@camstack/system 1.2.390 → 1.2.392

package/dist/auth/login-session-manager.d.ts

@@ -1,158 +1,118 @@
-import { IScopedLogger, SettingsStoreClient } from '@camstack/types';
+import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
 /**
- * @durable class=ledger owner=local-auth
- *   write="one row per login (password, passkey, SSO, handoff, session exchange);
- *     rewritten on every refresh / renewal (expiry slides, refresh hash rotates)
- *     and on revocation"
- *   retention="the daily reap deletes rows expired more than 7 days ago and rows
- *     revoked more than 30 days ago. A session the user keeps refreshing lives as
- *     long as it is used."
- */
+* @durable class=ledger owner=local-auth
+*   write="one row per login (password, passkey, SSO, handoff, session exchange);
+*     rewritten on every refresh / renewal (expiry slides, refresh hash rotates)
+*     and on revocation"
+*   retention="the daily reap deletes rows expired more than 7 days ago and rows
+*     revoked more than 30 days ago. A session the user keeps refreshing lives as
+*     long as it is used."
+*/
 export declare const LOGIN_SESSIONS_COLLECTION = "login_sessions";
 /**
- * @durable class=config owner=local-auth
- *   write="revoking all of a user's sessions (logout everywhere, password change or
- *     reset, user deletion) sets that user's cutoff to now"
- *   retention="none — one row per user who ever had all sessions revoked; it only
- *     ever matters for tokens minted before sessions existed, and is harmless after."
- */
+* @durable class=config owner=local-auth
+*   write="revoking all of a user's sessions (logout everywhere, password change or
+*     reset, user deletion) sets that user's cutoff to now"
+*   retention="none — one row per user who ever had all sessions revoked; it only
+*     ever matters for tokens minted before sessions existed, and is harmless after."
+*/
 export declare const LOGIN_SESSION_CUTOFFS_COLLECTION = "login_session_cutoffs";
-export declare const LOGIN_SESSIONS_COLUMNS: ({
-    name: string;
-    type: "TEXT";
-    primaryKey: boolean;
-    notNull: boolean;
-} | {
-    name: string;
-    type: "TEXT";
-    notNull: boolean;
-    primaryKey?: undefined;
-} | {
-    name: string;
-    type: "BOOLEAN";
-    notNull: boolean;
-    primaryKey?: undefined;
-} | {
-    name: string;
-    type: "INTEGER";
-    notNull: boolean;
-    primaryKey?: undefined;
-} | {
-    name: string;
-    type: "INTEGER";
-    primaryKey?: undefined;
-    notNull?: undefined;
-} | {
-    name: string;
-    type: "TEXT";
-    primaryKey?: undefined;
-    notNull?: undefined;
-})[];
-export declare const LOGIN_SESSION_CUTOFFS_COLUMNS: ({
-    name: string;
-    type: "TEXT";
-    primaryKey: boolean;
-    notNull: boolean;
-} | {
-    name: string;
-    type: "INTEGER";
-    notNull: boolean;
-    primaryKey?: undefined;
-})[];
+export declare const LOGIN_SESSIONS_COLUMNS: readonly CollectionColumn[];
+export declare const LOGIN_SESSION_CUTOFFS_COLUMNS: readonly CollectionColumn[];
 /** How a session began — shown on the sessions list. */
-export type LoginSessionMethod = 'password' | 'passkey' | 'sso' | 'handoff' | 'exchange';
+export type LoginSessionMethod = "password" | "passkey" | "sso" | "handoff" | "exchange";
 /** Why a session ended. */
-export type LoginSessionRevocation = 'logout' | 'logout-everywhere' | 'password-changed' | 'password-reset' | 'user-deleted' | 'refresh-reuse' | 'revoked-by-user' | 'revoked-by-admin';
+export type LoginSessionRevocation = "logout" | "logout-everywhere" | "password-changed" | "password-reset" | "user-deleted" | "refresh-reuse" | "revoked-by-user" | "revoked-by-admin";
 export interface LoginSessionRecord {
-    readonly id: string;
-    readonly userId: string;
-    readonly method: LoginSessionMethod;
-    readonly refreshable: boolean;
-    readonly createdAt: number;
-    readonly lastUsedAt: number;
-    readonly expiresAt: number;
-    readonly revokedAt: number | null;
-    readonly revokedReason: string | null;
-    readonly refreshHash: string | null;
-    readonly previousRefreshHash: string | null;
-    readonly rotatedAt: number | null;
-    readonly client: string | null;
-    readonly ip: string | null;
+	readonly id: string;
+	readonly userId: string;
+	readonly method: LoginSessionMethod;
+	readonly refreshable: boolean;
+	readonly createdAt: number;
+	readonly lastUsedAt: number;
+	readonly expiresAt: number;
+	readonly revokedAt: number | null;
+	readonly revokedReason: string | null;
+	readonly refreshHash: string | null;
+	readonly previousRefreshHash: string | null;
+	readonly rotatedAt: number | null;
+	readonly client: string | null;
+	readonly ip: string | null;
 }
 /** A session as the UI sees it — no refresh hashes. */
-export type LoginSessionSummary = Omit<LoginSessionRecord, 'refreshHash' | 'previousRefreshHash' | 'rotatedAt'>;
+export type LoginSessionSummary = Omit<LoginSessionRecord, "refreshHash" | "previousRefreshHash" | "rotatedAt">;
 export interface CreateLoginSessionInput {
-    readonly userId: string;
-    readonly lifetimeMs: number;
-    readonly refreshable: boolean;
-    readonly method: LoginSessionMethod;
-    readonly client?: string;
-    readonly ip?: string;
+	readonly userId: string;
+	readonly lifetimeMs: number;
+	readonly refreshable: boolean;
+	readonly method: LoginSessionMethod;
+	readonly client?: string;
+	readonly ip?: string;
 }
 export type LoginSessionCheck = {
-    readonly state: 'active';
-    readonly session: LoginSessionRecord;
+	readonly state: "active";
+	readonly session: LoginSessionRecord;
 } | {
-    readonly state: 'unknown' | 'revoked' | 'expired';
+	readonly state: "unknown" | "revoked" | "expired";
 };
 export type LoginSessionRefresh = {
-    readonly ok: true;
-    readonly session: LoginSessionRecord;
-    readonly refreshToken: string;
+	readonly ok: true;
+	readonly session: LoginSessionRecord;
+	readonly refreshToken: string;
 } | {
-    readonly ok: false;
-    readonly reason: 'unknown' | 'expired' | 'revoked' | 'reused';
+	readonly ok: false;
+	readonly reason: "unknown" | "expired" | "revoked" | "reused";
 };
 export declare const REFRESH_TOKEN_PREFIX = "csr_";
 export declare function toLoginSessionSummary(record: LoginSessionRecord): LoginSessionSummary;
 export interface LoginSessionManagerOptions {
-    readonly now?: () => number;
-    readonly logger?: IScopedLogger;
+	readonly now?: () => number;
+	readonly logger?: IScopedLogger;
 }
 export declare class LoginSessionManager {
-    private readonly store;
-    private readonly sessions;
-    /** refresh hash (current or previous) → session id */
-    private readonly byRefreshHash;
-    private readonly cutoffs;
-    private readonly now;
-    private readonly logger;
-    constructor(store: SettingsStoreClient, options?: LoginSessionManagerOptions);
-    /** Load every row into the mirror. Call once at init, before serving. */
-    load(): Promise<void>;
-    create(input: CreateLoginSessionInput): Promise<{
-        readonly session: LoginSessionRecord;
-        readonly refreshToken: string | null;
-    }>;
-    /** Is `sessionId` a live session right now? Synchronous: the hub asks on every request. */
-    check(sessionId: string): LoginSessionCheck;
-    /** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
-    legacyCutoff(userId: string): number;
-    /** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
-    refresh(refreshToken: string, lifetimeMs: number): Promise<LoginSessionRefresh>;
-    /** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
-    extend(sessionId: string, lifetimeMs: number): Promise<LoginSessionRecord | null>;
-    /** End one session. `false` when it was unknown or already ended. */
-    revoke(sessionId: string, reason: LoginSessionRevocation): Promise<boolean>;
-    /**
-     * End every live session of `userId` except `exceptSessionId`, and move the
-     * user's legacy cutoff to now (pre-session tokens die too). Returns how many
-     * sessions ended.
-     */
-    revokeAllForUser(userId: string, options: {
-        readonly exceptSessionId?: string;
-        readonly reason: LoginSessionRevocation;
-    }): Promise<number>;
-    /** `userId`'s live sessions, newest first. */
-    listForUser(userId: string): readonly LoginSessionSummary[];
-    /** Every live session, newest first. */
-    listActive(): readonly LoginSessionSummary[];
-    /** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
-    reap(): Promise<number>;
-    private newRefreshToken;
-    private remember;
-    private forget;
-    private replace;
-    private persist;
-    private persistCutoff;
+	private readonly store;
+	private readonly sessions;
+	/** refresh hash (current or previous) → session id */
+	private readonly byRefreshHash;
+	private readonly cutoffs;
+	private readonly now;
+	private readonly logger;
+	constructor(store: SettingsStoreClient, options?: LoginSessionManagerOptions);
+	/** Load every row into the mirror. Call once at init, before serving. */
+	load(): Promise<void>;
+	create(input: CreateLoginSessionInput): Promise<{
+		readonly session: LoginSessionRecord;
+		readonly refreshToken: string | null;
+	}>;
+	/** Is `sessionId` a live session right now? Synchronous: the hub asks on every request. */
+	check(sessionId: string): LoginSessionCheck;
+	/** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
+	legacyCutoff(userId: string): number;
+	/** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
+	refresh(refreshToken: string, lifetimeMs: number): Promise<LoginSessionRefresh>;
+	/** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
+	extend(sessionId: string, lifetimeMs: number): Promise<LoginSessionRecord | null>;
+	/** End one session. `false` when it was unknown or already ended. */
+	revoke(sessionId: string, reason: LoginSessionRevocation): Promise<boolean>;
+	/**
+	* End every live session of `userId` except `exceptSessionId`, and move the
+	* user's legacy cutoff to now (pre-session tokens die too). Returns how many
+	* sessions ended.
+	*/
+	revokeAllForUser(userId: string, options: {
+		readonly exceptSessionId?: string;
+		readonly reason: LoginSessionRevocation;
+	}): Promise<number>;
+	/** `userId`'s live sessions, newest first. */
+	listForUser(userId: string): readonly LoginSessionSummary[];
+	/** Every live session, newest first. */
+	listActive(): readonly LoginSessionSummary[];
+	/** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
+	reap(): Promise<number>;
+	private newRefreshToken;
+	private remember;
+	private forget;
+	private replace;
+	private persist;
+	private persistCutoff;
 }

package/dist/auth/parse-record.d.ts

@@ -1,18 +1,18 @@
 /**
- * Wrap a Zod schema parse with an actionable error message. The
- * settings-store regression that broke local-auth in May 2026 surfaced
- * as an opaque Zod error listing every required field as `undefined`
- * — confusing because the data IS in the DB, just exposed through the
- * wrong shape by `queryDeclared`. This helper makes the failure mode
- * obvious: it explicitly mentions the kind, the offending value's top-
- * level keys, and a hint about the most common cause.
- *
- * `schema` is typed loosely (any with a `parse` method) to avoid the
- * generic ZodTypeAny variance error across Zod major versions when this
- * helper is reused by callers that import schemas from `@camstack/types`.
- */
+* Wrap a Zod schema parse with an actionable error message. The
+* settings-store regression that broke local-auth in May 2026 surfaced
+* as an opaque Zod error listing every required field as `undefined`
+* — confusing because the data IS in the DB, just exposed through the
+* wrong shape by `queryDeclared`. This helper makes the failure mode
+* obvious: it explicitly mentions the kind, the offending value's top-
+* level keys, and a hint about the most common cause.
+*
+* `schema` is typed loosely (any with a `parse` method) to avoid the
+* generic ZodTypeAny variance error across Zod major versions when this
+* helper is reused by callers that import schemas from `@camstack/types`.
+*/
 interface ZodLikeSchema<T> {
-    parse(data: unknown): T;
+	parse(data: unknown): T;
 }
 export declare function parseRecord<T>(kind: string, schema: ZodLikeSchema<T>, data: unknown): T;
 export {};

package/dist/auth/scope-matcher.d.ts

@@ -1,8 +1,8 @@
 /**
- * The scope derivation moved to `@camstack/types`
- * (`src/auth/principal-scope.ts`) so that ADDONS can reach it — they may not
- * import `@camstack/system`, which is why `addon-export-alexa` had hand-copied
- * `scopesAllowDeviceCap` into its `directive-router.ts`. This module is the
- * kernel-side re-export; there is no second implementation.
- */
-export { scopesAllowAddon, scopesAllowDeviceCap } from '@camstack/types';
+* The scope derivation moved to `@camstack/types`
+* (`src/auth/principal-scope.ts`) so that ADDONS can reach it — they may not
+* import `@camstack/system`, which is why `addon-export-alexa` had hand-copied
+* `scopesAllowDeviceCap` into its `directive-router.ts`. This module is the
+* kernel-side re-export; there is no second implementation.
+*/
+export { scopesAllowAddon, scopesAllowDeviceCap } from "@camstack/types";

package/dist/auth/scoped-token-manager.d.ts

@@ -1,65 +1,65 @@
-import { ScopedToken, TokenScope, SettingsStoreClient } from '@camstack/types';
+import type { ScopedToken, TokenScope, SettingsStoreClient } from "@camstack/types";
 /**
- * Manages scoped API tokens with restricted addon/route/capability access.
- */
+* Manages scoped API tokens with restricted addon/route/capability access.
+*/
 export declare class ScopedTokenManager {
-    private readonly store;
-    constructor(store: SettingsStoreClient);
-    create(userId: string, name: string, scopes: TokenScope[], expiresAt?: number): Promise<{
-        token: string;
-        record: ScopedToken;
-    }>;
-    validate(rawToken: string): Promise<ScopedToken | null>;
-    /**
-     * Coarse scope match — checks only `addonId` / `capability` (no
-     * `route-prefix` after the caps-only migration). Used by addon-route
-     * HTTP handlers that need a quick allow/deny before the per-method
-     * `access` check kicks in via `METHOD_ACCESS_MAP` in
-     * `protectedProcedure`.
-     */
-    matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
-    revoke(tokenId: string): Promise<void>;
-    listForUser(userId: string): Promise<ScopedToken[]>;
-    updateLastUsed(tokenId: string): Promise<void>;
-    /**
-     * Delete tokens whose expiry has passed.
-     *
-     * These were never usable — {@link validate} already rejects an expired
-     * token — so this is hygiene rather than a hole being closed, and it is
-     * worth being precise about what it actually buys:
-     *
-     *  - `listForUser` returns rows with no expiry filter, so the operator's
-     *    token list showed dead tokens as if they were live. There was no way to
-     *    tell from the UI which ones still worked.
-     *  - a database that outlives its tokens keeps their hashes indefinitely.
-     *    27 rows on the live hub had been unusable for months.
-     *
-     * A token with NO expiry (`expiresAt` null/absent) is a deliberate
-     * never-expires token and MUST survive: `BETWEEN` never matches NULL in
-     * SQL, which is the property this depends on and the spec pins against a
-     * real SQLite.
-     *
-     * The bound is `nowMs - 1` because {@link validate} treats `now ===
-     * expiresAt` as still valid; reaping at exactly the expiry instant would
-     * delete a token that the same millisecond still accepts.
-     *
-     * Returns how many rows went.
-     */
-    reapExpired(nowMs?: number): Promise<number>;
-    /**
-     * One-shot migration: drop tokens whose owner can't be resolved.
-     *
-     * Two ways a token can end up orphan:
-     *   • Pre-fix tokens minted via the CLI were owned by the literal
-     *     string `"system"` (provider hardcode, fixed 2026-05-11).
-     *   • A user gets deleted but their tokens were not cascade-revoked.
-     *
-     * Either way the UI's `listScopedTokens({ userId: u.id })` never
-     * returns them, so the operator can't revoke through the normal flow.
-     * We sweep both classes by passing the live user-id set in.
-     *
-     * Idempotent: if no orphans exist the method is a no-op.
-     * Returns the number of tokens removed.
-     */
-    cleanupOrphans(validUserIds: ReadonlySet<string>): Promise<number>;
+	private readonly store;
+	constructor(store: SettingsStoreClient);
+	create(userId: string, name: string, scopes: TokenScope[], expiresAt?: number): Promise<{
+		token: string;
+		record: ScopedToken;
+	}>;
+	validate(rawToken: string): Promise<ScopedToken | null>;
+	/**
+	* Coarse scope match — checks only `addonId` / `capability` (no
+	* `route-prefix` after the caps-only migration). Used by addon-route
+	* HTTP handlers that need a quick allow/deny before the per-method
+	* `access` check kicks in via `METHOD_ACCESS_MAP` in
+	* `protectedProcedure`.
+	*/
+	matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
+	revoke(tokenId: string): Promise<void>;
+	listForUser(userId: string): Promise<ScopedToken[]>;
+	updateLastUsed(tokenId: string): Promise<void>;
+	/**
+	* Delete tokens whose expiry has passed.
+	*
+	* These were never usable — {@link validate} already rejects an expired
+	* token — so this is hygiene rather than a hole being closed, and it is
+	* worth being precise about what it actually buys:
+	*
+	*  - `listForUser` returns rows with no expiry filter, so the operator's
+	*    token list showed dead tokens as if they were live. There was no way to
+	*    tell from the UI which ones still worked.
+	*  - a database that outlives its tokens keeps their hashes indefinitely.
+	*    27 rows on the live hub had been unusable for months.
+	*
+	* A token with NO expiry (`expiresAt` null/absent) is a deliberate
+	* never-expires token and MUST survive: `BETWEEN` never matches NULL in
+	* SQL, which is the property this depends on and the spec pins against a
+	* real SQLite.
+	*
+	* The bound is `nowMs - 1` because {@link validate} treats `now ===
+	* expiresAt` as still valid; reaping at exactly the expiry instant would
+	* delete a token that the same millisecond still accepts.
+	*
+	* Returns how many rows went.
+	*/
+	reapExpired(nowMs?: number): Promise<number>;
+	/**
+	* One-shot migration: drop tokens whose owner can't be resolved.
+	*
+	* Two ways a token can end up orphan:
+	*   • Pre-fix tokens minted via the CLI were owned by the literal
+	*     string `"system"` (provider hardcode, fixed 2026-05-11).
+	*   • A user gets deleted but their tokens were not cascade-revoked.
+	*
+	* Either way the UI's `listScopedTokens({ userId: u.id })` never
+	* returns them, so the operator can't revoke through the normal flow.
+	* We sweep both classes by passing the live user-id set in.
+	*
+	* Idempotent: if no orphans exist the method is a no-op.
+	* Returns the number of tokens removed.
+	*/
+	cleanupOrphans(validUserIds: ReadonlySet<string>): Promise<number>;
 }

package/dist/auth/token-expiry.d.ts

@@ -1,39 +1,62 @@
-import { DEFAULT_TOKEN_EXPIRY, IScopedLogger } from '@camstack/types';
+/**
+* Validation for the operator-configured session-JWT lifetime
+* (`auth.tokenExpiry`, System → Settings → Authentication → Token Expiry).
+*
+* WHY THIS EXISTS. The field is a free-text box that reaches `jwt.sign`'s
+* `expiresIn`. Two things go wrong without a gate in front of it:
+*
+*   1. `jsonwebtoken` THROWS on a value it cannot parse. The only caller is
+*      the login/refresh path, so one typo in a settings form turns every
+*      login into a 500 — a self-inflicted outage from a text field.
+*   2. `jsonwebtoken` hands a bare numeric STRING to `ms()`, which reads it
+*      as MILLISECONDS. An operator who types `3600` meaning "an hour" gets
+*      a token that dies in 3.6 seconds. A bare number is therefore rejected
+*      rather than interpreted — the field's own description, placeholder and
+*      default are all duration strings (`24h`, `7d`, `30d`).
+*
+* A rejection never becomes an unbounded lifetime — it resolves to
+* {@link DEFAULT_TOKEN_EXPIRY}, the single documented default — and it is
+* never silent: `parseTokenExpiry` reports the refusal in its result and
+* `logTokenExpiryRejection` renders it. The two are separate so the caller
+* owns how often it speaks; the signer re-reads on every mint.
+*/
+import { DEFAULT_TOKEN_EXPIRY } from "@camstack/types";
+import type { IScopedLogger } from "@camstack/types";
 /** Why a candidate value was refused. Feeds the log line, not the UI. */
-export type TokenExpiryRejection = 'not-a-string' | 'malformed' | 'too-short' | 'too-long';
+export type TokenExpiryRejection = "not-a-string" | "malformed" | "too-short" | "too-long";
 interface TokenExpiryOutcome {
-    /**
-     * Lifetime to hand `jwt.sign`, in SECONDS.
-     *
-     * Deliberately a number rather than the duration string: `expiresIn` accepts
-     * both, but the string branch re-parses through `ms` — which is the branch
-     * that reads a bare number as milliseconds. Resolving to seconds here means
-     * exactly one parser decides what the operator's text meant, and it is this
-     * one.
-     */
-    readonly seconds: number;
-    /** The duration string actually applied — for the log line and the UI story. */
-    readonly value: string;
+	/**
+	* Lifetime to hand `jwt.sign`, in SECONDS.
+	*
+	* Deliberately a number rather than the duration string: `expiresIn` accepts
+	* both, but the string branch re-parses through `ms` — which is the branch
+	* that reads a bare number as milliseconds. Resolving to seconds here means
+	* exactly one parser decides what the operator's text meant, and it is this
+	* one.
+	*/
+	readonly seconds: number;
+	/** The duration string actually applied — for the log line and the UI story. */
+	readonly value: string;
 }
 export interface TokenExpiryRejected extends TokenExpiryOutcome {
-    readonly ok: false;
-    readonly reason: TokenExpiryRejection;
+	readonly ok: false;
+	readonly reason: TokenExpiryRejection;
 }
 export interface TokenExpiryAccepted extends TokenExpiryOutcome {
-    readonly ok: true;
-    readonly reason?: undefined;
+	readonly ok: true;
+	readonly reason?: undefined;
 }
 export type TokenExpiryResult = TokenExpiryAccepted | TokenExpiryRejected;
 /**
- * Parse a configured `auth.tokenExpiry`. An absent/blank value is not a
- * rejection — it is "operator never set it" and resolves to the default
- * without a log line.
- */
+* Parse a configured `auth.tokenExpiry`. An absent/blank value is not a
+* rejection — it is "operator never set it" and resolves to the default
+* without a log line.
+*/
 export declare function parseTokenExpiry(configured: unknown): TokenExpiryResult;
 /**
- * Report a refused `auth.tokenExpiry`. Separate from {@link parseTokenExpiry}
- * so the caller owns HOW OFTEN it speaks — the signer re-reads the setting on
- * every mint and must not turn one bad save into a line per login.
- */
+* Report a refused `auth.tokenExpiry`. Separate from {@link parseTokenExpiry}
+* so the caller owns HOW OFTEN it speaks — the signer re-reads the setting on
+* every mint and must not turn one bad save into a line per login.
+*/
 export declare function logTokenExpiryRejection(configured: unknown, rejection: TokenExpiryRejected, logger: IScopedLogger): void;
 export { DEFAULT_TOKEN_EXPIRY };

package/dist/auth/totp-manager.d.ts

@@ -1,54 +1,54 @@
-import { SettingsStoreClient } from '@camstack/types';
+import type { SettingsStoreClient } from "@camstack/types";
 export interface TotpSetupResult {
-    readonly secret: string;
-    readonly otpauthUrl: string;
+	readonly secret: string;
+	readonly otpauthUrl: string;
 }
 export interface TotpStatus {
-    readonly enabled: boolean;
-    readonly confirmedAt: number | null;
+	readonly enabled: boolean;
+	readonly confirmedAt: number | null;
 }
 export declare class TotpManager {
-    private readonly store;
-    /** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
-     *  per-call `epochTolerance`. Default window 1 = ±30 s. */
-    private readonly epochTolerance;
-    constructor(store: SettingsStoreClient, opts?: {
-        /** ±N 30-second windows tolerated. Default 1 = ±30 s clock skew. */
-        readonly window?: number;
-    });
-    /**
-     * Begin enrollment. Always generates a fresh secret — calling `setup`
-     * a second time on the same user replaces any pending half-enrollment
-     * (the user must rescan the QR / re-enter the secret).
-     *
-     * The user identity (`label`) is what an authenticator displays as
-     * the account name; we use the supplied `username` for human-readable
-     * recognition. `ISSUER` is the CamStack brand.
-     */
-    setup(userId: string, username: string): Promise<TotpSetupResult>;
-    /**
-     * Confirm enrollment by checking a code from the authenticator
-     * against the pending secret. On success, flips `confirmedAt` so
-     * `verify()` starts accepting codes. Idempotent on already-confirmed
-     * rows: re-confirming a valid code just succeeds with no state
-     * change.
-     */
-    confirm(userId: string, code: string): Promise<boolean>;
-    /**
-     * Remove enrollment. Idempotent — no error if the user had no row.
-     */
-    disable(userId: string): Promise<void>;
-    /**
-     * Verify a code against the confirmed secret. Returns `false` when:
-     *   - The user has no row (not set up).
-     *   - The row is pending (`confirmedAt === null`).
-     *   - The code doesn't match within the configured window.
-     */
-    verify(userId: string, code: string): Promise<boolean>;
-    /**
-     * Read the user's enrollment status. Pending half-enrollments are
-     * reported as `enabled: false` — only a confirmed row counts.
-     */
-    getStatus(userId: string): Promise<TotpStatus>;
-    private find;
+	private readonly store;
+	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
+	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
+	private readonly epochTolerance;
+	constructor(store: SettingsStoreClient, opts?: {
+		/** ±N 30-second windows tolerated. Default 1 = ±30 s clock skew. */
+		readonly window?: number;
+	});
+	/**
+	* Begin enrollment. Always generates a fresh secret — calling `setup`
+	* a second time on the same user replaces any pending half-enrollment
+	* (the user must rescan the QR / re-enter the secret).
+	*
+	* The user identity (`label`) is what an authenticator displays as
+	* the account name; we use the supplied `username` for human-readable
+	* recognition. `ISSUER` is the CamStack brand.
+	*/
+	setup(userId: string, username: string): Promise<TotpSetupResult>;
+	/**
+	* Confirm enrollment by checking a code from the authenticator
+	* against the pending secret. On success, flips `confirmedAt` so
+	* `verify()` starts accepting codes. Idempotent on already-confirmed
+	* rows: re-confirming a valid code just succeeds with no state
+	* change.
+	*/
+	confirm(userId: string, code: string): Promise<boolean>;
+	/**
+	* Remove enrollment. Idempotent — no error if the user had no row.
+	*/
+	disable(userId: string): Promise<void>;
+	/**
+	* Verify a code against the confirmed secret. Returns `false` when:
+	*   - The user has no row (not set up).
+	*   - The row is pending (`confirmedAt === null`).
+	*   - The code doesn't match within the configured window.
+	*/
+	verify(userId: string, code: string): Promise<boolean>;
+	/**
+	* Read the user's enrollment status. Pending half-enrollments are
+	* reported as `enabled: false` — only a confirmed row counts.
+	*/
+	getStatus(userId: string): Promise<TotpStatus>;
+	private find;
 }