    type: z.string().min(1),
+})
+    .passthrough();
+// Mirrors @simplewebauthn/browser's AuthenticationResponseJSON.
+export const webauthnAuthenticationResponseSchema = z
+    .object({
+    id: z.string().min(1),
+    rawId: z.string().min(1),
+    response: z.object({}).passthrough(),
+    authenticatorAttachment: z.string().optional(),
+    clientExtensionResults: z.object({}).passthrough().optional(),
+    type: z.string().min(1),
+})
+    .passthrough();
+// Optional human-friendly label a user may give a passkey ("MacBook
+// Touch ID", "YubiKey 5C"). Kept short and trimmed.
+export const webauthnLabelSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(64);
+// Response from POST /api/user/mfa/webauthn/options — the server-issued
+// PublicKeyCredentialCreationOptionsJSON plus the pending factor_id the
+// enrollment will be confirmed against.
+export const webauthnEnrollOptionsResponseSchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    // PublicKeyCredentialCreationOptionsJSON — opaque to us, handed to the
+    // browser verbatim.
+    options: z.object({}).passthrough(),
+})
+    .strict();
+// Body for POST /api/user/mfa/webauthn/verify-enrollment.
+export const webauthnVerifyEnrollmentBodySchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    label: webauthnLabelSchema.optional(),
+    attestation: webauthnRegistrationResponseSchema,
+})
+    .strict();
+// Response from POST /api/auth/mfa/webauthn/options — the server-issued
+// PublicKeyCredentialRequestOptionsJSON for an in-flight login challenge.
+export const webauthnAuthenticationOptionsResponseSchema = z
+    .object({
+    // PublicKeyCredentialRequestOptionsJSON — opaque to us.
+    options: z.object({}).passthrough(),
+})
+    .strict();
+// A single enrolled passkey as surfaced to the account settings UI.
+export const webauthnCredentialSummarySchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    label: z.string().nullable(),
+    created_at: z.number().int().positive(),
+    last_used_at: z.number().int().positive().nullable(),
+})
+    .strict();
+// Response from GET /api/user/mfa/webauthn — the user's enrolled passkeys.
+export const webauthnCredentialListResponseSchema = z
+    .object({
+    credentials: z.array(webauthnCredentialSummarySchema),
+})
+    .strict();
+//# sourceMappingURL=webauthn.js.map

package/dist/mfa/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/mfa/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,iDAAiD;AAEjD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,WAAW,EAAE,CAAC;AAMjB,gEAAgE;AAChE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,WAAW,EAAE,CAAC;AAMjB,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,wEAAwE;AACxE,wEAAwE;AACxE,wCAAwC;AACxC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,uEAAuE;IACvE,oBAAoB;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,kCAAkC;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC;KACzD,MAAM,CAAC;IACN,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.12.15",
+  "version": "0.13.0",
   "license": "UNLICENSED",
   "private": false,
   "repository": {