@portaidentity/server 1.7.0

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,UAAU,MAAM,gBAAgB,CAAC;AACxC,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAAU,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,YAAuB;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IAEtB,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,2CAA2C;IAC3C,0EAA0E;IAC1E,8EAA8E;IAC9E,yDAAyD;IACzD,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;IAE3B,kFAAkF;IAClF,gEAAgE;IAChE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,gFAAgF;IAChF,6EAA6E;IAC7E,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,iDAAiD;IACjD,EAAE;IACF,iCAAiC;IACjC,8DAA8D;IAC9D,gFAAgF;IAChF,qFAAqF;IACrF,uEAAuE;IACvE,EAAE;IACF,uCAAuC;IACvC,wFAAwF;IACxF,MAAM,EAAE,GAAG,UAAU,CAAC;QACpB,SAAS,EAAE,OAAO,EAAE,2DAA2D;QAC/E,SAAS,EAAE,OAAO,EAAE,uBAAuB;QAC3C,SAAS,EAAE,OAAO,EAAE,uBAAuB;KAC5C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,IACE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC3B,CAAC;YACD,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,4CAA4C;IAC5C,iCAAiC;IACjC,gCAAgC;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACrC,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAEjC,4EAA4E;IAC5E,uEAAuE;IACvE,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC;IAEzC,qEAAqE;IACrE,wEAAwE;IACxE,8DAA8D;IAC9D,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,cAAc,GAAG,IAAI,MAAM,EAAE,CAAC;IACpC,cAAc,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtD,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,2CAA2C;aACrD,CAAC;YACF,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,2CAA2C;aACrD,CAAC;YACF,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC1D,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAE3E,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE;YACvD,OAAO,EAAE,aAAa,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI;SACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC;IAEzC,wEAAwE;IACxE,uEAAuE;IACvE,gEAAgE;IAChE,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3B,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE9B,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,YAAY,EAAE,CAAC;QACjB,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEnC,2EAA2E;QAC3E,6EAA6E;QAC7E,8EAA8E;QAC9E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE;YAC5C,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,UAAU;YAC/C,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAC7C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IAEpC,6DAA6D;IAC7D,kEAAkE;IAClE,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IAEpC,iEAAiE;IACjE,wDAAwD;IACxD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvC,sDAAsD;IACtD,yEAAyE;IACzE,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAErC,mEAAmE;IACnE,4DAA4D;IAC5D,gEAAgE;IAChE,MAAM,oBAAoB,GAAG,0BAA0B,EAAE,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAE/C,kEAAkE;IAClE,0DAA0D;IAC1D,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAErC,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;IAE3C,+EAA+E;IAC/E,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC;IAEzC,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,wBAAwB,GAAG,8BAA8B,EAAE,CAAC;IAClE,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,cAAc,EAAE,CAAC,CAAC;IAEnD,yDAAyD;IACzD,MAAM,iBAAiB,GAAG,uBAAuB,EAAE,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;IAE5C,+DAA+D;IAC/D,sDAAsD;IACtD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvC,6DAA6D;IAC7D,kDAAkD;IAClD,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAErC,gDAAgD;IAChD,oDAAoD;IACpD,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;IAEtC,2DAA2D;IAC3D,oDAAoD;IACpD,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;IAEtC,yDAAyD;IACzD,0DAA0D;IAC1D,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;IAExC,0DAA0D;IAC1D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,uBAAuB,EAAE,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;IAE5C,sDAAsD;IACtD,kDAAkD;IAClD,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAErC,sDAAsD;IACtD,+EAA+E;IAC/E,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC;IAEzC,qDAAqD;IACrD,wDAAwD;IACxD,MAAM,uBAAuB,GAAG,6BAA6B,EAAE,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,cAAc,EAAE,CAAC,CAAC;IAElD,kDAAkD;IAClD,uDAAuD;IACvD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvC,kDAAkD;IAClD,uDAAuD;IACvD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvC,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,kEAAkE;IAClE,qEAAqE;IACrE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE5C,+EAA+E;QAC/E,2EAA2E;QAC3E,MAAM,eAAe,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,uDAAuD;IACvD,uEAAuE;IACvE,8EAA8E;IAC9E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,eAAe,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC5D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IAE1C,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,yBAAyB,EAAE,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,EAAE,CAAC,CAAC;IAE9C,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;IAE3C,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE5B,sDAAsD;IACtD,gEAAgE;IAChE,wEAAwE;IACxE,wDAAwD;IACxD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAEpC,wDAAwD;IACxD,8EAA8E;IAC9E,uDAAuD;IACvD,IAAI,YAAY,EAAE,CAAC;QACjB,4EAA4E;QAC5E,8EAA8E;QAC9E,6EAA6E;QAC7E,yEAAyE;QACzE,2EAA2E;QAC3E,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QAExC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAEvD,yEAAyE;QACzE,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QAEjC,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,6EAA6E;QAC7E,qEAAqE;QACrE,EAAE;QACF,mFAAmF;QACnF,+EAA+E;QAC/E,gFAAgF;QAChF,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACjC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACjC,8DAA8D;YAC9D,MAAM,IAAI,GAAI,GAAG,CAAC,OAAe,CAAC,IAAI,CAAC;YACvC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,8DAA8D;gBAC7D,GAAG,CAAC,GAAW,CAAC,IAAI,GAAG,IAAI,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,8FAA8F;QAC9F,sFAAsF;QACtF,6DAA6D;QAC7D,UAAU,CAAC,GAAG,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;QAEtD,uEAAuE;QACvE,kEAAkE;QAClE,EAAE;QACF,oEAAoE;QACpE,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,4CAA4C;QAC5C,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,UAAU,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAEpC,4EAA4E;QAC5E,yEAAyE;QACzE,+EAA+E;QAC/E,6EAA6E;QAC7E,UAAU,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAEnC,uEAAuE;QACvE,iEAAiE;QACjE,oDAAoD;QACpD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,sEAAsE;YACtE,gFAAgF;YAChF,8EAA8E;YAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC;YACjC,8DAA8D;YAC7D,GAAG,CAAC,GAAW,CAAC,WAAW,GAAG,WAAW,CAAC;YAE3C,yEAAyE;YACzE,kCAAkC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAEhE,mEAAmE;YACnE,qEAAqE;YACrE,2EAA2E;YAC3E,8DAA8D;YAC7D,GAAG,CAAC,GAAW,CAAC,kBAAkB,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;YAE7D,4CAA4C;YAC5C,EAAE;YACF,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,8DAA8D;YAC9D,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,EAAE;YACF,oDAAoD;YACpD,qEAAqE;YACrE,2DAA2D;YAC3D,sEAAsE;YACtE,4DAA4D;YAC5D,oEAAoE;YACpE,wEAAwE;YACxE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;YAE7C,8DAA8D;YAC9D,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,mEAAmE;YACnE,8DAA8D;YAC9D,gEAAgE;YAChE,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAElE,uEAAuE;YACvE,MAAM,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/two-factor/cache.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Two-factor authentication cache — Redis-backed fast lookup layer.
+ *
+ * Provides get/set/invalidate operations for a user's 2FA status stored
+ * in Redis. The cached status includes whether 2FA is enabled, the method,
+ * TOTP configuration state, and remaining recovery codes.
+ *
+ * Cache key: `2fa:status:{userId}` with a 5-minute TTL (matches org/user caches).
+ *
+ * Used by the auth login flow to quickly determine if 2FA is required
+ * without hitting the database for every authentication attempt.
+ *
+ * All Redis errors are caught and logged — cache failures never
+ * propagate to callers. The system gracefully degrades to direct
+ * database lookups when Redis is unavailable.
+ */
+import type { TwoFactorStatus } from './types.js';
+/**
+ * Get a user's 2FA status from cache.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to building the status from the database.
+ *
+ * @param userId - User UUID
+ * @returns Cached 2FA status or null
+ */
+export declare function getCachedTwoFactorStatus(userId: string): Promise<TwoFactorStatus | null>;
+/**
+ * Store a user's 2FA status in cache.
+ *
+ * The status object is simple (no Date fields) so JSON serialization
+ * is straightforward — no special deserialization needed.
+ *
+ * @param userId - User UUID
+ * @param status - 2FA status to cache
+ */
+export declare function cacheTwoFactorStatus(userId: string, status: TwoFactorStatus): Promise<void>;
+/**
+ * Invalidate the cached 2FA status for a user.
+ *
+ * Should be called after any 2FA state change (setup, disable,
+ * verification, recovery code use) to ensure stale data is not served.
+ *
+ * @param userId - User UUID
+ */
+export declare function invalidateTwoFactorCache(userId: string): Promise<void>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/two-factor/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/two-factor/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgBlD;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAW9F;AAMD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjG;AAMD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5E"}

package/dist/two-factor/cache.js

@@ -0,0 +1,122 @@
+/**
+ * Two-factor authentication cache — Redis-backed fast lookup layer.
+ *
+ * Provides get/set/invalidate operations for a user's 2FA status stored
+ * in Redis. The cached status includes whether 2FA is enabled, the method,
+ * TOTP configuration state, and remaining recovery codes.
+ *
+ * Cache key: `2fa:status:{userId}` with a 5-minute TTL (matches org/user caches).
+ *
+ * Used by the auth login flow to quickly determine if 2FA is required
+ * without hitting the database for every authentication attempt.
+ *
+ * All Redis errors are caught and logged — cache failures never
+ * propagate to callers. The system gracefully degrades to direct
+ * database lookups when Redis is unavailable.
+ */
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+import { afterDatabaseCommit } from '../lib/database.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Cache TTL in seconds (5 minutes — matches organizations/users caches) */
+const CACHE_TTL = 300;
+/** Key prefix for user 2FA status lookups */
+const STATUS_PREFIX = '2fa:status:';
+// ---------------------------------------------------------------------------
+// Cache retrieval
+// ---------------------------------------------------------------------------
+/**
+ * Get a user's 2FA status from cache.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to building the status from the database.
+ *
+ * @param userId - User UUID
+ * @returns Cached 2FA status or null
+ */
+export async function getCachedTwoFactorStatus(userId) {
+    try {
+        const redis = getRedis();
+        const data = await redis.get(`${STATUS_PREFIX}${userId}`);
+        if (!data)
+            return null;
+        return deserializeStatus(data);
+    }
+    catch {
+        // Graceful degradation — log and return null so caller falls back to DB
+        logger.warn({ event: 'two-factor-cache-read-failed' }, 'Two-factor cache read failed');
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Cache storage
+// ---------------------------------------------------------------------------
+/**
+ * Store a user's 2FA status in cache.
+ *
+ * The status object is simple (no Date fields) so JSON serialization
+ * is straightforward — no special deserialization needed.
+ *
+ * @param userId - User UUID
+ * @param status - 2FA status to cache
+ */
+export async function cacheTwoFactorStatus(userId, status) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            const data = JSON.stringify(status);
+            await redis.set(`${STATUS_PREFIX}${userId}`, data, 'EX', CACHE_TTL);
+        }
+        catch {
+            // Graceful degradation — cache write failure is non-fatal
+            logger.warn({ event: 'two-factor-cache-write-failed' }, 'Two-factor cache write failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Cache invalidation
+// ---------------------------------------------------------------------------
+/**
+ * Invalidate the cached 2FA status for a user.
+ *
+ * Should be called after any 2FA state change (setup, disable,
+ * verification, recovery code use) to ensure stale data is not served.
+ *
+ * @param userId - User UUID
+ */
+export async function invalidateTwoFactorCache(userId) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            await redis.del(`${STATUS_PREFIX}${userId}`);
+        }
+        catch {
+            // Graceful degradation — cache invalidation failure is non-fatal
+            logger.warn({ event: 'two-factor-cache-invalidation-failed' }, 'Two-factor cache invalidation failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Serialization helpers
+// ---------------------------------------------------------------------------
+/**
+ * Deserialize a JSON string from Redis into a TwoFactorStatus object.
+ *
+ * The TwoFactorStatus interface has no Date fields, so no special
+ * deserialization is needed beyond JSON.parse().
+ *
+ * @param data - JSON string from Redis
+ * @returns TwoFactorStatus object or null if parse fails
+ */
+function deserializeStatus(data) {
+    try {
+        return JSON.parse(data);
+    }
+    catch {
+        logger.warn('Failed to parse cached 2FA status JSON');
+        return null;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/two-factor/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/two-factor/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,6CAA6C;AAC7C,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,GAAG,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAuB;IAChF,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAC3D,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,GAAG,MAAM,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,sCAAsC,EAAE,EACjD,sCAAsC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/two-factor/crypto.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Two-factor authentication cryptography utilities.
+ *
+ * Provides AES-256-GCM encryption and decryption for TOTP secrets.
+ * TOTP secrets must be stored encrypted at rest because they are
+ * long-lived shared secrets — compromise would allow an attacker
+ * to generate valid TOTP codes indefinitely.
+ *
+ * The encryption key comes from the TWO_FACTOR_ENCRYPTION_KEY env var
+ * (32 bytes, hex-encoded = 64 characters). A random 12-byte IV is
+ * generated per encryption operation. The GCM auth tag provides
+ * authenticated encryption (tamper detection).
+ */
+/**
+ * Encrypt a TOTP secret with AES-256-GCM.
+ *
+ * Generates a random IV for each encryption operation to ensure
+ * the same plaintext never produces the same ciphertext.
+ *
+ * @param plaintext - The TOTP secret to encrypt (base32-encoded string)
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns Object containing encrypted data, IV, and auth tag (all hex-encoded)
+ * @throws TwoFactorCryptoError if the encryption key is invalid
+ */
+export declare function encryptTotpSecret(plaintext: string, encryptionKey: string): {
+    encrypted: string;
+    iv: string;
+    tag: string;
+};
+/**
+ * Decrypt a TOTP secret from its AES-256-GCM encrypted form.
+ *
+ * @param encrypted - Hex-encoded encrypted data
+ * @param iv - Hex-encoded initialization vector
+ * @param tag - Hex-encoded GCM authentication tag
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns The decrypted TOTP secret (base32-encoded string)
+ * @throws TwoFactorCryptoError if decryption fails (wrong key, tampered data, etc.)
+ */
+export declare function decryptTotpSecret(encrypted: string, iv: string, tag: string, encryptionKey: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/two-factor/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/two-factor/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAyBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,MAAM,CA0BR"}

package/dist/two-factor/crypto.js

@@ -0,0 +1,94 @@
+/**
+ * Two-factor authentication cryptography utilities.
+ *
+ * Provides AES-256-GCM encryption and decryption for TOTP secrets.
+ * TOTP secrets must be stored encrypted at rest because they are
+ * long-lived shared secrets — compromise would allow an attacker
+ * to generate valid TOTP codes indefinitely.
+ *
+ * The encryption key comes from the TWO_FACTOR_ENCRYPTION_KEY env var
+ * (32 bytes, hex-encoded = 64 characters). A random 12-byte IV is
+ * generated per encryption operation. The GCM auth tag provides
+ * authenticated encryption (tamper detection).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { TwoFactorCryptoError } from './errors.js';
+/** AES-256-GCM cipher parameters */
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96-bit IV recommended for GCM
+const TAG_LENGTH = 16; // 128-bit authentication tag
+/**
+ * Encrypt a TOTP secret with AES-256-GCM.
+ *
+ * Generates a random IV for each encryption operation to ensure
+ * the same plaintext never produces the same ciphertext.
+ *
+ * @param plaintext - The TOTP secret to encrypt (base32-encoded string)
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns Object containing encrypted data, IV, and auth tag (all hex-encoded)
+ * @throws TwoFactorCryptoError if the encryption key is invalid
+ */
+export function encryptTotpSecret(plaintext, encryptionKey) {
+    // Validate the encryption key is a valid 32-byte hex string
+    const keyBuffer = parseEncryptionKey(encryptionKey);
+    // Generate a random 12-byte IV — unique per encryption operation
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, keyBuffer, iv, {
+        authTagLength: TAG_LENGTH,
+    });
+    // Encrypt the plaintext
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    // Get the GCM authentication tag (provides tamper detection)
+    const tag = cipher.getAuthTag();
+    return {
+        encrypted: encrypted.toString('hex'),
+        iv: iv.toString('hex'),
+        tag: tag.toString('hex'),
+    };
+}
+/**
+ * Decrypt a TOTP secret from its AES-256-GCM encrypted form.
+ *
+ * @param encrypted - Hex-encoded encrypted data
+ * @param iv - Hex-encoded initialization vector
+ * @param tag - Hex-encoded GCM authentication tag
+ * @param encryptionKey - 32-byte hex-encoded encryption key (64 hex chars)
+ * @returns The decrypted TOTP secret (base32-encoded string)
+ * @throws TwoFactorCryptoError if decryption fails (wrong key, tampered data, etc.)
+ */
+export function decryptTotpSecret(encrypted, iv, tag, encryptionKey) {
+    const keyBuffer = parseEncryptionKey(encryptionKey);
+    try {
+        const decipher = createDecipheriv(ALGORITHM, keyBuffer, Buffer.from(iv, 'hex'), { authTagLength: TAG_LENGTH });
+        // Set the auth tag before decryption — GCM verifies integrity
+        decipher.setAuthTag(Buffer.from(tag, 'hex'));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(encrypted, 'hex')),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    catch (error) {
+        // Re-throw as a domain error — the underlying error may be
+        // "Unsupported state or unable to authenticate data" (wrong key/tag)
+        const message = error instanceof Error ? error.message : 'Unknown decryption error';
+        throw new TwoFactorCryptoError(`Decryption failed: ${message}`);
+    }
+}
+/**
+ * Parse and validate a hex-encoded encryption key.
+ *
+ * @param hexKey - 64 hex characters representing 32 bytes
+ * @returns Buffer containing the 32-byte key
+ * @throws TwoFactorCryptoError if the key is not a valid 32-byte hex string
+ */
+function parseEncryptionKey(hexKey) {
+    if (!hexKey || hexKey.length !== 64 || !/^[0-9a-f]+$/i.test(hexKey)) {
+        throw new TwoFactorCryptoError('Invalid encryption key: must be 64 hex characters (32 bytes)');
+    }
+    return Buffer.from(hexKey, 'hex');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/two-factor/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/two-factor/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,oCAAoC;AACpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gCAAgC;AACtD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,aAAqB;IAErB,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACtD,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,EAAU,EACV,GAAW,EACX,aAAqB;IAErB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EACtB,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;QAEF,8DAA8D;QAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2DAA2D;QAC3D,qEAAqE;QACrE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACpF,MAAM,IAAI,oBAAoB,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/two-factor/errors.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Two-factor authentication error types.
+ *
+ * Custom error classes for 2FA-specific business rule violations.
+ * Route handlers map these to appropriate HTTP status codes:
+ *   - TwoFactorNotEnabledError → 400
+ *   - TotpNotConfiguredError → 400
+ *   - OtpExpiredError → 400
+ *   - OtpInvalidError → 400
+ *   - RecoveryCodeInvalidError → 400
+ *   - RecoveryCodesExhaustedError → 400
+ *   - TwoFactorRequiredError → 403
+ *   - TwoFactorAlreadyEnabledError → 409
+ */
+/**
+ * Base error class for all 2FA errors.
+ * Provides a common type for catch blocks and error mapping.
+ */
+export declare class TwoFactorError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown when a 2FA operation is attempted but the user has not enabled 2FA.
+ * Example: trying to verify a TOTP code without having 2FA set up.
+ */
+export declare class TwoFactorNotEnabledError extends TwoFactorError {
+    constructor(userId: string);
+}
+/**
+ * Thrown when a TOTP operation is attempted but no TOTP config exists.
+ * Example: trying to verify a TOTP code without having configured TOTP.
+ */
+export declare class TotpNotConfiguredError extends TwoFactorError {
+    constructor(userId: string);
+}
+/**
+ * Thrown when an OTP code has expired (past its expires_at timestamp).
+ */
+export declare class OtpExpiredError extends TwoFactorError {
+    constructor();
+}
+/**
+ * Thrown when an OTP code does not match the stored hash.
+ */
+export declare class OtpInvalidError extends TwoFactorError {
+    constructor();
+}
+/**
+ * Thrown when a recovery code does not match any unused stored hash.
+ */
+export declare class RecoveryCodeInvalidError extends TwoFactorError {
+    constructor();
+}
+/**
+ * Thrown when all recovery codes have been used and none remain.
+ * The user must contact an admin or re-enroll 2FA.
+ */
+export declare class RecoveryCodesExhaustedError extends TwoFactorError {
+    constructor(userId: string);
+}
+/**
+ * Thrown when the organization's 2FA policy requires 2FA but the user
+ * has not yet set it up. Used during login flow to redirect to setup.
+ */
+export declare class TwoFactorRequiredError extends TwoFactorError {
+    constructor(userId: string);
+}
+/**
+ * Thrown when a user tries to set up 2FA but already has it enabled.
+ * They must disable existing 2FA first before re-enrolling.
+ */
+export declare class TwoFactorAlreadyEnabledError extends TwoFactorError {
+    constructor(userId: string);
+}
+/**
+ * Thrown when a 2FA encryption/decryption operation fails.
+ * Usually indicates a wrong or missing TWO_FACTOR_ENCRYPTION_KEY.
+ */
+export declare class TwoFactorCryptoError extends TwoFactorError {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/two-factor/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/two-factor/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc;IAC1D,YAAY,MAAM,EAAE,MAAM,EAGzB;CACF;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAM,EAAE,MAAM,EAGzB;CACF;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc;IACjD,cAGC;CACF;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc;IACjD,cAGC;CACF;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc;IAC1D,cAGC;CACF;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,cAAc;IAC7D,YAAY,MAAM,EAAE,MAAM,EAGzB;CACF;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAM,EAAE,MAAM,EAGzB;CACF;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,cAAc;IAC9D,YAAY,MAAM,EAAE,MAAM,EAGzB;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,cAAc;IACtD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/two-factor/errors.js

@@ -0,0 +1,112 @@
+/**
+ * Two-factor authentication error types.
+ *
+ * Custom error classes for 2FA-specific business rule violations.
+ * Route handlers map these to appropriate HTTP status codes:
+ *   - TwoFactorNotEnabledError → 400
+ *   - TotpNotConfiguredError → 400
+ *   - OtpExpiredError → 400
+ *   - OtpInvalidError → 400
+ *   - RecoveryCodeInvalidError → 400
+ *   - RecoveryCodesExhaustedError → 400
+ *   - TwoFactorRequiredError → 403
+ *   - TwoFactorAlreadyEnabledError → 409
+ */
+/**
+ * Base error class for all 2FA errors.
+ * Provides a common type for catch blocks and error mapping.
+ */
+export class TwoFactorError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TwoFactorError';
+    }
+}
+/**
+ * Thrown when a 2FA operation is attempted but the user has not enabled 2FA.
+ * Example: trying to verify a TOTP code without having 2FA set up.
+ */
+export class TwoFactorNotEnabledError extends TwoFactorError {
+    constructor(userId) {
+        super(`Two-factor authentication is not enabled for user: ${userId}`);
+        this.name = 'TwoFactorNotEnabledError';
+    }
+}
+/**
+ * Thrown when a TOTP operation is attempted but no TOTP config exists.
+ * Example: trying to verify a TOTP code without having configured TOTP.
+ */
+export class TotpNotConfiguredError extends TwoFactorError {
+    constructor(userId) {
+        super(`TOTP is not configured for user: ${userId}`);
+        this.name = 'TotpNotConfiguredError';
+    }
+}
+/**
+ * Thrown when an OTP code has expired (past its expires_at timestamp).
+ */
+export class OtpExpiredError extends TwoFactorError {
+    constructor() {
+        super('OTP code has expired');
+        this.name = 'OtpExpiredError';
+    }
+}
+/**
+ * Thrown when an OTP code does not match the stored hash.
+ */
+export class OtpInvalidError extends TwoFactorError {
+    constructor() {
+        super('Invalid OTP code');
+        this.name = 'OtpInvalidError';
+    }
+}
+/**
+ * Thrown when a recovery code does not match any unused stored hash.
+ */
+export class RecoveryCodeInvalidError extends TwoFactorError {
+    constructor() {
+        super('Invalid recovery code');
+        this.name = 'RecoveryCodeInvalidError';
+    }
+}
+/**
+ * Thrown when all recovery codes have been used and none remain.
+ * The user must contact an admin or re-enroll 2FA.
+ */
+export class RecoveryCodesExhaustedError extends TwoFactorError {
+    constructor(userId) {
+        super(`All recovery codes have been used for user: ${userId}`);
+        this.name = 'RecoveryCodesExhaustedError';
+    }
+}
+/**
+ * Thrown when the organization's 2FA policy requires 2FA but the user
+ * has not yet set it up. Used during login flow to redirect to setup.
+ */
+export class TwoFactorRequiredError extends TwoFactorError {
+    constructor(userId) {
+        super(`Two-factor authentication is required for user: ${userId}`);
+        this.name = 'TwoFactorRequiredError';
+    }
+}
+/**
+ * Thrown when a user tries to set up 2FA but already has it enabled.
+ * They must disable existing 2FA first before re-enrolling.
+ */
+export class TwoFactorAlreadyEnabledError extends TwoFactorError {
+    constructor(userId) {
+        super(`Two-factor authentication is already enabled for user: ${userId}`);
+        this.name = 'TwoFactorAlreadyEnabledError';
+    }
+}
+/**
+ * Thrown when a 2FA encryption/decryption operation fails.
+ * Usually indicates a wrong or missing TWO_FACTOR_ENCRYPTION_KEY.
+ */
+export class TwoFactorCryptoError extends TwoFactorError {
+    constructor(message) {
+        super(`Two-factor crypto error: ${message}`);
+        this.name = 'TwoFactorCryptoError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/two-factor/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/two-factor/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,cAAc;IAC1D,YAAY,MAAc;QACxB,KAAK,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAc;QACxB,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,cAAc;IACjD;QACE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,cAAc;IACjD;QACE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,cAAc;IAC1D;QACE,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,cAAc;IAC7D,YAAY,MAAc;QACxB,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAc;QACxB,KAAK,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,cAAc;IAC9D,YAAY,MAAc;QACxB,KAAK,CAAC,0DAA0D,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,cAAc;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/two-factor/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Two-factor authentication module — barrel export.
+ *
+ * Public API for the 2FA module. Re-exports types, errors, and crypto
+ * utilities. Additional exports (otp, totp, recovery, repository, cache,
+ * service) will be added as they are implemented in subsequent phases.
+ */
+export type { TwoFactorMethod, TwoFactorPolicy, UserTotp, OtpCode, RecoveryCode, TwoFactorSetupResult, TwoFactorStatus, InsertTotpData, UserTotpRow, OtpCodeRow, RecoveryCodeRow, } from './types.js';
+export { mapRowToUserTotp, mapRowToOtpCode, mapRowToRecoveryCode, } from './types.js';
+export { TwoFactorError, TwoFactorNotEnabledError, TotpNotConfiguredError, OtpExpiredError, OtpInvalidError, RecoveryCodeInvalidError, RecoveryCodesExhaustedError, TwoFactorRequiredError, TwoFactorAlreadyEnabledError, TwoFactorCryptoError, } from './errors.js';
+export { encryptTotpSecret, decryptTotpSecret } from './crypto.js';
+export { generateOtpCode, hashOtpCode, verifyOtpCode } from './otp.js';
+export { generateTotpSecret, generateTotpUri, generateQrCodeDataUri, verifyTotpCode, } from './totp.js';
+export { generateRecoveryCodes, hashRecoveryCode, verifyRecoveryCode, } from './recovery.js';
+export { insertTotp, findTotpByUserId, markTotpVerified, deleteTotp, insertOtpCode, findActiveOtpCodes, markOtpCodeUsed, deleteExpiredOtpCodes, countActiveOtpCodes, insertRecoveryCodes, findUnusedRecoveryCodes, markRecoveryCodeUsed, deleteAllRecoveryCodes, countUnusedRecoveryCodes, } from './repository.js';
+export { getCachedTwoFactorStatus, cacheTwoFactorStatus, invalidateTwoFactorCache, } from './cache.js';
+export { setupEmailOtp, setupTotp, getPendingTotpSetupInfo, confirmTotpSetup, sendOtpCode, verifyOtp, verifyTotp, verifyRecoveryCode as verifyRecoveryCodeService, getTwoFactorStatus, disableTwoFactor, regenerateRecoveryCodes, requiresTwoFactor, determineTwoFactorMethod, } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/two-factor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/two-factor/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,eAAe,EACf,eAAe,EACf,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGnE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGvE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,UAAU,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,cAAc,CAAC"}

package/dist/two-factor/index.js

@@ -0,0 +1,25 @@
+/**
+ * Two-factor authentication module — barrel export.
+ *
+ * Public API for the 2FA module. Re-exports types, errors, and crypto
+ * utilities. Additional exports (otp, totp, recovery, repository, cache,
+ * service) will be added as they are implemented in subsequent phases.
+ */
+export { mapRowToUserTotp, mapRowToOtpCode, mapRowToRecoveryCode, } from './types.js';
+// Errors
+export { TwoFactorError, TwoFactorNotEnabledError, TotpNotConfiguredError, OtpExpiredError, OtpInvalidError, RecoveryCodeInvalidError, RecoveryCodesExhaustedError, TwoFactorRequiredError, TwoFactorAlreadyEnabledError, TwoFactorCryptoError, } from './errors.js';
+// Crypto
+export { encryptTotpSecret, decryptTotpSecret } from './crypto.js';
+// OTP
+export { generateOtpCode, hashOtpCode, verifyOtpCode } from './otp.js';
+// TOTP
+export { generateTotpSecret, generateTotpUri, generateQrCodeDataUri, verifyTotpCode, } from './totp.js';
+// Recovery codes
+export { generateRecoveryCodes, hashRecoveryCode, verifyRecoveryCode, } from './recovery.js';
+// Repository
+export { insertTotp, findTotpByUserId, markTotpVerified, deleteTotp, insertOtpCode, findActiveOtpCodes, markOtpCodeUsed, deleteExpiredOtpCodes, countActiveOtpCodes, insertRecoveryCodes, findUnusedRecoveryCodes, markRecoveryCodeUsed, deleteAllRecoveryCodes, countUnusedRecoveryCodes, } from './repository.js';
+// Cache
+export { getCachedTwoFactorStatus, cacheTwoFactorStatus, invalidateTwoFactorCache, } from './cache.js';
+// Service
+export { setupEmailOtp, setupTotp, getPendingTotpSetupInfo, confirmTotpSetup, sendOtpCode, verifyOtp, verifyTotp, verifyRecoveryCode as verifyRecoveryCodeService, getTwoFactorStatus, disableTwoFactor, regenerateRecoveryCodes, requiresTwoFactor, determineTwoFactorMethod, } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/two-factor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/two-factor/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,SAAS;AACT,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM;AACN,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO;AACP,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,iBAAiB;AACjB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,aAAa;AACb,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,QAAQ;AACR,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,UAAU;AACV,OAAO,EACL,aAAa,EACb,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,UAAU,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,cAAc,CAAC"}