- Shipped
- November 15, 2026 at 4:56 AM UTC
- Author
- Kamo
- Commit
- f882dde
- KamoMobile approval + QR: keep the start's pollToken and poll interval and send pollToken on every status call (@kamo/auth 0.6.1); a FLOW_UNKNOWN poll reads as expired. - Trust This Device rides the second factor as rememberDevice (the answer's trustedDeviceToken + trustedDeviceDays set HttpOnly kamo_td); the email-code step no longer offers it (securityservice has no such field there — MFA follows and asks). Its lifetime is read from signin/methods or from the MFA-required answer. X-Kamo-Trusted-Device now rides every sign-in call (signin client relays, /api/session/select), not only /login. - An org switching a method off (*_NOT_ALLOWED) hides it like a method never offered; a passkey the site does not recognise **************** gets its own plain-language card. - The password request is unchanged.