@aooth/arbac-moost 0.1.8 → 0.1.10

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { t as AoothArbacUserCredentials } from "../user-B5vN7nVU.mjs";
+import { t as AoothArbacUserCredentials } from "../user-Dzu_08g0.mjs";
 import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKPMp3G8.mjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
@@ -141,4 +141,43 @@ declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, va
  */
 declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
 //#endregion
-export { AoothArbacUserCredentials, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getArbacAttenuationSpec, validateAttenuationTargets };
+//#region src/atscript/handle-spec.d.ts
+/**
+ * Resolved login/recovery HANDLE fields for a user credential model, discovered
+ * from the `@aooth.user.*` annotations (registered by `arbacPlugin`). Computed
+ * once per `TAtscriptAnnotatedType` and cached.
+ *
+ * - `emailField` — the field annotated `@aooth.user.email` **and** carrying a
+ *   `@db.index.unique` index. `undefined` when no field is annotated, or when
+ *   the annotated field lacks a unique index (the handle is then DISABLED — see
+ *   `warnings`).
+ * - `phoneField` — same, for `@aooth.user.phone`.
+ * - `handleFields` — the enabled handle field names in resolution order (email,
+ *   then phone; disabled handles omitted). Pass this straight to a `UserStore`
+ *   (`UsersStoreAtscriptDb` / `UserStoreMemory`) as its `handleFields` — the
+ *   store stays name-agnostic; this spec owns the email/phone semantics.
+ * - `warnings` — non-fatal misconfig notes (an annotated field with no unique
+ *   index → that handle is disabled, not fatal). The wiring layer should log
+ *   these at boot. Ambiguity (more than one field per role) is fatal and throws.
+ *
+ * A handle MUST be unique-when-present because `findByHandle` resolves a handle
+ * to AT MOST one row; a non-unique handle would resolve to an arbitrary one of
+ * several rows (an account-takeover footgun). That is why the unique index is
+ * the gate, and why a missing index disables rather than silently accepts.
+ */
+interface AoothUserHandleSpec {
+  emailField: string | undefined;
+  phoneField: string | undefined;
+  handleFields: string[];
+  warnings: string[];
+}
+/**
+ * Walk a user model's `@aooth.user.*` annotations into a cached
+ * {@link AoothUserHandleSpec}. Mirrors {@link getArbacAttenuationSpec}:
+ * structural, computed once, fail-loud on ambiguity. A model with no
+ * `@aooth.user.*` field resolves to all-`undefined` handles (email/phone login
+ * is simply unavailable — graceful degradation, not an error).
+ */
+declare function getAoothUserHandleSpec(userType: TAtscriptAnnotatedType): AoothUserHandleSpec;
+//#endregion
+export { AoothArbacUserCredentials, type AoothUserHandleSpec, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/atscript/index.mjs

@@ -1,5 +1,5 @@
 import { r as __decorate, t as ArbacUserProvider } from "../user.provider-BiM5P8fl.mjs";
-import { t as AoothArbacUserCredentials } from "../user-B5vN7nVU.mjs";
+import { t as AoothArbacUserCredentials } from "../user-Dzu_08g0.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
 //#region src/atscript/role-list.ts
@@ -27,7 +27,7 @@ function __decorateMetadata(k, v) {
 }
 //#endregion
 //#region src/atscript/auto-provider.ts
-const specCache$1 = /* @__PURE__ */ new WeakMap();
+const specCache$2 = /* @__PURE__ */ new WeakMap();
 /**
 * Resolve the identifier field on an object type using the three-step chain
 * documented on `ArbacExtractSpec.userIdField`. Used for the user type AND
@@ -66,7 +66,7 @@ function resolveIdentifierField(type) {
 	return metaId;
 }
 function getArbacExtractSpec(type) {
-	const cached = specCache$1.get(type);
+	const cached = specCache$2.get(type);
 	if (cached !== void 0) return cached;
 	const spec = {
 		userIdField: void 0,
@@ -75,7 +75,7 @@ function getArbacExtractSpec(type) {
 	};
 	const def = type.type;
 	if (def.kind !== "object") {
-		specCache$1.set(type, spec);
+		specCache$2.set(type, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -106,7 +106,7 @@ function getArbacExtractSpec(type) {
 		};
 	}
 	spec.userIdField = resolveIdentifierField(type);
-	specCache$1.set(type, spec);
+	specCache$2.set(type, spec);
 	return spec;
 }
 /**
@@ -236,14 +236,14 @@ let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUse
 AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [Object, Object])], AtscriptArbacUserProvider);
 //#endregion
 //#region src/atscript/attenuation-extract.ts
-const specCache = /* @__PURE__ */ new WeakMap();
+const specCache$1 = /* @__PURE__ */ new WeakMap();
 /**
 * Walk a credential model's `@arbac.attenuate.*` annotations into a cached
 * {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
 * structural, computed once, fail-loud on an ambiguous (multiple) role field.
 */
 function getArbacAttenuationSpec(credType) {
-	const cached = specCache.get(credType);
+	const cached = specCache$1.get(credType);
 	if (cached !== void 0) return cached;
 	const spec = {
 		roleField: void 0,
@@ -251,7 +251,7 @@ function getArbacAttenuationSpec(credType) {
 	};
 	const def = credType.type;
 	if (def.kind !== "object") {
-		specCache.set(credType, spec);
+		specCache$1.set(credType, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -266,7 +266,7 @@ function getArbacAttenuationSpec(credType) {
 	}
 	if (roleCandidates.length > 1) throw new Error(`getArbacAttenuationSpec: multiple @arbac.attenuate.role fields declared (${roleCandidates.join(", ")}). Exactly one assumed-role source is supported — drop @arbac.attenuate.role from all but the canonical field.`);
 	if (roleCandidates.length === 1) spec.roleField = roleCandidates[0];
-	specCache.set(credType, spec);
+	specCache$1.set(credType, spec);
 	return spec;
 }
 /**
@@ -330,4 +330,67 @@ function extractAttenuation(credType, record) {
 	return out;
 }
 //#endregion
-export { AoothArbacUserCredentials, AtscriptArbacUserProvider, extractAttenuation, getArbacAttenuationSpec, validateAttenuationTargets };
+//#region src/atscript/handle-spec.ts
+const specCache = /* @__PURE__ */ new WeakMap();
+/** A `@db.index.unique` annotation is a non-empty `(string | true)[]`. */
+function hasUniqueIndex(md) {
+	const unique = md.get("db.index.unique");
+	return Array.isArray(unique) && unique.length > 0;
+}
+/**
+* Resolve a single handle field for one role: fail loud on ambiguity (more than
+* one annotated field — there is no canonical choice), and warn-and-disable when
+* the sole annotated field lacks a unique index.
+*/
+function resolveHandleField(role, annotation, candidates, warnings) {
+	if (candidates.length === 0) return void 0;
+	if (candidates.length > 1) throw new Error(`getAoothUserHandleSpec: multiple ${annotation} fields declared (${candidates.map((c) => c.field).join(", ")}). Exactly one ${role} login handle is supported — drop ${annotation} from all but the canonical field.`);
+	const { field, md } = candidates[0];
+	if (!hasUniqueIndex(md)) {
+		warnings.push(`${annotation} on field "${field}" has no @db.index.unique — a login handle must resolve to at most one row, so the ${role} handle is DISABLED (login/recovery by ${role} unavailable). Add @db.index.unique to the field to enable it.`);
+		return;
+	}
+	return field;
+}
+/**
+* Walk a user model's `@aooth.user.*` annotations into a cached
+* {@link AoothUserHandleSpec}. Mirrors {@link getArbacAttenuationSpec}:
+* structural, computed once, fail-loud on ambiguity. A model with no
+* `@aooth.user.*` field resolves to all-`undefined` handles (email/phone login
+* is simply unavailable — graceful degradation, not an error).
+*/
+function getAoothUserHandleSpec(userType) {
+	const cached = specCache.get(userType);
+	if (cached !== void 0) return cached;
+	const spec = {
+		emailField: void 0,
+		phoneField: void 0,
+		handleFields: [],
+		warnings: []
+	};
+	const def = userType.type;
+	if (def.kind !== "object") {
+		specCache.set(userType, spec);
+		return spec;
+	}
+	const emailCandidates = [];
+	const phoneCandidates = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("aooth.user.email")) emailCandidates.push({
+			field: fieldName,
+			md
+		});
+		if (md.get("aooth.user.phone")) phoneCandidates.push({
+			field: fieldName,
+			md
+		});
+	}
+	spec.emailField = resolveHandleField("email", "@aooth.user.email", emailCandidates, spec.warnings);
+	spec.phoneField = resolveHandleField("phone", "@aooth.user.phone", phoneCandidates, spec.warnings);
+	spec.handleFields = [spec.emailField, spec.phoneField].filter((f) => f !== void 0);
+	specCache.set(userType, spec);
+	return spec;
+}
+//#endregion
+export { AoothArbacUserCredentials, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/plugin.d.mts

@@ -29,6 +29,16 @@ import { TAtscriptPlugin } from "@atscript/core";
  *   key in the user model's `@arbac.attribute` keyspace (validated to exist at
  *   boot). Multiple fields may each carry it, targeting different attrs.
  *
+ * This plugin also registers the `@aooth.user.*` identity-handle namespace
+ * (read by `getAoothUserHandleSpec`) so `.as` user models can mark their login
+ * handles name-agnostically:
+ *
+ * - `@aooth.user.email` — the field is the EMAIL login/recovery handle. Resolved
+ *   by annotation (not by being literally named `email`). MUST carry
+ *   `@db.index.unique` (unique-when-present); without it the handle is disabled
+ *   with a warning. At most one per type.
+ * - `@aooth.user.phone` — the PHONE login/recovery handle, same contract.
+ *
  * Install in `atscript.config.ts`:
  *
  * ```ts

package/dist/plugin.mjs

@@ -28,6 +28,16 @@ import { AnnotationSpec } from "@atscript/core";
 *   key in the user model's `@arbac.attribute` keyspace (validated to exist at
 *   boot). Multiple fields may each carry it, targeting different attrs.
 *
+* This plugin also registers the `@aooth.user.*` identity-handle namespace
+* (read by `getAoothUserHandleSpec`) so `.as` user models can mark their login
+* handles name-agnostically:
+*
+* - `@aooth.user.email` — the field is the EMAIL login/recovery handle. Resolved
+*   by annotation (not by being literally named `email`). MUST carry
+*   `@db.index.unique` (unique-when-present); without it the handle is disabled
+*   with a warning. At most one per type.
+* - `@aooth.user.phone` — the PHONE login/recovery handle, same contract.
+*
 * Install in `atscript.config.ts`:
 *
 * ```ts
@@ -39,40 +49,54 @@ function arbacPlugin() {
 	return {
 		name: "aoothjs-arbac",
 		config() {
-			return { annotations: { arbac: {
-				role: new AnnotationSpec({
-					description: "Marks this field as THE source of role identifiers for ARBAC evaluation. Two shapes are supported: inline (string | string[]) or @db.rel.from nav prop. Exactly one @arbac.role field per type — multiple declarations throw at boot.",
-					nodeType: ["prop"],
-					multiple: false
-				}),
-				attribute: new AnnotationSpec({
-					description: "Marks this field as a user attribute used by ARBAC scope evaluation. The field name becomes the attribute key. Multiple fields are merged.",
-					nodeType: ["prop"],
-					multiple: false
-				}),
-				userId: new AnnotationSpec({
-					description: "Overrides which field provides the user identifier for ARBAC. Resolution chain: @arbac.userId → @db.table.preferredId.uniqueIndex field → @meta.id.",
-					nodeType: ["prop"],
-					multiple: false
-				}),
-				attenuate: {
+			return { annotations: {
+				arbac: {
 					role: new AnnotationSpec({
-						description: "Marks the credential field holding the assumed-role SUBSET (string[]) for restrict-only ARBAC attenuation. Intersected with the user's roles (fail-closed). Exactly one @arbac.attenuate.role field per type — multiple declarations throw at boot.",
+						description: "Marks this field as THE source of role identifiers for ARBAC evaluation. Two shapes are supported: inline (string | string[]) or @db.rel.from nav prop. Exactly one @arbac.role field per type — multiple declarations throw at boot.",
+						nodeType: ["prop"],
+						multiple: false
+					}),
+					attribute: new AnnotationSpec({
+						description: "Marks this field as a user attribute used by ARBAC scope evaluation. The field name becomes the attribute key. Multiple fields are merged.",
+						nodeType: ["prop"],
+						multiple: false
+					}),
+					userId: new AnnotationSpec({
+						description: "Overrides which field provides the user identifier for ARBAC. Resolution chain: @arbac.userId → @db.table.preferredId.uniqueIndex field → @meta.id.",
+						nodeType: ["prop"],
+						multiple: false
+					}),
+					attenuate: {
+						role: new AnnotationSpec({
+							description: "Marks the credential field holding the assumed-role SUBSET (string[]) for restrict-only ARBAC attenuation. Intersected with the user's roles (fail-closed). Exactly one @arbac.attenuate.role field per type — multiple declarations throw at boot.",
+							nodeType: ["prop"],
+							multiple: false
+						}),
+						attr: new AnnotationSpec({
+							description: "Marks a credential field whose value narrows the named USER attribute for restrict-only ARBAC attenuation. The argument is the target key in the user model's @arbac.attribute keyspace (validated to exist at boot). Multiple fields may each carry it, targeting different attrs.",
+							nodeType: ["prop"],
+							multiple: false,
+							argument: {
+								name: "userAttr",
+								type: "string",
+								description: "Target user-attribute key (a field annotated @arbac.attribute on the user model)."
+							}
+						})
+					}
+				},
+				aooth: { user: {
+					email: new AnnotationSpec({
+						description: "Marks this field as the EMAIL login/recovery handle. The framework resolves the field by this annotation (name-agnostic) for findByHandle / recovery / signup. The field MUST carry @db.index.unique (unique-when-present) — a handle must resolve to at most one row; without a unique index the email handle is DISABLED with a warning. At most one @aooth.user.email field per type — multiple declarations throw at boot.",
 						nodeType: ["prop"],
 						multiple: false
 					}),
-					attr: new AnnotationSpec({
-						description: "Marks a credential field whose value narrows the named USER attribute for restrict-only ARBAC attenuation. The argument is the target key in the user model's @arbac.attribute keyspace (validated to exist at boot). Multiple fields may each carry it, targeting different attrs.",
+					phone: new AnnotationSpec({
+						description: "Marks this field as the PHONE login/recovery handle. Same resolution + unique-index contract as @aooth.user.email (disabled with a warning when the field lacks @db.index.unique). At most one @aooth.user.phone field per type — multiple throw at boot.",
 						nodeType: ["prop"],
-						multiple: false,
-						argument: {
-							name: "userAttr",
-							type: "string",
-							description: "Target user-attribute key (a field annotated @arbac.attribute on the user model)."
-						}
+						multiple: false
 					})
-				}
-			} } };
+				} }
+			} };
 		}
 	};
 }

package/dist/user-Dzu_08g0.mjs

@@ -0,0 +1,15 @@
+import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
+import "@aooth/user/atscript-db/model.as";
+//#region src/atscript/models/user.as
+var AoothArbacUserCredentials = class {
+	static __is_atscript_annotated_type = true;
+	static type = {};
+	static metadata = /* @__PURE__ */ new Map();
+	static id = "AoothArbacUserCredentials";
+	static toJsonSchema() {
+		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
+	}
+};
+defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
+//#endregion
+export { AoothArbacUserCredentials as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.8",
-    "@aooth/arbac-core": "0.1.8",
-    "@aooth/user": "0.1.8"
+    "@aooth/arbac": "0.1.10",
+    "@aooth/arbac-core": "0.1.10",
+    "@aooth/user": "0.1.10"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.69",
-    "@atscript/db": "^0.1.96",
-    "@atscript/db-sql-tools": "^0.1.96",
-    "@atscript/db-sqlite": "^0.1.96",
-    "@atscript/moost-db": "^0.1.96",
-    "@atscript/typescript": "^0.1.69",
-    "@moostjs/event-http": "^0.6.23",
+    "@atscript/core": "^0.1.71",
+    "@atscript/db": "^0.1.98",
+    "@atscript/db-sql-tools": "^0.1.98",
+    "@atscript/db-sqlite": "^0.1.98",
+    "@atscript/moost-db": "^0.1.98",
+    "@atscript/typescript": "^0.1.71",
+    "@moostjs/event-http": "^0.6.24",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.6",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.69"
+    "unplugin-atscript": "^0.1.71"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.96",
-    "@atscript/moost-db": "^0.1.96",
-    "@atscript/typescript": "^0.1.69",
-    "@moostjs/event-http": "^0.6.23",
+    "@atscript/db": "^0.1.98",
+    "@atscript/moost-db": "^0.1.98",
+    "@atscript/typescript": "^0.1.71",
+    "@moostjs/event-http": "^0.6.24",
     "@wooksjs/event-core": "^0.7.17",
     "@wooksjs/event-http": "^0.7.17",
-    "moost": "^0.6.23"
+    "moost": "^0.6.24"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {

package/dist/user-B5vN7nVU.mjs

@@ -1,15 +0,0 @@
-import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
-import "@aooth/user/atscript-db/model.as";
-//#region src/atscript/models/user.as
-var AoothArbacUserCredentials = class {
-	static __is_atscript_annotated_type = true;
-	static type = {};
-	static metadata = /* @__PURE__ */ new Map();
-	static id = "AoothArbacUserCredentials";
-	static toJsonSchema() {
-		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
-	}
-};
-defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("email", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "email_idx", true).optional().$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
-//#endregion
-export { AoothArbacUserCredentials as t };