@breadstone/archipel-mcp 0.0.13 → 0.0.14

package/data/packages/platform-authentication/api/Variable.AUTH_JWT_EXPIRES_IN.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_JWT\_EXPIRES\_IN'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_JWT\_EXPIRES\_IN
-
-```ts
-const AUTH_JWT_EXPIRES_IN: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:11](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L11)
-
-Lifetime of access tokens (e.g. `'15m'`, `'1h'`).

package/data/packages/platform-authentication/api/Variable.AUTH_JWT_SECRET.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_JWT\_SECRET'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_JWT\_SECRET
-
-```ts
-const AUTH_JWT_SECRET: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:8](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L8)
-
-Secret used to sign JWTs.

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_CHALLENGE_EXPIRES_IN.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_CHALLENGE\_EXPIRES\_IN'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_CHALLENGE\_EXPIRES\_IN
-
-```ts
-const AUTH_MFA_CHALLENGE_EXPIRES_IN: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:20](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L20)
-
-How long an MFA challenge stays valid (e.g. `'5m'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_EMAIL_CODE_TTL.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_EMAIL\_CODE\_TTL'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_EMAIL\_CODE\_TTL
-
-```ts
-const AUTH_MFA_EMAIL_CODE_TTL: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:35](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L35)
-
-Time-to-live for email OTP codes (e.g. `'10m'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_EMAIL_MIN_RESEND.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_EMAIL\_MIN\_RESEND'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_EMAIL\_MIN\_RESEND
-
-```ts
-const AUTH_MFA_EMAIL_MIN_RESEND: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:38](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L38)
-
-Minimum interval between email OTP resend requests (e.g. `'30s'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_ENCRYPTION_KEY.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_ENCRYPTION\_KEY'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_ENCRYPTION\_KEY
-
-```ts
-const AUTH_MFA_ENCRYPTION_KEY: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:17](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L17)
-
-AES encryption key used to encrypt MFA secrets at rest.

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_ISSUER.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_ISSUER'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_ISSUER
-
-```ts
-const AUTH_MFA_ISSUER: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:26](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L26)
-
-Issuer name shown in authenticator apps for TOTP MFA.

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_MAX_ATTEMPTS.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_MAX\_ATTEMPTS'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_MAX\_ATTEMPTS
-
-```ts
-const AUTH_MFA_MAX_ATTEMPTS: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:23](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L23)
-
-Maximum number of failed MFA attempts before lockout.

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_PUSH_CODE_TTL.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_PUSH\_CODE\_TTL'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_PUSH\_CODE\_TTL
-
-```ts
-const AUTH_MFA_PUSH_CODE_TTL: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:41](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L41)
-
-Time-to-live for push OTP codes (e.g. `'10m'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_PUSH_MIN_RESEND.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_PUSH\_MIN\_RESEND'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_PUSH\_MIN\_RESEND
-
-```ts
-const AUTH_MFA_PUSH_MIN_RESEND: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:44](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L44)
-
-Minimum interval between push OTP resend requests (e.g. `'30s'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_SMS_CODE_TTL.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_SMS\_CODE\_TTL'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_SMS\_CODE\_TTL
-
-```ts
-const AUTH_MFA_SMS_CODE_TTL: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:29](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L29)
-
-Time-to-live for SMS OTP codes (e.g. `'10m'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MFA_SMS_MIN_RESEND.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MFA\_SMS\_MIN\_RESEND'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MFA\_SMS\_MIN\_RESEND
-
-```ts
-const AUTH_MFA_SMS_MIN_RESEND: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:32](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L32)
-
-Minimum interval between SMS resend requests (e.g. `'30s'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MICROSOFT_CALLBACK_URL.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MICROSOFT\_CALLBACK\_URL'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MICROSOFT\_CALLBACK\_URL
-
-```ts
-const AUTH_MICROSOFT_CALLBACK_URL: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:65](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L65)
-
-Microsoft OAuth2 callback URL.

package/data/packages/platform-authentication/api/Variable.AUTH_MICROSOFT_CLIENT_ID.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MICROSOFT\_CLIENT\_ID'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MICROSOFT\_CLIENT\_ID
-
-```ts
-const AUTH_MICROSOFT_CLIENT_ID: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:59](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L59)
-
-Microsoft OAuth2 client ID.

package/data/packages/platform-authentication/api/Variable.AUTH_MICROSOFT_CLIENT_SECRET.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MICROSOFT\_CLIENT\_SECRET'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MICROSOFT\_CLIENT\_SECRET
-
-```ts
-const AUTH_MICROSOFT_CLIENT_SECRET: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:62](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L62)
-
-Microsoft OAuth2 client secret.

package/data/packages/platform-authentication/api/Variable.AUTH_MICROSOFT_SCOPE.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MICROSOFT\_SCOPE'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MICROSOFT\_SCOPE
-
-```ts
-const AUTH_MICROSOFT_SCOPE: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:71](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L71)
-
-Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`).

package/data/packages/platform-authentication/api/Variable.AUTH_MICROSOFT_TENANT.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_MICROSOFT\_TENANT'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_MICROSOFT\_TENANT
-
-```ts
-const AUTH_MICROSOFT_TENANT: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:68](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L68)
-
-Microsoft tenant ID or `'common'` for multi-tenant.

package/data/packages/platform-authentication/api/Variable.AUTH_VERIFY_JWT_EXPIRES_IN.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: AUTH\_VERIFY\_JWT\_EXPIRES\_IN'
-generated: true
-editUrl: false
----
-# Variable: AUTH\_VERIFY\_JWT\_EXPIRES\_IN
-
-```ts
-const AUTH_VERIFY_JWT_EXPIRES_IN: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:14](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L14)
-
-Lifetime of email-verification JWTs.

package/data/packages/platform-authentication/api/Variable.GITHUB_AUTH_CONFIG_ENTRIES.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: GITHUB\_AUTH\_CONFIG\_ENTRIES'
-generated: true
-editUrl: false
----
-# Variable: GITHUB\_AUTH\_CONFIG\_ENTRIES
-
-```ts
-const GITHUB_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, "module">>;
-```
-
-Defined in: [libs/platform-authentication/src/connectors/github/env.ts:14](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/connectors/github/env.ts#L14)
-
-Configuration entries required by GitHub OAuth authentication.

package/data/packages/platform-authentication/api/Variable.GOOGLE_AUTH_CONFIG_ENTRIES.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: GOOGLE\_AUTH\_CONFIG\_ENTRIES'
-generated: true
-editUrl: false
----
-# Variable: GOOGLE\_AUTH\_CONFIG\_ENTRIES
-
-```ts
-const GOOGLE_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, "module">>;
-```
-
-Defined in: [libs/platform-authentication/src/connectors/google/env.ts:14](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/connectors/google/env.ts#L14)
-
-Configuration entries required by Google OAuth authentication.

package/data/packages/platform-authentication/api/Variable.MICROSOFT_AUTH_CONFIG_ENTRIES.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: MICROSOFT\_AUTH\_CONFIG\_ENTRIES'
-generated: true
-editUrl: false
----
-# Variable: MICROSOFT\_AUTH\_CONFIG\_ENTRIES
-
-```ts
-const MICROSOFT_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, "module">>;
-```
-
-Defined in: [libs/platform-authentication/src/connectors/microsoft/env.ts:15](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/connectors/microsoft/env.ts#L15)
-
-Configuration entries required by Microsoft OAuth authentication.

package/data/packages/platform-authentication/api/Variable.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: PLATFORM\_AUTHENTICATION\_CONFIG\_ENTRIES'
-generated: true
-editUrl: false
----
-# Variable: PLATFORM\_AUTHENTICATION\_CONFIG\_ENTRIES
-
-```ts
-const PLATFORM_AUTHENTICATION_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, "module">>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:107](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L107)
-
-Core configuration entries required by `platform-authentication`.

package/data/packages/platform-authentication/api/Variable.ROLES_KEY.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: ROLES\_KEY'
-generated: true
-editUrl: false
----
-# Variable: ROLES\_KEY
-
-```ts
-const ROLES_KEY: "use_roles" = 'use_roles';
-```
-
-Defined in: [libs/platform-authentication/src/decorators/RolesDecorator.ts:12](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/decorators/RolesDecorator.ts#L12)
-
-Represents the key for the `UseRoles` decorator.

package/data/packages/platform-authentication/api/Variable.SEED_ANONYMOUS_USERNAME.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: SEED\_ANONYMOUS\_USERNAME'
-generated: true
-editUrl: false
----
-# Variable: SEED\_ANONYMOUS\_USERNAME
-
-```ts
-const SEED_ANONYMOUS_USERNAME: IConfigKey<string>;
-```
-
-Defined in: [libs/platform-authentication/src/env.ts:104](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/env.ts#L104)
-
-Username used for the anonymous seed user.

package/data/packages/platform-authentication/api/Variable.SESSION_LIST_MAPPING_KEY.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: SESSION\_LIST\_MAPPING\_KEY'
-generated: true
-editUrl: false
----
-# Variable: SESSION\_LIST\_MAPPING\_KEY
-
-```ts
-const SESSION_LIST_MAPPING_KEY: IMappingKey<ISessionMappingInput[], SessionResponse[]>;
-```
-
-Defined in: [libs/platform-authentication/src/mappers/SessionMappingProfile.ts:29](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/mappers/SessionMappingProfile.ts#L29)
-
-Type-safe mapping key for Session entity list to response list transformation.

package/data/packages/platform-authentication/api/Variable.SESSION_MAPPING_KEY.md

@@ -1,14 +0,0 @@
----
-title: 'Variable: SESSION\_MAPPING\_KEY'
-generated: true
-editUrl: false
----
-# Variable: SESSION\_MAPPING\_KEY
-
-```ts
-const SESSION_MAPPING_KEY: IMappingKey<ISessionMappingInput, SessionResponse>;
-```
-
-Defined in: [libs/platform-authentication/src/mappers/SessionMappingProfile.ts:20](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/mappers/SessionMappingProfile.ts#L20)
-
-Type-safe mapping key for Session entity to response transformation.

package/data/packages/platform-authentication/api/Variable.TOTP_MFA_PROVIDERS.md

@@ -1,29 +0,0 @@
----
-title: 'Variable: TOTP\_MFA\_PROVIDERS'
-generated: true
-editUrl: false
----
-# Variable: TOTP\_MFA\_PROVIDERS
-
-```ts
-const TOTP_MFA_PROVIDERS: ReadonlyArray<Provider>;
-```
-
-Defined in: [libs/platform-authentication/src/mfa/totp/index.ts:27](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/mfa/totp/index.ts#L27)
-
-Providers required by the [TotpMfaChannel](Class.TotpMfaChannel).
-
-Spread these into the `additionalProviders` option of `AuthModule.register()`
-when enabling TOTP-based MFA.
-
-## Example
-
-```typescript
-import { TotpMfaChannel, TOTP_MFA_PROVIDERS } from '@breadstone/archipel-platform-authentication/mfa/totp';
-
-AuthModule.register({
-  mfaChannels: [TotpMfaChannel],
-  additionalProviders: [...TOTP_MFA_PROVIDERS],
-  // ...
-});
-```

package/data/packages/platform-authentication/api/Variable.User.md

@@ -1,24 +0,0 @@
----
-title: 'Variable: User'
-generated: true
-editUrl: false
----
-# Variable: User
-
-```ts
-const User: (...dataOrPipes) => ParameterDecorator;
-```
-
-Defined in: [libs/platform-authentication/src/decorators/UserDecorator.ts:13](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-authentication/src/decorators/UserDecorator.ts#L13)
-
-Represents the `User` decorator.
-
-## Parameters
-
-| Parameter | Type |
-| ------ | ------ |
-| ...`dataOrPipes` | `unknown`[] |
-
-## Returns
-
-`ParameterDecorator`

package/data/packages/platform-authentication/api/index.md

@@ -1,112 +0,0 @@
----
-title: '@breadstone/archipel-platform-authentication'
-generated: true
-editUrl: false
----
-# @breadstone/archipel-platform-authentication
-
-## Classes
-
-| Class | Description |
-| ------ | ------ |
-| [AnonymousAuthGuard](Class.AnonymousAuthGuard) | The `AnonymousAuthGuard` protects routes using anonymous authentication. |
-| [AppleConnector](Class.AppleConnector) | The `AppleConnector` integrates Apple Sign In authentication. |
-| [AuthModule](Class.AuthModule) | The `AuthModule` handles JWT-based authentication, including token creation and validation. |
-| [AuthSubjectPort](Class.AuthSubjectPort) | Abstract port for resolving authentication subjects by identity. Used by the JWT, Local, and Anonymous strategies. |
-| [AuthTokenService](Class.AuthTokenService) | Generic service responsible for creating JWT access tokens. Builds a base payload from [IAuthSubject](Interface.IAuthSubject) and optionally enriches it via the [TokenEnricherPort](Class.TokenEnricherPort) with product-specific claims. |
-| [ChallengeService](Class.ChallengeService) | Stores and validates MFA login challenges. |
-| [GithubAuthGuard](Class.GithubAuthGuard) | The `GithubAuthGuard` protects routes using GitHub authentication. |
-| [GithubConnector](Class.GithubConnector) | - |
-| [GoogleConnector](Class.GoogleConnector) | The `GoogleConnector` integrates Google OAuth authentication. |
-| [JwtAuthGuard](Class.JwtAuthGuard) | The `JwtAuthGuard` protects routes using JWT-based authentication. |
-| [JwtPayloadBase](Class.JwtPayloadBase) | Abstract base class for JWT payloads. Products extend this to add their own claims (e.g. `profileId`, `isPro`). Used as both a serialization contract and NestJS injection token. |
-| [LastActiveMiddleware](Class.LastActiveMiddleware) | Middleware to automatically update the lastActive timestamp for authenticated sessions. Extracts the JWT token from the Authorization header and updates the session asynchronously. |
-| [LocalAuthGuard](Class.LocalAuthGuard) | The `LocalAuthGuard` protects routes using local authentication. |
-| [MfaService](Class.MfaService) | Orchestrates MFA channels, backup codes, and user preferences. |
-| [MfaSubjectPort](Class.MfaSubjectPort) | Abstract port for reading and writing MFA state on the underlying subject entity. Used by the MfaService and all MFA channel implementations. |
-| [MicrosoftConnector](Class.MicrosoftConnector) | The `MicrosoftConnector` integrates Microsoft OAuth authentication. |
-| [RolesGuard](Class.RolesGuard) | - |
-| [SessionMappingProfile](Class.SessionMappingProfile) | Mapping profile for Session entity to response transformations. |
-| [SessionPersistencePort](Class.SessionPersistencePort) | Abstract port for persisting and querying sessions. Used by the SessionService and LastActiveMiddleware. |
-| [SessionResponse](Class.SessionResponse) | The `SessionResponse` class. |
-| [SessionService](Class.SessionService) | Manages user sessions via the [SessionPersistencePort](Class.SessionPersistencePort). |
-| [SocialAuthGuard](Class.SocialAuthGuard) | - |
-| [SocialAuthPort](Class.SocialAuthPort) | Abstract port for resolving or creating subjects from social / OAuth profiles. Used by all social strategies (GitHub, Google, Microsoft, Apple). |
-| [TokenEnricherPort](Class.TokenEnricherPort) | Abstract port for enriching JWT claims with product-specific data. This is an optional port: when not provided, the token contains only base claims. |
-| [TotpMfaChannel](Class.TotpMfaChannel) | - |
-| [VerificationService](Class.VerificationService) | Manages email / PIN verification tokens via the [VerificationSubjectPort](Class.VerificationSubjectPort). |
-| [VerificationSubjectPort](Class.VerificationSubjectPort) | Abstract port for verifiable subject persistence. Used by the VerificationService to manage email/PIN verification. |
-
-## Interfaces
-
-| Interface | Description |
-| ------ | ------ |
-| [IAuthModuleOptions](Interface.IAuthModuleOptions) | Options for configuring the `AuthModule`. |
-| [IAuthSubject](Interface.IAuthSubject) | Generic authentication subject returned by the [AuthSubjectPort](Class.AuthSubjectPort). Represents any entity that can authenticate (user, service account, etc.). |
-| [IMfaChallengePayload](Interface.IMfaChallengePayload) | Represents the MFA challenge payload encoded in a challenge token. |
-| [IMfaChallengeState](Interface.IMfaChallengeState) | - |
-| [IMfaConfirmation](Interface.IMfaConfirmation) | Represents the activation result for multi-factor authentication. |
-| [IMfaSetup](Interface.IMfaSetup) | Represents the data required to onboard a multi-factor authenticator. |
-| [IMfaSubject](Interface.IMfaSubject) | Represents an MFA-enabled subject. Contains the data the MFA subsystem needs to read and write MFA state on the underlying user-like entity. |
-| [IMfaSubjectUpdate](Interface.IMfaSubjectUpdate) | Data payload for updating MFA state on the underlying entity. All properties are optional — only the provided ones are applied. |
-| [ISessionRecord](Interface.ISessionRecord) | Represents a persisted session record. |
-| [ISignInResult](Interface.ISignInResult) | Represents the outcome of a sign-in attempt. |
-| [ISocialProfile](Interface.ISocialProfile) | Profile data received from a social / OAuth provider. |
-| [IStoreSessionArgs](Interface.IStoreSessionArgs) | Arguments for storing a new session. |
-| [IVerifiableSubject](Interface.IVerifiableSubject) | Represents a verifiable authentication subject. Used by the [VerificationService](Class.VerificationService) to verify email / PIN. |
-
-## Variables
-
-| Variable | Description |
-| ------ | ------ |
-| [APPLE\_AUTH\_CONFIG\_ENTRIES](Variable.APPLE_AUTH_CONFIG_ENTRIES) | Configuration entries required by Apple Sign-In authentication. |
-| [AUTH\_APPLE\_CALLBACK\_URL](Variable.AUTH_APPLE_CALLBACK_URL) | Apple Sign-In callback URL. |
-| [AUTH\_APPLE\_CLIENT\_ID](Variable.AUTH_APPLE_CLIENT_ID) | Apple Sign-In client (service) ID. |
-| [AUTH\_APPLE\_KEY\_ID](Variable.AUTH_APPLE_KEY_ID) | Apple Sign-In key ID. |
-| [AUTH\_APPLE\_PRIVATE\_KEY](Variable.AUTH_APPLE_PRIVATE_KEY) | Apple Sign-In private key (PEM string). |
-| [AUTH\_APPLE\_SCOPE](Variable.AUTH_APPLE_SCOPE) | Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). |
-| [AUTH\_APPLE\_TEAM\_ID](Variable.AUTH_APPLE_TEAM_ID) | Apple developer team ID. |
-| [AUTH\_GITHUB\_CALLBACK\_URL](Variable.AUTH_GITHUB_CALLBACK_URL) | GitHub OAuth callback URL. |
-| [AUTH\_GITHUB\_CLIENT\_ID](Variable.AUTH_GITHUB_CLIENT_ID) | GitHub OAuth client ID. |
-| [AUTH\_GITHUB\_CLIENT\_SECRET](Variable.AUTH_GITHUB_CLIENT_SECRET) | GitHub OAuth client secret. |
-| [AUTH\_GITHUB\_SCOPE](Variable.AUTH_GITHUB_SCOPE) | Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). |
-| [AUTH\_GOOGLE\_CALLBACK\_URL](Variable.AUTH_GOOGLE_CALLBACK_URL) | Google OAuth2 callback URL. |
-| [AUTH\_GOOGLE\_CLIENT\_ID](Variable.AUTH_GOOGLE_CLIENT_ID) | Google OAuth2 client ID. |
-| [AUTH\_GOOGLE\_CLIENT\_SECRET](Variable.AUTH_GOOGLE_CLIENT_SECRET) | Google OAuth2 client secret. |
-| [AUTH\_GOOGLE\_SCOPE](Variable.AUTH_GOOGLE_SCOPE) | Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). |
-| [AUTH\_JWT\_EXPIRES\_IN](Variable.AUTH_JWT_EXPIRES_IN) | Lifetime of access tokens (e.g. `'15m'`, `'1h'`). |
-| [AUTH\_JWT\_SECRET](Variable.AUTH_JWT_SECRET) | Secret used to sign JWTs. |
-| [AUTH\_MFA\_CHALLENGE\_EXPIRES\_IN](Variable.AUTH_MFA_CHALLENGE_EXPIRES_IN) | How long an MFA challenge stays valid (e.g. `'5m'`). |
-| [AUTH\_MFA\_EMAIL\_CODE\_TTL](Variable.AUTH_MFA_EMAIL_CODE_TTL) | Time-to-live for email OTP codes (e.g. `'10m'`). |
-| [AUTH\_MFA\_EMAIL\_MIN\_RESEND](Variable.AUTH_MFA_EMAIL_MIN_RESEND) | Minimum interval between email OTP resend requests (e.g. `'30s'`). |
-| [AUTH\_MFA\_ENCRYPTION\_KEY](Variable.AUTH_MFA_ENCRYPTION_KEY) | AES encryption key used to encrypt MFA secrets at rest. |
-| [AUTH\_MFA\_ISSUER](Variable.AUTH_MFA_ISSUER) | Issuer name shown in authenticator apps for TOTP MFA. |
-| [AUTH\_MFA\_MAX\_ATTEMPTS](Variable.AUTH_MFA_MAX_ATTEMPTS) | Maximum number of failed MFA attempts before lockout. |
-| [AUTH\_MFA\_PUSH\_CODE\_TTL](Variable.AUTH_MFA_PUSH_CODE_TTL) | Time-to-live for push OTP codes (e.g. `'10m'`). |
-| [AUTH\_MFA\_PUSH\_MIN\_RESEND](Variable.AUTH_MFA_PUSH_MIN_RESEND) | Minimum interval between push OTP resend requests (e.g. `'30s'`). |
-| [AUTH\_MFA\_SMS\_CODE\_TTL](Variable.AUTH_MFA_SMS_CODE_TTL) | Time-to-live for SMS OTP codes (e.g. `'10m'`). |
-| [AUTH\_MFA\_SMS\_MIN\_RESEND](Variable.AUTH_MFA_SMS_MIN_RESEND) | Minimum interval between SMS resend requests (e.g. `'30s'`). |
-| [AUTH\_MICROSOFT\_CALLBACK\_URL](Variable.AUTH_MICROSOFT_CALLBACK_URL) | Microsoft OAuth2 callback URL. |
-| [AUTH\_MICROSOFT\_CLIENT\_ID](Variable.AUTH_MICROSOFT_CLIENT_ID) | Microsoft OAuth2 client ID. |
-| [AUTH\_MICROSOFT\_CLIENT\_SECRET](Variable.AUTH_MICROSOFT_CLIENT_SECRET) | Microsoft OAuth2 client secret. |
-| [AUTH\_MICROSOFT\_SCOPE](Variable.AUTH_MICROSOFT_SCOPE) | Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). |
-| [AUTH\_MICROSOFT\_TENANT](Variable.AUTH_MICROSOFT_TENANT) | Microsoft tenant ID or `'common'` for multi-tenant. |
-| [AUTH\_VERIFY\_JWT\_EXPIRES\_IN](Variable.AUTH_VERIFY_JWT_EXPIRES_IN) | Lifetime of email-verification JWTs. |
-| [GITHUB\_AUTH\_CONFIG\_ENTRIES](Variable.GITHUB_AUTH_CONFIG_ENTRIES) | Configuration entries required by GitHub OAuth authentication. |
-| [GOOGLE\_AUTH\_CONFIG\_ENTRIES](Variable.GOOGLE_AUTH_CONFIG_ENTRIES) | Configuration entries required by Google OAuth authentication. |
-| [MICROSOFT\_AUTH\_CONFIG\_ENTRIES](Variable.MICROSOFT_AUTH_CONFIG_ENTRIES) | Configuration entries required by Microsoft OAuth authentication. |
-| [PLATFORM\_AUTHENTICATION\_CONFIG\_ENTRIES](Variable.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES) | Core configuration entries required by `platform-authentication`. |
-| [ROLES\_KEY](Variable.ROLES_KEY) | Represents the key for the `UseRoles` decorator. |
-| [SEED\_ANONYMOUS\_USERNAME](Variable.SEED_ANONYMOUS_USERNAME) | Username used for the anonymous seed user. |
-| [SESSION\_LIST\_MAPPING\_KEY](Variable.SESSION_LIST_MAPPING_KEY) | Type-safe mapping key for Session entity list to response list transformation. |
-| [SESSION\_MAPPING\_KEY](Variable.SESSION_MAPPING_KEY) | Type-safe mapping key for Session entity to response transformation. |
-| [TOTP\_MFA\_PROVIDERS](Variable.TOTP_MFA_PROVIDERS) | Providers required by the [TotpMfaChannel](Class.TotpMfaChannel). |
-| [User](Variable.User) | Represents the `User` decorator. |
-
-## Functions
-
-| Function | Description |
-| ------ | ------ |
-| [socialAuthGuardFactory](Function.socialAuthGuardFactory) | - |
-| [Token](Function.Token) | Represents the `Token` decorator. |
-| [UseRoles](Function.UseRoles) | Represents the `UseRoles` decorator. |