packages/types/src/signInFuture.ts (1)

54-65: Add JSDoc and make params readonly (public API polish).

These new public types lack JSDoc and use mutable fields. Recommend documenting intent and marking fields readonly.

Apply this diff:

-export interface SignInFutureMFAPhoneCodeVerifyParams {
-  code: string;
-}
+/** Parameters to verify an MFA phone code second factor. */
+export interface SignInFutureMFAPhoneCodeVerifyParams {
+  readonly code: string;
+}
 
-export interface SignInFutureTOTPVerifyParams {
-  code: string;
-}
+/** Parameters to verify a TOTP second factor. */
+export interface SignInFutureTOTPVerifyParams {
+  readonly code: string;
+}
 
-export interface SignInFutureBackupCodeVerifyParams {
-  code: string;
-}
+/** Parameters to verify a backup code second factor. */
+export interface SignInFutureBackupCodeVerifyParams {
+  readonly code: string;
+}

packages/clerk-js/src/core/resources/SignIn.ts (5)

30-43: Type imports are correct; consider naming consistency across MFA param types.

Minor: SignInFutureMFAPhoneCodeVerifyParams uses an MFA prefix while TOTP/backup code types don’t. Optional alignment for consistency (not blocking).

---

521-526: Expose MFA surface with an explicit experimental JSDoc.

Add a short JSDoc to mfa to mark the API surface as experimental and describe methods.

Apply this diff:

-  mfa = {
+  /**
+   * @experimental MFA-related second factor helpers for custom sign-in flows.
+   * Includes phone code, TOTP, and backup code verification.
+   */
+  mfa = {
     sendPhoneCode: this.sendMFAPhoneCode.bind(this),
     verifyPhoneCode: this.verifyMFAPhoneCode.bind(this),
     verifyTOTP: this.verifyTOTP.bind(this),
     verifyBackupCode: this.verifyBackupCode.bind(this),
   };

---

717-725: Trim user input and add sign-in guard.

Prevents whitespace-related failures and early misuse.

Apply this diff:

-  async verifyMFAPhoneCode(params: SignInFutureMFAPhoneCodeVerifyParams): Promise<{ error: unknown }> {
-    const { code } = params;
+  async verifyMFAPhoneCode(params: SignInFutureMFAPhoneCodeVerifyParams): Promise<{ error: unknown }> {
+    if (!this.resource.id) {
+      throw new Error('Cannot verify MFA phone code without an active sign-in.');
+    }
+    const code = params.code.trim();
     return runAsyncResourceTask(this.resource, async () => {
       await this.resource.__internal_basePost({
         body: { code, strategy: 'phone_code' },
         action: 'attempt_second_factor',
       });
     });
   }

---

727-735: Trim code and add sign-in guard (TOTP).

Aligns with other guards; avoids subtle user input errors.

Apply this diff:

-  async verifyTOTP(params: SignInFutureTOTPVerifyParams): Promise<{ error: unknown }> {
-    const { code } = params;
+  async verifyTOTP(params: SignInFutureTOTPVerifyParams): Promise<{ error: unknown }> {
+    if (!this.resource.id) {
+      throw new Error('Cannot verify TOTP without an active sign-in.');
+    }
+    const code = params.code.trim();
     return runAsyncResourceTask(this.resource, async () => {
       await this.resource.__internal_basePost({
         body: { code, strategy: 'totp' },
         action: 'attempt_second_factor',
       });
     });
   }

---

737-745: Trim code and add sign-in guard (backup code).

Same rationale as above.

Apply this diff:

-  async verifyBackupCode(params: SignInFutureBackupCodeVerifyParams): Promise<{ error: unknown }> {
-    const { code } = params;
+  async verifyBackupCode(params: SignInFutureBackupCodeVerifyParams): Promise<{ error: unknown }> {
+    if (!this.resource.id) {
+      throw new Error('Cannot verify backup code without an active sign-in.');
+    }
+    const code = params.code.trim();
     return runAsyncResourceTask(this.resource, async () => {
       await this.resource.__internal_basePost({
         body: { code, strategy: 'backup_code' },
         action: 'attempt_second_factor',
       });
     });
   }

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.