@seamless-auth/types 0.31.0 → 0.32.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @seamless-auth/types
 
+## 0.32.0
+
+### Minor Changes
+
+- cf2de06: Shared schemas for the rest of the v0.20 account recovery contract, and a recovery flag on `/users/me`.
+  
+  - `AccountRecoveryRequestSchema` and `AccountRecoveryRequestsResponseSchema` for `GET /recovery/requests`, and `AccountRecoveryRequestIdParamSchema` for `DELETE /recovery/requests/:id`.
+  - `AccountRecoveryVerifyResponseSchema`: the status plus the optional `deliveries` returned to a server that owns delivery.
+  - `RecoveryErrorCodeSchema`, the `error` values the recovery code and account recovery routes answer with.
+  - `MeResponseSchema` gains optional `recovery`, true for a recovery session, so a cookie client can tell after a reload that the user still has to enroll a factor.
+
 ## 0.31.0
 
 ### Minor Changes

package/dist/schemas/me/schema.d.ts

@@ -102,6 +102,7 @@ export declare const MeResponseSchema: z.ZodObject<{
         memberCount: z.ZodOptional<z.ZodNumber>;
         retiredOAuthProviders: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
+    recovery: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type MeResponse = z.infer<typeof MeResponseSchema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schemas/me/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/me/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAOvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,sCAAsC;AACtC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/me/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAOvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,sCAAsC;AACtC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/schemas/me/schema.js

@@ -20,5 +20,11 @@ export const MeResponseSchema = z.object({
     credentials: z.array(CredentialResponseSchema),
     organizations: z.array(OrganizationSchema).optional(),
     activeOrganization: OrganizationSchema.nullable().optional(),
+    /**
+     * True for a recovery session, from account recovery or a recovery code: it can only
+     * enroll a new passkey or authenticator app until one is enrolled. A cookie client
+     * cannot read its access token, so this is how it learns that after a reload.
+     */
+    recovery: z.boolean().optional(),
 });
 //# sourceMappingURL=schema.js.map

package/dist/schemas/me/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/me/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/me/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC"}

package/dist/schemas/recovery/schema.d.ts

@@ -149,8 +149,126 @@ export declare const AccountRecoveryStatusSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type AccountRecoveryStatus = z.infer<typeof AccountRecoveryStatusSchema>;
 /**
- * `POST /recovery/cancel`. Either the token from the notice sent to the other
- * channels, or no body with an access session for the account.
+ * `POST /recovery/verify`. `deliveries` carries the "recovery opened" notices only for a
+ * credentialed caller that owns delivery and names their kinds in
+ * `x-seamless-auth-delivery-kinds`; each can hold a cancel link for the owner alone.
+ */
+export declare const AccountRecoveryVerifyResponseSchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        completed: "completed";
+        pending: "pending";
+        ready: "ready";
+        cancelled: "cancelled";
+    }>;
+    requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    deliveries: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"otp_email">;
+        to: z.ZodString;
+        token: z.ZodString;
+        purpose: z.ZodOptional<z.ZodEnum<{
+            account_recovery: "account_recovery";
+        }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"otp_sms">;
+        to: z.ZodString;
+        token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        purpose: z.ZodOptional<z.ZodEnum<{
+            account_recovery: "account_recovery";
+        }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"magic_link_email">;
+        to: z.ZodString;
+        token: z.ZodOptional<z.ZodString>;
+        magicLinkUrl: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"enrollment_invite_email">;
+        to: z.ZodString;
+        signInUrl: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_notice_email">;
+        notice: z.ZodEnum<{
+            account_recovery_completed: "account_recovery_completed";
+            recovery_code_used: "recovery_code_used";
+            account_recovery_opened: "account_recovery_opened";
+            identity_changed: "identity_changed";
+        }>;
+        to: z.ZodString;
+        subject: z.ZodString;
+        text: z.ZodString;
+        cancelUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_notice_sms">;
+        notice: z.ZodEnum<{
+            account_recovery_completed: "account_recovery_completed";
+            recovery_code_used: "recovery_code_used";
+            account_recovery_opened: "account_recovery_opened";
+            identity_changed: "identity_changed";
+        }>;
+        to: z.ZodString;
+        text: z.ZodString;
+        cancelUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "kind">>>;
+}, z.core.$strip>;
+export type AccountRecoveryVerifyResponse = z.infer<typeof AccountRecoveryVerifyResponseSchema>;
+/** One open request, as `GET /recovery/requests` lists it for the signed-in owner. */
+export declare const AccountRecoveryRequestSchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        completed: "completed";
+        pending: "pending";
+        ready: "ready";
+        cancelled: "cancelled";
+    }>;
+    requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    id: z.ZodString;
+    channel: z.ZodEnum<{
+        email: "email";
+        phone: "phone";
+    }>;
+}, z.core.$strip>;
+export type AccountRecoveryRequest = z.infer<typeof AccountRecoveryRequestSchema>;
+export declare const AccountRecoveryRequestsResponseSchema: z.ZodObject<{
+    requests: z.ZodArray<z.ZodObject<{
+        state: z.ZodEnum<{
+            completed: "completed";
+            pending: "pending";
+            ready: "ready";
+            cancelled: "cancelled";
+        }>;
+        requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        id: z.ZodString;
+        channel: z.ZodEnum<{
+            email: "email";
+            phone: "phone";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AccountRecoveryRequestsResponse = z.infer<typeof AccountRecoveryRequestsResponseSchema>;
+/** `DELETE /recovery/requests/:id`. */
+export declare const AccountRecoveryRequestIdParamSchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export type AccountRecoveryRequestIdParam = z.infer<typeof AccountRecoveryRequestIdParamSchema>;
+/**
+ * The `error` values the recovery code and account recovery routes answer with, so a
+ * client can tell them apart without matching strings of its own.
+ */
+export declare const RecoveryErrorCodeSchema: z.ZodEnum<{
+    invalid_recovery_code: "invalid_recovery_code";
+    recovery_codes_disabled: "recovery_codes_disabled";
+    cancel_token_required: "cancel_token_required";
+    recovery_notice_failed: "recovery_notice_failed";
+    account_recovery_disabled: "account_recovery_disabled";
+    recovery_not_found: "recovery_not_found";
+    recovery_not_ready: "recovery_not_ready";
+    enrollment_required: "enrollment_required";
+}>;
+export type RecoveryErrorCode = z.infer<typeof RecoveryErrorCodeSchema>;
+/**
+ * `POST /recovery/cancel` with the token from the "recovery opened" notice. A signed-in
+ * owner cancels without it through `DELETE /recovery/requests/:id`.
  */
 export declare const AccountRecoveryCancelRequestSchema: z.ZodObject<{
     cancelToken: z.ZodOptional<z.ZodString>;

package/dist/schemas/recovery/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAGiD,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAA6B,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,kFAAkF;AAClF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,0BAA0B;;;;;EAAyD,CAAC;AAEjG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAGiD,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAA6B,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,kFAAkF;AAClF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,0BAA0B;;;;;EAAyD,CAAC;AAEjG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,sFAAsF;AACtF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;iBAEhD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,uCAAuC;AACvC,eAAO,MAAM,mCAAmC;;iBAAsC,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;EASlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}

package/dist/schemas/recovery/schema.js

@@ -72,8 +72,40 @@ export const AccountRecoveryStatusSchema = z.object({
     completesAt: IsoDate,
 });
 /**
- * `POST /recovery/cancel`. Either the token from the notice sent to the other
- * channels, or no body with an access session for the account.
+ * `POST /recovery/verify`. `deliveries` carries the "recovery opened" notices only for a
+ * credentialed caller that owns delivery and names their kinds in
+ * `x-seamless-auth-delivery-kinds`; each can hold a cancel link for the owner alone.
+ */
+export const AccountRecoveryVerifyResponseSchema = AccountRecoveryStatusSchema.extend({
+    deliveries: z.array(AuthDeliverySchema).optional(),
+});
+/** One open request, as `GET /recovery/requests` lists it for the signed-in owner. */
+export const AccountRecoveryRequestSchema = AccountRecoveryStatusSchema.extend({
+    id: z.string().uuid(),
+    channel: AccountRecoveryChannelSchema,
+});
+export const AccountRecoveryRequestsResponseSchema = z.object({
+    requests: z.array(AccountRecoveryRequestSchema),
+});
+/** `DELETE /recovery/requests/:id`. */
+export const AccountRecoveryRequestIdParamSchema = z.object({ id: z.string().uuid() });
+/**
+ * The `error` values the recovery code and account recovery routes answer with, so a
+ * client can tell them apart without matching strings of its own.
+ */
+export const RecoveryErrorCodeSchema = z.enum([
+    'invalid_recovery_code',
+    'recovery_codes_disabled',
+    'cancel_token_required',
+    'recovery_notice_failed',
+    'account_recovery_disabled',
+    'recovery_not_found',
+    'recovery_not_ready',
+    'enrollment_required',
+]);
+/**
+ * `POST /recovery/cancel` with the token from the "recovery opened" notice. A signed-in
+ * owner cancels without it through `DELETE /recovery/requests/:id`.
  */
 export const AccountRecoveryCancelRequestSchema = z.object({
     cancelToken: z.string().trim().min(1).optional(),

package/dist/schemas/recovery/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAIjF,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,kBAAkB;CACzB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC7E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAIvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC;CACvD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAIjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;CACrB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAIjF,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,kBAAkB;CACzB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC7E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAIvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC;CACvD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAIjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;CACrB,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,2BAA2B,CAAC,MAAM,CAAC;IACpF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAIH,sFAAsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC,MAAM,CAAC;IAC7E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,OAAO,EAAE,4BAA4B;CACtC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;CAChD,CAAC,CAAC;AAIH,uCAAuC;AACvC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAIvF;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,uBAAuB;IACvB,yBAAyB;IACzB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "Apache-2.0",

package/src/schemas/me/schema.ts

@@ -27,6 +27,12 @@ export const MeResponseSchema = z.object({
   credentials: z.array(CredentialResponseSchema),
   organizations: z.array(OrganizationSchema).optional(),
   activeOrganization: OrganizationSchema.nullable().optional(),
+  /**
+   * True for a recovery session, from account recovery or a recovery code: it can only
+   * enroll a new passkey or authenticator app until one is enrolled. A cookie client
+   * cannot read its access token, so this is how it learns that after a reload.
+   */
+  recovery: z.boolean().optional(),
 });
 
 export type MeResponse = z.infer<typeof MeResponseSchema>;

package/src/schemas/recovery/schema.ts

@@ -107,8 +107,55 @@ export const AccountRecoveryStatusSchema = z.object({
 export type AccountRecoveryStatus = z.infer<typeof AccountRecoveryStatusSchema>;
 
 /**
- * `POST /recovery/cancel`. Either the token from the notice sent to the other
- * channels, or no body with an access session for the account.
+ * `POST /recovery/verify`. `deliveries` carries the "recovery opened" notices only for a
+ * credentialed caller that owns delivery and names their kinds in
+ * `x-seamless-auth-delivery-kinds`; each can hold a cancel link for the owner alone.
+ */
+export const AccountRecoveryVerifyResponseSchema = AccountRecoveryStatusSchema.extend({
+  deliveries: z.array(AuthDeliverySchema).optional(),
+});
+
+export type AccountRecoveryVerifyResponse = z.infer<typeof AccountRecoveryVerifyResponseSchema>;
+
+/** One open request, as `GET /recovery/requests` lists it for the signed-in owner. */
+export const AccountRecoveryRequestSchema = AccountRecoveryStatusSchema.extend({
+  id: z.string().uuid(),
+  channel: AccountRecoveryChannelSchema,
+});
+
+export type AccountRecoveryRequest = z.infer<typeof AccountRecoveryRequestSchema>;
+
+export const AccountRecoveryRequestsResponseSchema = z.object({
+  requests: z.array(AccountRecoveryRequestSchema),
+});
+
+export type AccountRecoveryRequestsResponse = z.infer<typeof AccountRecoveryRequestsResponseSchema>;
+
+/** `DELETE /recovery/requests/:id`. */
+export const AccountRecoveryRequestIdParamSchema = z.object({ id: z.string().uuid() });
+
+export type AccountRecoveryRequestIdParam = z.infer<typeof AccountRecoveryRequestIdParamSchema>;
+
+/**
+ * The `error` values the recovery code and account recovery routes answer with, so a
+ * client can tell them apart without matching strings of its own.
+ */
+export const RecoveryErrorCodeSchema = z.enum([
+  'invalid_recovery_code',
+  'recovery_codes_disabled',
+  'cancel_token_required',
+  'recovery_notice_failed',
+  'account_recovery_disabled',
+  'recovery_not_found',
+  'recovery_not_ready',
+  'enrollment_required',
+]);
+
+export type RecoveryErrorCode = z.infer<typeof RecoveryErrorCodeSchema>;
+
+/**
+ * `POST /recovery/cancel` with the token from the "recovery opened" notice. A signed-in
+ * owner cancels without it through `DELETE /recovery/requests/:id`.
  */
 export const AccountRecoveryCancelRequestSchema = z.object({
   cancelToken: z.string().trim().min(1).optional(),