opendevbrowser 0.0.15 → 0.0.16

package/skills/opendevbrowser-form-testing/SKILL.md

@@ -0,0 +1,143 @@
+---
+name: opendevbrowser-form-testing
+description: This skill should be used when the user asks to "test a form", "verify validation", "check submission behavior", "test multi-step forms", or "debug form errors" with OpenDevBrowser.
+version: 2.0.0
+---
+
+# Form Testing Skill
+
+Use this skill for robust form automation across dynamic, multi-step, challenge-protected, and accessibility-critical flows.
+
+## Pack Contents
+
+- `artifacts/form-workflows.md`
+- `assets/templates/validation-matrix.json`
+- `assets/templates/challenge-decision-tree.json`
+- `assets/templates/a11y-assertions.md`
+- `assets/templates/multi-step-state.json`
+- `scripts/run-form-workflow.sh`
+- `scripts/validate-skill-assets.sh`
+- Shared robustness matrix: `../opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md`
+
+## Fast Start
+
+```bash
+./skills/opendevbrowser-form-testing/scripts/validate-skill-assets.sh
+./skills/opendevbrowser-form-testing/scripts/run-form-workflow.sh validation
+./skills/opendevbrowser-form-testing/scripts/run-form-workflow.sh multi-step
+./skills/opendevbrowser-form-testing/scripts/run-form-workflow.sh challenge-checkpoint
+```
+
+## Core Rules
+
+- Snapshot first, then act.
+- Keep one field mutation per decision loop in failure analysis.
+- Re-snapshot after each invalid submit to avoid stale refs.
+- Verify both UX and network behavior for each submission branch.
+- Keep challenge retries bounded and honor `Retry-After` when 429 pressure appears.
+
+## Parallel Multitab Alignment
+
+- Apply shared concurrency policy from `../opendevbrowser-best-practices/SKILL.md` ("Parallel Operations").
+- Validate form workflows in `managed`, `extension`, and `cdpConnect` paths before parity sign-off.
+- Keep one session per worker and avoid alternating `target-use` inside one command stream.
+
+## Robustness Coverage (Known-Issue Matrix)
+
+Matrix source: `../opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md`
+
+- `ISSUE-01`: stale refs after dynamic validation rerenders
+- `ISSUE-02`: iframe challenge or embedded payment/auth forms
+- `ISSUE-05`: anti-bot checkpoint loops on submit
+- `ISSUE-06`: rate-limit/backoff behavior
+- `ISSUE-08`: restricted origin or unsupported test surface
+
+## Form Coverage Matrix
+
+Cover at least:
+- required/optional fields
+- format/pattern constraints
+- numeric and length boundaries
+- dependent and conditional sections
+- disabled/enabled transitions
+- server-side rejection paths
+
+Use the matrix template in `assets/templates/validation-matrix.json`.
+
+| Validation area | Minimal assertion | Evidence capture |
+| --- | --- | --- |
+| Required vs optional | Empty required field blocks submit; optional field allows submit | `snapshot`, inline error text, submit request status |
+| Format and pattern | Invalid format shows field error and keeps form invalid | `dom_get_text`, `get_attr aria-invalid`, request payload |
+| Numeric and length bounds | Min/max boundaries are enforced consistently client+server | field value checks, server response body |
+| Conditional sections | Dependent fields appear/disappear with correct state reset | before/after snapshots, visibility checks |
+| Disabled/enabled transitions | Submit only enables when constraints are satisfied | `is_enabled`, transition snapshots |
+| Server-side rejection | Backend validation errors map to correct field/global errors | `network_poll`, rendered error copy |
+
+## Canonical Validation Flow
+
+```text
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_type sessionId="<session-id>" ref="<field-ref>" text=""
+opendevbrowser_click sessionId="<session-id>" ref="<submit-ref>"
+opendevbrowser_snapshot sessionId="<session-id>" format="outline"
+opendevbrowser_dom_get_text sessionId="<session-id>" ref="<error-ref>"
+```
+
+## Accessibility Assertions
+
+Validate error handling semantics:
+- error text bound to invalid field
+- `aria-invalid="true"` when invalid
+- keyboard focus on first invalid field when applicable
+- labels/instructions remain programmatically associated
+
+```text
+opendevbrowser_get_attr sessionId="<session-id>" ref="<field-ref>" name="aria-invalid"
+opendevbrowser_get_attr sessionId="<session-id>" ref="<field-ref>" name="aria-describedby"
+```
+
+## Anti-Bot and Challenge Branches
+
+For forms guarded by challenge providers:
+
+1. Detect challenge widget/frame state.
+2. Mark manual checkpoint in run log.
+3. Complete challenge manually or by approved test key in non-production.
+4. Resume from fresh snapshot and continue validation.
+
+Do not implement challenge bypass behavior.
+
+Loop guardrail:
+- Stop after 2 repeated challenge checkpoints without forward progress.
+- Capture network evidence and escalate as blocker.
+
+## Multi-Step and Conditional Forms
+
+For wizard flows:
+1. validate current step
+2. submit and wait for next-step container ref
+3. assert state carryover from prior step
+4. finalize and validate confirmation payload
+
+Use `assets/templates/multi-step-state.json` to track progression.
+
+## Network Correlation
+
+Always poll and inspect submit requests:
+
+```text
+opendevbrowser_network_poll sessionId="<session-id>" max=50
+```
+
+Flag mismatch cases:
+- UI shows success but network fails
+- UI hides server validation errors
+- repeated 429/403 challenge pressure on submit endpoint
+
+## References
+
+- Playwright best practices: https://playwright.dev/docs/best-practices
+- WCAG 2.2 (Input assistance + accessible authentication): https://www.w3.org/TR/WCAG22/
+- Cloudflare Turnstile testing: https://developers.cloudflare.com/turnstile/tutorials/testing/
+- reCAPTCHA v2 test keys: https://developers.google.com/recaptcha/docs/faq
+- hCaptcha test keys: https://docs.hcaptcha.com/

package/skills/opendevbrowser-form-testing/artifacts/form-workflows.md

@@ -0,0 +1,37 @@
+# Form Workflows
+
+## Validation workflow
+
+1. Discover refs
+2. Run negative matrix cases
+3. Assert field-level and summary errors
+4. Run positive submission path
+5. Re-snapshot after each submit branch
+
+## Multi-step workflow
+
+1. Validate each step in isolation
+2. Preserve and verify carried values
+3. Validate final confirmation state and IDs
+
+## Dynamic requirement workflow
+
+1. Trigger conditional sections (toggles/selectors)
+2. Re-snapshot and discover newly required fields
+3. Validate requiredness transitions and submit gating
+4. Verify hidden fields are not submitted unexpectedly
+
+## File upload workflow
+
+1. Validate accepted type/size constraints
+2. Validate invalid file rejection path
+3. Validate success path and server response correlation
+4. Confirm upload state survives step transitions
+
+## Challenge checkpoint workflow
+
+1. Detect challenge state
+2. Pause and annotate checkpoint
+3. Resume after manual completion
+4. Continue assertions from refreshed snapshot
+5. Stop and escalate after repeated challenge loops

package/skills/opendevbrowser-form-testing/assets/templates/a11y-assertions.md

@@ -0,0 +1,7 @@
+# Accessibility Assertions
+
+- Field has associated label
+- Error message is specific and linked (`aria-describedby`)
+- Invalid state uses `aria-invalid="true"`
+- Focus moves to first invalid field after submit
+- Keyboard-only path can complete correction and submit

package/skills/opendevbrowser-form-testing/assets/templates/challenge-decision-tree.json

@@ -0,0 +1,16 @@
+{
+  "challenge_detected": false,
+  "provider": "unknown",
+  "issue_ids": [
+    "ISSUE-02",
+    "ISSUE-05",
+    "ISSUE-06"
+  ],
+  "action": "manual_checkpoint",
+  "max_challenge_retries": 2,
+  "retry_after_seconds": 0,
+  "resume_conditions": [
+    "challenge_cleared",
+    "new_snapshot_taken"
+  ]
+}

package/skills/opendevbrowser-form-testing/assets/templates/multi-step-state.json

@@ -0,0 +1,11 @@
+{
+  "flow": "",
+  "step_index": 0,
+  "step_name": "",
+  "completed_steps": [],
+  "carried_state": {},
+  "final_confirmation": {
+    "seen": false,
+    "reference_id": ""
+  }
+}

package/skills/opendevbrowser-form-testing/assets/templates/validation-matrix.json

@@ -0,0 +1,24 @@
+{
+  "form": "",
+  "fields": [
+    {
+      "name": "",
+      "type": "text",
+      "required": true,
+      "cases": [
+        "empty",
+        "whitespace",
+        "out_of_range",
+        "valid"
+      ]
+    }
+  ],
+  "conditional_cases": [
+    "becomes_required_after_toggle",
+    "hidden_field_not_submitted"
+  ],
+  "submit_cases": [
+    "invalid_blocked",
+    "valid_success"
+  ]
+}

package/skills/opendevbrowser-form-testing/examples/sample-validation-matrix.json

@@ -0,0 +1,29 @@
+{
+  "form": "checkout",
+  "fields": [
+    {
+      "name": "email",
+      "type": "email",
+      "required": true,
+      "cases": [
+        "empty",
+        "invalid_format",
+        "valid"
+      ]
+    },
+    {
+      "name": "postal_code",
+      "type": "text",
+      "required": true,
+      "cases": [
+        "too_short",
+        "invalid_charset",
+        "valid"
+      ]
+    }
+  ],
+  "submit_cases": [
+    "invalid_blocked",
+    "valid_success"
+  ]
+}

package/skills/opendevbrowser-form-testing/scripts/run-form-workflow.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+print_help() {
+  cat <<'HELP'
+Form testing workflow router
+
+Usage:
+  ./skills/opendevbrowser-form-testing/scripts/run-form-workflow.sh <workflow>
+
+Workflows:
+  discovery
+  validation
+  multi-step
+  dynamic-required
+  file-upload
+  challenge-checkpoint
+  list
+HELP
+}
+
+workflow="${1:-list}"
+
+case "$workflow" in
+  list)
+    print_help
+    ;;
+  discovery)
+    cat <<'FLOW'
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+# map refs for all inputs, toggles, and submit controls
+FLOW
+    ;;
+  validation)
+    cat <<'FLOW'
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_type sessionId="<session-id>" ref="<field-ref>" text=""
+opendevbrowser_click sessionId="<session-id>" ref="<submit-ref>"
+opendevbrowser_snapshot sessionId="<session-id>" format="outline"
+opendevbrowser_dom_get_text sessionId="<session-id>" ref="<error-ref>"
+opendevbrowser_get_attr sessionId="<session-id>" ref="<field-ref>" name="aria-invalid"
+FLOW
+    ;;
+  multi-step)
+    cat <<'FLOW'
+# validate each step, then continue
+opendevbrowser_click sessionId="<session-id>" ref="<next-step-ref>"
+opendevbrowser_wait sessionId="<session-id>" ref="<step-container-ref>" state="visible"
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+FLOW
+    ;;
+  dynamic-required)
+    cat <<'FLOW'
+# Trigger conditional branch then re-snapshot for updated requirements.
+opendevbrowser_click sessionId="<session-id>" ref="<toggle-ref>"
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_click sessionId="<session-id>" ref="<submit-ref>"
+opendevbrowser_snapshot sessionId="<session-id>" format="outline"
+FLOW
+    ;;
+  file-upload)
+    cat <<'FLOW'
+# Validate upload constraints and submission behavior.
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_click sessionId="<session-id>" ref="<file-input-ref>"
+opendevbrowser_network_poll sessionId="<session-id>" max=50
+FLOW
+    ;;
+  challenge-checkpoint)
+    cat <<'FLOW'
+# if challenge is detected, pause automation and resume after manual completion
+opendevbrowser_snapshot sessionId="<session-id>" format="outline"
+opendevbrowser_wait sessionId="<session-id>" until="networkidle"
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+FLOW
+    ;;
+  *)
+    echo "Unknown workflow: $workflow" >&2
+    print_help
+    exit 2
+    ;;
+esac

package/skills/opendevbrowser-form-testing/scripts/validate-skill-assets.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+skill_file="$root/SKILL.md"
+
+required=(
+  "artifacts/form-workflows.md"
+  "assets/templates/validation-matrix.json"
+  "assets/templates/challenge-decision-tree.json"
+  "assets/templates/a11y-assertions.md"
+  "assets/templates/multi-step-state.json"
+  "scripts/run-form-workflow.sh"
+  "scripts/validate-skill-assets.sh"
+)
+
+status=0
+for rel in "${required[@]}"; do
+  if [[ ! -f "$root/$rel" ]]; then
+    echo "Missing required asset: $rel" >&2
+    status=1
+  fi
+  if ! grep -Fq "$rel" "$skill_file"; then
+    echo "SKILL.md missing reference: $rel" >&2
+    status=1
+  fi
+done
+
+for rel in scripts/run-form-workflow.sh scripts/validate-skill-assets.sh; do
+  if [[ -f "$root/$rel" && ! -x "$root/$rel" ]]; then
+    echo "Script is not executable: $rel" >&2
+    status=1
+  fi
+done
+
+for rel in assets/templates/validation-matrix.json assets/templates/challenge-decision-tree.json assets/templates/multi-step-state.json; do
+  if [[ -f "$root/$rel" ]]; then
+    if ! node -e 'const fs=require("fs"); JSON.parse(fs.readFileSync(process.argv[1], "utf8"));' "$root/$rel" >/dev/null 2>&1; then
+      echo "Invalid JSON template: $rel" >&2
+      status=1
+    fi
+  fi
+done
+
+if [[ $status -ne 0 ]]; then
+  exit $status
+fi
+
+echo "Form testing skill assets validated."

package/skills/opendevbrowser-login-automation/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: opendevbrowser-login-automation
+description: This skill should be used when the user asks to "automate login", "test authentication", "sign in programmatically", "validate login errors", or "verify session persistence" with OpenDevBrowser.
+version: 2.0.0
+---
+
+# Login Automation Skill
+
+Use this skill for deterministic auth testing that handles MFA and anti-bot checkpoints without unsafe bypass patterns.
+
+## Pack Contents
+
+- `artifacts/login-workflows.md`
+- `assets/templates/login-scenario-matrix.json`
+- `assets/templates/challenge-checkpoint.md`
+- `assets/templates/auth-signals.json`
+- `scripts/run-login-workflow.sh`
+- `scripts/record-auth-signals.sh`
+- `scripts/validate-skill-assets.sh`
+- Shared robustness matrix: `../opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md`
+
+## Fast Start
+
+1. Validate pack integrity.
+
+```bash
+./skills/opendevbrowser-login-automation/scripts/validate-skill-assets.sh
+```
+
+2. Print a ready workflow.
+
+```bash
+./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh password
+./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh mfa
+./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh challenge-checkpoint
+```
+
+## Core Rules
+
+- Use snapshot refs, not ad-hoc selectors.
+- Run one decision loop at a time: snapshot -> action -> snapshot.
+- Never store credentials in skill files, logs, screenshots, or committed fixtures.
+- Treat anti-bot challenges as checkpoints (manual solve or approved test keys), not bypass targets.
+- Keep a bounded retry budget (max 2 automated retries) and honor `Retry-After` when present.
+
+## Parallel Multitab Alignment
+
+- Apply shared concurrency policy from `../opendevbrowser-best-practices/SKILL.md` ("Parallel Operations").
+- Validate login paths across `managed`, `extension`, and `cdpConnect` before parity sign-off.
+- Treat extension headless attempts as expected `unsupported_mode`; do not force unsupported auth runs.
+
+## Robustness Coverage (Known-Issue Matrix)
+
+Matrix source: `../opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md`
+
+- `ISSUE-01`: stale refs / DOM churn
+- `ISSUE-02`: challenge or SSO iframe boundaries
+- `ISSUE-03`: popup/new-tab SSO redirects
+- `ISSUE-04`: MFA/session step-up branching
+- `ISSUE-05`: anti-bot challenge loops
+- `ISSUE-06`: 429/backoff discipline
+- `ISSUE-07`: extension readiness on resume
+
+## Challenge-Aware Flow
+
+1. Preflight: goto login page, wait, snapshot actionables.
+2. Enter identifier and password.
+3. Submit once.
+4. Branch by observed state:
+   - authenticated shell appears -> success validation
+   - MFA prompt appears -> continue MFA branch
+   - popup/new-tab SSO appears -> switch target and continue auth branch
+   - anti-bot challenge appears -> checkpoint branch
+   - invalid credentials or lockout message -> failure branch
+
+```text
+opendevbrowser_goto sessionId="<session-id>" url="https://example.com/login"
+opendevbrowser_wait sessionId="<session-id>" until="networkidle"
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_type sessionId="<session-id>" ref="<identifier-ref>" text="<resolved-identifier>"
+opendevbrowser_type sessionId="<session-id>" ref="<password-ref>" text="<resolved-password>"
+opendevbrowser_click sessionId="<session-id>" ref="<submit-ref>"
+opendevbrowser_wait sessionId="<session-id>" until="networkidle"
+opendevbrowser_snapshot sessionId="<session-id>" format="outline"
+```
+
+## Anti-Bot Checkpoint Pattern
+
+Use this when CAPTCHA/turnstile/challenge pages appear.
+
+1. Detect challenge UI from snapshot refs or page text.
+2. Pause automation and mark checkpoint in run log.
+3. Complete challenge manually (or with provider-approved test key in non-production).
+4. Resume from a fresh snapshot and continue auth validation.
+
+Signals to monitor:
+- challenge iframe/widget visible
+- error copy like "verify you are human"
+- repeated 403/429 responses on auth endpoints
+- repeated challenge pages after resume (loop condition)
+
+Challenge loop guardrail:
+- After 2 challenge checkpoints without success, stop automation and escalate.
+- If `Retry-After` is available, wait at least that duration before any retry.
+
+## MFA Pattern
+
+1. Submit primary credentials.
+2. Wait for OTP/passkey/TOTP ref visibility.
+3. Enter second factor.
+4. Submit and validate authenticated state.
+
+```text
+opendevbrowser_wait sessionId="<session-id>" ref="<mfa-input-ref>" state="visible"
+opendevbrowser_type sessionId="<session-id>" ref="<mfa-input-ref>" text="<resolved-otp>"
+opendevbrowser_click sessionId="<session-id>" ref="<mfa-submit-ref>"
+opendevbrowser_wait sessionId="<session-id>" until="networkidle"
+```
+
+## Validation Signals
+
+Validate at least two independent signals:
+
+- URL/route transition to authenticated area.
+- Auth-only element visible (`opendevbrowser_is_visible`).
+- Auth request success from `opendevbrowser_network_poll`.
+
+```text
+opendevbrowser_network_poll sessionId="<session-id>" max=50
+```
+
+## Session Persistence and Reauth
+
+Use persistent profiles for remember-me checks:
+
+```text
+opendevbrowser_launch profile="auth-test" persistProfile=true noExtension=true
+```
+
+Close and relaunch, then confirm one of:
+- still authenticated without credential prompt
+- intentionally forced reauth policy was applied
+
+## Failure Modes
+
+- Invalid credentials: assert explicit field/banner errors.
+- Rate limit/lockout: stop retries, apply cooldown, rotate test account.
+- Challenge loop: escalate as anti-bot pressure issue.
+- MFA unavailable for test account: mark incomplete test prerequisite.
+
+## References
+
+Use these sources when tuning login automation behavior:
+- Playwright auth guide: https://playwright.dev/docs/auth
+- OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
+- NIST SP 800-63B (Digital Identity): https://pages.nist.gov/800-63-4/sp800-63b.html
+- Cloudflare Turnstile testing keys: https://developers.cloudflare.com/turnstile/tutorials/testing/
+- reCAPTCHA v2 testing keys: https://developers.google.com/recaptcha/docs/faq
+- hCaptcha test keys: https://docs.hcaptcha.com/

package/skills/opendevbrowser-login-automation/artifacts/login-workflows.md

@@ -0,0 +1,39 @@
+# Login Workflows
+
+## Password-only workflow
+
+1. Preflight snapshot
+2. Type identifier/password
+3. Submit
+4. Validate URL + auth-only ref + network status
+5. Re-snapshot before any follow-up action
+
+## MFA workflow
+
+1. Run password-only steps
+2. Wait for MFA field
+3. Submit second factor
+4. Validate session issuance
+
+## SSO popup/new-tab workflow
+
+1. Trigger SSO action from login page
+2. Detect target/page change
+3. Continue auth on active SSO target
+4. Validate return to original app shell
+5. Rebind refs from fresh snapshot
+
+## Challenge checkpoint workflow
+
+1. Detect challenge state
+2. Record checkpoint with timestamp and trigger
+3. Pause automated actions
+4. Resume after challenge completion from fresh snapshot
+5. If challenge repeats twice, stop and escalate as anti-bot pressure
+
+## Lockout recovery workflow
+
+1. Detect lockout or throttling banner
+2. Stop retry loop
+3. Record cooldown window/account status and `Retry-After` if present
+4. Resume with different account or after wait window

package/skills/opendevbrowser-login-automation/assets/templates/auth-signals.json

@@ -0,0 +1,21 @@
+{
+  "session_id": "",
+  "url_before": "",
+  "url_after": "",
+  "auth_element_ref": "",
+  "auth_element_visible": false,
+  "network": {
+    "login_request_seen": false,
+    "status_codes": [],
+    "retry_after_seconds": 0
+  },
+  "frames_seen": 0,
+  "popup_detected": false,
+  "challenge_detected": false,
+  "challenge_type": "none",
+  "challenge_checkpoint_count": 0,
+  "mfa_detected": false,
+  "mfa_method": "unknown",
+  "issue_ids": [],
+  "result": "unknown"
+}

package/skills/opendevbrowser-login-automation/assets/templates/challenge-checkpoint.md

@@ -0,0 +1,10 @@
+# Challenge Checkpoint
+
+- Session ID:
+- URL:
+- Timestamp (UTC):
+- Challenge type (turnstile/recaptcha/hcaptcha/other):
+- Trigger signal:
+- Manual action taken:
+- Resume timestamp:
+- Post-resume outcome:

package/skills/opendevbrowser-login-automation/assets/templates/login-scenario-matrix.json

@@ -0,0 +1,26 @@
+{
+  "scenario": "",
+  "steps": [],
+  "issue_ids": [
+    "ISSUE-01",
+    "ISSUE-02",
+    "ISSUE-03",
+    "ISSUE-04",
+    "ISSUE-05",
+    "ISSUE-06",
+    "ISSUE-07"
+  ],
+  "expected_signals": [
+    "url_changed",
+    "auth_shell_visible",
+    "auth_network_success"
+  ],
+  "failure_signals": [
+    "invalid_credentials",
+    "anti_bot_challenge",
+    "rate_limited",
+    "lockout"
+  ],
+  "max_automated_retries": 2,
+  "requires_manual_checkpoint": false
+}

package/skills/opendevbrowser-login-automation/examples/sample-auth-signals.json

@@ -0,0 +1,14 @@
+{
+  "session_id": "session-123",
+  "url_before": "https://example.com/login",
+  "url_after": "https://example.com/app",
+  "auth_element_ref": "r42",
+  "auth_element_visible": true,
+  "network": {
+    "login_request_seen": true,
+    "status_codes": [200]
+  },
+  "challenge_detected": false,
+  "mfa_detected": true,
+  "result": "authenticated"
+}