@absolutejs/auth 0.29.0-beta.2 → 0.29.0-beta.4

package/dist/mfa/challenge.d.ts

@@ -28,10 +28,10 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
             query: unknown;
             headers: unknown;
             response: {
+                401: "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "authenticated";
                 };
-                401: "No MFA challenge in progress" | "Invalid MFA code";
                 422: {
                     type: "validation";
                     on: string;

package/dist/mfa/routes.d.ts

@@ -26,11 +26,11 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
+                401: "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
                 };
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -53,11 +53,11 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -80,10 +80,10 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
+                401: "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "authenticated";
                 };
-                401: "No MFA challenge in progress" | "Invalid MFA code";
                 422: {
                     type: "validation";
                     on: string;

package/dist/mfa/totp.d.ts

@@ -26,11 +26,11 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             query: unknown;
             headers: unknown;
             response: {
+                401: "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
                 };
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -53,11 +53,11 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             query: unknown;
             headers: unknown;
             response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;

package/dist/oidc/config.d.ts

@@ -1,11 +1,13 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { OnClientRegistration } from './registration';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
     accessTokenTtlMs?: number;
     authorizationCodeStore: AuthorizationCodeStore;
     clientAssertionJtiStore?: ClientAssertionJtiStore;
+    clientRegistrationTokenStore?: ClientRegistrationTokenStore;
     clientStore: OAuthClientStore;
     deviceAuthorizationStore?: DeviceAuthorizationStore;
     deviceCodeTtlMs?: number;
@@ -28,9 +30,11 @@ export type OidcProviderConfig<UserType> = {
     getUserId: (user: UserType) => string;
     idTokenTtlMs?: number;
     issuer: string;
+    initialAccessTokenStore?: InitialAccessTokenStore;
     loginUrl?: string;
     logoutDeliveryStore?: LogoutDeliveryStore;
     oidcRoute?: RouteString;
+    onClientRegistration?: OnClientRegistration;
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;
     signingKey: SigningKey;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,7 +1,9 @@
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
 export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
 export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
 export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
+export declare const createInMemoryClientRegistrationTokenStore: () => ClientRegistrationTokenStore;
+export declare const createInMemoryInitialAccessTokenStore: (initialHashes?: string[]) => InitialAccessTokenStore;
 export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
 export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;

package/dist/oidc/postgresStores.d.ts

@@ -1,5 +1,5 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const oauthClientAssertionJtisTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_client_assertion_jtis";
     schema: undefined;
@@ -81,6 +81,68 @@ export declare const oauthClientAssertionJtisTable: import("drizzle-orm/pg-core"
     };
     dialect: "pg";
 }>;
+export declare const oauthClientRegistrationTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_client_registration_tokens";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_client_registration_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_oauth_client_registration_tokens";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "auth_oauth_client_registration_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthClientsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_clients";
     schema: undefined;
@@ -763,6 +825,32 @@ export declare const oauthDeviceAuthorizationsTable: import("drizzle-orm/pg-core
     };
     dialect: "pg";
 }>;
+export declare const oauthInitialAccessTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_initial_access_tokens";
+    schema: undefined;
+    columns: {
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "auth_oauth_initial_access_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthLogoutDeliveriesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_logout_deliveries";
     schema: undefined;
@@ -1112,13 +1200,17 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
 }>;
 export declare const createNeonAuthorizationCodeStore: (databaseUrl: string) => AuthorizationCodeStore;
 export declare const createNeonClientAssertionJtiStore: (databaseUrl: string) => ClientAssertionJtiStore;
+export declare const createNeonClientRegistrationTokenStore: (databaseUrl: string) => ClientRegistrationTokenStore;
 export declare const createNeonDeviceAuthorizationStore: (databaseUrl: string) => DeviceAuthorizationStore;
+export declare const createNeonInitialAccessTokenStore: (databaseUrl: string) => InitialAccessTokenStore;
 export declare const createNeonLogoutDeliveryStore: (databaseUrl: string) => LogoutDeliveryStore;
 export declare const createNeonOAuthClientStore: (databaseUrl: string) => OAuthClientStore;
 export declare const createNeonOidcRefreshTokenStore: (databaseUrl: string) => OidcRefreshTokenStore;
 export declare const createPostgresAuthorizationCodeStore: (db: AnyPgDatabase) => AuthorizationCodeStore;
 export declare const createPostgresClientAssertionJtiStore: (db: AnyPgDatabase) => ClientAssertionJtiStore;
+export declare const createPostgresClientRegistrationTokenStore: (db: AnyPgDatabase) => ClientRegistrationTokenStore;
 export declare const createPostgresDeviceAuthorizationStore: (db: AnyPgDatabase) => DeviceAuthorizationStore;
+export declare const createPostgresInitialAccessTokenStore: (db: AnyPgDatabase) => InitialAccessTokenStore;
 export declare const createPostgresLogoutDeliveryStore: (db: AnyPgDatabase) => LogoutDeliveryStore;
 export declare const createPostgresOAuthClientStore: (db: AnyPgDatabase) => OAuthClientStore;
 export declare const createPostgresOidcRefreshTokenStore: (db: AnyPgDatabase) => OidcRefreshTokenStore;

package/dist/oidc/registration.d.ts

@@ -0,0 +1,131 @@
+import type { ClientRegistrationTokenStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore } from './types';
+export type ClientRegistrationMetadata = {
+    backchannel_logout_uri?: string;
+    client_name?: string;
+    jwks?: JsonWebKey[];
+    jwks_uri?: string;
+    post_logout_redirect_uris?: string[];
+    redirect_uris?: string[];
+    scope?: string;
+};
+export type ClientRegistrationDecision = {
+    allow: false;
+    denyReason: string;
+} | {
+    allow: true;
+    transform?: Partial<OAuthClient>;
+};
+export type OnClientRegistration = (context: {
+    metadata: ClientRegistrationMetadata;
+}) => ClientRegistrationDecision | Promise<ClientRegistrationDecision>;
+export type RegisterClientResult = {
+    body: {
+        error: string;
+        error_description?: string;
+    };
+    ok: false;
+    status: 400 | 401 | 403 | 501;
+} | {
+    body: ClientRegistrationMetadata & {
+        client_id: string;
+        registration_access_token: string;
+        registration_client_uri: string;
+    };
+    ok: true;
+};
+export declare const deleteRegisteredClient: ({ authorization, clientId, clientStore, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "unsupported_response_type";
+    };
+    readonly status: 501;
+} | {
+    readonly body: {
+        readonly error: "invalid_token";
+    };
+    readonly status: 401;
+} | {
+    readonly status: 204;
+    readonly body?: undefined;
+}>;
+export declare const getRegisteredClient: ({ authorization, clientId, clientStore, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "invalid_token";
+    };
+    readonly status: 401;
+} | {
+    readonly body: {
+        readonly error: "invalid_client";
+    };
+    readonly status: 404;
+} | {
+    readonly body: ClientRegistrationMetadata & {
+        client_id: string;
+    };
+    readonly status: 200;
+}>;
+export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
+    clientStore: OAuthClientStore;
+    initialAccessTokenStore?: InitialAccessTokenStore;
+    metadata: ClientRegistrationMetadata;
+    onClientRegistration?: OnClientRegistration;
+    presentedInitialAccessToken?: string;
+    registrationBaseUrl: string;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<RegisterClientResult>;
+export declare const updateRegisteredClient: ({ authorization, clientId, clientStore, metadata, onClientRegistration, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    metadata: ClientRegistrationMetadata;
+    onClientRegistration?: OnClientRegistration;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "unsupported_response_type";
+        readonly error_description?: undefined;
+    };
+    readonly status: 501;
+} | {
+    readonly body: {
+        readonly error: "invalid_token";
+        readonly error_description?: undefined;
+    };
+    readonly status: 401;
+} | {
+    readonly body: {
+        readonly error: "invalid_client_metadata";
+        readonly error_description: string;
+    };
+    readonly status: 403;
+} | {
+    readonly body: {
+        readonly error: "invalid_redirect_uri";
+        readonly error_description?: undefined;
+    };
+    readonly status: 400;
+} | {
+    readonly body: {
+        readonly registration_access_token: string;
+        readonly backchannel_logout_uri?: string;
+        readonly client_name?: string;
+        readonly jwks?: JsonWebKey[];
+        readonly jwks_uri?: string;
+        readonly post_logout_redirect_uris?: string[];
+        readonly redirect_uris?: string[];
+        readonly scope?: string;
+        readonly client_id: string;
+        readonly error?: undefined;
+        readonly error_description?: undefined;
+    };
+    readonly status: 200;
+}>;

package/dist/oidc/routes.d.ts

@@ -247,6 +247,126 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             };
         };
     };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                jwks?: any;
+                scope?: string | undefined;
+                backchannel_logout_uri?: string | undefined;
+                client_name?: string | undefined;
+                jwks_uri?: string | undefined;
+                post_logout_redirect_uris?: string[] | undefined;
+                redirect_uris?: string[] | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":clientId": {
+            get: {
+                body: unknown;
+                params: {
+                    clientId: string;
+                };
+                query: unknown;
+                headers: {
+                    authorization?: string | undefined;
+                };
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":clientId": {
+            put: {
+                body: {
+                    jwks?: any;
+                    scope?: string | undefined;
+                    backchannel_logout_uri?: string | undefined;
+                    client_name?: string | undefined;
+                    jwks_uri?: string | undefined;
+                    post_logout_redirect_uris?: string[] | undefined;
+                    redirect_uris?: string[] | undefined;
+                };
+                params: {
+                    clientId: string;
+                };
+                query: unknown;
+                headers: {
+                    authorization?: string | undefined;
+                };
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":clientId": {
+            delete: {
+                body: unknown;
+                params: {
+                    clientId: string;
+                };
+                query: unknown;
+                headers: {
+                    authorization?: string | undefined;
+                };
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         get: {

package/dist/oidc/types.d.ts

@@ -13,7 +13,23 @@ export type ClientAssertionJtiStore = {
     recordIfFresh: (clientId: string, jti: string, expiresAt: number) => Promise<boolean>;
 };
 export type OAuthClientStore = {
+    deleteClient?: (clientId: string) => Promise<void>;
     findClient: (clientId: string) => Promise<OAuthClient | undefined>;
+    saveClient?: (client: OAuthClient) => Promise<void>;
+    updateClient?: (clientId: string, client: OAuthClient) => Promise<void>;
+};
+export type ClientRegistrationToken = {
+    clientId: string;
+    createdAt: number;
+    tokenHash: string;
+};
+export type ClientRegistrationTokenStore = {
+    deleteByClientId: (clientId: string) => Promise<void>;
+    findByTokenHash: (tokenHash: string) => Promise<ClientRegistrationToken | undefined>;
+    saveToken: (token: ClientRegistrationToken) => Promise<void>;
+};
+export type InitialAccessTokenStore = {
+    consumeToken: (tokenHash: string) => Promise<boolean>;
 };
 export type AuthorizationCode = {
     claims?: Record<string, unknown>;

package/dist/organizations/routes.d.ts

@@ -27,13 +27,13 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
             query: unknown;
             headers: unknown;
             response: {
+                401: "Authentication required";
                 200: {
                     readonly organizations: {
                         membership: import("./types").OrganizationMembership;
                         organization: import("./types").Organization | undefined;
                     }[];
                 };
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -57,11 +57,11 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
             query: unknown;
             headers: unknown;
             response: {
+                401: "Authentication required";
+                403: "Cannot create organizations";
                 200: {
                     readonly organization: import("./types").Organization;
                 };
-                401: "Authentication required";
-                403: "Cannot create organizations";
                 422: {
                     type: "validation";
                     on: string;
@@ -89,12 +89,12 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                     query: unknown;
                     headers: unknown;
                     response: {
+                        401: "Authentication required";
+                        403: "Cannot manage members";
                         200: {
                             readonly invitationId: string;
                             readonly token: string;
                         };
-                        401: "Authentication required";
-                        403: "Cannot manage members";
                         422: {
                             type: "validation";
                             on: string;
@@ -121,6 +121,8 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                     query: unknown;
                     headers: unknown;
                     response: {
+                        401: "Authentication required";
+                        403: "Cannot manage members";
                         200: {
                             readonly invitations: {
                                 email: string;
@@ -130,8 +132,6 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                                 state: import("./types").InvitationState;
                             }[];
                         };
-                        401: "Authentication required";
-                        403: "Cannot manage members";
                         422: {
                             type: "validation";
                             on: string;
@@ -160,12 +160,12 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                         query: unknown;
                         headers: unknown;
                         response: {
-                            200: {
-                                readonly revoked: string;
-                            };
                             401: "Authentication required";
                             403: "Cannot manage members";
                             404: "Invitation not found";
+                            200: {
+                                readonly revoked: string;
+                            };
                             422: {
                                 type: "validation";
                                 on: string;
@@ -193,12 +193,12 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                     query: unknown;
                     headers: unknown;
                     response: {
+                        400: "Invalid or expired invitation";
+                        401: "Authentication required";
                         200: {
                             readonly organizationId: string;
                             readonly roles: string[];
                         };
-                        400: "Invalid or expired invitation";
-                        401: "Authentication required";
                         422: {
                             type: "validation";
                             on: string;
@@ -225,11 +225,11 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                     query: unknown;
                     headers: unknown;
                     response: {
+                        401: "Authentication required";
+                        403: "Not a member";
                         200: {
                             readonly members: import("./types").OrganizationMembership[];
                         };
-                        401: "Authentication required";
-                        403: "Not a member";
                         422: {
                             type: "validation";
                             on: string;
@@ -258,11 +258,11 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                         query: unknown;
                         headers: unknown;
                         response: {
+                            401: "Authentication required";
+                            403: "Cannot manage members";
                             200: {
                                 readonly removed: string;
                             };
-                            401: "Authentication required";
-                            403: "Cannot manage members";
                             422: {
                                 type: "validation";
                                 on: string;

package/dist/passwordless/routes.d.ts

@@ -64,11 +64,11 @@ export declare const passwordlessRoutes: <UserType>({ authSessionStore, emit, ge
                     query: unknown;
                     headers: unknown;
                     response: {
+                        400: "Invalid or expired link";
+                        401: "No account for this email";
                         200: {
                             readonly status: "authenticated";
                         };
-                        400: "Invalid or expired link";
-                        401: "No account for this email";
                         422: {
                             type: "validation";
                             on: string;
@@ -123,11 +123,11 @@ export declare const passwordlessRoutes: <UserType>({ authSessionStore, emit, ge
                     query: unknown;
                     headers: unknown;
                     response: {
+                        400: "Invalid or expired code";
+                        401: "No account for this email";
                         200: {
                             readonly status: "authenticated";
                         };
-                        400: "Invalid or expired code";
-                        401: "No account for this email";
                         422: {
                             type: "validation";
                             on: string;