@schemavaults/auth-common 0.12.9 → 0.12.15

package/dist/auth-error-message-catalog.d.ts

@@ -1,4 +1,4 @@
-declare const ERROR_IDS: readonly ["unknown", "bad_request", "app_id_not_found", "api_server_id_not_found", "unauthenticated", "forbidden", "account_disabled", "load_user_data_failure", "internal_server_error", "load_server_config_failure", "server_misconfiguration", "account_not_in_organization", "pkce_challenge_expired"];
+declare const ERROR_IDS: readonly ["unknown", "bad_request", "app_id_not_found", "api_server_id_not_found", "unauthenticated", "forbidden", "account_disabled", "load_user_data_failure", "internal_server_error", "load_server_config_failure", "server_misconfiguration", "account_not_in_organization", "pkce_challenge_expired", "invalid_redirect_uri"];
 export type SchemaVaultsAuthErrorId = (typeof ERROR_IDS)[number];
 export declare const ERROR_MESSAGE_CATALOG: Record<SchemaVaultsAuthErrorId, string>;
 export declare function isValidErrorId(id: string): id is SchemaVaultsAuthErrorId;

package/dist/auth-error-message-catalog.js

@@ -12,6 +12,7 @@ const ERROR_IDS = [
     "server_misconfiguration",
     "account_not_in_organization",
     "pkce_challenge_expired",
+    "invalid_redirect_uri",
 ];
 export const ERROR_MESSAGE_CATALOG = {
     unknown: "An unknown error occurred",
@@ -27,6 +28,7 @@ export const ERROR_MESSAGE_CATALOG = {
     server_misconfiguration: "The server does not appear to be configured properly. If you are the site admin, please see the logs for more details.",
     account_not_in_organization: "Your account is not a member of the organization required for the attempted action.",
     pkce_challenge_expired: "Your authorization session has expired. Please return to the requesting application and try again.",
+    invalid_redirect_uri: "The redirect URI presented by the requesting application is not registered for it. For your safety, login has been blocked.",
 };
 export function isValidErrorId(id) {
     return ERROR_IDS.includes(id);

package/dist/auth-error-message-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;CACY,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;CACvG,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;IACxB,sBAAsB;CACc,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;IACtG,oBAAoB,EAClB,6HAA6H;CAChI,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}

package/dist/auth_acquire_tokens_grant_types.d.ts

@@ -7,6 +7,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
     client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
     grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strict", z.ZodTypeAny, {
     code: string;
     challenge_time: number;
@@ -14,6 +15,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     audience: string | string[];
     client_app_id: string;
     grant_type: "authorization_code";
+    redirect_uri?: string | null | undefined;
 }, {
     code: string;
     challenge_time: number;
@@ -21,6 +23,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     audience: string | string[];
     client_app_id: string;
     grant_type: "authorization_code";
+    redirect_uri?: string | null | undefined;
 }>;
 export declare const refreshTokenPOSTbody: z.ZodObject<{
     audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
@@ -46,6 +49,7 @@ export declare const grantTypePOSTbodySchemaMap: {
         audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
         client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
         grant_type: z.ZodLiteral<"authorization_code">;
+        redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
         code: string;
         challenge_time: number;
@@ -53,6 +57,7 @@ export declare const grantTypePOSTbodySchemaMap: {
         audience: string | string[];
         client_app_id: string;
         grant_type: "authorization_code";
+        redirect_uri?: string | null | undefined;
     }, {
         code: string;
         challenge_time: number;
@@ -60,6 +65,7 @@ export declare const grantTypePOSTbodySchemaMap: {
         audience: string | string[];
         client_app_id: string;
         grant_type: "authorization_code";
+        redirect_uri?: string | null | undefined;
     }>;
     readonly refresh_token: z.ZodObject<{
         audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;

package/dist/auth_acquire_tokens_grant_types.js

@@ -20,6 +20,14 @@ export const authorizationCodePOSTbody = _createTokenEndpointBaseSchema
         .refine((value) => /^[A-Za-z0-9_-]+$/.test(value)),
     code_verifier: PKCE_ProofKeyManager.codeChallengeSchema,
     challenge_time: z.number().nonnegative(),
+    // OAuth2 `redirect_uri` (RFC 6749 §4.1.3) bound to the issued
+    // authorization code. The token endpoint verifies this matches the
+    // value persisted on the authorization_codes row by exact string
+    // equality, so a code minted for URI A cannot be redeemed by
+    // presenting URI B even when both share an allowlisted origin.
+    // Null/absent is reserved for the auth server's own account flow,
+    // which has no third-party callback.
+    redirect_uri: z.string().url().nullable().optional(),
 })
     .required({
     grant_type: true,

package/dist/auth_acquire_tokens_grant_types.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}
+{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACxC,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,6DAA6D;IAC7D,+DAA+D;IAC/D,kEAAkE;IAClE,qCAAqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}

package/dist/authenticate_result.d.ts

@@ -1,4 +1,18 @@
 import { z } from "zod";
+export declare const availableMfaFactorSchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    factor_type: z.ZodEnum<["totp"]>;
+    last_used_at: z.ZodNullable<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    factor_id: string;
+    factor_type: "totp";
+    last_used_at: number | null;
+}, {
+    factor_id: string;
+    factor_type: "totp";
+    last_used_at: number | null;
+}>;
+export type AvailableMfaFactor = z.infer<typeof availableMfaFactorSchema>;
 export declare const authenticatedAuthenticateResultSchema: z.ZodObject<{
     kind: z.ZodLiteral<"authenticated">;
     success: z.ZodBoolean;
@@ -22,18 +36,44 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
     message: z.ZodString;
     challenge_id: z.ZodString;
     expires_at: z.ZodNumber;
+    available_factors: z.ZodArray<z.ZodObject<{
+        factor_id: z.ZodString;
+        factor_type: z.ZodEnum<["totp"]>;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }, {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }>, "many">;
+    recovery_codes_available: z.ZodBoolean;
 }, "strict", z.ZodTypeAny, {
     message: string;
     expires_at: number;
     kind: "mfa_required";
     success: boolean;
     challenge_id: string;
+    available_factors: {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }[];
+    recovery_codes_available: boolean;
 }, {
     message: string;
     expires_at: number;
     kind: "mfa_required";
     success: boolean;
     challenge_id: string;
+    available_factors: {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }[];
+    recovery_codes_available: boolean;
 }>;
 export type MfaRequiredAuthenticateResult = z.infer<typeof mfaRequiredAuthenticateResultSchema>;
 export declare const authenticateFailureResultSchema: z.ZodObject<{
@@ -85,18 +125,44 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
     message: z.ZodString;
     challenge_id: z.ZodString;
     expires_at: z.ZodNumber;
+    available_factors: z.ZodArray<z.ZodObject<{
+        factor_id: z.ZodString;
+        factor_type: z.ZodEnum<["totp"]>;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }, {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }>, "many">;
+    recovery_codes_available: z.ZodBoolean;
 }, "strict", z.ZodTypeAny, {
     message: string;
     expires_at: number;
     kind: "mfa_required";
     success: boolean;
     challenge_id: string;
+    available_factors: {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }[];
+    recovery_codes_available: boolean;
 }, {
     message: string;
     expires_at: number;
     kind: "mfa_required";
     success: boolean;
     challenge_id: string;
+    available_factors: {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }[];
+    recovery_codes_available: boolean;
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"failure">;
     success: z.ZodBoolean;

package/dist/authenticate_result.js

@@ -1,4 +1,12 @@
 import { z } from "zod";
+import { mfaFactorTypeSchema } from "./mfa/mfa-factor-type";
+export const availableMfaFactorSchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    factor_type: mfaFactorTypeSchema,
+    last_used_at: z.number().int().positive().nullable(),
+})
+    .strict();
 export const authenticatedAuthenticateResultSchema = z
     .object({
     kind: z.literal("authenticated"),
@@ -16,6 +24,8 @@ export const mfaRequiredAuthenticateResultSchema = z
     message: z.string(),
     challenge_id: z.string().uuid(),
     expires_at: z.number().int().positive(),
+    available_factors: z.array(availableMfaFactorSchema),
+    recovery_codes_available: z.boolean(),
 })
     .strict();
 export const authenticateFailureResultSchema = z

package/dist/authenticate_result.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}
+{"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export * from "./middleware";
 export type * from "./middleware";
 export * from "./pkce";
 export type * from "./pkce";
-export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, } from "./authenticate_result";
+export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
 export * from "./mfa";
 export { requestTokensResultSchema, type RequestTokensResult, successfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";

package/dist/index.js

@@ -5,7 +5,7 @@ export * from "./credentials";
 export * from "./token-data";
 export * from "./middleware";
 export * from "./pkce";
-export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, } from "./authenticate_result";
+export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, } from "./authenticate_result";
 export * from "./mfa";
 export { requestTokensResultSchema, successfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,GAMzC,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,GAOzB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/mfa/index.d.ts

@@ -1,3 +1,3 @@
 export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, type MfaFactorType, } from "./mfa-factor-type";
 export { mfaChallengeSchema, type MfaChallengeDescriptor, } from "./mfa-challenge";
-export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaCodeOnlyBody, } from "./mfa-verify-body";
+export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaFactorStatusResponse, type MfaEnrolledFactor, type MfaCodeOnlyBody, type MfaTotpProofBody, type MfaChallengeFactorsPayload, } from "./mfa-verify-body";

package/dist/mfa/index.js

@@ -1,4 +1,4 @@
 export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, } from "./mfa-factor-type";
 export { mfaChallengeSchema, } from "./mfa-challenge";
-export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, } from "./mfa-verify-body";
+export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, } from "./mfa-verify-body";
 //# sourceMappingURL=index.js.map

package/dist/mfa/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,qBAAqB,GAOtB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GAWjC,MAAM,mBAAmB,CAAC"}

package/dist/mfa/mfa-verify-body.d.ts

@@ -6,13 +6,16 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
     client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
     proof: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         type: z.ZodLiteral<"totp">;
+        factor_id: z.ZodString;
         code: z.ZodString;
     }, "strict", z.ZodTypeAny, {
         code: string;
         type: "totp";
+        factor_id: string;
     }, {
         code: string;
         type: "totp";
+        factor_id: string;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"recovery_code">;
         recovery_code: z.ZodString;
@@ -29,6 +32,7 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
     proof: {
         code: string;
         type: "totp";
+        factor_id: string;
     } | {
         type: "recovery_code";
         recovery_code: string;
@@ -39,6 +43,7 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
     proof: {
         code: string;
         type: "totp";
+        factor_id: string;
     } | {
         type: "recovery_code";
         recovery_code: string;
@@ -87,24 +92,72 @@ export declare const mfaVerifyEnrollmentResponseSchema: z.ZodObject<{
     recovery_codes: string[];
 }>;
 export type MfaVerifyEnrollmentResponse = z.infer<typeof mfaVerifyEnrollmentResponseSchema>;
-export declare const mfaStatusResponseSchema: z.ZodObject<{
+export declare const mfaFactorStatusResponseSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
+    pending: z.ZodBoolean;
     factor_id: z.ZodOptional<z.ZodString>;
-    factor_type: z.ZodOptional<z.ZodLiteral<"totp">>;
+    factor_type: z.ZodOptional<z.ZodEnum<["totp"]>>;
     verified_at: z.ZodOptional<z.ZodNumber>;
-    recovery_codes_remaining: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     enabled: boolean;
+    pending: boolean;
     factor_id?: string | undefined;
     factor_type?: "totp" | undefined;
     verified_at?: number | undefined;
-    recovery_codes_remaining?: number | undefined;
 }, {
     enabled: boolean;
+    pending: boolean;
     factor_id?: string | undefined;
     factor_type?: "totp" | undefined;
     verified_at?: number | undefined;
-    recovery_codes_remaining?: number | undefined;
+}>;
+export type MfaFactorStatusResponse = z.infer<typeof mfaFactorStatusResponseSchema>;
+export declare const mfaEnrolledFactorSchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    factor_type: z.ZodEnum<["totp"]>;
+    verified_at: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    factor_id: string;
+    factor_type: "totp";
+    verified_at?: number | undefined;
+}, {
+    factor_id: string;
+    factor_type: "totp";
+    verified_at?: number | undefined;
+}>;
+export type MfaEnrolledFactor = z.infer<typeof mfaEnrolledFactorSchema>;
+export declare const mfaStatusResponseSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    factors: z.ZodArray<z.ZodObject<{
+        factor_id: z.ZodString;
+        factor_type: z.ZodEnum<["totp"]>;
+        verified_at: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        factor_id: string;
+        factor_type: "totp";
+        verified_at?: number | undefined;
+    }, {
+        factor_id: string;
+        factor_type: "totp";
+        verified_at?: number | undefined;
+    }>, "many">;
+    recovery_codes_remaining: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    factors: {
+        factor_id: string;
+        factor_type: "totp";
+        verified_at?: number | undefined;
+    }[];
+    recovery_codes_remaining: number;
+}, {
+    enabled: boolean;
+    factors: {
+        factor_id: string;
+        factor_type: "totp";
+        verified_at?: number | undefined;
+    }[];
+    recovery_codes_remaining: number;
 }>;
 export type MfaStatusResponse = z.infer<typeof mfaStatusResponseSchema>;
 export declare const mfaCodeOnlyBodySchema: z.ZodObject<{
@@ -115,3 +168,45 @@ export declare const mfaCodeOnlyBodySchema: z.ZodObject<{
     code: string;
 }>;
 export type MfaCodeOnlyBody = z.infer<typeof mfaCodeOnlyBodySchema>;
+export declare const mfaTotpProofBodySchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    factor_id: string;
+}, {
+    code: string;
+    factor_id: string;
+}>;
+export type MfaTotpProofBody = z.infer<typeof mfaTotpProofBodySchema>;
+export declare const mfaChallengeFactorsPayloadSchema: z.ZodObject<{
+    available_factors: z.ZodArray<z.ZodObject<{
+        factor_id: z.ZodString;
+        factor_type: z.ZodEnum<["totp"]>;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }, {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }>, "many">;
+    recovery_codes_available: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    available_factors: {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }[];
+    recovery_codes_available: boolean;
+}, {
+    available_factors: {
+        factor_id: string;
+        factor_type: "totp";
+        last_used_at: number | null;
+    }[];
+    recovery_codes_available: boolean;
+}>;
+export type MfaChallengeFactorsPayload = z.infer<typeof mfaChallengeFactorsPayloadSchema>;

package/dist/mfa/mfa-verify-body.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
 import { appIdSchema } from "@schemavaults/app-definitions";
+import { availableMfaFactorSchema } from "../authenticate_result";
+import { mfaFactorTypeSchema } from "./mfa-factor-type";
 export const totpCodeSchema = z
     .string()
     .regex(/^\d{6}$/u, "TOTP code must be exactly 6 digits");
@@ -12,7 +14,13 @@ export const mfaVerifyBodySchema = z
     challenge_id: z.string().uuid(),
     client_app_id: appIdSchema,
     proof: z.discriminatedUnion("type", [
-        z.object({ type: z.literal("totp"), code: totpCodeSchema }).strict(),
+        z
+            .object({
+            type: z.literal("totp"),
+            factor_id: z.string().uuid(),
+            code: totpCodeSchema,
+        })
+            .strict(),
         z
             .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
             .strict(),
@@ -40,13 +48,39 @@ export const mfaVerifyEnrollmentResponseSchema = z
     recovery_codes: z.array(recoveryCodeSchema).min(1),
 })
     .strict();
-export const mfaStatusResponseSchema = z
+// Status of a single MFA factor type — returned by
+// GET /api/user/mfa/status/[factor_type]. `enabled` means a verified,
+// active factor of that type exists; `pending` means an enrollment is in
+// progress (an unverified factor exists but hasn't been confirmed yet).
+// The two are mutually exclusive. When neither is set the user has no
+// factor of that type. `factor_id`/`factor_type` are present whenever a
+// factor row exists (verified or pending); `verified_at` only when enabled.
+export const mfaFactorStatusResponseSchema = z
     .object({
     enabled: z.boolean(),
+    pending: z.boolean(),
     factor_id: z.string().uuid().optional(),
-    factor_type: z.literal("totp").optional(),
+    factor_type: mfaFactorTypeSchema.optional(),
     verified_at: z.number().int().positive().optional(),
-    recovery_codes_remaining: z.number().int().nonnegative().optional(),
+})
+    .strict();
+// A single verified factor in the account-wide MFA status list.
+export const mfaEnrolledFactorSchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    factor_type: mfaFactorTypeSchema,
+    verified_at: z.number().int().positive().optional(),
+})
+    .strict();
+// Account-wide MFA status — returned by GET /api/user/mfa/status. Lists
+// every verified factor rather than collapsing to a single one, plus the
+// account-wide recovery-code count. `enabled` is a convenience mirror of
+// `factors.length > 0`.
+export const mfaStatusResponseSchema = z
+    .object({
+    enabled: z.boolean(),
+    factors: z.array(mfaEnrolledFactorSchema),
+    recovery_codes_remaining: z.number().int().nonnegative(),
 })
     .strict();
 export const mfaCodeOnlyBodySchema = z
@@ -54,4 +88,25 @@ export const mfaCodeOnlyBodySchema = z
     code: totpCodeSchema,
 })
     .strict();
+// Authorize an action with a TOTP code from a specific factor. The caller
+// names which factor the code belongs to so the server verifies against
+// exactly that factor (one targeted lookup) instead of trying every
+// enrolled factor's secret in turn.
+export const mfaTotpProofBodySchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    code: totpCodeSchema,
+})
+    .strict();
+// Shape of the MFA challenge factor list that the login form stashes in
+// sessionStorage (keyed by challenge_id) so the downstream MFA challenge
+// page can render the factor picker without a second server round-trip.
+// Mirrors the `available_factors` + `recovery_codes_available` fields the
+// server already includes in the `mfa_required` login response.
+export const mfaChallengeFactorsPayloadSchema = z
+    .object({
+    available_factors: z.array(availableMfaFactorSchema),
+    recovery_codes_available: z.boolean(),
+})
+    .strict();
 //# sourceMappingURL=mfa-verify-body.js.map

package/dist/mfa/mfa-verify-body.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACpE,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;YAC5B,IAAI,EAAE,cAAc;SACrB,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,mDAAmD;AACnD,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.12.9",
+  "version": "0.12.15",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -30,7 +30,7 @@
     "typescript": "5.8.3",
     "tsc-alias": "1.8.16",
     "@types/crypto-js": "4.2.0",
-    "bun-types": "1.3.11",
+    "bun-types": "1.3.14",
     "eslint": "9.39.1",
     "@eslint/js": "9.39.1",
     "globals": "16.5.0",
@@ -40,7 +40,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "packageManager": "bun@1.3.11",
+  "packageManager": "bun@1.3.14",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",