@witnium-tech/witniumchain 0.11.0 → 0.12.0

package/dist/index.mjs

@@ -175,9 +175,10 @@ var WitniumchainClient = class {
    * the contract with the caller's client-generated `ownerPublicKey` +
    * `initialSigningPublicKey`. Witnium never sees the private bytes.
    *
-   * Returns `{ orgId, userId, contractAddress, contractVersion,
-   * emailVerifyToken }`. The verify token is also emailed; it's echoed here
-   * for UIs that prefer to render the verify link themselves.
+   * Returns `{ orgId, userId, contractAddress, contractVersion }`. The
+   * email-verify link is mailed to `adminEmail` and never returned, so there
+   * is nothing to render. If the mail cannot be sent, nothing is created and
+   * the call fails with a 502; retry it.
    */
   createOrg(body) {
     return this.req("POST", "/v1/orgs", { auth: "Public", body });
@@ -235,11 +236,36 @@ var WitniumchainClient = class {
       query: { token }
     });
   }
+  /**
+   * Password login. Check `status`: `'authenticated'` means the session
+   * cookie is set. `'mfa_required'` means NO session exists yet: the server
+   * set a short-lived challenge cookie, and {@link loginMfa} must follow with
+   * the user's TOTP or recovery code.
+   */
   login(body) {
     return this.req("POST", "/v1/auth/login", { auth: "Public", body });
   }
-  logout() {
-    return this.req("POST", "/v1/auth/logout", { auth: "Public" });
+  /**
+   * Second step of an MFA login, after `login()` returned `'mfa_required'`.
+   * Relies on the challenge cookie from that call (`credentials: 'include'`).
+   * 401 `mfa_code_invalid`: wrong or reused code, the user may retry.
+   * 401 `mfa_challenge_invalid`: expired or used up, start again at `login()`.
+   * 429 `mfa_rate_limited`: the body carries `retryAfterSeconds`.
+   */
+  loginMfa(body) {
+    return this.req("POST", "/v1/auth/login/mfa", { auth: "Public", body });
+  }
+  /**
+   * End the first-party session. The cached bearer token is dropped even when
+   * the request fails, so a logged-out tab never keeps the previous user's
+   * token.
+   */
+  async logout() {
+    try {
+      return await this.req("POST", "/v1/auth/logout", { auth: "Public" });
+    } finally {
+      this.signOut();
+    }
   }
   forgotPassword(body) {
     return this.req("POST", "/v1/auth/forgot-password", { auth: "Public", body });
@@ -472,20 +498,34 @@ var WitniumchainClient = class {
       auth: "SessionCookie"
     });
   }
-  confirmTotp(body) {
-    return this.req("POST", "/v1/account/mfa/totp/confirm", {
+  /**
+   * Confirming bumps the user's security epoch server-side, which ends every
+   * session-minted access token. A cached one is dropped so the next bearer
+   * call mints a fresh token.
+   */
+  async confirmTotp(body) {
+    const res = await this.req("POST", "/v1/account/mfa/totp/confirm", {
       auth: "SessionCookie",
       body
     });
+    if (this.accessTokenFromSession) {
+      this.accessToken = void 0;
+      this.accessTokenFromSession = false;
+    }
+    return res;
   }
-  disableTotp() {
+  /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
+  disableTotp(body) {
     return this.req("DELETE", "/v1/account/mfa/totp", {
-      auth: "SessionCookie"
+      auth: "SessionCookie",
+      body
     });
   }
-  regenerateRecoveryCodes() {
+  /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
+  regenerateRecoveryCodes(body) {
     return this.req("POST", "/v1/account/mfa/recovery-codes/regenerate", {
-      auth: "SessionCookie"
+      auth: "SessionCookie",
+      body
     });
   }
   // ────────────────────────────────────────────────────────────────────────
@@ -1350,7 +1390,12 @@ var OrgMembers = class {
   list() {
     return this.client.listMembers();
   }
-  /** Invite a member by email (default role `member`). */
+  /**
+   * Invite a member by email (default role `member`). `inviteEmailSent` says
+   * whether the invitation (with the verify link) was mailed; the token is
+   * never returned. A 502 means the membership was recorded but the mail
+   * failed; retry.
+   */
   invite(body) {
     return this.client.inviteMember(body);
   }
@@ -1370,7 +1415,10 @@ var OrgMembers = class {
   remove(userId) {
     return this.client.removeMember(userId);
   }
-  /** Re-mint an email-verify token for a pending member. */
+  /**
+   * Re-send the invitation email to a pending member. Returns `{ email }`;
+   * the fresh verify token is mailed, never returned.
+   */
   resendInvite(userId) {
     return this.client.resendMemberInvite(userId);
   }
@@ -1394,14 +1442,18 @@ var MfaTotp = class {
    * Confirm enrolment with the first user-supplied code. Returns the 10
    * single-use recovery codes — show them to the user ONCE; the server never
    * returns them again. Throws `WitniumchainApiError` with status 400 when
-   * the code is invalid or the enrolment is already confirmed.
+   * the code is invalid or the enrolment is already confirmed. Signs the
+   * user out of every other device and connected app.
    */
   confirm(code) {
     return this.client.confirmTotp({ code });
   }
-  /** Disable TOTP, wiping both the secret and all recovery codes. */
-  disable() {
-    return this.client.disableTotp();
+  /**
+   * Disable TOTP, wiping both the secret and all recovery codes. Requires the
+   * user's current code or a recovery code.
+   */
+  disable(proof) {
+    return this.client.disableTotp(proof);
   }
 };
 var MfaRecoveryCodes = class {
@@ -1412,9 +1464,10 @@ var MfaRecoveryCodes = class {
   /**
    * Issue a fresh set of 10 recovery codes, invalidating the prior ones.
    * Same as `confirm` — codes are returned ONCE and never readable again.
+   * Requires the user's current code or a recovery code.
    */
-  regenerate() {
-    return this.client.regenerateRecoveryCodes();
+  regenerate(proof) {
+    return this.client.regenerateRecoveryCodes(proof);
   }
 };
 function sleep(ms) {