[Bccorb]

Closes #105. The shared contract for epic fells-code/seamless-auth-api#386, shipping in the one v0.20 types release with #107.

Decisions (Brandon, 2026-10-22)

• Recovery sessions are restricted until a new factor is enrolled. RecoverySessionResponseSchema carries recovery: true and nextStep: 'enroll_passkey'. The API answers 403 enrollment_required outside enrollment, recovery codes, /users/me and logout, and the adapters' requireAuth refuse recovery: true by default (fells-code/seamless-auth-server, v0.20).
• Self-service recovery is off by default with a 24h delay (1h to 30d).
• Staged policy is optional, and every policy change is versioned: a whole-config PATCH touching a policy key still applies immediately and is recorded as a config_patch version, so rollback always works.
• Break-glass is env-listed admin accounts (BREAK_GLASS_EMAILS); types only add the break_glass_sign_in event and the dry-run count.

Routes these describe (API side, fells-code/seamless-auth-api#398 #399 #401 #402 #403)

Route	Auth	Request	Response
GET /recovery-codes	access		RecoveryCodesStatus
POST /recovery-codes	access (+ step-up if a set exists)		RecoveryCodesGenerated
POST /recovery-codes/redeem	ephemeral	RecoveryCodeRedeemRequest	RecoverySessionResponse
POST /recovery/start	ephemeral	AccountRecoveryStartRequest	AccountRecoveryStartResponse
POST /recovery/verify	ephemeral	AccountRecoveryVerifyRequest	AccountRecoveryStatus
GET /recovery/status	ephemeral		AccountRecoveryStatus
POST /recovery/cancel	cancel token or access	AccountRecoveryCancelRequest	message
POST /recovery/complete	ephemeral		RecoverySessionResponse
GET /system-config/policy	admin:read		PolicyStateResponse
PUT /system-config/policy/draft	admin:write	PolicyDraftSaveRequest	PolicyDraft
DELETE /system-config/policy/draft	admin:write		message
POST /system-config/policy/publish	admin:write + step-up	PolicyPublishRequest	PolicyVersion (409 if expectedVersion is stale)
POST /system-config/policy/rollback	admin:write + step-up	PolicyRollbackRequest	PolicyVersion
GET /system-config/policy/versions	admin:read		PolicyVersionsResponse
POST /system-config/policy/dry-run	admin:read	PolicyDryRunRequest	PolicyDryRunResponse

Recovery codes are not a login method, so no login_methods change can remove them; they are gated by recovery_codes.enabled only.

Compatibility

Everything is additive or defaulted: existing payloads parse unchanged, and PublicSystemConfigResponseSchema's new fields are optional for servers before v0.20. Minor changeset.

Checks: typecheck, lint, format:check, vitest (21 files, 323 tests), test:zod-floor (zod 4.5.0, bundler and NodeNext), build, pack (new modules present).