@seliseblocks/client 0.1.0 → 0.1.2

package/dist/client.d.ts

@@ -3,6 +3,7 @@ import { BlocksDataClient } from "./data/data-client.js";
 import { BlocksHttpClient } from "./http/http-client.js";
 import { BlocksIAMClient } from "./iam/iam-client.js";
 import { BlocksLocalizationClient } from "./localization/localization-client.js";
+import { BlocksMfaClient } from "./mfa/mfa-client.js";
 export type BlocksOidcConfig = {
     /**
      * Public browser OIDC client id used by Blocks IAM IdpController and refresh-token calls.
@@ -55,6 +56,7 @@ export type BlocksClient = {
     http: BlocksHttpClient;
     iam: BlocksIAMClient;
     localization: BlocksLocalizationClient;
+    mfa: BlocksMfaClient;
 };
 export type RequiredConfig = {
     accessToken?: string | (() => Promise<string | undefined> | string | undefined);

package/dist/client.js

@@ -3,6 +3,7 @@ import { BlocksDataClient } from "./data/data-client.js";
 import { BlocksHttpClient } from "./http/http-client.js";
 import { BlocksIAMClient } from "./iam/iam-client.js";
 import { BlocksLocalizationClient } from "./localization/localization-client.js";
+import { BlocksMfaClient } from "./mfa/mfa-client.js";
 /**
  * What: creates a framework-neutral Blocks SDK instance for one tenant/app runtime.
  * Why: frontend code needs a single configured entry point for IAM, Auth, Data, and Localization APIs.
@@ -18,7 +19,8 @@ export function createBlocksClient(config) {
         data: new BlocksDataClient(http),
         http,
         iam: new BlocksIAMClient(http),
-        localization: new BlocksLocalizationClient(http)
+        localization: new BlocksLocalizationClient(http),
+        mfa: new BlocksMfaClient(http)
     };
 }
 function normalizeConfig(config) {

package/dist/data/data-client.d.ts

@@ -1,5 +1,5 @@
 import { BlocksHttpClient } from "../http/http-client.js";
-import { BlocksDataCollection, BlocksDmsCreateFolderRequest, BlocksDmsListRequest, BlocksDmsUploadRequest, BlocksFileDeleteRequest, BlocksFileGetOptions, BlocksFileInfoListRequest, BlocksDataSchema, BlocksFileListRequest, BlocksFileUpdateAdditionalInfoRequest, BlocksFileUploadRequest, BlocksFolderDeleteRequest, BlocksGraphqlRequest, BlocksLocalStorageUploadRequest, BlocksPagedResult, BlocksRegexGenerateRequest, BlocksSchemaFieldValidationOptions, BlocksSchemaListOptions, BlocksSchemaValidationListOptions, BlocksUploadToUrlRequest } from "./types.js";
+import { BlocksDataCollection, BlocksDataCollectionOptions, BlocksDmsCreateFolderRequest, BlocksDmsListRequest, BlocksDmsUploadRequest, BlocksFileDeleteRequest, BlocksFileGetOptions, BlocksFileInfoListRequest, BlocksDataSchema, BlocksFileListRequest, BlocksFileUpdateAdditionalInfoRequest, BlocksFileUploadRequest, BlocksFolderDeleteRequest, BlocksGraphqlRequest, BlocksLocalStorageUploadRequest, BlocksPagedResult, BlocksRegexGenerateRequest, BlocksSchemaFieldValidationOptions, BlocksSchemaListOptions, BlocksSchemaValidationListOptions, BlocksUploadToUrlRequest } from "./types.js";
 export declare class BlocksDataClient {
     private readonly http;
     constructor(http: BlocksHttpClient);
@@ -85,7 +85,7 @@ export declare class BlocksDataClient {
          */
         delete: (request: BlocksFileDeleteRequest) => Promise<unknown>;
         /**
-         * What: updates file additional properties through `POST /data/v4/Files/updateFileAdditionalInfo`.
+         * What: updates file additional properties through `POST /data/v4/Files/UpdateFileAdditionalInfo`.
          * Why: apps often need to attach searchable metadata such as agent status or business references to a file.
          * How: pass `itemId` and `additionalProperties`; the SDK forwards the request as-is except for not adding project fields.
          */
@@ -171,8 +171,8 @@ export declare class BlocksDataClient {
     };
     /**
      * What: creates CRUD helpers for a Data runtime collection.
-     * Why: frontend code usually works with business collection names rather than hand-written URLs.
-     * How: pass the exact collection name; returned helpers support list/get/create/update/delete and never add `ProjectKey`.
+     * Why: frontend code usually works with schema names rather than hand-written GraphQL operations.
+     * How: pass the exact schema name, such as `Product`; returned helpers call `/data/v4/gateway` and never add `ProjectKey`.
      */
-    collection<T = Record<string, unknown>>(name: string): BlocksDataCollection<T>;
+    collection<T = Record<string, unknown>>(schemaName: string, options?: BlocksDataCollectionOptions): BlocksDataCollection<T>;
 }

package/dist/data/data-client.js

@@ -124,11 +124,11 @@ export class BlocksDataClient {
             body: withoutProjectKey(request)
         }),
         /**
-         * What: updates file additional properties through `POST /data/v4/Files/updateFileAdditionalInfo`.
+         * What: updates file additional properties through `POST /data/v4/Files/UpdateFileAdditionalInfo`.
          * Why: apps often need to attach searchable metadata such as agent status or business references to a file.
          * How: pass `itemId` and `additionalProperties`; the SDK forwards the request as-is except for not adding project fields.
          */
-        updateAdditionalInfo: (request) => this.http.request(`${DATA_API}/Files/updateFileAdditionalInfo`, {
+        updateAdditionalInfo: (request) => this.http.request(`${DATA_API}/Files/UpdateFileAdditionalInfo`, {
             body: withoutProjectKey(request)
         }),
         /**
@@ -241,51 +241,100 @@ export class BlocksDataClient {
     };
     /**
      * What: creates CRUD helpers for a Data runtime collection.
-     * Why: frontend code usually works with business collection names rather than hand-written URLs.
-     * How: pass the exact collection name; returned helpers support list/get/create/update/delete and never add `ProjectKey`.
+     * Why: frontend code usually works with schema names rather than hand-written GraphQL operations.
+     * How: pass the exact schema name, such as `Product`; returned helpers call `/data/v4/gateway` and never add `ProjectKey`.
      */
-    collection(name) {
+    collection(schemaName, options = {}) {
+        assertGraphqlName(schemaName, "schemaName");
+        const listField = `get${schemaName}s`;
+        const createField = `insert${schemaName}`;
+        const updateField = `update${schemaName}`;
+        const deleteField = `delete${schemaName}`;
         return {
             /**
-             * What: creates a collection item through `POST /data/v4/{collection}`.
+             * What: creates a schema-backed item through `POST /data/v4/gateway`.
              * Why: forms need a direct runtime create operation.
-             * How: pass the item payload; Data validates it against the active collection schema.
+             * How: pass the item payload; Data validates it against the active schema's insert input.
              */
-            create: (payload) => this.http.request(`${DATA_API}/${encodeURIComponent(name)}`, { body: payload }),
+            create: (payload) => this.graphql({
+                operationName: createField,
+                query: `mutation ${createField}($input: ${schemaName}InsertInput!) {
+  ${createField}(input: $input) {
+    acknowledged
+    itemId
+    message
+    totalImpactedData
+  }
+}`,
+                variables: { input: payload }
+            }),
             /**
-             * What: deletes a collection item through `DELETE /data/v4/{collection}/{itemId}`.
+             * What: deletes a schema-backed item through `POST /data/v4/gateway`.
              * Why: collection UIs need a runtime delete operation when allowed by permissions/rules.
-             * How: pass the item id from Data.
+             * How: pass the item id from Data; the SDK sends a GraphQL `filter` on `ItemId`.
              */
-            delete: (itemId) => this.http.request(`${DATA_API}/${encodeURIComponent(name)}/${encodeURIComponent(itemId)}`, {
-                method: "DELETE"
+            delete: (itemId, deleteOptions = {}) => this.graphql({
+                operationName: deleteField,
+                query: `mutation ${deleteField}($filter: String, $input: ${schemaName}DeleteInput!) {
+  ${deleteField}(filter: $filter, input: $input) {
+    acknowledged
+    itemId
+    message
+    totalImpactedData
+  }
+}`,
+                variables: {
+                    filter: itemIdFilter(itemId),
+                    input: { isHardDelete: deleteOptions.hardDelete ?? false }
+                }
             }),
             /**
-             * What: reads one collection item through `GET /data/v4/{collection}/{itemId}`.
+             * What: reads one schema-backed item through `POST /data/v4/gateway`.
              * Why: detail pages need one runtime record by id.
-             * How: pass the item id from Data.
+             * How: pass the item id from Data; the SDK queries `get{SchemaName}s` with an `ItemId` filter.
              */
-            get: (itemId) => this.http.request(`${DATA_API}/${encodeURIComponent(name)}/${encodeURIComponent(itemId)}`),
+            get: (itemId, getOptions = {}) => this.graphql({
+                operationName: listField,
+                query: collectionListQuery(listField, selectionFor(getOptions.fields ?? options.fields)),
+                variables: {
+                    input: {
+                        filter: itemIdFilter(itemId),
+                        pageNo: 1,
+                        pageSize: 1
+                    }
+                }
+            }),
             /**
-             * What: lists collection items through `GET /data/v4/{collection}`.
+             * What: lists schema-backed items through `POST /data/v4/gateway`.
              * Why: tables, grids, and pickers need paged runtime records.
-             * How: pass `pageNo`, `pageSize`, and optional query fields supported by the collection endpoint.
+             * How: pass `pageNo`, `pageSize`, optional `filter`/`sort`, and GraphQL fields to select.
              */
-            list: (options) => this.http.request(`${DATA_API}/${encodeURIComponent(name)}`, {
-                query: {
-                    PageNo: options?.pageNo ?? 1,
-                    PageSize: options?.pageSize ?? 20,
-                    ...options?.query
+            list: (listOptions) => this.graphql({
+                operationName: listField,
+                query: collectionListQuery(listField, selectionFor(listOptions?.fields ?? options.fields)),
+                variables: {
+                    input: dynamicQueryInput(listOptions)
                 }
             }),
             /**
-             * What: updates a collection item through `PUT /data/v4/{collection}/{itemId}`.
+             * What: updates a schema-backed item through `POST /data/v4/gateway`.
              * Why: edit forms need a runtime update operation.
-             * How: pass the item id and partial payload; Data applies its schema/rule validation.
+             * How: pass the item id and partial payload; the SDK sends a GraphQL `filter` on `ItemId`.
              */
-            update: (itemId, payload) => this.http.request(`${DATA_API}/${encodeURIComponent(name)}/${encodeURIComponent(itemId)}`, {
-                body: payload,
-                method: "PUT"
+            update: (itemId, payload) => this.graphql({
+                operationName: updateField,
+                query: `mutation ${updateField}($filter: String, $input: ${schemaName}UpdateInput!) {
+  ${updateField}(filter: $filter, input: $input) {
+    acknowledged
+    itemId
+    message
+    totalImpactedData
+  }
+}`,
+                variables: {
+                    filter: itemIdFilter(itemId),
+                    input: payload
+                }
             })
         };
     }
@@ -383,3 +432,50 @@ function withoutProjectKey(request) {
     delete record.ProjectKey;
     return record;
 }
+function dynamicQueryInput(options) {
+    return {
+        filter: normalizeGraphqlJsonInput(options?.filter ?? options?.query),
+        pageNo: options?.pageNo ?? 1,
+        pageSize: options?.pageSize ?? 20,
+        sort: normalizeGraphqlJsonInput(options?.sort)
+    };
+}
+function collectionListQuery(fieldName, selection) {
+    return `query ${fieldName}($input: DynamicQueryInput) {
+  ${fieldName}(input: $input) {
+    items {
+${indent(selection, 6)}
+    }
+    totalCount
+    pageNo
+    pageSize
+    totalPages
+    hasNextPage
+    hasPreviousPage
+  }
+}`;
+}
+function selectionFor(fields) {
+    const selected = fields?.length ? fields : ["ItemId"];
+    const unique = Array.from(new Set(["ItemId", ...selected]));
+    for (const field of unique)
+        assertGraphqlName(field, "field");
+    return unique.join("\n");
+}
+function itemIdFilter(itemId) {
+    return JSON.stringify({ ItemId: itemId });
+}
+function normalizeGraphqlJsonInput(value) {
+    if (value === undefined)
+        return undefined;
+    return typeof value === "string" ? value : JSON.stringify(value);
+}
+function assertGraphqlName(value, label) {
+    if (!/^[_A-Za-z][_0-9A-Za-z]*$/.test(value)) {
+        throw new Error(`Invalid Blocks Data GraphQL ${label}: ${value}`);
+    }
+}
+function indent(value, spaces) {
+    const pad = " ".repeat(spaces);
+    return value.split("\n").map((line) => `${pad}${line}`).join("\n");
+}

package/dist/data/types.d.ts

@@ -9,14 +9,30 @@ export type BlocksPagedResult<T> = {
     message?: string | null;
 };
 export type BlocksDataListOptions = {
+    fields?: string[];
+    filter?: Record<string, unknown> | string;
     pageNo?: number;
     pageSize?: number;
+    /**
+     * Legacy convenience alias for the GraphQL DynamicQueryInput.Filter payload.
+     * Prefer `filter` for new code.
+     */
     query?: Record<string, boolean | number | string | undefined>;
+    sort?: Record<string, unknown> | string;
+};
+export type BlocksDataCollectionOptions = {
+    fields?: string[];
+};
+export type BlocksDataDeleteOptions = {
+    hardDelete?: boolean;
+};
+export type BlocksDataGetOptions = {
+    fields?: string[];
 };
 export type BlocksDataCollection<T = Record<string, unknown>> = {
     create(payload: Partial<T>): Promise<unknown>;
-    delete(itemId: string): Promise<unknown>;
-    get(itemId: string): Promise<unknown>;
+    delete(itemId: string, options?: BlocksDataDeleteOptions): Promise<unknown>;
+    get(itemId: string, options?: BlocksDataGetOptions): Promise<unknown>;
     list(options?: BlocksDataListOptions): Promise<unknown>;
     update(itemId: string, payload: Partial<T>): Promise<unknown>;
 };

package/dist/index.d.ts

@@ -5,8 +5,10 @@ export type { BlocksClient, BlocksClientConfig, BlocksOidcConfig } from "./clien
 export { BlocksApiError } from "./http/errors.js";
 export { BlocksIAMClient } from "./iam/iam-client.js";
 export { BlocksLocalizationClient } from "./localization/localization-client.js";
+export { BlocksMfaClient } from "./mfa/mfa-client.js";
 export type { BlocksAuthPassThroughResponse, BlocksAuthResponse, BlocksClientCredentialsRequest, BlocksAuthLoginRequest, BlocksIdpCallbackRequest, BlocksIdpInitiateRequest, BlocksIdpInitiateResponse, BlocksLoginOption, BlocksLogoutRequest, BlocksOidcRefreshRequest, BlocksOidcUserInfo, BlocksRefreshRequest, BlocksSocialLoginRequest, BlocksSwitchOrganizationRequest } from "./auth/auth-client.js";
 export type { BlocksRequestOptions } from "./types.js";
 export type { BlocksBaseResponse, BlocksGetMyOrganizationsResponse, BlocksGetOrganizationResponse, BlocksGetOrganizationsResponse, BlocksGetPermissionResponse, BlocksGetPermissionsResponse, BlocksGetRoleResponse, BlocksGetRolesResponse, BlocksGetUserResponse, BlocksGetUsersResponse, BlocksIamListRequest, BlocksMeResponse, BlocksOrganization, BlocksPermission, BlocksQueryListResponse, BlocksQueryResponse, BlocksRole, BlocksUser } from "./iam/types.js";
 export type { BlocksDataCollection, BlocksDataListOptions, BlocksDmsCreateFolderRequest, BlocksDmsListRequest, BlocksDmsMetaDataValue, BlocksDmsUploadItem, BlocksDmsUploadRequest, BlocksFileDeleteRequest, BlocksFileGetOptions, BlocksFileInfoListRequest, BlocksFileListRequest, BlocksFileUpdateAdditionalInfoRequest, BlocksFileUploadRequest, BlocksFolderDeleteRequest, BlocksGraphqlRequest, BlocksLocalStorageUploadRequest, BlocksPagedResult, BlocksRegexGenerateRequest, BlocksSchemaFieldValidationOptions, BlocksSchemaListOptions, BlocksSchemaValidationListOptions, BlocksUploadToUrlRequest } from "./data/types.js";
-export type { BlocksLocalizationDictionary, BlocksLocalizationKey, BlocksLocalizationKeysByNamesRequest, BlocksLocalizationKeysByNamesResponse, BlocksLocalizationLanguage, BlocksLocalizationModule, BlocksLocalizationTranslationOptions } from "./localization/types.js";
+export type { BlocksLocalizationDictionary, BlocksLocalizationKey, BlocksLocalizationKeyResource, BlocksLocalizationKeysByNamesRequest, BlocksLocalizationKeysByNamesResponse, BlocksLocalizationLanguage, BlocksLocalizationModule, BlocksLocalizationTranslationOptions } from "./localization/types.js";
+export type { BlocksMfaBackupCodeUseRequest, BlocksMfaConfig, BlocksMfaGenerateRequest, BlocksMfaPassThroughResponse, BlocksMfaResendRequest, BlocksMfaSetMethodRequest, BlocksMfaVerifyRequest, BlocksMfaVerifyTotpSetupRequest } from "./mfa/types.js";

package/dist/index.js

@@ -4,3 +4,4 @@ export { BlocksDataClient } from "./data/data-client.js";
 export { BlocksApiError } from "./http/errors.js";
 export { BlocksIAMClient } from "./iam/iam-client.js";
 export { BlocksLocalizationClient } from "./localization/localization-client.js";
+export { BlocksMfaClient } from "./mfa/mfa-client.js";

package/dist/localization/types.d.ts

@@ -18,12 +18,20 @@ export type BlocksLocalizationTranslationOptions = {
     language: string;
     moduleName: string;
 };
+export type BlocksLocalizationKeyResource = {
+    characterLength?: number;
+    culture?: string;
+    value?: string;
+};
 export type BlocksLocalizationKey = Record<string, unknown> & {
+    context?: string;
+    isNewKey?: boolean;
+    isPartiallyTranslated?: boolean;
     itemId?: string;
     keyName?: string;
     moduleId?: string;
-    moduleName?: string;
-    values?: Record<string, unknown>;
+    resources?: BlocksLocalizationKeyResource[];
+    routes?: string[];
 };
 export type BlocksLocalizationKeysByNamesRequest = {
     keyNames: string[];

package/dist/mfa/mfa-client.d.ts

@@ -0,0 +1,82 @@
+import { BlocksHttpClient } from "../http/http-client.js";
+import { BlocksMfaBackupCodeUseRequest, BlocksMfaConfig, BlocksMfaGenerateRequest, BlocksMfaPassThroughResponse, BlocksMfaResendRequest, BlocksMfaSetMethodRequest, BlocksMfaVerifyRequest, BlocksMfaVerifyTotpSetupRequest } from "./types.js";
+/**
+ * Consumer-facing MFA surface: enroll, verify, switch, or disable the signed-in user's own MFA,
+ * and manage their own backup codes. Tenant-wide MFA policy (`POST /iam/v4/mfa/config`) is
+ * deliberately not exposed here -- that's an admin/tenant-settings action, not a user self-service
+ * flow, the same distinction the SDK already draws for `identityProviders` admin methods.
+ */
+export declare class BlocksMfaClient {
+    private readonly http;
+    constructor(http: BlocksHttpClient);
+    /**
+     * What: reads the tenant's current MFA policy through `GET /iam/v4/mfa/config`.
+     * Why: consumer apps can check whether MFA is enabled/required before prompting enrollment.
+     * How: call with an authorized token; the SDK returns IAM's policy shape as-is.
+     */
+    config(): Promise<BlocksMfaConfig>;
+    readonly totp: {
+        /**
+         * What: starts TOTP enrollment through `POST /iam/v4/mfa/totp/setup`.
+         * Why: authenticator-app enrollment needs a secret/QR payload from IAM before the user can scan it.
+         * How: call for the signed-in user, then render IAM's returned secret/QR data in your enrollment UI.
+         */
+        setup: () => Promise<BlocksMfaPassThroughResponse>;
+        /**
+         * What: confirms TOTP enrollment through `POST /iam/v4/mfa/totp/verify-setup`.
+         * Why: IAM must confirm the user's authenticator app is correctly configured before enabling TOTP.
+         * How: pass the 6-digit `code` the user typed from their authenticator app.
+         */
+        verifySetup: (request: BlocksMfaVerifyTotpSetupRequest) => Promise<BlocksMfaPassThroughResponse>;
+    };
+    /**
+     * What: sends an OTP challenge through `POST /iam/v4/mfa/generate`.
+     * Why: email/SMS-based MFA needs IAM to issue and deliver a one-time code before verification.
+     * How: pass the target `mfaType`; IAM returns an `mfaId` to pass to `verify`/`resend`.
+     */
+    generate(request: BlocksMfaGenerateRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: resends a pending OTP through `POST /iam/v4/mfa/resend`.
+     * Why: users may not receive the first code (SMS delay, spam filtering) and need a retry.
+     * How: pass the `mfaId` returned from `generate`.
+     */
+    resend(request: BlocksMfaResendRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: verifies an OTP or step-up challenge through `POST /iam/v4/mfa/verify`.
+     * Why: login and sensitive in-app actions need this to confirm the code the user entered.
+     * How: pass `mfaId`, `verificationCode`, and `authType`; set `isFromTokenCall` when verifying as part of a token/login exchange rather than a standalone check.
+     */
+    verify(request: BlocksMfaVerifyRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: sets the signed-in user's active MFA method through `PUT /iam/v4/mfa/method`.
+     * Why: users who have enrolled more than one method need to switch which one is active.
+     * How: pass the `mfaType` to activate; enroll it first (e.g. via `totp.setup`/`verifySetup`) if it isn't already.
+     */
+    setMethod(request: BlocksMfaSetMethodRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: disables MFA for the signed-in user through `POST /iam/v4/mfa/disable`.
+     * Why: users need a self-service way to turn MFA off when the tenant's policy allows opt-out.
+     * How: call with an authorized token; IAM enforces whether opt-out is permitted for this tenant/role.
+     */
+    disable(): Promise<BlocksMfaPassThroughResponse>;
+    readonly backupCodes: {
+        /**
+         * What: lists the signed-in user's backup codes through `GET /iam/v4/mfa/backup-codes`.
+         * Why: account-security screens need to show how many unused recovery codes remain.
+         * How: call with an authorized token.
+         */
+        list: () => Promise<BlocksMfaPassThroughResponse>;
+        /**
+         * What: generates a fresh set of backup codes through `POST /iam/v4/mfa/backup-codes/generate`.
+         * Why: users need recovery codes for when their primary MFA method is unavailable.
+         * How: call once TOTP/OTP is enrolled; treat the response as sensitive and show it to the user only once.
+         */
+        generate: () => Promise<BlocksMfaPassThroughResponse>;
+        /**
+         * What: consumes one backup code through `POST /iam/v4/mfa/backup-codes/use`.
+         * Why: lets a user complete login/step-up when their primary MFA method is unavailable.
+         * How: pass the signed-in `userId` and the backup `code` the user entered; each code is single-use.
+         */
+        use: (request: BlocksMfaBackupCodeUseRequest) => Promise<BlocksMfaPassThroughResponse>;
+    };
+}

package/dist/mfa/mfa-client.js

@@ -0,0 +1,98 @@
+const MFA_API = "/iam/v4/mfa";
+/**
+ * Consumer-facing MFA surface: enroll, verify, switch, or disable the signed-in user's own MFA,
+ * and manage their own backup codes. Tenant-wide MFA policy (`POST /iam/v4/mfa/config`) is
+ * deliberately not exposed here -- that's an admin/tenant-settings action, not a user self-service
+ * flow, the same distinction the SDK already draws for `identityProviders` admin methods.
+ */
+export class BlocksMfaClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * What: reads the tenant's current MFA policy through `GET /iam/v4/mfa/config`.
+     * Why: consumer apps can check whether MFA is enabled/required before prompting enrollment.
+     * How: call with an authorized token; the SDK returns IAM's policy shape as-is.
+     */
+    config() {
+        return this.http.request(`${MFA_API}/config`);
+    }
+    totp = {
+        /**
+         * What: starts TOTP enrollment through `POST /iam/v4/mfa/totp/setup`.
+         * Why: authenticator-app enrollment needs a secret/QR payload from IAM before the user can scan it.
+         * How: call for the signed-in user, then render IAM's returned secret/QR data in your enrollment UI.
+         */
+        setup: () => this.http.request(`${MFA_API}/totp/setup`, { method: "POST" }),
+        /**
+         * What: confirms TOTP enrollment through `POST /iam/v4/mfa/totp/verify-setup`.
+         * Why: IAM must confirm the user's authenticator app is correctly configured before enabling TOTP.
+         * How: pass the 6-digit `code` the user typed from their authenticator app.
+         */
+        verifySetup: (request) => this.http.request(`${MFA_API}/totp/verify-setup`, { body: request })
+    };
+    /**
+     * What: sends an OTP challenge through `POST /iam/v4/mfa/generate`.
+     * Why: email/SMS-based MFA needs IAM to issue and deliver a one-time code before verification.
+     * How: pass the target `mfaType`; IAM returns an `mfaId` to pass to `verify`/`resend`.
+     */
+    generate(request) {
+        return this.http.request(`${MFA_API}/generate`, { body: request });
+    }
+    /**
+     * What: resends a pending OTP through `POST /iam/v4/mfa/resend`.
+     * Why: users may not receive the first code (SMS delay, spam filtering) and need a retry.
+     * How: pass the `mfaId` returned from `generate`.
+     */
+    resend(request) {
+        return this.http.request(`${MFA_API}/resend`, { body: request });
+    }
+    /**
+     * What: verifies an OTP or step-up challenge through `POST /iam/v4/mfa/verify`.
+     * Why: login and sensitive in-app actions need this to confirm the code the user entered.
+     * How: pass `mfaId`, `verificationCode`, and `authType`; set `isFromTokenCall` when verifying as part of a token/login exchange rather than a standalone check.
+     */
+    verify(request) {
+        return this.http.request(`${MFA_API}/verify`, { body: request });
+    }
+    /**
+     * What: sets the signed-in user's active MFA method through `PUT /iam/v4/mfa/method`.
+     * Why: users who have enrolled more than one method need to switch which one is active.
+     * How: pass the `mfaType` to activate; enroll it first (e.g. via `totp.setup`/`verifySetup`) if it isn't already.
+     */
+    setMethod(request) {
+        return this.http.request(`${MFA_API}/method`, {
+            body: request,
+            method: "PUT"
+        });
+    }
+    /**
+     * What: disables MFA for the signed-in user through `POST /iam/v4/mfa/disable`.
+     * Why: users need a self-service way to turn MFA off when the tenant's policy allows opt-out.
+     * How: call with an authorized token; IAM enforces whether opt-out is permitted for this tenant/role.
+     */
+    disable() {
+        return this.http.request(`${MFA_API}/disable`, { method: "POST" });
+    }
+    backupCodes = {
+        /**
+         * What: lists the signed-in user's backup codes through `GET /iam/v4/mfa/backup-codes`.
+         * Why: account-security screens need to show how many unused recovery codes remain.
+         * How: call with an authorized token.
+         */
+        list: () => this.http.request(`${MFA_API}/backup-codes`),
+        /**
+         * What: generates a fresh set of backup codes through `POST /iam/v4/mfa/backup-codes/generate`.
+         * Why: users need recovery codes for when their primary MFA method is unavailable.
+         * How: call once TOTP/OTP is enrolled; treat the response as sensitive and show it to the user only once.
+         */
+        generate: () => this.http.request(`${MFA_API}/backup-codes/generate`, { method: "POST" }),
+        /**
+         * What: consumes one backup code through `POST /iam/v4/mfa/backup-codes/use`.
+         * Why: lets a user complete login/step-up when their primary MFA method is unavailable.
+         * How: pass the signed-in `userId` and the backup `code` the user entered; each code is single-use.
+         */
+        use: (request) => this.http.request(`${MFA_API}/backup-codes/use`, { body: request })
+    };
+}

package/dist/mfa/types.d.ts

@@ -0,0 +1,34 @@
+export type BlocksMfaConfig = Record<string, unknown> & {
+    allowBackupCodes?: boolean;
+    allowUserOptOut?: boolean;
+    backupCodesCount?: number;
+    enableMfa?: boolean;
+    requireMfaForAllUsers?: boolean;
+    userMfaType?: number[];
+};
+export type BlocksMfaGenerateRequest = {
+    /** IAM-defined numeric MFA method (its enum names aren't in the swagger contract -- treat as opaque). */
+    mfaType: number;
+    sendPhoneNumberAsEmailDomain?: string;
+};
+export type BlocksMfaResendRequest = {
+    mfaId: string;
+    sendPhoneNumberAsEmailDomain?: string;
+};
+export type BlocksMfaVerifyRequest = {
+    authType: number;
+    isFromTokenCall?: boolean;
+    mfaId: string;
+    verificationCode: string;
+};
+export type BlocksMfaSetMethodRequest = {
+    mfaType: number;
+};
+export type BlocksMfaVerifyTotpSetupRequest = {
+    code: string;
+};
+export type BlocksMfaBackupCodeUseRequest = {
+    code: string;
+    userId: string;
+};
+export type BlocksMfaPassThroughResponse = Record<string, unknown>;

package/dist/mfa/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,48 +1,48 @@
-{
-  "name": "@seliseblocks/client",
-  "version": "0.1.0",
-  "description": "Framework-neutral TypeScript client SDK for SELISE Blocks frontend applications.",
-  "license": "MIT",
-  "type": "module",
-  "keywords": [
-    "selise",
-    "blocks",
-    "sdk",
-    "typescript",
-    "frontend"
-  ],
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "sideEffects": false,
-  "files": [
-    "dist",
-    "README.md",
-    "AI_USAGE_GUIDE.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "prepack": "npm run build",
-    "prepublishOnly": "npm test"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.5.0"
-  }
-}
+{
+  "name": "@seliseblocks/client",
+  "version": "0.1.2",
+  "description": "Framework-neutral TypeScript client SDK for SELISE Blocks frontend applications.",
+  "license": "MIT",
+  "type": "module",
+  "keywords": [
+    "selise",
+    "blocks",
+    "sdk",
+    "typescript",
+    "frontend"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "AI_USAGE_GUIDE.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.0"
+  }
+}