@cairs-npm/express-auth-2fa 0.0.0-stage → 0.1.1

package/dist/index.cjs

@@ -0,0 +1,1760 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/crypto/hash.ts
+var hash_exports = {};
+__export(hash_exports, {
+  DUMMY_HASH: () => DUMMY_HASH,
+  hashPassword: () => hashPassword,
+  randomId: () => randomId,
+  randomSmsCode: () => randomSmsCode,
+  randomToken: () => randomToken,
+  sha256Hex: () => sha256Hex,
+  timingSafeEqualStr: () => timingSafeEqualStr,
+  verifyPassword: () => verifyPassword
+});
+function hashPassword(plain, params) {
+  return import_argon2.default.hash(plain, {
+    type: import_argon2.default.argon2id,
+    memoryCost: params.memoryKiB,
+    timeCost: params.iterations,
+    parallelism: params.parallelism
+  });
+}
+function verifyPassword(hash, plain) {
+  return import_argon2.default.verify(hash, plain).catch(() => false);
+}
+function sha256Hex(value) {
+  return import_node_crypto.default.createHash("sha256").update(value, "utf8").digest("hex");
+}
+function timingSafeEqualStr(a, b) {
+  const ha = import_node_crypto.default.createHash("sha256").update(a).digest();
+  const hb = import_node_crypto.default.createHash("sha256").update(b).digest();
+  return import_node_crypto.default.timingSafeEqual(ha, hb);
+}
+function randomToken() {
+  return import_node_crypto.default.randomBytes(32).toString("base64url");
+}
+function randomSmsCode() {
+  return import_node_crypto.default.randomInt(0, 1e6).toString().padStart(6, "0");
+}
+function randomId(prefix) {
+  return `${prefix}_${import_node_crypto.default.randomBytes(9).toString("base64url")}`;
+}
+var import_node_crypto, import_argon2, DUMMY_HASH;
+var init_hash = __esm({
+  "src/crypto/hash.ts"() {
+    "use strict";
+    import_node_crypto = __toESM(require("crypto"), 1);
+    import_argon2 = __toESM(require("argon2"), 1);
+    DUMMY_HASH = "$argon2id$v=19$m=65536,t=3,p=4$AAAAAAAAAAAAAAAAAAAAAA$1AkBK4sQubUqG5fSG5+0E4yP+4DpVXq3sfJv4boqK3k";
+  }
+});
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  ApiErrorException: () => ApiErrorException,
+  AuthService: () => AuthService,
+  apiError: () => apiError,
+  consoleEmail: () => consoleEmail,
+  consoleSms: () => consoleSms,
+  createAuthRouter: () => createAuthRouter,
+  errorHandler: () => errorHandler,
+  getCollections: () => getCollections,
+  migrate: () => migrate2,
+  twilioSms: () => twilioSms
+});
+module.exports = __toCommonJS(src_exports);
+var import_express3 = require("express");
+var import_helmet = __toESM(require("helmet"), 1);
+
+// src/config/schema.ts
+var import_zod = require("zod");
+var limitSchema = import_zod.z.object({
+  /** Failed passwords before lockout (BR-2). */
+  loginMaxAttempts: import_zod.z.number().int().positive().default(5),
+  /** Window for failed-login counting, minutes (BR-2). */
+  loginWindowMin: import_zod.z.number().positive().default(15),
+  /** Lockout duration, minutes (BR-2, BR-9). */
+  lockMinutes: import_zod.z.number().positive().default(15),
+  /** Min seconds between SMS sends on one challenge (BR-6). */
+  smsResendSec: import_zod.z.number().nonnegative().default(30),
+  /** Max SMS sends per challenge (BR-6). */
+  smsMaxPerChallenge: import_zod.z.number().int().positive().default(5),
+  /** Max SMS sends per user per hour (BR-6). */
+  smsMaxPerUserHour: import_zod.z.number().int().positive().default(10),
+  /** Wrong codes per challenge before lockout (BR-9). */
+  mfaMaxAttempts: import_zod.z.number().int().positive().default(5),
+  /** Max verification methods per user (BR-16). */
+  maxMethods: import_zod.z.number().int().positive().default(5),
+  /** Per-IP login requests per minute (NFR-B4). */
+  loginIpPerMin: import_zod.z.number().int().positive().default(20),
+  /** Per-IP MFA verify requests per minute (NFR-B4). */
+  verifyIpPerMin: import_zod.z.number().int().positive().default(30),
+  /** Per-IP step-up requests per minute (NFR-B4). */
+  stepUpIpPerMin: import_zod.z.number().int().positive().default(20)
+});
+var argon2Schema = import_zod.z.object({
+  memoryKiB: import_zod.z.number().int().positive().default(65536),
+  iterations: import_zod.z.number().int().positive().default(3),
+  parallelism: import_zod.z.number().int().positive().default(4)
+});
+var cookieSchema = import_zod.z.object({
+  secure: import_zod.z.boolean().default(true),
+  domain: import_zod.z.string().optional(),
+  sameSite: import_zod.z.enum(["lax", "strict", "none"]).default("lax"),
+  path: import_zod.z.string().default("/")
+});
+var ttlSchema = import_zod.z.object({
+  accessTokenSec: import_zod.z.number().int().positive().default(900),
+  refreshTokenDays: import_zod.z.number().positive().default(30),
+  trustedDeviceDays: import_zod.z.number().positive().default(30),
+  challengeSec: import_zod.z.number().int().positive().default(300),
+  stepUpSec: import_zod.z.number().int().positive().default(300),
+  pendingMethodMin: import_zod.z.number().positive().default(15),
+  auditDays: import_zod.z.number().positive().default(365)
+});
+var configSchema = import_zod.z.object({
+  db: import_zod.z.custom((v) => !!v && typeof v.collection === "function"),
+  issuer: import_zod.z.string().min(1),
+  /** PEM PKCS8 private key (Ed25519 or RSA). Required, min 32 bytes. */
+  jwtPrivateKey: import_zod.z.string().min(32),
+  /** 32-byte AES key, raw string or base64. Required. */
+  encryptionKey: import_zod.z.string().min(32),
+  keyId: import_zod.z.string().default("v1"),
+  userAdapter: import_zod.z.custom(
+    (v) => !!v && typeof v.findByLogin === "function" && typeof v.findById === "function"
+  ),
+  smsProvider: import_zod.z.custom((v) => !!v && typeof v.send === "function"),
+  /** Enables the always-present EMAIL method (default for new users). */
+  emailProvider: import_zod.z.custom((v) => !v || typeof v.send === "function").optional(),
+  /** MongoClient for transactions; defaults to the client behind `db`. */
+  client: import_zod.z.custom((v) => !v || typeof v.startSession === "function").optional(),
+  logger: import_zod.z.custom().optional(),
+  hooks: import_zod.z.custom((v) => !v || typeof v === "object").optional(),
+  clock: import_zod.z.custom((v) => !v || typeof v === "function").optional(),
+  collectionPrefix: import_zod.z.string().min(1).default("auth_"),
+  /**
+   * Passkeys (WebAuthn) as a second step. `rpID` is the site's domain (e.g. "childmatch.com",
+   * "localhost"); `origins` are the exact browser origins allowed (e.g. "https://app.childmatch.com").
+   * Omit to turn passkeys off.
+   */
+  passkeys: import_zod.z.object({
+    rpID: import_zod.z.string().min(1),
+    rpName: import_zod.z.string().min(1),
+    origins: import_zod.z.array(import_zod.z.string().url()).min(1)
+  }).optional(),
+  /** 2-Step Verification state for users who have not chosen one yet. */
+  twoStepDefault: import_zod.z.boolean().default(false),
+  limits: limitSchema.default({}),
+  /**
+   * Set false to turn off every RATE_LIMITED check: the per-IP limits on login / code
+   * verify / send / step-up and the code-send cooldown and caps. Account lockouts after
+   * failed passwords or codes (LOCKED) still apply.
+   */
+  rateLimits: import_zod.z.boolean().default(true),
+  argon2: argon2Schema.default({}),
+  cookies: cookieSchema.default({}),
+  ttl: ttlSchema.default({}),
+  /** Serve GET /auth/openapi.json (A.7 docs). */
+  exposeDocs: import_zod.z.boolean().default(false)
+});
+
+// src/config/defaults.ts
+var noopLogger = {
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+var SENSITIVE_KEYS = ["password", "code", "secret", "token", "phone", "authorization"];
+function redact(value, depth = 0) {
+  if (value === null || value === void 0 || depth > 6) return value;
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value.map((v) => redact(v, depth + 1));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SENSITIVE_KEYS.some((s) => k.toLowerCase().includes(s)) ? "[REDACTED]" : redact(v, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function wrapLogger(logger) {
+  if (!logger) return noopLogger;
+  return {
+    info: (o, m) => logger.info(redact(o), m),
+    warn: (o, m) => logger.warn(redact(o), m),
+    error: (o, m) => logger.error(redact(o), m)
+  };
+}
+function resolveConfig(input) {
+  const parsed = configSchema.parse(input);
+  const key = decodeEncryptionKey(parsed.encryptionKey);
+  if (key.length !== 32) {
+    throw new Error("encryptionKey must decode to exactly 32 bytes (raw 32-char string or base64)");
+  }
+  const clock = parsed.clock ?? (() => /* @__PURE__ */ new Date());
+  return { ...parsed, clock, logger: wrapLogger(parsed.logger) };
+}
+function decodeEncryptionKey(raw) {
+  const asBase64 = Buffer.from(raw, "base64");
+  if (asBase64.length === 32 && asBase64.toString("base64").replace(/=+$/, "") === raw.replace(/=+$/, "")) {
+    return asBase64;
+  }
+  return Buffer.from(raw, "utf8");
+}
+
+// src/data/migrate.ts
+function getCollections(db, prefix = "auth_") {
+  return {
+    credentials: db.collection(`${prefix}credentials`),
+    methods: db.collection(`${prefix}mfa_methods`),
+    challenges: db.collection(`${prefix}challenges`),
+    sessions: db.collection(`${prefix}sessions`),
+    trustedDevices: db.collection(`${prefix}trusted_devices`),
+    events: db.collection(`${prefix}events`),
+    rateLimits: db.collection(`${prefix}rate_limits`)
+  };
+}
+var VALIDATORS = {
+  credentials: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["userId", "passwordHash", "twoStepEnabled", "updatedAt"],
+      properties: {
+        userId: { bsonType: "string" },
+        passwordHash: { bsonType: "string" },
+        twoStepEnabled: { bsonType: "bool" },
+        lockedUntil: { bsonType: ["date", "null"] },
+        updatedAt: { bsonType: "date" }
+      }
+    }
+  },
+  mfa_methods: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["userId", "type", "label", "isDefault", "status", "createdAt"],
+      properties: {
+        userId: { bsonType: "string" },
+        type: { enum: ["EMAIL", "TOTP", "SMS", "PASSKEY"] },
+        label: { bsonType: "string" },
+        isDefault: { bsonType: "bool" },
+        status: { enum: ["pending", "active"] },
+        createdAt: { bsonType: "date" },
+        lastUsedAt: { bsonType: ["date", "null"] }
+      }
+    }
+  },
+  challenges: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["_id", "userId", "purpose", "attempts", "expiresAt"],
+      properties: {
+        userId: { bsonType: "string" },
+        purpose: { enum: ["login", "step_up", "enroll"] },
+        attempts: { bsonType: "int" },
+        expiresAt: { bsonType: "date" }
+      }
+    }
+  },
+  sessions: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["_id", "userId", "refreshTokenHash", "familyId", "expiresAt"],
+      properties: {
+        userId: { bsonType: "string" },
+        refreshTokenHash: { bsonType: "string" },
+        familyId: { bsonType: "string" },
+        expiresAt: { bsonType: "date" },
+        revokedAt: { bsonType: ["date", "null"] }
+      }
+    }
+  },
+  trusted_devices: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["userId", "tokenHash", "expiresAt"],
+      properties: {
+        userId: { bsonType: "string" },
+        tokenHash: { bsonType: "string" },
+        expiresAt: { bsonType: "date" }
+      }
+    }
+  },
+  events: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["userId", "type", "at"],
+      properties: {
+        userId: { bsonType: "string" },
+        type: { bsonType: "string" },
+        at: { bsonType: "date" }
+      }
+    }
+  },
+  rate_limits: {
+    $jsonSchema: {
+      bsonType: "object",
+      required: ["_id", "count", "expiresAt"],
+      properties: {
+        count: { bsonType: "int" },
+        expiresAt: { bsonType: "date" }
+      }
+    }
+  }
+};
+async function migrate(db, prefix = "auth_", auditDays = 365) {
+  for (const [suffix, validator] of Object.entries(VALIDATORS)) {
+    const name = `${prefix}${suffix}`;
+    const exists = await db.listCollections({ name }).hasNext();
+    if (!exists) {
+      await db.createCollection(name, { validator });
+    } else {
+      await db.command({ collMod: name, validator });
+    }
+  }
+  const c = getCollections(db, prefix);
+  await c.credentials.createIndex({ userId: 1 }, { unique: true });
+  await c.methods.createIndex({ userId: 1 });
+  await c.methods.createIndex(
+    { userId: 1, isDefault: 1 },
+    { unique: true, partialFilterExpression: { isDefault: true } }
+  );
+  await c.methods.createIndex(
+    { userId: 1, type: 1 },
+    { unique: true, partialFilterExpression: { type: "EMAIL" } }
+  );
+  await c.methods.createIndex(
+    { pendingExpiresAt: 1 },
+    { expireAfterSeconds: 0, partialFilterExpression: { status: "pending" } }
+  );
+  await c.challenges.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  await c.sessions.createIndex({ refreshTokenHash: 1 }, { unique: true });
+  await c.sessions.createIndex({ userId: 1 });
+  await c.sessions.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  await c.trustedDevices.createIndex({ tokenHash: 1 }, { unique: true });
+  await c.trustedDevices.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  await c.events.createIndex({ userId: 1, at: -1 });
+  await c.events.createIndex({ at: 1 }, { expireAfterSeconds: Math.floor(auditDays * 86400) });
+  await c.rateLimits.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  return c;
+}
+
+// src/services/auth.service.ts
+init_hash();
+
+// src/middleware/errors.ts
+var import_zod2 = require("zod");
+var ApiErrorException = class extends Error {
+  constructor(status, code, message, extra) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.extra = extra;
+  }
+  status;
+  code;
+  extra;
+};
+function apiError(status, code, message, extra) {
+  return new ApiErrorException(status, code, message, {
+    attemptsLeft: extra?.attemptsLeft,
+    retryAt: extra?.retryAt instanceof Date ? extra.retryAt.toISOString() : extra?.retryAt
+  });
+}
+function errorHandler(err, _req, res, _next) {
+  if (err instanceof ApiErrorException) {
+    const body = { error: err.code, message: err.message, ...err.extra };
+    res.status(err.status).json(body);
+    return;
+  }
+  if (err instanceof import_zod2.ZodError) {
+    res.status(400).json({ error: "VALIDATION_ERROR", message: err.issues[0]?.message ?? "The request is invalid." });
+    return;
+  }
+  console.error("express-auth-2fa: unhandled error", err);
+  res.status(500).json({ error: "VALIDATION_ERROR", message: "Internal error." });
+}
+function parseBody(schema, body) {
+  return schema.parse(body);
+}
+
+// src/middleware/cookies.ts
+var REFRESH_COOKIE = "auth_refresh";
+var TRUSTED_DEVICE_COOKIE = "auth_trusted";
+var CSRF_COOKIE = "auth_csrf";
+function parseCookies(req) {
+  const header = req.headers.cookie;
+  if (!header) return {};
+  const out = {};
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    out[part.slice(0, eq).trim()] = decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return out;
+}
+function setCookie(res, config, name, value, maxAgeMs, httpOnly = true) {
+  res.cookie(name, value, {
+    httpOnly,
+    secure: config.cookies.secure,
+    sameSite: config.cookies.sameSite,
+    domain: config.cookies.domain,
+    path: config.cookies.path,
+    maxAge: maxAgeMs
+  });
+}
+function clearCookie(res, config, name) {
+  res.clearCookie(name, {
+    secure: config.cookies.secure,
+    sameSite: config.cookies.sameSite,
+    domain: config.cookies.domain,
+    path: config.cookies.path
+  });
+}
+
+// src/services/method.service.ts
+var import_mongodb = require("mongodb");
+var import_libphonenumber_js = require("libphonenumber-js");
+
+// src/crypto/encrypt.ts
+var import_node_crypto2 = __toESM(require("crypto"), 1);
+function encryptString(plain, key, keyId) {
+  const iv = import_node_crypto2.default.randomBytes(12);
+  const cipher = import_node_crypto2.default.createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  return [keyId, iv, cipher.getAuthTag(), ct].map((b) => typeof b === "string" ? b : b.toString("base64url")).join(".");
+}
+function decryptString(payload, keys) {
+  const parts = payload.split(".");
+  if (parts.length !== 4) throw new Error("invalid ciphertext format");
+  const [keyId, ivB64, tagB64, ctB64] = parts;
+  const key = keys[keyId];
+  if (!key) throw new Error(`unknown keyId: ${keyId}`);
+  const decipher = import_node_crypto2.default.createDecipheriv("aes-256-gcm", key, Buffer.from(ivB64, "base64url"));
+  decipher.setAuthTag(Buffer.from(tagB64, "base64url"));
+  const plain = Buffer.concat([decipher.update(Buffer.from(ctB64, "base64url")), decipher.final()]);
+  return { plain: plain.toString("utf8"), keyId };
+}
+
+// src/crypto/totp.ts
+var import_otplib = require("otplib");
+function atEpoch(epochMs) {
+  const a = import_otplib.authenticator.clone();
+  a.options = { digits: 6, step: 30, window: 0, epoch: epochMs };
+  return a;
+}
+function generateTotpSecret() {
+  return import_otplib.authenticator.generateSecret(20);
+}
+function buildOtpauthUri(issuer, account, secret) {
+  return import_otplib.authenticator.keyuri(account, issuer, secret);
+}
+function totpStepAt(epochMs) {
+  return Math.floor(epochMs / 3e4);
+}
+function checkTotp(code, secret, nowMs) {
+  for (const offset of [-1, 0, 1]) {
+    const epoch = nowMs + offset * 3e4;
+    if (atEpoch(epoch).verify({ token: code, secret })) {
+      return { valid: true, step: totpStepAt(epoch) };
+    }
+  }
+  return { valid: false, step: null };
+}
+
+// src/services/method.service.ts
+init_hash();
+
+// src/services/methodSecret.ts
+function decryptMethodSecret(payload, keys) {
+  try {
+    return decryptString(payload, keys).plain;
+  } catch {
+    throw apiError(
+      409,
+      "VALIDATION_ERROR",
+      "This verification method can no longer be used. Choose another method, or remove it and add it again."
+    );
+  }
+}
+async function pruneUnreadableMethods(config, cols, userId, audit) {
+  const keys = { [config.keyId]: decodeEncryptionKey(config.encryptionKey) };
+  const methods = await cols.methods.find({ userId, type: { $in: ["SMS", "TOTP"] } }).toArray();
+  const unreadable = methods.filter((m) => {
+    const sealed = m.type === "SMS" ? m.phoneE164Enc : m.secretEnc;
+    if (!sealed) return true;
+    try {
+      decryptString(sealed, keys);
+      return false;
+    } catch {
+      return true;
+    }
+  });
+  if (unreadable.length === 0) return 0;
+  await cols.methods.deleteMany({ _id: { $in: unreadable.map((m) => m._id) } });
+  if (!await cols.methods.findOne({ userId, status: "active", isDefault: true })) {
+    const next = await cols.methods.findOne({ userId, status: "active", type: "EMAIL" }) ?? await cols.methods.findOne({ userId, status: "active" }, { sort: { lastUsedAt: -1, createdAt: -1 } });
+    if (next) await cols.methods.updateOne({ _id: next._id }, { $set: { isDefault: true } });
+  }
+  for (const m of unreadable) {
+    await audit?.record(userId, "method_removed", { meta: { methodId: m._id.toString(), type: m.type, reason: "unreadable" } });
+  }
+  return unreadable.length;
+}
+
+// src/services/delivery.ts
+function maskEmail(email) {
+  const at = email.lastIndexOf("@");
+  if (at <= 0) return "\u2022\u2022\u2022";
+  return `${email[0]}\u2022\u2022\u2022${email.slice(at)}`;
+}
+function isDuplicateKey(e) {
+  return !!e && typeof e === "object" && e.code === 11e3;
+}
+async function ensureEmailMethod(config, cols, userId, email) {
+  if (!config.emailProvider) return;
+  const address = email ?? (await config.userAdapter.findById(userId))?.email;
+  if (!address || !address.includes("@")) return;
+  const label = maskEmail(address);
+  const existing = await cols.methods.findOne({ userId, type: "EMAIL" });
+  if (existing) {
+    if (existing.label !== label) await cols.methods.updateOne({ _id: existing._id }, { $set: { label } });
+    return;
+  }
+  const hasDefault = await cols.methods.countDocuments({ userId, status: "active", isDefault: true }) > 0;
+  const doc = {
+    userId,
+    type: "EMAIL",
+    label,
+    isDefault: !hasDefault,
+    status: "active",
+    createdAt: config.clock(),
+    lastUsedAt: null
+  };
+  try {
+    await cols.methods.insertOne(doc);
+  } catch (e) {
+    if (!isDuplicateKey(e)) throw e;
+    if (await cols.methods.findOne({ userId, type: "EMAIL" })) return;
+    try {
+      await cols.methods.insertOne({ ...doc, _id: void 0, isDefault: false });
+    } catch (e2) {
+      if (!isDuplicateKey(e2)) throw e2;
+    }
+  }
+}
+async function deliverCode(config, encKey, method, code) {
+  const message = `Your verification code is ${code}`;
+  if (method.type === "SMS") {
+    if (!method.phoneE164Enc) throw apiError(400, "VALIDATION_ERROR", "Unknown SMS method.");
+    const phone = decryptMethodSecret(method.phoneE164Enc, { [config.keyId]: encKey });
+    await config.smsProvider.send(phone, message);
+    return `\u2022\u2022\u2022\u2022 ${method.phoneLast4 ?? ""}`.trim();
+  }
+  if (method.type === "EMAIL") {
+    const email = (await config.userAdapter.findById(method.userId))?.email;
+    if (!config.emailProvider || !email) throw apiError(400, "VALIDATION_ERROR", "Email verification is not available.");
+    await config.emailProvider.send({ to: email, code, message });
+    return maskEmail(email);
+  }
+  throw apiError(400, "VALIDATION_ERROR", "This method does not send codes.");
+}
+
+// src/services/method.service.ts
+function toApiMethod(doc) {
+  return {
+    id: doc._id.toString(),
+    type: doc.type,
+    label: doc.type === "SMS" ? `\u2022\u2022\u2022\u2022 ${doc.phoneLast4 ?? ""}`.trim() : doc.label,
+    isDefault: doc.isDefault,
+    createdAt: doc.createdAt.toISOString(),
+    lastUsedAt: doc.lastUsedAt ? doc.lastUsedAt.toISOString() : null
+  };
+}
+function duplicateTypeMessage(type) {
+  return type === "SMS" ? "You already have a phone number. Remove it before adding another." : "You already have an authenticator app. Remove it before adding another.";
+}
+var MethodService = class {
+  constructor(config, cols, tokens, audit) {
+    this.config = config;
+    this.cols = cols;
+    this.tokens = tokens;
+    this.audit = audit;
+    this.encKey = decodeEncryptionKey(config.encryptionKey);
+  }
+  config;
+  cols;
+  tokens;
+  audit;
+  encKey;
+  objectId(id) {
+    try {
+      return new import_mongodb.ObjectId(id);
+    } catch {
+      throw apiError(400, "VALIDATION_ERROR", "Invalid id.");
+    }
+  }
+  /** BR-14 — active methods only, default first, then by createdAt. */
+  async securitySummary(userId) {
+    await ensureEmailMethod(this.config, this.cols, userId);
+    await pruneUnreadableMethods(this.config, this.cols, userId, this.audit);
+    const cred = await this.cols.credentials.findOne({ userId });
+    const docs = await this.cols.methods.find({ userId, status: "active" }).toArray();
+    const methods = docs.sort((a, b) => Number(b.isDefault) - Number(a.isDefault) || a.createdAt.getTime() - b.createdAt.getTime()).map(toApiMethod);
+    return { twoStepEnabled: cred?.twoStepEnabled ?? this.config.twoStepDefault, methods };
+  }
+  /** BR-15 — enable needs ≥1 active method; disable needs step-up + revokes trusted devices. */
+  async setTwoStep(userId, sid, enabled, stepUpToken) {
+    const now = this.config.clock();
+    if (enabled) {
+      await ensureEmailMethod(this.config, this.cols, userId);
+      const count = await this.cols.methods.countDocuments({ userId, status: "active" });
+      if (count === 0) throw apiError(409, "NO_METHODS", "Add a verification method before enabling 2-Step Verification.");
+    } else {
+      if (!stepUpToken) throw apiError(403, "STEP_UP_REQUIRED", "This action requires recent verification.");
+      await this.tokens.verifyStepUpToken(stepUpToken, userId, sid);
+      await this.cols.trustedDevices.deleteMany({ userId });
+    }
+    await this.cols.credentials.updateOne({ userId }, { $set: { twoStepEnabled: enabled, updatedAt: now } });
+    await this.audit.record(userId, enabled ? "2fa_enabled" : "2fa_disabled", {});
+    return { twoStepEnabled: enabled };
+  }
+  /** BR-16 — add a pending TOTP (otpauthUri+secret once) or pending SMS (sends code). Max 5 methods. */
+  async addMethod(userId, input) {
+    if (input.type === "EMAIL") {
+      throw apiError(400, "VALIDATION_ERROR", "The email method is added automatically from the account email.");
+    }
+    const now = this.config.clock();
+    if (await this.cols.methods.findOne({ userId, type: input.type, status: "active" })) {
+      throw apiError(409, "VALIDATION_ERROR", duplicateTypeMessage(input.type));
+    }
+    await this.cols.methods.deleteMany({ userId, type: input.type, status: "pending" });
+    const total = await this.cols.methods.countDocuments({ userId });
+    if (total >= this.config.limits.maxMethods) {
+      throw apiError(409, "VALIDATION_ERROR", `You can add at most ${this.config.limits.maxMethods} verification methods.`);
+    }
+    const pendingExpiresAt = new Date(now.getTime() + this.config.ttl.pendingMethodMin * 6e4);
+    if (input.type === "TOTP") {
+      const secret = generateTotpSecret();
+      const user = await this.config.userAdapter.findById(userId);
+      const account = user?.email ?? user?.username ?? userId;
+      const doc2 = {
+        userId,
+        type: "TOTP",
+        label: input.label ?? "Authenticator app",
+        isDefault: false,
+        status: "pending",
+        secretEnc: encryptString(secret, this.encKey, this.config.keyId),
+        pendingExpiresAt,
+        createdAt: now,
+        lastUsedAt: null
+      };
+      const { insertedId: insertedId2 } = await this.cols.methods.insertOne(doc2);
+      await this.audit.record(userId, "method_add_started", { meta: { type: "TOTP" } });
+      return {
+        pendingMethodId: insertedId2.toString(),
+        otpauthUri: buildOtpauthUri(this.config.issuer, account, secret),
+        secret
+      };
+    }
+    const parsed = input.phone ? (0, import_libphonenumber_js.parsePhoneNumberFromString)(input.phone) : void 0;
+    if (!parsed || !parsed.isValid()) throw apiError(400, "VALIDATION_ERROR", "Enter a valid phone number.");
+    const e164 = parsed.number;
+    const last4 = e164.slice(-4);
+    const code = randomSmsCode();
+    const doc = {
+      userId,
+      type: "SMS",
+      label: `\u2022\u2022\u2022\u2022 ${last4}`,
+      isDefault: false,
+      status: "pending",
+      phoneE164Enc: encryptString(e164, this.encKey, this.config.keyId),
+      phoneLast4: last4,
+      pendingCodeHash: sha256Hex(code),
+      pendingExpiresAt,
+      createdAt: now,
+      lastUsedAt: null
+    };
+    const { insertedId } = await this.cols.methods.insertOne(doc);
+    await this.config.smsProvider.send(e164, `Your verification code is ${code}`);
+    await this.audit.record(userId, "method_add_started", { meta: { type: "SMS" } });
+    return { pendingMethodId: insertedId.toString() };
+  }
+  /** BR-17 — confirm a pending method; first active method becomes default. */
+  async confirmMethod(userId, methodId, code) {
+    const method = await this.cols.methods.findOne({ _id: this.objectId(methodId), userId, status: "pending" });
+    if (!method) throw apiError(404, "VALIDATION_ERROR", "Unknown method.");
+    const now = this.config.clock();
+    let ok = false;
+    if (method.type === "TOTP") {
+      const secret = decryptMethodSecret(method.secretEnc, { [this.config.keyId]: this.encKey });
+      ok = checkTotp(code, secret, now.getTime()).valid;
+    } else {
+      ok = !!method.pendingCodeHash && timingSafeEqualStr(method.pendingCodeHash, sha256Hex(code));
+    }
+    if (!ok) throw apiError(401, "INVALID_CODE", "That code didn't work. Try again.");
+    if (await this.cols.methods.findOne({ userId, type: method.type, status: "active" })) {
+      await this.cols.methods.deleteOne({ _id: method._id });
+      throw apiError(409, "VALIDATION_ERROR", duplicateTypeMessage(method.type));
+    }
+    const activeCount = await this.cols.methods.countDocuments({ userId, status: "active" });
+    await this.cols.methods.updateOne(
+      { _id: method._id },
+      {
+        $set: { status: "active", isDefault: activeCount === 0, lastUsedAt: now },
+        $unset: { pendingCodeHash: "", pendingExpiresAt: "" }
+      }
+    );
+    await this.audit.record(userId, "method_added", { meta: { type: method.type } });
+    return toApiMethod({ ...method, status: "active", isDefault: activeCount === 0, lastUsedAt: now });
+  }
+  /** BR-18 — rename (TOTP only, 1–40 chars) or set default (step-up, transaction). */
+  async patchMethod(userId, sid, methodId, input) {
+    const method = await this.cols.methods.findOne({ _id: this.objectId(methodId), userId, status: "active" });
+    if (!method) throw apiError(404, "VALIDATION_ERROR", "Unknown method.");
+    if (input.isDefault === true) {
+      if (!input.stepUpToken) throw apiError(403, "STEP_UP_REQUIRED", "This action requires recent verification.");
+      await this.tokens.verifyStepUpToken(input.stepUpToken, userId, sid);
+      await this.withTransaction(async (session) => {
+        await this.cols.methods.updateMany({ userId, isDefault: true }, { $set: { isDefault: false } }, { session });
+        await this.cols.methods.updateOne({ _id: method._id }, { $set: { isDefault: true } }, { session });
+      });
+      method.isDefault = true;
+      await this.audit.record(userId, "method_set_default", { meta: { methodId } });
+    }
+    if (input.isDefault === false && method.isDefault) {
+      throw apiError(400, "VALIDATION_ERROR", "Set another method as default instead.");
+    }
+    if (input.label !== void 0) {
+      if (method.type !== "TOTP" && method.type !== "PASSKEY") {
+        throw apiError(400, "VALIDATION_ERROR", "Only authenticator apps and passkeys can be renamed.");
+      }
+      if (input.label.length < 1 || input.label.length > 40) {
+        throw apiError(400, "VALIDATION_ERROR", "Label must be 1\u201340 characters.");
+      }
+      await this.cols.methods.updateOne({ _id: method._id }, { $set: { label: input.label } });
+      method.label = input.label;
+      await this.audit.record(userId, "method_renamed", { meta: { methodId } });
+    }
+    return toApiMethod(method);
+  }
+  /** BR-19 — remove (step-up); LAST_METHOD guard; promote most-recently-used default. */
+  async deleteMethod(userId, sid, methodId, stepUpToken) {
+    if (!stepUpToken) throw apiError(403, "STEP_UP_REQUIRED", "This action requires recent verification.");
+    await this.tokens.verifyStepUpToken(stepUpToken, userId, sid);
+    const method = await this.cols.methods.findOne({ _id: this.objectId(methodId), userId });
+    if (!method) throw apiError(404, "VALIDATION_ERROR", "Unknown method.");
+    if (method.type === "EMAIL") throw apiError(400, "VALIDATION_ERROR", "Your email verification method can't be removed.");
+    const cred = await this.cols.credentials.findOne({ userId });
+    const activeCount = await this.cols.methods.countDocuments({ userId, status: "active" });
+    if (cred?.twoStepEnabled && method.status === "active" && activeCount <= 1) {
+      throw apiError(409, "LAST_METHOD", "You can't remove your last verification method while 2-Step Verification is on.");
+    }
+    await this.withTransaction(async (session) => {
+      await this.cols.methods.deleteOne({ _id: method._id }, { session });
+      if (method.isDefault && method.status === "active") {
+        const next = await this.cols.methods.findOne(
+          { userId, status: "active", _id: { $ne: method._id } },
+          { sort: { lastUsedAt: -1, createdAt: -1 }, session }
+        );
+        if (next) await this.cols.methods.updateOne({ _id: next._id }, { $set: { isDefault: true } }, { session });
+      }
+    });
+    await this.audit.record(userId, "method_removed", { meta: { methodId, type: method.type } });
+  }
+  transactionsSupported = null;
+  /** Transactions need a replica set or mongos; a standalone server (common in dev/test) has neither. */
+  supportsTransactions() {
+    this.transactionsSupported ??= this.config.db.command({ hello: 1 }).then((h) => !!h.setName || h.msg === "isdbgrid").catch(() => false);
+    return this.transactionsSupported;
+  }
+  async withTransaction(fn) {
+    if (!await this.supportsTransactions()) {
+      await fn(void 0);
+      return;
+    }
+    const db = this.config.db;
+    const client = this.config.client ?? db.client ?? db.s?.client;
+    if (!client) throw new Error("express-auth-2fa: no MongoClient available for transactions; pass `client`.");
+    const session = client.startSession();
+    try {
+      await session.withTransaction(async () => fn(session));
+    } finally {
+      await session.endSession();
+    }
+  }
+};
+
+// src/services/auth.service.ts
+function ctxOf(req) {
+  return { ip: req.ip, userAgent: req.headers["user-agent"] };
+}
+var AuthService = class {
+  constructor(config, cols, tokens, audit) {
+    this.config = config;
+    this.cols = cols;
+    this.tokens = tokens;
+    this.audit = audit;
+  }
+  config;
+  cols;
+  tokens;
+  audit;
+  async getCredentials(userId) {
+    return this.cols.credentials.findOne({ userId });
+  }
+  async ensureCredentials(userId) {
+    const now = this.config.clock();
+    await this.cols.credentials.updateOne(
+      { userId },
+      {
+        $setOnInsert: {
+          userId,
+          passwordHash: "",
+          twoStepEnabled: this.config.twoStepDefault,
+          failedLogins: { count: 0, windowStart: now },
+          lockedUntil: null,
+          updatedAt: now
+        }
+      },
+      { upsert: true }
+    );
+    return await this.cols.credentials.findOne({ userId });
+  }
+  /** Set or update the password for a user (used by apps/tests; registration is app-owned). */
+  async setPassword(userId, password) {
+    const { hashPassword: hashPassword2 } = await Promise.resolve().then(() => (init_hash(), hash_exports));
+    const now = this.config.clock();
+    const cred = await this.ensureCredentials(userId);
+    await this.cols.credentials.updateOne(
+      { _id: cred._id },
+      { $set: { passwordHash: await hashPassword2(password, this.config.argon2), updatedAt: now } }
+    );
+  }
+  async login(req, res, input) {
+    const now = this.config.clock();
+    const ctx = ctxOf(req);
+    const user = await this.config.userAdapter.findByLogin(input.username);
+    const cred = user ? await this.getCredentials(user.id) : null;
+    const ok = await verifyPassword(cred?.passwordHash || DUMMY_HASH, input.password);
+    if (!user || !cred?.passwordHash || !ok) {
+      if (user && cred) await this.registerFailedLogin(cred, now);
+      throw apiError(401, "INVALID_CREDENTIALS", "Invalid username or password.");
+    }
+    if (cred.lockedUntil && cred.lockedUntil.getTime() > now.getTime()) {
+      throw apiError(423, "LOCKED", "Too many attempts. Try again later.", { retryAt: cred.lockedUntil });
+    }
+    await this.resetFailedLogins(cred, now);
+    const trustedOk = cred.twoStepEnabled && await this.checkTrustedDevice(req, user.id);
+    if (!cred.twoStepEnabled || trustedOk) {
+      await this.audit.record(user.id, "login_success", ctx);
+      return this.authenticate(user.id, req, res, ["pwd"], { rememberMe: input.rememberMe });
+    }
+    await ensureEmailMethod(this.config, this.cols, user.id, user.email);
+    await pruneUnreadableMethods(this.config, this.cols, user.id, this.audit);
+    const active = await this.cols.methods.find({ userId: user.id, status: "active" }).toArray();
+    if (active.length === 0) {
+      await this.audit.record(user.id, "login_success", ctx);
+      return this.authenticate(user.id, req, res, ["pwd"], { rememberMe: input.rememberMe });
+    }
+    const challengeId = randomId("chg");
+    await this.cols.challenges.insertOne({
+      _id: challengeId,
+      userId: user.id,
+      purpose: "login",
+      methodId: null,
+      smsCodeHash: null,
+      smsSentAt: null,
+      smsSendCount: 0,
+      attempts: 0,
+      expiresAt: new Date(now.getTime() + this.config.ttl.challengeSec * 1e3),
+      createdAt: now
+    });
+    const methods = active.map(toApiMethod);
+    const defaultMethod = active.find((m) => m.isDefault) ?? active.find((m) => m.type === "EMAIL") ?? active[0];
+    await this.audit.record(user.id, "login_mfa_required", ctx);
+    return {
+      status: "MFA_REQUIRED",
+      challengeId,
+      methods,
+      defaultMethodId: defaultMethod._id.toString()
+    };
+  }
+  async registerFailedLogin(cred, now) {
+    const { loginMaxAttempts, loginWindowMin, lockMinutes } = this.config.limits;
+    const windowMs = loginWindowMin * 6e4;
+    const count = cred.failedLogins && now.getTime() - cred.failedLogins.windowStart.getTime() < windowMs ? cred.failedLogins.count + 1 : 1;
+    const locked = count >= loginMaxAttempts;
+    await this.cols.credentials.updateOne(
+      { _id: cred._id },
+      {
+        $set: {
+          failedLogins: { count, windowStart: locked ? cred.failedLogins?.windowStart ?? now : count === 1 ? now : cred.failedLogins.windowStart },
+          ...locked ? { lockedUntil: new Date(now.getTime() + lockMinutes * 6e4) } : {},
+          updatedAt: now
+        }
+      }
+    );
+    if (locked) await this.audit.record(cred.userId, "account_locked", {});
+  }
+  async resetFailedLogins(cred, now) {
+    await this.cols.credentials.updateOne(
+      { _id: cred._id },
+      { $set: { failedLogins: { count: 0, windowStart: now }, updatedAt: now } }
+    );
+  }
+  async checkTrustedDevice(req, userId) {
+    const token = parseCookies(req)[TRUSTED_DEVICE_COOKIE];
+    if (!token) return false;
+    const doc = await this.cols.trustedDevices.findOne({ tokenHash: sha256Hex(token), userId });
+    if (!doc) return false;
+    if (doc.expiresAt.getTime() <= this.config.clock().getTime()) return false;
+    return true;
+  }
+  /** Issue tokens + set cookies (refresh cookie, CSRF cookie). */
+  async authenticate(userId, req, res, amr, opts = {}) {
+    const ctx = ctxOf(req);
+    const bundle = await this.tokens.issueTokens(userId, amr, ctx);
+    const refreshDays = opts.rememberMe ? this.config.ttl.refreshTokenDays : Math.min(this.config.ttl.refreshTokenDays, 1);
+    setCookie(res, this.config, REFRESH_COOKIE, bundle.refreshToken, refreshDays * 864e5);
+    const csrfToken = randomToken();
+    setCookie(res, this.config, CSRF_COOKIE, csrfToken, this.config.ttl.refreshTokenDays * 864e5, false);
+    if (opts.rememberDevice) {
+      await this.trustDevice(userId, res, opts.deviceLabel ?? "This device");
+    }
+    const user = await this.config.userAdapter.findById(userId);
+    return {
+      status: "AUTHENTICATED",
+      user: { id: userId, username: user?.username, email: user?.email },
+      tokens: { accessToken: bundle.accessToken, expiresInSec: bundle.expiresInSec, csrfToken }
+    };
+  }
+  async trustDevice(userId, res, label) {
+    const token = randomToken();
+    const now = this.config.clock();
+    await this.cols.trustedDevices.insertOne({
+      userId,
+      tokenHash: sha256Hex(token),
+      label,
+      createdAt: now,
+      expiresAt: new Date(now.getTime() + this.config.ttl.trustedDeviceDays * 864e5)
+    });
+    setCookie(res, this.config, TRUSTED_DEVICE_COOKIE, token, this.config.ttl.trustedDeviceDays * 864e5);
+  }
+  async refresh(req, res) {
+    const cookies = parseCookies(req);
+    const csrfCookie = cookies[CSRF_COOKIE];
+    const csrfHeader = req.headers["x-csrf-token"];
+    if (!csrfCookie || !csrfHeader || csrfCookie !== csrfHeader) {
+      throw apiError(403, "INVALID_CREDENTIALS", "CSRF token mismatch.");
+    }
+    const raw = cookies[REFRESH_COOKIE];
+    if (!raw) throw apiError(401, "INVALID_CREDENTIALS", "No refresh token.");
+    const bundle = await this.tokens.rotateRefreshToken(raw, ctxOf(req));
+    setCookie(res, this.config, REFRESH_COOKIE, bundle.refreshToken, this.config.ttl.refreshTokenDays * 864e5);
+    return { accessToken: bundle.accessToken, expiresInSec: bundle.expiresInSec, csrfToken: csrfCookie };
+  }
+  async logout(req, res, sid) {
+    await this.tokens.revokeSession(sid);
+    clearCookie(res, this.config, REFRESH_COOKIE);
+    clearCookie(res, this.config, CSRF_COOKIE);
+    clearCookie(res, this.config, TRUSTED_DEVICE_COOKIE);
+    const auth = req.auth;
+    if (auth) await this.audit.record(auth.sub, "logout", ctxOf(req));
+  }
+  async listActiveMethods(userId) {
+    const docs = await this.cols.methods.find({ userId, status: "active" }).toArray();
+    return docs.sort((a, b) => Number(b.isDefault) - Number(a.isDefault) || a.createdAt.getTime() - b.createdAt.getTime()).map(toApiMethod);
+  }
+};
+
+// src/services/mfa.service.ts
+var import_mongodb2 = require("mongodb");
+init_hash();
+
+// src/middleware/rateLimit.ts
+function rateLimit(cols, config, bucket, max, windowMs) {
+  return async (req, _res, next) => {
+    if (!config.rateLimits) {
+      next();
+      return;
+    }
+    const now = config.clock().getTime();
+    const slot = Math.floor(now / windowMs);
+    const key = `${bucket}:${req.ip ?? "unknown"}:${slot}`;
+    const expiresAt = new Date((slot + 1) * windowMs + 6e4);
+    try {
+      const doc = await cols.rateLimits.findOneAndUpdate(
+        { _id: key },
+        { $inc: { count: 1 }, $setOnInsert: { expiresAt } },
+        { upsert: true, returnDocument: "after" }
+      );
+      const count = doc?.count ?? 1;
+      if (count > max) {
+        next(
+          apiError(429, "RATE_LIMITED", "Too many requests. Try again later.", {
+            retryAt: new Date((slot + 1) * windowMs)
+          })
+        );
+        return;
+      }
+      next();
+    } catch {
+      next();
+    }
+  };
+}
+async function consumeUserQuota(cols, config, bucket, userId, max, windowMs) {
+  const now = config.clock().getTime();
+  const slot = Math.floor(now / windowMs);
+  const key = `${bucket}:u:${userId}:${slot}`;
+  const retryAt = new Date((slot + 1) * windowMs);
+  const doc = await cols.rateLimits.findOneAndUpdate(
+    { _id: key },
+    { $inc: { count: 1 }, $setOnInsert: { expiresAt: new Date((slot + 1) * windowMs + 6e4) } },
+    { upsert: true, returnDocument: "after" }
+  );
+  return { allowed: (doc?.count ?? 1) <= max, retryAt };
+}
+
+// src/services/mfa.service.ts
+var MfaService = class {
+  constructor(config, cols, tokens, audit, auth) {
+    this.config = config;
+    this.cols = cols;
+    this.tokens = tokens;
+    this.audit = audit;
+    this.auth = auth;
+    this.encKey = decodeEncryptionKey(config.encryptionKey);
+  }
+  config;
+  cols;
+  tokens;
+  audit;
+  auth;
+  encKey;
+  async getChallenge(challengeId, purpose) {
+    const ch = await this.cols.challenges.findOne({ _id: challengeId, purpose });
+    if (!ch || ch.expiresAt.getTime() <= this.config.clock().getTime()) {
+      throw apiError(410, "CHALLENGE_EXPIRED", "This verification challenge has expired. Sign in again.");
+    }
+    return ch;
+  }
+  /** BR-5/BR-6 — send (or resend) an SMS or email code for a challenge. */
+  async sendCode(challengeId, methodId) {
+    const ch = await this.getChallenge(challengeId, "login");
+    const now = this.config.clock();
+    const limits = this.config.limits;
+    const method = await this.cols.methods.findOne({
+      _id: this.objectId(methodId),
+      userId: ch.userId,
+      type: { $in: ["SMS", "EMAIL"] },
+      status: "active"
+    });
+    if (!method) throw apiError(400, "VALIDATION_ERROR", "Unknown method.");
+    const limited = this.config.rateLimits;
+    if (limited && ch.smsSentAt && now.getTime() - ch.smsSentAt.getTime() < limits.smsResendSec * 1e3) {
+      throw apiError(429, "RATE_LIMITED", "Please wait before requesting another code.", {
+        retryAt: new Date(ch.smsSentAt.getTime() + limits.smsResendSec * 1e3)
+      });
+    }
+    if (limited && ch.smsSendCount >= limits.smsMaxPerChallenge) {
+      throw apiError(429, "RATE_LIMITED", "Too many codes sent for this challenge.", { retryAt: ch.expiresAt });
+    }
+    const quota = limited ? await consumeUserQuota(this.cols, this.config, `${method.type.toLowerCase()}_send`, ch.userId, limits.smsMaxPerUserHour, 36e5) : { allowed: true, retryAt: void 0 };
+    if (!quota.allowed) {
+      throw apiError(429, "RATE_LIMITED", "Too many codes sent. Try again later.", { retryAt: quota.retryAt });
+    }
+    const code = randomSmsCode();
+    await this.cols.challenges.updateOne(
+      { _id: challengeId },
+      { $set: { methodId, smsCodeHash: sha256Hex(code), smsSentAt: now }, $inc: { smsSendCount: 1 } }
+    );
+    const sentTo = await deliverCode(this.config, this.encKey, method, code);
+    return { sentTo, resendAfterSec: limited ? limits.smsResendSec : 0 };
+  }
+  /** BR-7..BR-10 — verify a 6-digit code against a login challenge. */
+  async verify(req, res, input) {
+    const ch = await this.getChallenge(input.challengeId, "login");
+    const now = this.config.clock();
+    const method = await this.cols.methods.findOne({ _id: this.objectId(input.methodId), userId: ch.userId, status: "active" });
+    if (!method) throw apiError(400, "VALIDATION_ERROR", "Unknown method.");
+    if (method.type === "PASSKEY") throw apiError(400, "VALIDATION_ERROR", "Use your passkey to verify.");
+    const ok = await this.checkCode(ch, method, input.code, now);
+    if (!ok) {
+      const attempts = ch.attempts + 1;
+      const attemptsLeft = this.config.limits.mfaMaxAttempts - attempts;
+      if (attemptsLeft <= 0) {
+        await this.cols.challenges.deleteOne({ _id: ch._id });
+        const lockedUntil = new Date(now.getTime() + this.config.limits.lockMinutes * 6e4);
+        await this.cols.credentials.updateOne({ userId: ch.userId }, { $set: { lockedUntil, updatedAt: now } });
+        await this.audit.record(ch.userId, "mfa_locked", ctxOf(req));
+        throw apiError(423, "LOCKED", "Too many attempts. Try again later.", { retryAt: lockedUntil });
+      }
+      await this.cols.challenges.updateOne({ _id: ch._id }, { $set: { attempts } });
+      await this.audit.record(ch.userId, "mfa_failed", ctxOf(req));
+      throw apiError(401, "INVALID_CODE", "That code didn't work. Try again.", { attemptsLeft });
+    }
+    await this.cols.challenges.deleteOne({ _id: ch._id });
+    await this.cols.methods.updateOne({ _id: method._id }, { $set: { lastUsedAt: now } });
+    await this.audit.record(ch.userId, "login_success", ctxOf(req));
+    const user = await this.config.userAdapter.findById(ch.userId);
+    const ua = req.headers["user-agent"];
+    const result = await this.auth.authenticate(ch.userId, req, res, ["pwd", "otp"], {
+      rememberDevice: input.rememberDevice,
+      deviceLabel: typeof ua === "string" ? ua.slice(0, 80) : void 0
+    });
+    res.json({ ...result, user: result.user ?? { id: ch.userId, username: user?.username, email: user?.email } });
+  }
+  async checkCode(ch, method, code, now) {
+    if (method.type === "TOTP") {
+      if (!method.secretEnc) return false;
+      const secret = decryptMethodSecret(method.secretEnc, { [this.config.keyId]: this.encKey });
+      const check = checkTotp(code, secret, now.getTime());
+      if (check.valid && check.step !== null && check.step > (method.lastUsedStep ?? -1)) {
+        await this.cols.methods.updateOne({ _id: method._id }, { $set: { lastUsedStep: check.step } });
+        return true;
+      }
+      return false;
+    }
+    const valid = !!ch.smsCodeHash && timingSafeEqualStr(ch.smsCodeHash, sha256Hex(code));
+    if (valid) await this.cols.challenges.updateOne({ _id: ch._id }, { $set: { smsCodeHash: null } });
+    return valid;
+  }
+  /** BR-13 — step-up: verify a fresh TOTP/SMS/email code, return a 5-min stepUpToken. */
+  async stepUp(req, input, auth) {
+    const method = await this.cols.methods.findOne({ _id: this.objectId(input.methodId), userId: auth.sub, status: "active" });
+    if (!method) throw apiError(400, "VALIDATION_ERROR", "Unknown method.");
+    if (method.type === "PASSKEY") throw apiError(400, "VALIDATION_ERROR", "Choose a method that sends or shows a code.");
+    const now = this.config.clock();
+    if (method.type !== "TOTP" && !input.code) {
+      const challengeId = randomId("chg");
+      const code = randomSmsCode();
+      await this.cols.challenges.insertOne({
+        _id: challengeId,
+        userId: auth.sub,
+        purpose: "step_up",
+        methodId: input.methodId,
+        smsCodeHash: sha256Hex(code),
+        smsSentAt: now,
+        smsSendCount: 1,
+        attempts: 0,
+        expiresAt: new Date(now.getTime() + this.config.ttl.challengeSec * 1e3),
+        createdAt: now
+      });
+      const sentTo = await deliverCode(this.config, this.encKey, method, code);
+      return { challengeId, sentTo, resendAfterSec: this.config.rateLimits ? this.config.limits.smsResendSec : 0 };
+    }
+    if (!input.code) throw apiError(400, "VALIDATION_ERROR", "code is required.");
+    let ok = false;
+    if (method.type === "TOTP") {
+      const secret = decryptMethodSecret(method.secretEnc, { [this.config.keyId]: this.encKey });
+      const check = checkTotp(input.code, secret, now.getTime());
+      if (check.valid && check.step !== null && check.step > (method.lastUsedStep ?? -1)) {
+        ok = true;
+        await this.cols.methods.updateOne({ _id: method._id }, { $set: { lastUsedStep: check.step } });
+      }
+    } else {
+      const ch = await this.cols.challenges.findOne(
+        { userId: auth.sub, purpose: "step_up", methodId: input.methodId },
+        { sort: { createdAt: -1 } }
+      );
+      if (ch && ch.expiresAt.getTime() > now.getTime() && ch.smsCodeHash && timingSafeEqualStr(ch.smsCodeHash, sha256Hex(input.code))) {
+        ok = true;
+        await this.cols.challenges.deleteOne({ _id: ch._id });
+      }
+    }
+    if (!ok) {
+      await this.audit.record(auth.sub, "step_up_failed", ctxOf(req));
+      throw apiError(401, "INVALID_CODE", "That code didn't work. Try again.");
+    }
+    await this.cols.methods.updateOne({ _id: method._id }, { $set: { lastUsedAt: now } });
+    await this.audit.record(auth.sub, "step_up_success", ctxOf(req));
+    const { token, expiresInSec } = await this.tokens.signStepUpToken(auth.sub, auth.sid);
+    return { stepUpToken: token, expiresInSec };
+  }
+  objectId(id) {
+    try {
+      return new import_mongodb2.ObjectId(id);
+    } catch {
+      throw apiError(400, "VALIDATION_ERROR", "Invalid id.");
+    }
+  }
+};
+
+// src/services/passkey.service.ts
+var import_server = require("@simplewebauthn/server");
+init_hash();
+var PasskeyService = class {
+  constructor(config, cols, audit, auth) {
+    this.config = config;
+    this.cols = cols;
+    this.audit = audit;
+    this.auth = auth;
+  }
+  config;
+  cols;
+  audit;
+  auth;
+  rp() {
+    if (!this.config.passkeys) throw apiError(400, "VALIDATION_ERROR", "Passkeys are not enabled.");
+    return this.config.passkeys;
+  }
+  activePasskeys(userId) {
+    return this.cols.methods.find({ userId, type: "PASSKEY", status: "active" }).toArray();
+  }
+  descriptor(m) {
+    return { id: m.credentialId, transports: m.transports };
+  }
+  async liveChallenge(filter) {
+    const ch = await this.cols.challenges.findOne(filter);
+    if (!ch || ch.expiresAt.getTime() <= this.config.clock().getTime()) {
+      throw apiError(410, "CHALLENGE_EXPIRED", "This verification challenge has expired. Sign in again.");
+    }
+    return ch;
+  }
+  /** Step 1 of adding a passkey: WebAuthn creation options for the signed-in user. */
+  async registrationOptions(userId) {
+    const rp = this.rp();
+    const now = this.config.clock();
+    if (await this.cols.methods.countDocuments({ userId }) >= this.config.limits.maxMethods) {
+      throw apiError(409, "VALIDATION_ERROR", `You can add at most ${this.config.limits.maxMethods} verification methods.`);
+    }
+    const user = await this.config.userAdapter.findById(userId);
+    const name = user?.email ?? user?.username ?? userId;
+    const options = await (0, import_server.generateRegistrationOptions)({
+      rpName: rp.rpName,
+      rpID: rp.rpID,
+      userName: name,
+      userDisplayName: name,
+      userID: new TextEncoder().encode(userId),
+      attestationType: "none",
+      excludeCredentials: (await this.activePasskeys(userId)).map((m) => this.descriptor(m)),
+      authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" }
+    });
+    await this.cols.challenges.deleteMany({ userId, purpose: "enroll" });
+    await this.cols.challenges.insertOne({
+      _id: randomId("chg"),
+      userId,
+      purpose: "enroll",
+      methodId: null,
+      smsCodeHash: null,
+      smsSentAt: null,
+      smsSendCount: 0,
+      attempts: 0,
+      webauthnChallenge: options.challenge,
+      expiresAt: new Date(now.getTime() + this.config.ttl.challengeSec * 1e3),
+      createdAt: now
+    });
+    return options;
+  }
+  /** Step 2 of adding a passkey: verify the browser's attestation and store the credential. */
+  async register(userId, input) {
+    const rp = this.rp();
+    const ch = await this.liveChallenge({ userId, purpose: "enroll" });
+    let verification;
+    try {
+      verification = await (0, import_server.verifyRegistrationResponse)({
+        response: input.response,
+        expectedChallenge: ch.webauthnChallenge ?? "",
+        expectedOrigin: rp.origins,
+        expectedRPID: rp.rpID,
+        requireUserVerification: false
+      });
+    } catch {
+      verification = null;
+    }
+    if (!verification?.verified || !verification.registrationInfo) {
+      throw apiError(400, "VALIDATION_ERROR", "We couldn't add that passkey. Try again.");
+    }
+    await this.cols.challenges.deleteOne({ _id: ch._id });
+    const { credential } = verification.registrationInfo;
+    if (await this.cols.methods.findOne({ type: "PASSKEY", credentialId: credential.id })) {
+      throw apiError(409, "VALIDATION_ERROR", "That passkey is already added.");
+    }
+    const now = this.config.clock();
+    const hasDefault = !!await this.cols.methods.findOne({ userId, status: "active", isDefault: true });
+    const doc = {
+      userId,
+      type: "PASSKEY",
+      label: input.label?.trim() || "Passkey",
+      isDefault: !hasDefault,
+      status: "active",
+      credentialId: credential.id,
+      publicKey: Buffer.from(credential.publicKey).toString("base64url"),
+      counter: credential.counter,
+      transports: credential.transports,
+      createdAt: now,
+      lastUsedAt: null
+    };
+    const { insertedId } = await this.cols.methods.insertOne(doc);
+    await this.audit.record(userId, "method_added", { meta: { type: "PASSKEY" } });
+    return toApiMethod({ ...doc, _id: insertedId });
+  }
+  /** Sign-in code step: WebAuthn request options for the user behind a login challenge. */
+  async loginOptions(challengeId) {
+    const rp = this.rp();
+    const ch = await this.liveChallenge({ _id: challengeId, purpose: "login" });
+    const passkeys = await this.activePasskeys(ch.userId);
+    if (passkeys.length === 0) throw apiError(400, "VALIDATION_ERROR", "There's no passkey on this account.");
+    const options = await (0, import_server.generateAuthenticationOptions)({
+      rpID: rp.rpID,
+      allowCredentials: passkeys.map((m) => this.descriptor(m)),
+      userVerification: "preferred"
+    });
+    await this.cols.challenges.updateOne({ _id: ch._id }, { $set: { webauthnChallenge: options.challenge } });
+    return options;
+  }
+  /** Sign-in code step: verify the passkey assertion and finish signing in. */
+  async loginVerify(req, res, input) {
+    const rp = this.rp();
+    const ch = await this.liveChallenge({ _id: input.challengeId, purpose: "login" });
+    if (!ch.webauthnChallenge) throw apiError(400, "VALIDATION_ERROR", "Start the passkey check again.");
+    const response = input.response;
+    const method = await this.cols.methods.findOne({
+      userId: ch.userId,
+      type: "PASSKEY",
+      status: "active",
+      credentialId: typeof response.id === "string" ? response.id : ""
+    });
+    if (!method) throw apiError(401, "INVALID_CODE", "That passkey isn't on this account.");
+    let verification;
+    try {
+      verification = await (0, import_server.verifyAuthenticationResponse)({
+        response,
+        expectedChallenge: ch.webauthnChallenge,
+        expectedOrigin: rp.origins,
+        expectedRPID: rp.rpID,
+        credential: {
+          id: method.credentialId,
+          publicKey: Buffer.from(method.publicKey, "base64url"),
+          counter: method.counter ?? 0,
+          transports: method.transports
+        },
+        requireUserVerification: false
+      });
+    } catch {
+      verification = null;
+    }
+    if (!verification?.verified) {
+      await this.audit.record(ch.userId, "mfa_failed", ctxOf(req));
+      throw apiError(401, "INVALID_CODE", "We couldn't verify your passkey. Try again.");
+    }
+    const now = this.config.clock();
+    await this.cols.challenges.deleteOne({ _id: ch._id });
+    await this.cols.methods.updateOne(
+      { _id: method._id },
+      { $set: { counter: verification.authenticationInfo.newCounter, lastUsedAt: now } }
+    );
+    await this.audit.record(ch.userId, "login_success", ctxOf(req));
+    const ua = req.headers["user-agent"];
+    const result = await this.auth.authenticate(ch.userId, req, res, ["pwd", "hwk"], {
+      rememberDevice: input.rememberDevice,
+      deviceLabel: typeof ua === "string" ? ua.slice(0, 80) : void 0
+    });
+    res.json(result);
+  }
+};
+
+// src/services/token.service.ts
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+var import_jose = require("jose");
+init_hash();
+var TokenService = class {
+  constructor(config, cols) {
+    this.config = config;
+    this.cols = cols;
+    const keyObj = import_node_crypto3.default.createPrivateKey(config.jwtPrivateKey);
+    this.alg = keyObj.asymmetricKeyType === "ed25519" ? "EdDSA" : "RS256";
+    this.privateKeyPromise = (0, import_jose.importPKCS8)(config.jwtPrivateKey, this.alg);
+    this.publicKeyPromise = (0, import_jose.importSPKI)(
+      import_node_crypto3.default.createPublicKey(keyObj).export({ type: "spki", format: "pem" }).toString(),
+      this.alg
+    );
+  }
+  config;
+  cols;
+  alg;
+  privateKeyPromise;
+  publicKeyPromise;
+  async signAccessToken(userId, sid, amr) {
+    const key = await this.privateKeyPromise;
+    return new import_jose.SignJWT({ sid, amr }).setProtectedHeader({ alg: this.alg }).setIssuer(this.config.issuer).setSubject(userId).setIssuedAt().setExpirationTime(`${this.config.ttl.accessTokenSec}s`).sign(key);
+  }
+  async verifyAccessToken(token) {
+    try {
+      const { payload } = await (0, import_jose.jwtVerify)(token, await this.publicKeyPromise, {
+        issuer: this.config.issuer
+      });
+      return { sub: payload.sub, sid: payload.sid, amr: payload.amr ?? [] };
+    } catch {
+      throw apiError(401, "INVALID_CREDENTIALS", "Invalid or expired access token.");
+    }
+  }
+  /** Create a new session + refresh token; returns tokens for the client. */
+  async issueTokens(userId, amr, meta, familyId) {
+    const now = this.config.clock();
+    const sid = randomId("ses");
+    const refreshToken = randomToken();
+    const expiresAt = new Date(now.getTime() + this.config.ttl.refreshTokenDays * 864e5);
+    const doc = {
+      _id: sid,
+      userId,
+      refreshTokenHash: sha256Hex(refreshToken),
+      familyId: familyId ?? randomId("fam"),
+      rotatedFrom: null,
+      userAgent: meta.userAgent,
+      ip: meta.ip,
+      createdAt: now,
+      expiresAt,
+      revokedAt: null
+    };
+    await this.cols.sessions.insertOne(doc);
+    return {
+      accessToken: await this.signAccessToken(userId, sid, amr),
+      expiresInSec: this.config.ttl.accessTokenSec,
+      refreshToken,
+      sessionId: sid
+    };
+  }
+  /**
+   * Rotate a refresh token (BR-11). Reuse of a rotated token revokes the whole
+   * family. Old hashes are retained in `usedHashes` so reuse is detectable.
+   */
+  async rotateRefreshToken(rawToken, meta) {
+    const hash = sha256Hex(rawToken);
+    const now = this.config.clock();
+    const session = await this.cols.sessions.findOne({
+      $or: [{ refreshTokenHash: hash }, { usedHashes: hash }]
+    });
+    if (!session) {
+      throw apiError(401, "INVALID_CREDENTIALS", "Invalid refresh token.");
+    }
+    if (session.refreshTokenHash !== hash) {
+      await this.cols.sessions.updateMany(
+        { familyId: session.familyId, revokedAt: null },
+        { $set: { revokedAt: now } }
+      );
+      throw apiError(401, "INVALID_CREDENTIALS", "Refresh token reuse detected; session revoked.");
+    }
+    if (session.revokedAt || session.expiresAt.getTime() <= now.getTime()) {
+      throw apiError(401, "INVALID_CREDENTIALS", "Session expired.");
+    }
+    const newToken = randomToken();
+    await this.cols.sessions.updateOne(
+      { _id: session._id, refreshTokenHash: hash },
+      {
+        $set: {
+          refreshTokenHash: sha256Hex(newToken),
+          userAgent: meta.userAgent,
+          ip: meta.ip
+        },
+        $push: { usedHashes: { $each: [hash], $slice: -200 } }
+      }
+    );
+    return {
+      accessToken: await this.signAccessToken(session.userId, session._id, ["pwd", "otp"]),
+      expiresInSec: this.config.ttl.accessTokenSec,
+      refreshToken: newToken,
+      sessionId: session._id
+    };
+  }
+  async revokeSession(sid) {
+    await this.cols.sessions.updateOne({ _id: sid }, { $set: { revokedAt: this.config.clock() } });
+  }
+  /** 5-minute step-up JWT bound to sub+sid (BR-13). */
+  async signStepUpToken(userId, sid) {
+    const key = await this.privateKeyPromise;
+    const token = await new import_jose.SignJWT({ sid, purpose: "step_up" }).setProtectedHeader({ alg: this.alg }).setIssuer(this.config.issuer).setSubject(userId).setIssuedAt().setExpirationTime(`${this.config.ttl.stepUpSec}s`).sign(key);
+    return { token, expiresInSec: this.config.ttl.stepUpSec };
+  }
+  async verifyStepUpToken(token, userId, sid) {
+    try {
+      const { payload } = await (0, import_jose.jwtVerify)(token, await this.publicKeyPromise, {
+        issuer: this.config.issuer
+      });
+      if (payload.purpose !== "step_up" || payload.sub !== userId || payload.sid !== sid) {
+        throw new Error("mismatch");
+      }
+    } catch {
+      throw apiError(403, "STEP_UP_REQUIRED", "This action requires recent verification.");
+    }
+  }
+};
+
+// src/services/audit.service.ts
+var AuditService = class {
+  constructor(config, cols) {
+    this.config = config;
+    this.cols = cols;
+  }
+  config;
+  cols;
+  async record(userId, type, meta = {}) {
+    const event = {
+      userId,
+      type,
+      ip: meta.ip,
+      userAgent: meta.userAgent,
+      at: this.config.clock(),
+      meta: meta.meta
+    };
+    await this.cols.events.insertOne(event);
+    try {
+      await this.config.hooks?.onSecurityEvent?.(event);
+    } catch {
+    }
+  }
+};
+
+// src/routes/auth.routes.ts
+var import_express = require("express");
+var import_auth_2fa_contract = require("@cairs-npm/auth-2fa-contract");
+
+// src/middleware/requireAuth.ts
+function requireAuth(tokens) {
+  return async (req, _res, next) => {
+    const header = req.headers.authorization ?? "";
+    const token = header.startsWith("Bearer ") ? header.slice(7) : null;
+    if (!token) {
+      next(apiError(401, "INVALID_CREDENTIALS", "Missing access token."));
+      return;
+    }
+    try {
+      req.auth = await tokens.verifyAccessToken(token);
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+
+// src/routes/auth.routes.ts
+var wrap = (fn) => (req, res, next) => fn(req, res).then((r) => r === void 0 ? void 0 : res.json(r)).catch(next);
+function buildAuthRouter(config, cols, services) {
+  const router = (0, import_express.Router)();
+  const { loginIpPerMin, verifyIpPerMin, stepUpIpPerMin } = config.limits;
+  router.post("/auth/login", rateLimit(cols, config, "login_ip", loginIpPerMin, 6e4), wrap(async (req, res) => {
+    const input = parseBody(import_auth_2fa_contract.loginRequestSchema, req.body);
+    return services.auth.login(req, res, input);
+  }));
+  router.post("/auth/mfa/send", rateLimit(cols, config, "mfa_send_ip", verifyIpPerMin, 6e4), wrap(async (req) => {
+    const input = parseBody(import_auth_2fa_contract.mfaSendRequestSchema, req.body);
+    return services.mfa.sendCode(input.challengeId, input.methodId);
+  }));
+  router.post("/auth/mfa/verify", rateLimit(cols, config, "mfa_verify_ip", verifyIpPerMin, 6e4), async (req, res, next) => {
+    try {
+      const input = parseBody(import_auth_2fa_contract.mfaVerifyRequestSchema, req.body);
+      await services.mfa.verify(req, res, input);
+    } catch (err) {
+      next(err);
+    }
+  });
+  router.post("/auth/passkey/options", rateLimit(cols, config, "mfa_verify_ip", verifyIpPerMin, 6e4), wrap(async (req) => {
+    const input = parseBody(import_auth_2fa_contract.passkeyLoginOptionsRequestSchema, req.body);
+    return services.passkeys.loginOptions(input.challengeId);
+  }));
+  router.post("/auth/passkey/verify", rateLimit(cols, config, "mfa_verify_ip", verifyIpPerMin, 6e4), async (req, res, next) => {
+    try {
+      const input = parseBody(import_auth_2fa_contract.passkeyLoginVerifyRequestSchema, req.body);
+      await services.passkeys.loginVerify(req, res, input);
+    } catch (err) {
+      next(err);
+    }
+  });
+  router.post("/auth/refresh", wrap(async (req, res) => services.auth.refresh(req, res)));
+  router.post("/auth/logout", requireAuth(services.tokens), wrap(async (req, res) => {
+    await services.auth.logout(req, res, req.auth.sid);
+    res.status(204).end();
+    return void 0;
+  }));
+  router.post("/auth/step-up", requireAuth(services.tokens), rateLimit(cols, config, "step_up_ip", stepUpIpPerMin, 6e4), wrap(async (req) => {
+    const input = parseBody(import_auth_2fa_contract.stepUpRequestSchema.extend({ code: import_auth_2fa_contract.stepUpRequestSchema.shape.code.optional() }), req.body);
+    return services.mfa.stepUp(req, input, req.auth);
+  }));
+  if (config.exposeDocs) {
+    router.get("/auth/openapi.json", (_req, res) => {
+      res.json(buildOpenApiDoc());
+    });
+  }
+  return router;
+}
+function buildOpenApiDoc() {
+  return {
+    openapi: "3.1.0",
+    info: { title: "express-auth-2fa", version: "0.1.0" },
+    paths: {
+      "/auth/login": { post: { summary: "Password sign-in; returns AUTHENTICATED or MFA_REQUIRED" } },
+      "/auth/mfa/send": { post: { summary: "Send/resend an SMS code for a challenge" } },
+      "/auth/mfa/verify": { post: { summary: "Verify a 6-digit TOTP or SMS code" } },
+      "/auth/refresh": { post: { summary: "Rotate refresh cookie; returns a new access token" } },
+      "/auth/logout": { post: { summary: "Revoke the session and clear cookies" } },
+      "/auth/step-up": { post: { summary: "Verify a fresh code; returns a 5-min stepUpToken" } },
+      "/account/security": { get: { summary: "2FA status + active methods" } },
+      "/account/security/two-step": { put: { summary: "Enable/disable 2-Step Verification" } },
+      "/account/security/methods": { post: { summary: "Add a pending TOTP or SMS method" } },
+      "/account/security/methods/{id}/confirm": { post: { summary: "Confirm a pending method with a code" } },
+      "/account/security/methods/{id}": {
+        patch: { summary: "Rename or set-default a method" },
+        delete: { summary: "Remove a method" }
+      }
+    }
+  };
+}
+
+// src/routes/account.routes.ts
+var import_express2 = require("express");
+var import_auth_2fa_contract2 = require("@cairs-npm/auth-2fa-contract");
+var wrap2 = (fn) => (req, res, next) => fn(req, res).then((r) => r === void 0 ? void 0 : res.json(r)).catch(next);
+function buildAccountRouter(_config, _cols, services) {
+  const router = (0, import_express2.Router)();
+  const auth = requireAuth(services.tokens);
+  router.get("/account/security", auth, wrap2(async (req) => {
+    return services.methods.securitySummary(req.auth.sub);
+  }));
+  router.put("/account/security/two-step", auth, wrap2(async (req) => {
+    const input = parseBody(import_auth_2fa_contract2.twoStepRequestSchema, req.body);
+    return services.methods.setTwoStep(req.auth.sub, req.auth.sid, input.enabled, input.stepUpToken);
+  }));
+  router.post("/account/security/methods", auth, wrap2(async (req) => {
+    const input = parseBody(import_auth_2fa_contract2.addMethodRequestSchema, req.body);
+    return services.methods.addMethod(req.auth.sub, input);
+  }));
+  router.post("/account/security/passkeys/options", auth, wrap2(async (req) => {
+    return services.passkeys.registrationOptions(req.auth.sub);
+  }));
+  router.post("/account/security/passkeys", auth, wrap2(async (req) => {
+    const input = parseBody(import_auth_2fa_contract2.passkeyRegisterRequestSchema, req.body);
+    return services.passkeys.register(req.auth.sub, input);
+  }));
+  router.post("/account/security/methods/:id/confirm", auth, wrap2(async (req) => {
+    const input = parseBody(import_auth_2fa_contract2.confirmMethodRequestSchema, req.body);
+    return services.methods.confirmMethod(req.auth.sub, req.params.id, input.code);
+  }));
+  router.patch("/account/security/methods/:id", auth, wrap2(async (req) => {
+    const input = parseBody(import_auth_2fa_contract2.patchMethodRequestSchema, req.body);
+    return services.methods.patchMethod(req.auth.sub, req.auth.sid, req.params.id, input);
+  }));
+  router.delete("/account/security/methods/:id", auth, wrap2(async (req, res) => {
+    const input = parseBody(import_auth_2fa_contract2.deleteMethodRequestSchema, req.body);
+    await services.methods.deleteMethod(req.auth.sub, req.auth.sid, req.params.id, input.stepUpToken);
+    res.status(204).end();
+    return void 0;
+  }));
+  return router;
+}
+
+// src/adapters/sms/console.ts
+function consoleSms(logger) {
+  return {
+    send: async (phoneE164, message) => {
+      const masked = `\u2022\u2022\u2022\u2022 ${phoneE164.slice(-4)}`;
+      (logger ?? console).info({ to: masked }, message);
+    }
+  };
+}
+
+// src/adapters/sms/twilio.ts
+function twilioSms(opts) {
+  const baseUrl = (opts.baseUrl ?? "https://api.twilio.com/2010-04-01").replace(/\/+$/, "");
+  const auth = `Basic ${Buffer.from(`${opts.sid}:${opts.token}`).toString("base64")}`;
+  return {
+    send: async (phoneE164, message) => {
+      if (opts.client) {
+        await opts.client.messages.create({ to: phoneE164, from: opts.from, body: message });
+        return;
+      }
+      const form = new URLSearchParams({ To: phoneE164, Body: message });
+      form.set(opts.from.startsWith("MG") ? "MessagingServiceSid" : "From", opts.from);
+      const res = await fetch(`${baseUrl}/Accounts/${encodeURIComponent(opts.sid)}/Messages.json`, {
+        method: "POST",
+        headers: { Authorization: auth, "Content-Type": "application/x-www-form-urlencoded" },
+        body: form.toString()
+      });
+      if (!res.ok) {
+        const detail = await res.json().catch(() => null);
+        throw new Error(`twilio: SMS not sent (${res.status}${detail?.code ? ` ${detail.code}` : ""}): ${detail?.message ?? res.statusText}`);
+      }
+    }
+  };
+}
+
+// src/adapters/email/console.ts
+function consoleEmail(logger) {
+  return {
+    send: async ({ to, message }) => {
+      (logger ?? console).info({ to: maskEmail(to) }, message);
+    }
+  };
+}
+
+// src/index.ts
+async function migrate2(db, prefix = "auth_", auditDays = 365) {
+  return migrate(db, prefix, auditDays);
+}
+function createAuthRouter(input) {
+  const config = resolveConfig(input);
+  const cols = getCollections(config.db, config.collectionPrefix);
+  const tokens = new TokenService(config, cols);
+  const audit = new AuditService(config, cols);
+  const auth = new AuthService(config, cols, tokens, audit);
+  const mfa = new MfaService(config, cols, tokens, audit, auth);
+  const methods = new MethodService(config, cols, tokens, audit);
+  const passkeys = new PasskeyService(config, cols, audit, auth);
+  const router = (0, import_express3.Router)();
+  router.use((0, import_helmet.default)());
+  router.use(buildAuthRouter(config, cols, { auth, mfa, passkeys, tokens }));
+  router.use(buildAccountRouter(config, cols, { methods, passkeys, tokens }));
+  router.use(errorHandler);
+  router.services = { auth, mfa, methods, passkeys, tokens, audit };
+  return router;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ApiErrorException,
+  AuthService,
+  apiError,
+  consoleEmail,
+  consoleSms,
+  createAuthRouter,
+  errorHandler,
+  getCollections,
+  migrate,
+  twilioSms
+});
+//# sourceMappingURL=index.cjs.map