@cairs-npm/express-auth-2fa 0.1.4 → 0.1.6

package/dist/index.d.cts

@@ -35,6 +35,9 @@ interface MethodDoc {
     lastUsedStep?: number;
     /** SMS confirm-code hash while pending. */
     pendingCodeHash?: string;
+    /** When the pending SMS code was last sent, and how many were sent (resend cooldown + cap). */
+    pendingCodeSentAt?: Date;
+    pendingSendCount?: number;
     /** Expiry for pending methods (TTL). */
     pendingExpiresAt?: Date;
     /** Passkey: WebAuthn credential id (base64url). */
@@ -161,150 +164,67 @@ interface Logger {
     error: (obj: object, msg?: string) => void;
 }
 declare const configSchema: z.ZodObject<{
-    db: z.ZodType<Db, z.ZodTypeDef, Db>;
+    db: z.ZodCustom<Db, Db>;
     issuer: z.ZodString;
-    /** PEM PKCS8 private key (Ed25519 or RSA). Required, min 32 bytes. */
     jwtPrivateKey: z.ZodString;
-    /** 32-byte AES key, raw string or base64. Required. */
     encryptionKey: z.ZodString;
     keyId: z.ZodDefault<z.ZodString>;
-    userAdapter: z.ZodType<UserAdapter, z.ZodTypeDef, UserAdapter>;
-    smsProvider: z.ZodType<SmsProvider, z.ZodTypeDef, SmsProvider>;
-    /** Enables the always-present EMAIL method (default for new users). */
-    emailProvider: z.ZodOptional<z.ZodType<EmailProvider, z.ZodTypeDef, EmailProvider>>;
-    /** MongoClient for transactions; defaults to the client behind `db`. */
-    client: z.ZodOptional<z.ZodType<MongoClient, z.ZodTypeDef, MongoClient>>;
-    logger: z.ZodOptional<z.ZodType<Logger, z.ZodTypeDef, Logger>>;
-    hooks: z.ZodOptional<z.ZodType<Hooks, z.ZodTypeDef, Hooks>>;
-    clock: z.ZodOptional<z.ZodType<Clock, z.ZodTypeDef, Clock>>;
+    userAdapter: z.ZodCustom<UserAdapter, UserAdapter>;
+    smsProvider: z.ZodCustom<SmsProvider, SmsProvider>;
+    emailProvider: z.ZodOptional<z.ZodCustom<EmailProvider, EmailProvider>>;
+    client: z.ZodOptional<z.ZodCustom<MongoClient, MongoClient>>;
+    logger: z.ZodOptional<z.ZodCustom<Logger, Logger>>;
+    hooks: z.ZodOptional<z.ZodCustom<Hooks, Hooks>>;
+    clock: z.ZodOptional<z.ZodCustom<Clock, Clock>>;
     collectionPrefix: z.ZodDefault<z.ZodString>;
-    /**
-     * Passkeys (WebAuthn) as a second step. `rpID` is the site's domain (e.g. "childmatch.com",
-     * "localhost"); `origins` are the exact browser origins allowed (e.g. "https://app.childmatch.com").
-     * Omit to turn passkeys off.
-     */
     passkeys: z.ZodOptional<z.ZodObject<{
         rpID: z.ZodString;
         rpName: z.ZodString;
-        origins: z.ZodArray<z.ZodString, "many">;
-    }, "strip", z.ZodTypeAny, {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    }, {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    }>>;
-    /**
-     * Allow POST /auth/login/start: sign in with the identifier and a verification method only
-     * (no password). Single-factor — enable only for apps that already sign in by code. Pass a
-     * function to allow it per request, e.g. only for `type: "badge"`.
-     */
-    passwordlessLogin: z.ZodDefault<z.ZodUnion<[z.ZodBoolean, z.ZodType<(input: {
+        origins: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    passwordlessLogin: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCustom<(input: {
         username: string;
         type?: string;
-    }) => boolean | Promise<boolean>, z.ZodTypeDef, (input: {
+    }) => boolean | Promise<boolean>, (input: {
         username: string;
         type?: string;
     }) => boolean | Promise<boolean>>]>>;
-    /**
-     * 2-Step Verification switch above each user's own choice. False: password sign-in never
-     * asks for a code and the two-step setting can't be turned on. Passwordless sign-in still
-     * sends a code — it's the only factor there. Pass a function to decide per user, e.g. from
-     * an organization setting.
-     */
-    twoStepEnabled: z.ZodDefault<z.ZodUnion<[z.ZodBoolean, z.ZodType<(input: {
+    twoStepEnabled: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCustom<(input: {
         userId: string;
-    }) => boolean | Promise<boolean>, z.ZodTypeDef, (input: {
+    }) => boolean | Promise<boolean>, (input: {
         userId: string;
     }) => boolean | Promise<boolean>>]>>;
-    /** 2-Step Verification state for users who have not chosen one yet. */
     twoStepDefault: z.ZodDefault<z.ZodBoolean>;
-    limits: z.ZodDefault<z.ZodObject<{
-        /** Failed passwords before lockout (BR-2). */
+    limits: z.ZodPrefault<z.ZodObject<{
         loginMaxAttempts: z.ZodDefault<z.ZodNumber>;
-        /** Window for failed-login counting, minutes (BR-2). */
         loginWindowMin: z.ZodDefault<z.ZodNumber>;
-        /** Lockout duration, minutes (BR-2, BR-9). */
         lockMinutes: z.ZodDefault<z.ZodNumber>;
-        /** Min seconds between SMS sends on one challenge (BR-6). */
         smsResendSec: z.ZodDefault<z.ZodNumber>;
-        /** Max SMS sends per challenge (BR-6). */
         smsMaxPerChallenge: z.ZodDefault<z.ZodNumber>;
-        /** Max SMS sends per user per hour (BR-6). */
         smsMaxPerUserHour: z.ZodDefault<z.ZodNumber>;
-        /** Wrong codes per challenge before lockout (BR-9). */
         mfaMaxAttempts: z.ZodDefault<z.ZodNumber>;
-        /** Max verification methods per user (BR-16). */
         maxMethods: z.ZodDefault<z.ZodNumber>;
-        /** Per-IP login requests per minute (NFR-B4). */
         loginIpPerMin: z.ZodDefault<z.ZodNumber>;
-        /** Per-IP MFA verify requests per minute (NFR-B4). */
         verifyIpPerMin: z.ZodDefault<z.ZodNumber>;
-        /** Per-IP step-up requests per minute (NFR-B4). */
         stepUpIpPerMin: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        loginMaxAttempts: number;
-        loginWindowMin: number;
-        lockMinutes: number;
-        smsResendSec: number;
-        smsMaxPerChallenge: number;
-        smsMaxPerUserHour: number;
-        mfaMaxAttempts: number;
-        maxMethods: number;
-        loginIpPerMin: number;
-        verifyIpPerMin: number;
-        stepUpIpPerMin: number;
-    }, {
-        loginMaxAttempts?: number | undefined;
-        loginWindowMin?: number | undefined;
-        lockMinutes?: number | undefined;
-        smsResendSec?: number | undefined;
-        smsMaxPerChallenge?: number | undefined;
-        smsMaxPerUserHour?: number | undefined;
-        mfaMaxAttempts?: number | undefined;
-        maxMethods?: number | undefined;
-        loginIpPerMin?: number | undefined;
-        verifyIpPerMin?: number | undefined;
-        stepUpIpPerMin?: number | undefined;
-    }>>;
-    /**
-     * Set false to turn off every RATE_LIMITED check: the per-IP limits on login / code
-     * verify / send / step-up and the code-send cooldown and caps. Account lockouts after
-     * failed passwords or codes (LOCKED) still apply.
-     */
+    }, z.core.$strip>>;
     rateLimits: z.ZodDefault<z.ZodBoolean>;
-    argon2: z.ZodDefault<z.ZodObject<{
+    argon2: z.ZodPrefault<z.ZodObject<{
         memoryKiB: z.ZodDefault<z.ZodNumber>;
         iterations: z.ZodDefault<z.ZodNumber>;
         parallelism: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        memoryKiB: number;
-        iterations: number;
-        parallelism: number;
-    }, {
-        memoryKiB?: number | undefined;
-        iterations?: number | undefined;
-        parallelism?: number | undefined;
-    }>>;
-    cookies: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>>;
+    cookies: z.ZodPrefault<z.ZodObject<{
         secure: z.ZodDefault<z.ZodBoolean>;
         domain: z.ZodOptional<z.ZodString>;
-        sameSite: z.ZodDefault<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodDefault<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         path: z.ZodDefault<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        secure: boolean;
-        sameSite: "lax" | "strict" | "none";
-        domain?: string | undefined;
-    }, {
-        path?: string | undefined;
-        secure?: boolean | undefined;
-        domain?: string | undefined;
-        sameSite?: "lax" | "strict" | "none" | undefined;
-    }>>;
-    ttl: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>>;
+    ttl: z.ZodPrefault<z.ZodObject<{
         accessTokenSec: z.ZodDefault<z.ZodNumber>;
         refreshTokenDays: z.ZodDefault<z.ZodNumber>;
         trustedDeviceDays: z.ZodDefault<z.ZodNumber>;
@@ -312,150 +232,9 @@ declare const configSchema: z.ZodObject<{
         stepUpSec: z.ZodDefault<z.ZodNumber>;
         pendingMethodMin: z.ZodDefault<z.ZodNumber>;
         auditDays: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        accessTokenSec: number;
-        refreshTokenDays: number;
-        trustedDeviceDays: number;
-        challengeSec: number;
-        stepUpSec: number;
-        pendingMethodMin: number;
-        auditDays: number;
-    }, {
-        accessTokenSec?: number | undefined;
-        refreshTokenDays?: number | undefined;
-        trustedDeviceDays?: number | undefined;
-        challengeSec?: number | undefined;
-        stepUpSec?: number | undefined;
-        pendingMethodMin?: number | undefined;
-        auditDays?: number | undefined;
-    }>>;
-    /** Serve GET /auth/openapi.json (A.7 docs). */
+    }, z.core.$strip>>;
     exposeDocs: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    db: Db;
-    issuer: string;
-    jwtPrivateKey: string;
-    encryptionKey: string;
-    keyId: string;
-    userAdapter: UserAdapter;
-    smsProvider: SmsProvider;
-    collectionPrefix: string;
-    passwordlessLogin: boolean | ((input: {
-        username: string;
-        type?: string;
-    }) => boolean | Promise<boolean>);
-    twoStepEnabled: boolean | ((input: {
-        userId: string;
-    }) => boolean | Promise<boolean>);
-    twoStepDefault: boolean;
-    limits: {
-        loginMaxAttempts: number;
-        loginWindowMin: number;
-        lockMinutes: number;
-        smsResendSec: number;
-        smsMaxPerChallenge: number;
-        smsMaxPerUserHour: number;
-        mfaMaxAttempts: number;
-        maxMethods: number;
-        loginIpPerMin: number;
-        verifyIpPerMin: number;
-        stepUpIpPerMin: number;
-    };
-    rateLimits: boolean;
-    argon2: {
-        memoryKiB: number;
-        iterations: number;
-        parallelism: number;
-    };
-    cookies: {
-        path: string;
-        secure: boolean;
-        sameSite: "lax" | "strict" | "none";
-        domain?: string | undefined;
-    };
-    ttl: {
-        accessTokenSec: number;
-        refreshTokenDays: number;
-        trustedDeviceDays: number;
-        challengeSec: number;
-        stepUpSec: number;
-        pendingMethodMin: number;
-        auditDays: number;
-    };
-    exposeDocs: boolean;
-    emailProvider?: EmailProvider | undefined;
-    client?: MongoClient | undefined;
-    logger?: Logger | undefined;
-    hooks?: Hooks | undefined;
-    clock?: Clock | undefined;
-    passkeys?: {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    } | undefined;
-}, {
-    db: Db;
-    issuer: string;
-    jwtPrivateKey: string;
-    encryptionKey: string;
-    userAdapter: UserAdapter;
-    smsProvider: SmsProvider;
-    keyId?: string | undefined;
-    emailProvider?: EmailProvider | undefined;
-    client?: MongoClient | undefined;
-    logger?: Logger | undefined;
-    hooks?: Hooks | undefined;
-    clock?: Clock | undefined;
-    collectionPrefix?: string | undefined;
-    passkeys?: {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    } | undefined;
-    passwordlessLogin?: boolean | ((input: {
-        username: string;
-        type?: string;
-    }) => boolean | Promise<boolean>) | undefined;
-    twoStepEnabled?: boolean | ((input: {
-        userId: string;
-    }) => boolean | Promise<boolean>) | undefined;
-    twoStepDefault?: boolean | undefined;
-    limits?: {
-        loginMaxAttempts?: number | undefined;
-        loginWindowMin?: number | undefined;
-        lockMinutes?: number | undefined;
-        smsResendSec?: number | undefined;
-        smsMaxPerChallenge?: number | undefined;
-        smsMaxPerUserHour?: number | undefined;
-        mfaMaxAttempts?: number | undefined;
-        maxMethods?: number | undefined;
-        loginIpPerMin?: number | undefined;
-        verifyIpPerMin?: number | undefined;
-        stepUpIpPerMin?: number | undefined;
-    } | undefined;
-    rateLimits?: boolean | undefined;
-    argon2?: {
-        memoryKiB?: number | undefined;
-        iterations?: number | undefined;
-        parallelism?: number | undefined;
-    } | undefined;
-    cookies?: {
-        path?: string | undefined;
-        secure?: boolean | undefined;
-        domain?: string | undefined;
-        sameSite?: "lax" | "strict" | "none" | undefined;
-    } | undefined;
-    ttl?: {
-        accessTokenSec?: number | undefined;
-        refreshTokenDays?: number | undefined;
-        trustedDeviceDays?: number | undefined;
-        challengeSec?: number | undefined;
-        stepUpSec?: number | undefined;
-        pendingMethodMin?: number | undefined;
-        auditDays?: number | undefined;
-    } | undefined;
-    exposeDocs?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 type AuthConfigInput = z.input<typeof configSchema>;
 type AuthConfig = z.output<typeof configSchema> & {
     clock: Clock;

package/dist/index.d.ts

@@ -35,6 +35,9 @@ interface MethodDoc {
     lastUsedStep?: number;
     /** SMS confirm-code hash while pending. */
     pendingCodeHash?: string;
+    /** When the pending SMS code was last sent, and how many were sent (resend cooldown + cap). */
+    pendingCodeSentAt?: Date;
+    pendingSendCount?: number;
     /** Expiry for pending methods (TTL). */
     pendingExpiresAt?: Date;
     /** Passkey: WebAuthn credential id (base64url). */
@@ -161,150 +164,67 @@ interface Logger {
     error: (obj: object, msg?: string) => void;
 }
 declare const configSchema: z.ZodObject<{
-    db: z.ZodType<Db, z.ZodTypeDef, Db>;
+    db: z.ZodCustom<Db, Db>;
     issuer: z.ZodString;
-    /** PEM PKCS8 private key (Ed25519 or RSA). Required, min 32 bytes. */
     jwtPrivateKey: z.ZodString;
-    /** 32-byte AES key, raw string or base64. Required. */
     encryptionKey: z.ZodString;
     keyId: z.ZodDefault<z.ZodString>;
-    userAdapter: z.ZodType<UserAdapter, z.ZodTypeDef, UserAdapter>;
-    smsProvider: z.ZodType<SmsProvider, z.ZodTypeDef, SmsProvider>;
-    /** Enables the always-present EMAIL method (default for new users). */
-    emailProvider: z.ZodOptional<z.ZodType<EmailProvider, z.ZodTypeDef, EmailProvider>>;
-    /** MongoClient for transactions; defaults to the client behind `db`. */
-    client: z.ZodOptional<z.ZodType<MongoClient, z.ZodTypeDef, MongoClient>>;
-    logger: z.ZodOptional<z.ZodType<Logger, z.ZodTypeDef, Logger>>;
-    hooks: z.ZodOptional<z.ZodType<Hooks, z.ZodTypeDef, Hooks>>;
-    clock: z.ZodOptional<z.ZodType<Clock, z.ZodTypeDef, Clock>>;
+    userAdapter: z.ZodCustom<UserAdapter, UserAdapter>;
+    smsProvider: z.ZodCustom<SmsProvider, SmsProvider>;
+    emailProvider: z.ZodOptional<z.ZodCustom<EmailProvider, EmailProvider>>;
+    client: z.ZodOptional<z.ZodCustom<MongoClient, MongoClient>>;
+    logger: z.ZodOptional<z.ZodCustom<Logger, Logger>>;
+    hooks: z.ZodOptional<z.ZodCustom<Hooks, Hooks>>;
+    clock: z.ZodOptional<z.ZodCustom<Clock, Clock>>;
     collectionPrefix: z.ZodDefault<z.ZodString>;
-    /**
-     * Passkeys (WebAuthn) as a second step. `rpID` is the site's domain (e.g. "childmatch.com",
-     * "localhost"); `origins` are the exact browser origins allowed (e.g. "https://app.childmatch.com").
-     * Omit to turn passkeys off.
-     */
     passkeys: z.ZodOptional<z.ZodObject<{
         rpID: z.ZodString;
         rpName: z.ZodString;
-        origins: z.ZodArray<z.ZodString, "many">;
-    }, "strip", z.ZodTypeAny, {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    }, {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    }>>;
-    /**
-     * Allow POST /auth/login/start: sign in with the identifier and a verification method only
-     * (no password). Single-factor — enable only for apps that already sign in by code. Pass a
-     * function to allow it per request, e.g. only for `type: "badge"`.
-     */
-    passwordlessLogin: z.ZodDefault<z.ZodUnion<[z.ZodBoolean, z.ZodType<(input: {
+        origins: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    passwordlessLogin: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCustom<(input: {
         username: string;
         type?: string;
-    }) => boolean | Promise<boolean>, z.ZodTypeDef, (input: {
+    }) => boolean | Promise<boolean>, (input: {
         username: string;
         type?: string;
     }) => boolean | Promise<boolean>>]>>;
-    /**
-     * 2-Step Verification switch above each user's own choice. False: password sign-in never
-     * asks for a code and the two-step setting can't be turned on. Passwordless sign-in still
-     * sends a code — it's the only factor there. Pass a function to decide per user, e.g. from
-     * an organization setting.
-     */
-    twoStepEnabled: z.ZodDefault<z.ZodUnion<[z.ZodBoolean, z.ZodType<(input: {
+    twoStepEnabled: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCustom<(input: {
         userId: string;
-    }) => boolean | Promise<boolean>, z.ZodTypeDef, (input: {
+    }) => boolean | Promise<boolean>, (input: {
         userId: string;
     }) => boolean | Promise<boolean>>]>>;
-    /** 2-Step Verification state for users who have not chosen one yet. */
     twoStepDefault: z.ZodDefault<z.ZodBoolean>;
-    limits: z.ZodDefault<z.ZodObject<{
-        /** Failed passwords before lockout (BR-2). */
+    limits: z.ZodPrefault<z.ZodObject<{
         loginMaxAttempts: z.ZodDefault<z.ZodNumber>;
-        /** Window for failed-login counting, minutes (BR-2). */
         loginWindowMin: z.ZodDefault<z.ZodNumber>;
-        /** Lockout duration, minutes (BR-2, BR-9). */
         lockMinutes: z.ZodDefault<z.ZodNumber>;
-        /** Min seconds between SMS sends on one challenge (BR-6). */
         smsResendSec: z.ZodDefault<z.ZodNumber>;
-        /** Max SMS sends per challenge (BR-6). */
         smsMaxPerChallenge: z.ZodDefault<z.ZodNumber>;
-        /** Max SMS sends per user per hour (BR-6). */
         smsMaxPerUserHour: z.ZodDefault<z.ZodNumber>;
-        /** Wrong codes per challenge before lockout (BR-9). */
         mfaMaxAttempts: z.ZodDefault<z.ZodNumber>;
-        /** Max verification methods per user (BR-16). */
         maxMethods: z.ZodDefault<z.ZodNumber>;
-        /** Per-IP login requests per minute (NFR-B4). */
         loginIpPerMin: z.ZodDefault<z.ZodNumber>;
-        /** Per-IP MFA verify requests per minute (NFR-B4). */
         verifyIpPerMin: z.ZodDefault<z.ZodNumber>;
-        /** Per-IP step-up requests per minute (NFR-B4). */
         stepUpIpPerMin: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        loginMaxAttempts: number;
-        loginWindowMin: number;
-        lockMinutes: number;
-        smsResendSec: number;
-        smsMaxPerChallenge: number;
-        smsMaxPerUserHour: number;
-        mfaMaxAttempts: number;
-        maxMethods: number;
-        loginIpPerMin: number;
-        verifyIpPerMin: number;
-        stepUpIpPerMin: number;
-    }, {
-        loginMaxAttempts?: number | undefined;
-        loginWindowMin?: number | undefined;
-        lockMinutes?: number | undefined;
-        smsResendSec?: number | undefined;
-        smsMaxPerChallenge?: number | undefined;
-        smsMaxPerUserHour?: number | undefined;
-        mfaMaxAttempts?: number | undefined;
-        maxMethods?: number | undefined;
-        loginIpPerMin?: number | undefined;
-        verifyIpPerMin?: number | undefined;
-        stepUpIpPerMin?: number | undefined;
-    }>>;
-    /**
-     * Set false to turn off every RATE_LIMITED check: the per-IP limits on login / code
-     * verify / send / step-up and the code-send cooldown and caps. Account lockouts after
-     * failed passwords or codes (LOCKED) still apply.
-     */
+    }, z.core.$strip>>;
     rateLimits: z.ZodDefault<z.ZodBoolean>;
-    argon2: z.ZodDefault<z.ZodObject<{
+    argon2: z.ZodPrefault<z.ZodObject<{
         memoryKiB: z.ZodDefault<z.ZodNumber>;
         iterations: z.ZodDefault<z.ZodNumber>;
         parallelism: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        memoryKiB: number;
-        iterations: number;
-        parallelism: number;
-    }, {
-        memoryKiB?: number | undefined;
-        iterations?: number | undefined;
-        parallelism?: number | undefined;
-    }>>;
-    cookies: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>>;
+    cookies: z.ZodPrefault<z.ZodObject<{
         secure: z.ZodDefault<z.ZodBoolean>;
         domain: z.ZodOptional<z.ZodString>;
-        sameSite: z.ZodDefault<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodDefault<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         path: z.ZodDefault<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        secure: boolean;
-        sameSite: "lax" | "strict" | "none";
-        domain?: string | undefined;
-    }, {
-        path?: string | undefined;
-        secure?: boolean | undefined;
-        domain?: string | undefined;
-        sameSite?: "lax" | "strict" | "none" | undefined;
-    }>>;
-    ttl: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>>;
+    ttl: z.ZodPrefault<z.ZodObject<{
         accessTokenSec: z.ZodDefault<z.ZodNumber>;
         refreshTokenDays: z.ZodDefault<z.ZodNumber>;
         trustedDeviceDays: z.ZodDefault<z.ZodNumber>;
@@ -312,150 +232,9 @@ declare const configSchema: z.ZodObject<{
         stepUpSec: z.ZodDefault<z.ZodNumber>;
         pendingMethodMin: z.ZodDefault<z.ZodNumber>;
         auditDays: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        accessTokenSec: number;
-        refreshTokenDays: number;
-        trustedDeviceDays: number;
-        challengeSec: number;
-        stepUpSec: number;
-        pendingMethodMin: number;
-        auditDays: number;
-    }, {
-        accessTokenSec?: number | undefined;
-        refreshTokenDays?: number | undefined;
-        trustedDeviceDays?: number | undefined;
-        challengeSec?: number | undefined;
-        stepUpSec?: number | undefined;
-        pendingMethodMin?: number | undefined;
-        auditDays?: number | undefined;
-    }>>;
-    /** Serve GET /auth/openapi.json (A.7 docs). */
+    }, z.core.$strip>>;
     exposeDocs: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    db: Db;
-    issuer: string;
-    jwtPrivateKey: string;
-    encryptionKey: string;
-    keyId: string;
-    userAdapter: UserAdapter;
-    smsProvider: SmsProvider;
-    collectionPrefix: string;
-    passwordlessLogin: boolean | ((input: {
-        username: string;
-        type?: string;
-    }) => boolean | Promise<boolean>);
-    twoStepEnabled: boolean | ((input: {
-        userId: string;
-    }) => boolean | Promise<boolean>);
-    twoStepDefault: boolean;
-    limits: {
-        loginMaxAttempts: number;
-        loginWindowMin: number;
-        lockMinutes: number;
-        smsResendSec: number;
-        smsMaxPerChallenge: number;
-        smsMaxPerUserHour: number;
-        mfaMaxAttempts: number;
-        maxMethods: number;
-        loginIpPerMin: number;
-        verifyIpPerMin: number;
-        stepUpIpPerMin: number;
-    };
-    rateLimits: boolean;
-    argon2: {
-        memoryKiB: number;
-        iterations: number;
-        parallelism: number;
-    };
-    cookies: {
-        path: string;
-        secure: boolean;
-        sameSite: "lax" | "strict" | "none";
-        domain?: string | undefined;
-    };
-    ttl: {
-        accessTokenSec: number;
-        refreshTokenDays: number;
-        trustedDeviceDays: number;
-        challengeSec: number;
-        stepUpSec: number;
-        pendingMethodMin: number;
-        auditDays: number;
-    };
-    exposeDocs: boolean;
-    emailProvider?: EmailProvider | undefined;
-    client?: MongoClient | undefined;
-    logger?: Logger | undefined;
-    hooks?: Hooks | undefined;
-    clock?: Clock | undefined;
-    passkeys?: {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    } | undefined;
-}, {
-    db: Db;
-    issuer: string;
-    jwtPrivateKey: string;
-    encryptionKey: string;
-    userAdapter: UserAdapter;
-    smsProvider: SmsProvider;
-    keyId?: string | undefined;
-    emailProvider?: EmailProvider | undefined;
-    client?: MongoClient | undefined;
-    logger?: Logger | undefined;
-    hooks?: Hooks | undefined;
-    clock?: Clock | undefined;
-    collectionPrefix?: string | undefined;
-    passkeys?: {
-        rpID: string;
-        rpName: string;
-        origins: string[];
-    } | undefined;
-    passwordlessLogin?: boolean | ((input: {
-        username: string;
-        type?: string;
-    }) => boolean | Promise<boolean>) | undefined;
-    twoStepEnabled?: boolean | ((input: {
-        userId: string;
-    }) => boolean | Promise<boolean>) | undefined;
-    twoStepDefault?: boolean | undefined;
-    limits?: {
-        loginMaxAttempts?: number | undefined;
-        loginWindowMin?: number | undefined;
-        lockMinutes?: number | undefined;
-        smsResendSec?: number | undefined;
-        smsMaxPerChallenge?: number | undefined;
-        smsMaxPerUserHour?: number | undefined;
-        mfaMaxAttempts?: number | undefined;
-        maxMethods?: number | undefined;
-        loginIpPerMin?: number | undefined;
-        verifyIpPerMin?: number | undefined;
-        stepUpIpPerMin?: number | undefined;
-    } | undefined;
-    rateLimits?: boolean | undefined;
-    argon2?: {
-        memoryKiB?: number | undefined;
-        iterations?: number | undefined;
-        parallelism?: number | undefined;
-    } | undefined;
-    cookies?: {
-        path?: string | undefined;
-        secure?: boolean | undefined;
-        domain?: string | undefined;
-        sameSite?: "lax" | "strict" | "none" | undefined;
-    } | undefined;
-    ttl?: {
-        accessTokenSec?: number | undefined;
-        refreshTokenDays?: number | undefined;
-        trustedDeviceDays?: number | undefined;
-        challengeSec?: number | undefined;
-        stepUpSec?: number | undefined;
-        pendingMethodMin?: number | undefined;
-        auditDays?: number | undefined;
-    } | undefined;
-    exposeDocs?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 type AuthConfigInput = z.input<typeof configSchema>;
 type AuthConfig = z.output<typeof configSchema> & {
     clock: Clock;