@omni2fa/core 0.6.1

package/dist/types/api.d.ts

@@ -0,0 +1,1075 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+export interface paths {
+    "/methods": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List active 2FA methods for the current user. */
+        get: operations["listMethods"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/methods/{methodId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove an enrolled 2FA method.
+         * @description Removes a single enrolled method. If this is the user's last method
+         *     and the host has configured `AllowDisabling = false`, the request
+         *     returns `409 LAST_METHOD_PROTECTED` — host policy decides whether
+         *     to forbid removing the last method.
+         */
+        delete: operations["removeMethod"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/challenge/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start verification of a chosen method.
+         * @description After the host verifies the user's password and issues a pre-auth token,
+         *     the frontend calls this with the picked method. Backend prepares
+         *     method-specific challenge state — see response shape per type.
+         *
+         *     For **TOTP** — this is a no-op acknowledgment; the user enters the code
+         *     from their authenticator and the frontend goes straight to `/verify`.
+         *
+         *     For **Email** (v0.2+) — backend sends an OTP email and returns confirmation.
+         *
+         *     For **WebAuthn** (v0.3+) — backend returns assertion request options
+         *     for `navigator.credentials.get()`.
+         */
+        post: operations["startChallenge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/challenge/resend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Re-send the login OTP for a method that delivers codes out-of-band (Email).
+         * @description For **Email** — re-sends the one-time code for the active login challenge of the
+         *     given method, subject to a resend cooldown. For methods that don't deliver codes
+         *     (TOTP, WebAuthn) this is not applicable and returns `400 VALIDATION_FAILED`.
+         */
+        post: operations["resendChallenge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/challenge/recovery-code": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Complete login with a one-time recovery code instead of a 2FA method.
+         * @description Method-agnostic fallback. Consumes the recovery code (one-time use) and, on success,
+         *     returns the verified `userId` exactly like `/challenge/verify`.
+         */
+        post: operations["verifyRecoveryCode"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/challenge/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify the user's response to a challenge.
+         * @description Final step of the 2FA login flow. On success, the host application
+         *     receives the `userId` and is responsible for minting its session JWT.
+         *
+         *     Omni2FA does **not** issue session tokens — only verification results.
+         */
+        post: operations["verifyChallenge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/email/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Begin Email OTP enrollment.
+         * @description The host supplies the destination email address — Omni2FA does not read it from a
+         *     claim and does not own address verification (that is the host's responsibility). The
+         *     server issues a one-time code, persists it as a pending enrollment, and emails it.
+         */
+        post: operations["startEmailEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/email/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Confirm Email OTP enrollment by verifying the emailed code. */
+        post: operations["confirmEmailEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/email/resend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Re-send the enrollment OTP, subject to a resend cooldown. */
+        post: operations["resendEmailEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/webauthn/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Begin WebAuthn enrollment — issue credential creation options.
+         * @description Returns `PublicKeyCredentialCreationOptions` (as `optionsJson`) for the browser to pass to
+         *     `navigator.credentials.create()`. The pending ceremony is persisted; the browser attestation
+         *     is posted back to `/confirm`.
+         */
+        post: operations["startWebAuthnEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/webauthn/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Confirm WebAuthn enrollment by verifying the browser attestation. */
+        post: operations["confirmWebAuthnEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/totp/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Begin TOTP enrollment.
+         * @description Generates a fresh secret, persists it as a pending enrollment,
+         *     and returns the otpauth:// URI plus the base32 secret. The frontend
+         *     renders the URI as a QR and shows the secret for manual entry.
+         */
+        post: operations["startTotpEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/enroll/totp/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm TOTP enrollment by verifying a code.
+         * @description User scans the QR and submits the first 6-digit code from their
+         *     authenticator. Backend validates the code against the pending secret
+         *     and persists the method on success.
+         */
+        post: operations["confirmTotpEnrollment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/recovery-codes/regenerate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Generate a fresh set of recovery codes, invalidating all previous ones.
+         * @description Returns the new plaintext codes **once**. Previous codes stop working immediately.
+         *     The frontend must display them and instruct the user to save them — no second chance.
+         */
+        post: operations["regenerateRecoveryCodes"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /**
+         * @description The type of 2FA factor. Currently only `Totp` is implemented (v0.1).
+         *     `Email` lands in v0.2, `WebAuthn` in v0.3.
+         * @enum {string}
+         */
+        TwoFactorMethodType: "Totp" | "Email" | "WebAuthn";
+        TwoFactorMethodDto: {
+            /** Format: uuid */
+            id: string;
+            type: components["schemas"]["TwoFactorMethodType"];
+            /** @description Optional human-readable label (e.g. "Personal authenticator", "YubiKey 5"). */
+            name?: string | null;
+            /** Format: date-time */
+            createdAt: string;
+            /** Format: date-time */
+            lastUsedAt?: string | null;
+        };
+        /**
+         * @description **Contract-only schema — not used by any Omni2FA endpoint.**
+         *
+         *     Returned by the **host's** login endpoint (e.g. `POST /auth/login`)
+         *     when the verified user has 2FA methods enrolled. Carries the
+         *     short-lived pre-auth token (issued via the .NET helper
+         *     `IPreAuthTokenIssuer.IssueAsync(userId)`) and the list of methods the
+         *     user can pick from.
+         *
+         *     This schema is published as part of the cross-stack contract so any
+         *     host implementation (.NET, Python, Node, …) returns the same shape
+         *     and any frontend can decode it identically. Because no Omni2FA-owned
+         *     endpoint produces it, the `no-unused-components` linter rule is
+         *     suppressed for this single schema in `.redocly.lint-ignore.yaml`.
+         */
+        PreAuthChallengeResponse: {
+            /** @description Short-lived JWT. Send as Bearer token to all `/challenge/*` endpoints. */
+            preAuthToken: string;
+            availableMethods: components["schemas"]["TwoFactorMethodDto"][];
+            /** Format: date-time */
+            expiresAt: string;
+        };
+        ChallengeStartRequest: {
+            /**
+             * Format: uuid
+             * @description ID of the method the user picked from `availableMethods`.
+             */
+            methodId: string;
+        };
+        /**
+         * @description Method-specific challenge payload. `type` discriminates the shape.
+         *     For TOTP — empty payload (just confirms challenge started); `expiresAt` and
+         *     `resendAvailableAt` are null. For Email — an OTP was sent; `expiresAt` is when
+         *     it stops validating and `resendAvailableAt` is when a resend becomes allowed.
+         *     WebAuthn assertion options will be added in v0.3.
+         */
+        ChallengeStartResponse: {
+            type: components["schemas"]["TwoFactorMethodType"];
+            /**
+             * Format: date-time
+             * @description For Email — when the sent code stops validating. Null for TOTP.
+             */
+            expiresAt?: string | null;
+            /**
+             * Format: date-time
+             * @description For Email — earliest time a resend is permitted. Null for TOTP.
+             */
+            resendAvailableAt?: string | null;
+            /**
+             * @description For WebAuthn — `PublicKeyCredentialRequestOptions` JSON to pass to
+             *     `navigator.credentials.get()`. Null for TOTP and Email.
+             */
+            optionsJson?: string | null;
+        };
+        ChallengeResendRequest: {
+            /**
+             * Format: uuid
+             * @description The method whose active login OTP should be re-sent.
+             */
+            methodId: string;
+        };
+        ChallengeVerifyRequest: {
+            /** Format: uuid */
+            methodId: string;
+            /** @description For TOTP and Email — the 6-digit numeric code. Null for WebAuthn. */
+            code?: string | null;
+            /** @description For WebAuthn — the JSON from `navigator.credentials.get()`. Null for TOTP and Email. */
+            assertionResponseJson?: string | null;
+        };
+        VerifySuccessResponse: {
+            /** @description Always `true` on this response. Failures use `4xx` with `ErrorResponse`. */
+            verified: boolean;
+            /**
+             * @description Verified user's identifier, stringified. The host application casts
+             *     this to its native userId type (Guid/long/int/email) and uses it to
+             *     mint its final session JWT/cookie. Omni2FA does not issue session tokens.
+             */
+            userId: string;
+        };
+        EmailEnrollStartRequest: {
+            /**
+             * Format: email
+             * @description Destination address the OTP is sent to, supplied by the host. Omni2FA does not
+             *     derive it from a claim and does not verify address ownership — that is host policy.
+             * @example alice@example.com
+             */
+            email: string;
+        };
+        EmailEnrollStartResponse: {
+            /**
+             * Format: uuid
+             * @description Identifier for the pending enrollment ceremony. Pass back in `confirm` / `resend`.
+             */
+            enrollmentId: string;
+            /**
+             * Format: date-time
+             * @description When the emailed code stops validating.
+             */
+            expiresAt: string;
+            /**
+             * Format: date-time
+             * @description Earliest time a resend is permitted (cooldown).
+             */
+            resendAvailableAt: string;
+        };
+        EmailEnrollConfirmRequest: {
+            /**
+             * Format: uuid
+             * @description Value returned from `/enroll/email/start`.
+             */
+            enrollmentId: string;
+            /**
+             * @description The numeric code from the enrollment email.
+             * @example 123456
+             */
+            code: string;
+            /** @description Optional human-readable label for this method. */
+            name?: string | null;
+        };
+        EmailEnrollResendRequest: {
+            /**
+             * Format: uuid
+             * @description Value returned from `/enroll/email/start`.
+             */
+            enrollmentId: string;
+        };
+        WebAuthnEnrollStartResponse: {
+            /**
+             * Format: uuid
+             * @description Identifier for the pending ceremony. Pass back in `confirm`.
+             */
+            enrollmentId: string;
+            /**
+             * @description `PublicKeyCredentialCreationOptions` JSON for `navigator.credentials.create()`.
+             *     Challenge, user id, and excluded credential ids are base64url-encoded.
+             */
+            optionsJson: string;
+        };
+        WebAuthnEnrollConfirmRequest: {
+            /**
+             * Format: uuid
+             * @description Value returned from `/enroll/webauthn/start`.
+             */
+            enrollmentId: string;
+            /** @description The JSON produced by `navigator.credentials.create()`, base64url-encoded fields. */
+            attestationResponseJson: string;
+            /** @description Optional human-readable label for this credential (e.g. "YubiKey 5"). */
+            name?: string | null;
+        };
+        TotpEnrollStartResponse: {
+            /**
+             * Format: uuid
+             * @description Identifier for the pending enrollment ceremony. Pass back in `confirm`.
+             */
+            enrollmentId: string;
+            /**
+             * @description `otpauth://` URI for authenticator app QR code. Format:
+             *     `otpauth://totp/{Issuer}:{accountLabel}?secret={base32}&issuer={Issuer}&algorithm=SHA1&digits=6&period=30`.
+             * @example otpauth://totp/MyApp:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=MyApp&algorithm=SHA1&digits=6&period=30
+             */
+            otpAuthUri: string;
+            /**
+             * @description Base32-encoded TOTP secret. Shown to the user as a fallback to QR scanning.
+             * @example JBSWY3DPEHPK3PXP
+             */
+            secret: string;
+        };
+        TotpEnrollConfirmRequest: {
+            /**
+             * Format: uuid
+             * @description Value returned from `/enroll/totp/start`.
+             */
+            enrollmentId: string;
+            /**
+             * @description 6-digit code from the user's authenticator app.
+             * @example 123456
+             */
+            code: string;
+            /** @description Optional human-readable label for this method. */
+            name?: string | null;
+        };
+        MethodCreatedResponse: {
+            /**
+             * Format: uuid
+             * @description Identifier of the newly created method.
+             */
+            methodId: string;
+            /**
+             * @description Present only when this enrollment generated recovery codes (i.e. it was the user's
+             *     first method). Plaintext, shown once — the frontend must display and have the user
+             *     save them. Null on every subsequent enrollment.
+             */
+            recoveryCodes?: string[] | null;
+        };
+        RecoveryCodesResponse: {
+            /** @description Fresh plaintext codes, shown once. Previous codes are now invalid. */
+            recoveryCodes: string[];
+        };
+        RecoveryCodeVerifyRequest: {
+            /**
+             * @description A single unused recovery code. Dashes/spaces and case are normalized server-side.
+             * @example A1B2-C3D4-E5
+             */
+            recoveryCode: string;
+        };
+        /**
+         * @description Uniform error envelope returned by every non-2xx response. Frontends
+         *     switch on `code` (machine-readable, stable). `message` is informational
+         *     and may be localized.
+         *     See `Core/protocol/ERROR_CODES.md` for the full catalogue.
+         */
+        ErrorResponse: {
+            /**
+             * @description Machine-readable error code, stable across versions.
+             * @example INVALID_CODE
+             */
+            code: string;
+            /**
+             * @description Human-readable message. May be localized by host.
+             * @example The code you entered is invalid.
+             */
+            message: string;
+            /** @description Optional structured context. Shape depends on `code`. */
+            details?: {
+                [key: string]: unknown;
+            } | null;
+        };
+    };
+    responses: {
+        /** @description Missing or invalid session token. */
+        Unauthorized: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+        /** @description Pre-auth token is missing, malformed, or expired. */
+        PreAuthInvalidOrExpired: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+        /** @description Request validation failed. */
+        BadRequest: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+        /**
+         * @description Rate limit exceeded. Default policy is 20 attempts per minute per IP
+         *     on verify endpoints — see `docs/CODE_STYLE.md` rule 5 + ROADMAP v0.6.
+         */
+        TooManyRequests: {
+            headers: {
+                /** @description Seconds until the next attempt is allowed. */
+                "Retry-After"?: number;
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+    };
+    parameters: {
+        /** @description Identifier of the enrolled method. */
+        MethodIdPath: string;
+    };
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    listMethods: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Array of active methods. Empty array if user has no 2FA enrolled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TwoFactorMethodDto"][];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    removeMethod: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Identifier of the enrolled method. */
+                methodId: components["parameters"]["MethodIdPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Method removed. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Method not found, or does not belong to current user. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Conflict — removing this method is forbidden by host policy. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    startChallenge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ChallengeStartRequest"];
+            };
+        };
+        responses: {
+            /** @description Challenge prepared. Response shape depends on method type. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ChallengeStartResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["PreAuthInvalidOrExpired"];
+            /** @description Method not found, or does not belong to current pre-auth user. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    resendChallenge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ChallengeResendRequest"];
+            };
+        };
+        responses: {
+            /** @description A fresh code was sent (or the previous one re-sent). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ChallengeStartResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["PreAuthInvalidOrExpired"];
+            /** @description No active challenge for the given method under the current pre-auth user. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    verifyRecoveryCode: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RecoveryCodeVerifyRequest"];
+            };
+        };
+        responses: {
+            /** @description Recovery code accepted. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerifySuccessResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Code invalid, already used, or pre-auth invalid/expired. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    verifyChallenge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ChallengeVerifyRequest"];
+            };
+        };
+        responses: {
+            /** @description Verification succeeded. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerifySuccessResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Code invalid, pre-auth invalid/expired, or challenge consumed/missing. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    startEmailEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["EmailEnrollStartRequest"];
+            };
+        };
+        responses: {
+            /** @description Enrollment started, OTP emailed. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["EmailEnrollStartResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description An Email method is already enrolled for this user. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    confirmEmailEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["EmailEnrollConfirmRequest"];
+            };
+        };
+        responses: {
+            /** @description Email method enrolled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MethodCreatedResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description No pending Email enrollment for this user, or it has expired. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    resendEmailEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["EmailEnrollResendRequest"];
+            };
+        };
+        responses: {
+            /** @description A fresh code was sent. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["EmailEnrollStartResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description No pending Email enrollment for this user, or it has expired. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    startWebAuthnEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Creation options issued. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebAuthnEnrollStartResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description The per-user WebAuthn credential cap has been reached. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    confirmWebAuthnEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebAuthnEnrollConfirmRequest"];
+            };
+        };
+        responses: {
+            /** @description WebAuthn credential enrolled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MethodCreatedResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Attestation failed verification, or no pending enrollment. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description No pending WebAuthn enrollment for this user, or it has expired. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    startTotpEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Enrollment ceremony started. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TotpEnrollStartResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description TOTP method already enrolled for this user. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    confirmTotpEnrollment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TotpEnrollConfirmRequest"];
+            };
+        };
+        responses: {
+            /** @description TOTP enrolled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MethodCreatedResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description No pending TOTP enrollment for this user, or it has expired. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    regenerateRecoveryCodes: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description New codes generated. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RecoveryCodesResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+}
+//# sourceMappingURL=api.d.ts.map