@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/public/factors/passkeys.js

@@ -0,0 +1,238 @@
+import { mutation, query } from "../../functions.js";
+import { vPasskeyDoc } from "../../model.js";
+import { v } from "convex/values";
+
+//#region src/component/public/factors/passkeys.ts
+/**
+* Store a new WebAuthn passkey credential for a user.
+*
+* Persists the public key material and metadata returned by the browser's
+* `navigator.credentials.create()` call after a successful registration
+* ceremony. Each passkey is tied to a single user.
+*
+* @param userId - The `_id` of the `User` who owns this passkey.
+* @param credentialId - Base64url-encoded credential identifier assigned
+*   by the authenticator; used to look up the key during authentication.
+* @param publicKey - Raw public key bytes (COSE format) for signature
+*   verification.
+* @param algorithm - COSE algorithm identifier (e.g. `-7` for ES256,
+*   `-257` for RS256).
+* @param counter - Signature counter reported by the authenticator at
+*   registration time; used to detect cloned credentials.
+* @param transports - Optional list of transport hints (e.g.
+*   `["usb", "ble", "nfc", "internal"]`) to help the browser select
+*   the correct authenticator.
+* @param deviceType - Authenticator attachment type (e.g.
+*   `"singleDevice"` or `"multiDevice"`).
+* @param backedUp - Whether the credential is backed up (synced) by the
+*   authenticator platform.
+* @param name - Optional human-readable label for the passkey
+*   (e.g. `"MacBook Pro Touch ID"`).
+* @param createdAt - Unix timestamp (in milliseconds) when the passkey
+*   was registered.
+* @returns The `_id` of the newly created `Passkey` document.
+*
+* @example
+* ```ts
+* const passkeyId = await ctx.runMutation(
+*   components.auth.factors.passkeys.passkeyInsert,
+*   {
+*     userId: user._id,
+*     credentialId: "dGVzdC1jcmVkZW50aWFs",
+*     publicKey: publicKeyBytes,
+*     algorithm: -7,
+*     counter: 0,
+*     transports: ["internal"],
+*     deviceType: "multiDevice",
+*     backedUp: true,
+*     name: "MacBook Pro Touch ID",
+*     createdAt: Date.now(),
+*   },
+* );
+* ```
+*/
+const passkeyInsert = mutation({
+	args: {
+		userId: v.id("User"),
+		credentialId: v.string(),
+		publicKey: v.bytes(),
+		algorithm: v.number(),
+		counter: v.number(),
+		transports: v.optional(v.array(v.string())),
+		deviceType: v.string(),
+		backedUp: v.boolean(),
+		name: v.optional(v.string()),
+		createdAt: v.number()
+	},
+	returns: v.id("Passkey"),
+	handler: async (ctx, args) => {
+		return await ctx.db.insert("Passkey", args);
+	}
+});
+/**
+* Look up a passkey by its credential ID.
+*
+* Queries the `Passkey` table using the `credential_id` unique index.
+* This is the primary lookup during a WebAuthn authentication ceremony:
+* the authenticator provides a credential ID, and this function retrieves
+* the corresponding public key and counter for signature verification.
+*
+* @param credentialId - Base64url-encoded credential identifier to search for.
+* @returns The matching `Passkey` document, or `null` if no passkey exists
+*   with the given credential ID.
+*
+* @example
+* ```ts
+* const passkey = await ctx.runQuery(
+*   components.auth.factors.passkeys.passkeyGetByCredentialId,
+*   { credentialId: "dGVzdC1jcmVkZW50aWFs" },
+* );
+* if (passkey === null) {
+*   throw new Error("Unknown credential");
+* }
+* ```
+*/
+const passkeyGetByCredentialId = query({
+	args: { credentialId: v.string() },
+	returns: v.union(vPasskeyDoc, v.null()),
+	handler: async (ctx, { credentialId }) => {
+		return await ctx.db.query("Passkey").withIndex("credential_id", (q) => q.eq("credentialId", credentialId)).unique();
+	}
+});
+/**
+* List all passkeys registered to a user.
+*
+* Retrieves every `Passkey` document associated with the given user via
+* the `user_id` index. Useful for displaying a user's registered
+* authenticators in a settings page, or for building the
+* `allowCredentials` list during a WebAuthn authentication ceremony.
+*
+* @param userId - The `_id` of the `User` whose passkeys to retrieve.
+* @returns An array of `Passkey` documents. Returns an empty array if the
+*   user has no registered passkeys.
+*
+* @example
+* ```ts
+* const passkeys = await ctx.runQuery(
+*   components.auth.factors.passkeys.passkeyListByUserId,
+*   { userId: user._id },
+* );
+* // Display each passkey's name and creation date
+* for (const pk of passkeys) {
+*   console.log(pk.name, new Date(pk.createdAt));
+* }
+* ```
+*/
+const passkeyListByUserId = query({
+	args: { userId: v.id("User") },
+	returns: v.array(vPasskeyDoc),
+	handler: async (ctx, { userId }) => {
+		return await ctx.db.query("Passkey").withIndex("user_id", (q) => q.eq("userId", userId)).collect();
+	}
+});
+/**
+* Update a passkey's signature counter and last-used timestamp after
+* a successful authentication.
+*
+* After verifying a WebAuthn assertion, the relying party must persist
+* the new counter value reported by the authenticator. A counter that
+* does not increase may indicate a cloned credential.
+*
+* @param passkeyId - The `_id` of the `Passkey` document to update.
+* @param counter - The new signature counter value returned by the
+*   authenticator in the assertion response.
+* @param lastUsedAt - Unix timestamp (in milliseconds) recording when
+*   this passkey was most recently used to authenticate.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.factors.passkeys.passkeyUpdateCounter,
+*   {
+*     passkeyId: passkey._id,
+*     counter: assertionResponse.counter,
+*     lastUsedAt: Date.now(),
+*   },
+* );
+* ```
+*/
+const passkeyUpdateCounter = mutation({
+	args: {
+		passkeyId: v.id("Passkey"),
+		counter: v.number(),
+		lastUsedAt: v.number()
+	},
+	returns: v.null(),
+	handler: async (ctx, { passkeyId, counter, lastUsedAt }) => {
+		await ctx.db.patch("Passkey", passkeyId, {
+			counter,
+			lastUsedAt
+		});
+		return null;
+	}
+});
+/**
+* Update a passkey's metadata fields.
+*
+* Performs a partial patch on the `Passkey` document. Typically used to
+* rename a passkey (e.g. from `"Security Key"` to `"YubiKey 5C"`), but
+* can update any mutable fields via the `data` argument.
+*
+* @param passkeyId - The `_id` of the `Passkey` document to update.
+* @param data - An object containing the fields to patch. Commonly
+*   includes `{ name: "New Label" }`, but accepts any valid passkey fields.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.factors.passkeys.passkeyUpdateMeta,
+*   {
+*     passkeyId: passkey._id,
+*     data: { name: "YubiKey 5C NFC" },
+*   },
+* );
+* ```
+*/
+const passkeyUpdateMeta = mutation({
+	args: {
+		passkeyId: v.id("Passkey"),
+		data: v.any()
+	},
+	returns: v.null(),
+	handler: async (ctx, { passkeyId, data }) => {
+		await ctx.db.patch("Passkey", passkeyId, data);
+		return null;
+	}
+});
+/**
+* Delete a passkey credential from the `Passkey` table.
+*
+* Permanently removes the passkey record. After deletion the credential
+* can no longer be used for authentication. Typically called from a
+* user's security settings when they want to unregister an authenticator.
+*
+* @param passkeyId - The `_id` of the `Passkey` document to delete.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.factors.passkeys.passkeyDelete,
+*   { passkeyId: passkey._id },
+* );
+* ```
+*/
+const passkeyDelete = mutation({
+	args: { passkeyId: v.id("Passkey") },
+	returns: v.null(),
+	handler: async (ctx, { passkeyId }) => {
+		await ctx.db.delete("Passkey", passkeyId);
+		return null;
+	}
+});
+
+//#endregion
+export { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta };
+//# sourceMappingURL=passkeys.js.map

package/dist/component/public/factors/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","names":[],"sources":["../../../../src/component/public/factors/passkeys.ts"],"sourcesContent":["import { v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport { vPasskeyDoc } from \"../../model\";\n\n/**\n * Store a new WebAuthn passkey credential for a user.\n *\n * Persists the public key material and metadata returned by the browser's\n * `navigator.credentials.create()` call after a successful registration\n * ceremony. Each passkey is tied to a single user.\n *\n * @param userId - The `_id` of the `User` who owns this passkey.\n * @param credentialId - Base64url-encoded credential identifier assigned\n *   by the authenticator; used to look up the key during authentication.\n * @param publicKey - Raw public key bytes (COSE format) for signature\n *   verification.\n * @param algorithm - COSE algorithm identifier (e.g. `-7` for ES256,\n *   `-257` for RS256).\n * @param counter - Signature counter reported by the authenticator at\n *   registration time; used to detect cloned credentials.\n * @param transports - Optional list of transport hints (e.g.\n *   `[\"usb\", \"ble\", \"nfc\", \"internal\"]`) to help the browser select\n *   the correct authenticator.\n * @param deviceType - Authenticator attachment type (e.g.\n *   `\"singleDevice\"` or `\"multiDevice\"`).\n * @param backedUp - Whether the credential is backed up (synced) by the\n *   authenticator platform.\n * @param name - Optional human-readable label for the passkey\n *   (e.g. `\"MacBook Pro Touch ID\"`).\n * @param createdAt - Unix timestamp (in milliseconds) when the passkey\n *   was registered.\n * @returns The `_id` of the newly created `Passkey` document.\n *\n * @example\n * ```ts\n * const passkeyId = await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyInsert,\n *   {\n *     userId: user._id,\n *     credentialId: \"dGVzdC1jcmVkZW50aWFs\",\n *     publicKey: publicKeyBytes,\n *     algorithm: -7,\n *     counter: 0,\n *     transports: [\"internal\"],\n *     deviceType: \"multiDevice\",\n *     backedUp: true,\n *     name: \"MacBook Pro Touch ID\",\n *     createdAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const passkeyInsert = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    credentialId: v.string(),\n    publicKey: v.bytes(),\n    algorithm: v.number(),\n    counter: v.number(),\n    transports: v.optional(v.array(v.string())),\n    deviceType: v.string(),\n    backedUp: v.boolean(),\n    name: v.optional(v.string()),\n    createdAt: v.number(),\n  },\n  returns: v.id(\"Passkey\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"Passkey\", args);\n  },\n});\n\n/**\n * Look up a passkey by its credential ID.\n *\n * Queries the `Passkey` table using the `credential_id` unique index.\n * This is the primary lookup during a WebAuthn authentication ceremony:\n * the authenticator provides a credential ID, and this function retrieves\n * the corresponding public key and counter for signature verification.\n *\n * @param credentialId - Base64url-encoded credential identifier to search for.\n * @returns The matching `Passkey` document, or `null` if no passkey exists\n *   with the given credential ID.\n *\n * @example\n * ```ts\n * const passkey = await ctx.runQuery(\n *   components.auth.factors.passkeys.passkeyGetByCredentialId,\n *   { credentialId: \"dGVzdC1jcmVkZW50aWFs\" },\n * );\n * if (passkey === null) {\n *   throw new Error(\"Unknown credential\");\n * }\n * ```\n */\nexport const passkeyGetByCredentialId = query({\n  args: { credentialId: v.string() },\n  returns: v.union(vPasskeyDoc, v.null()),\n  handler: async (ctx, { credentialId }) => {\n    return await ctx.db\n      .query(\"Passkey\")\n      .withIndex(\"credential_id\", (q) => q.eq(\"credentialId\", credentialId))\n      .unique();\n  },\n});\n\n/**\n * List all passkeys registered to a user.\n *\n * Retrieves every `Passkey` document associated with the given user via\n * the `user_id` index. Useful for displaying a user's registered\n * authenticators in a settings page, or for building the\n * `allowCredentials` list during a WebAuthn authentication ceremony.\n *\n * @param userId - The `_id` of the `User` whose passkeys to retrieve.\n * @returns An array of `Passkey` documents. Returns an empty array if the\n *   user has no registered passkeys.\n *\n * @example\n * ```ts\n * const passkeys = await ctx.runQuery(\n *   components.auth.factors.passkeys.passkeyListByUserId,\n *   { userId: user._id },\n * );\n * // Display each passkey's name and creation date\n * for (const pk of passkeys) {\n *   console.log(pk.name, new Date(pk.createdAt));\n * }\n * ```\n */\nexport const passkeyListByUserId = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.array(vPasskeyDoc),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"Passkey\")\n      .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n      .collect();\n  },\n});\n\n/**\n * Update a passkey's signature counter and last-used timestamp after\n * a successful authentication.\n *\n * After verifying a WebAuthn assertion, the relying party must persist\n * the new counter value reported by the authenticator. A counter that\n * does not increase may indicate a cloned credential.\n *\n * @param passkeyId - The `_id` of the `Passkey` document to update.\n * @param counter - The new signature counter value returned by the\n *   authenticator in the assertion response.\n * @param lastUsedAt - Unix timestamp (in milliseconds) recording when\n *   this passkey was most recently used to authenticate.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyUpdateCounter,\n *   {\n *     passkeyId: passkey._id,\n *     counter: assertionResponse.counter,\n *     lastUsedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const passkeyUpdateCounter = mutation({\n  args: {\n    passkeyId: v.id(\"Passkey\"),\n    counter: v.number(),\n    lastUsedAt: v.number(),\n  },\n  returns: v.null(),\n  handler: async (ctx, { passkeyId, counter, lastUsedAt }) => {\n    await ctx.db.patch(\"Passkey\", passkeyId, { counter, lastUsedAt });\n    return null;\n  },\n});\n\n/**\n * Update a passkey's metadata fields.\n *\n * Performs a partial patch on the `Passkey` document. Typically used to\n * rename a passkey (e.g. from `\"Security Key\"` to `\"YubiKey 5C\"`), but\n * can update any mutable fields via the `data` argument.\n *\n * @param passkeyId - The `_id` of the `Passkey` document to update.\n * @param data - An object containing the fields to patch. Commonly\n *   includes `{ name: \"New Label\" }`, but accepts any valid passkey fields.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyUpdateMeta,\n *   {\n *     passkeyId: passkey._id,\n *     data: { name: \"YubiKey 5C NFC\" },\n *   },\n * );\n * ```\n */\nexport const passkeyUpdateMeta = mutation({\n  args: { passkeyId: v.id(\"Passkey\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { passkeyId, data }) => {\n    await ctx.db.patch(\"Passkey\", passkeyId, data);\n    return null;\n  },\n});\n\n/**\n * Delete a passkey credential from the `Passkey` table.\n *\n * Permanently removes the passkey record. After deletion the credential\n * can no longer be used for authentication. Typically called from a\n * user's security settings when they want to unregister an authenticator.\n *\n * @param passkeyId - The `_id` of the `Passkey` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyDelete,\n *   { passkeyId: passkey._id },\n * );\n * ```\n */\nexport const passkeyDelete = mutation({\n  args: { passkeyId: v.id(\"Passkey\") },\n  returns: v.null(),\n  handler: async (ctx, { passkeyId }) => {\n    await ctx.db.delete(\"Passkey\", passkeyId);\n    return null;\n  },\n});\n\n// ============================================================================\n// TOTP Two-Factor Authentication\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,MAAa,gBAAgB,SAAS;CACpC,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,cAAc,EAAE,QAAQ;EACxB,WAAW,EAAE,OAAO;EACpB,WAAW,EAAE,QAAQ;EACrB,SAAS,EAAE,QAAQ;EACnB,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;EAC3C,YAAY,EAAE,QAAQ;EACtB,UAAU,EAAE,SAAS;EACrB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,2BAA2B,MAAM;CAC5C,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;CAClC,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,EAAE,mBAAmB;AACxC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,kBAAkB,MAAM,EAAE,GAAG,gBAAgB,aAAa,CAAC,CACrE,QAAQ;;CAEd,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BF,MAAa,sBAAsB,MAAM;CACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,SAAS;;CAEf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BF,MAAa,uBAAuB,SAAS;CAC3C,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,SAAS,EAAE,QAAQ;EACnB,YAAY,EAAE,QAAQ;EACvB;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,WAAW,SAAS,iBAAiB;AAC1D,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW;GAAE;GAAS;GAAY,CAAC;AACjE,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,oBAAoB,SAAS;CACxC,MAAM;EAAE,WAAW,EAAE,GAAG,UAAU;EAAE,MAAM,EAAE,KAAK;EAAE;CACnD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,WAAW,WAAW;AAC3C,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,KAAK;AAC9C,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;AAoBF,MAAa,gBAAgB,SAAS;CACpC,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE;CACpC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,gBAAgB;AACrC,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/public/factors/totp.d.ts

@@ -0,0 +1,189 @@
+declare namespace totp_d_exports {
+  export { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed };
+}
+/**
+ * Store a new TOTP (Time-based One-Time Password) enrollment for a user.
+ *
+ * Creates a `TotpFactor` record containing the shared secret and OTP
+ * parameters. The enrollment starts in an unverified state until the
+ * user confirms it by submitting a valid code generated from the secret.
+ *
+ * @param userId - The `_id` of the `User` enrolling in TOTP-based 2FA.
+ * @param secret - The shared secret key as raw bytes, typically 20 bytes
+ *   of cryptographically random data.
+ * @param digits - Number of digits in the generated OTP code (usually `6`).
+ * @param period - Time step in seconds for code generation (usually `30`).
+ * @param verified - Whether the enrollment has been verified. Set to
+ *   `false` during initial setup; set to `true` after the user submits
+ *   a valid code.
+ * @param name - Optional human-readable label for the TOTP factor
+ *   (e.g. `"Google Authenticator"`).
+ * @param createdAt - Unix timestamp (in milliseconds) when the enrollment
+ *   was created.
+ * @returns The `_id` of the newly created `TotpFactor` document.
+ *
+ * @example
+ * ```ts
+ * const totpId = await ctx.runMutation(
+ *   components.auth.factors.totp.totpInsert,
+ *   {
+ *     userId: user._id,
+ *     secret: crypto.getRandomValues(new Uint8Array(20)),
+ *     digits: 6,
+ *     period: 30,
+ *     verified: false,
+ *     name: "Authenticator App",
+ *     createdAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const totpInsert: any;
+/**
+ * Get a verified TOTP enrollment for a user.
+ *
+ * Queries the `TotpFactor` table using the `user_id_verified` compound
+ * index to find the first enrollment that has been successfully verified.
+ * This is the primary lookup during a TOTP authentication challenge --
+ * only verified enrollments should be used to validate codes.
+ *
+ * @param userId - The `_id` of the `User` whose verified TOTP enrollment
+ *   to retrieve.
+ * @returns The first verified `TotpFactor` document for the user, or
+ *   `null` if the user has no verified TOTP enrollment.
+ *
+ * @example
+ * ```ts
+ * const totp = await ctx.runQuery(
+ *   components.auth.factors.totp.totpGetVerifiedByUserId,
+ *   { userId: user._id },
+ * );
+ * if (totp === null) {
+ *   // User does not have TOTP 2FA enabled
+ * }
+ * ```
+ */
+declare const totpGetVerifiedByUserId: any;
+/**
+ * List all TOTP enrollments for a user, both verified and unverified.
+ *
+ * Retrieves every `TotpFactor` document associated with the given user
+ * via the `user_id` index. Useful for displaying enrolled authenticator
+ * apps in a security settings page, including pending (unverified)
+ * enrollments that the user has not yet confirmed.
+ *
+ * @param userId - The `_id` of the `User` whose TOTP enrollments to
+ *   retrieve.
+ * @returns An array of `TotpFactor` documents. Returns an empty array if
+ *   the user has no TOTP enrollments.
+ *
+ * @example
+ * ```ts
+ * const factors = await ctx.runQuery(
+ *   components.auth.factors.totp.totpListByUserId,
+ *   { userId: user._id },
+ * );
+ * const verified = factors.filter((f) => f.verified);
+ * const pending = factors.filter((f) => !f.verified);
+ * ```
+ */
+declare const totpListByUserId: any;
+/**
+ * Get a single TOTP enrollment by its document ID.
+ *
+ * Performs a direct document lookup on the `TotpFactor` table. This is
+ * used when you already have the enrollment's `_id` (e.g. from a
+ * previous list query) and need to fetch its full details, including
+ * the secret and verification status.
+ *
+ * @param totpId - The `_id` of the `TotpFactor` document to retrieve.
+ * @returns The `TotpFactor` document, or `null` if no enrollment exists
+ *   with the given ID.
+ *
+ * @example
+ * ```ts
+ * const totp = await ctx.runQuery(
+ *   components.auth.factors.totp.totpGetById,
+ *   { totpId: enrollmentId },
+ * );
+ * if (totp !== null && !totp.verified) {
+ *   // Enrollment is still pending confirmation
+ * }
+ * ```
+ */
+declare const totpGetById: any;
+/**
+ * Mark a TOTP enrollment as verified, completing the setup process.
+ *
+ * Called after the user successfully submits a valid TOTP code during
+ * enrollment. This transitions the factor from a pending state to an
+ * active, verified state, enabling it for future authentication
+ * challenges.
+ *
+ * @param totpId - The `_id` of the `TotpFactor` document to mark as
+ *   verified.
+ * @param lastUsedAt - Unix timestamp (in milliseconds) recording when
+ *   the verification code was successfully validated.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * // After validating the user's TOTP code during setup
+ * await ctx.runMutation(
+ *   components.auth.factors.totp.totpMarkVerified,
+ *   {
+ *     totpId: enrollment._id,
+ *     lastUsedAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const totpMarkVerified: any;
+/**
+ * Update a TOTP enrollment's last-used timestamp.
+ *
+ * Called after each successful TOTP code validation during sign-in.
+ * Tracking the last-used time helps detect stale enrollments and can
+ * be surfaced in security settings for user awareness.
+ *
+ * @param totpId - The `_id` of the `TotpFactor` document to update.
+ * @param lastUsedAt - Unix timestamp (in milliseconds) recording when
+ *   the TOTP code was most recently validated.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.factors.totp.totpUpdateLastUsed,
+ *   {
+ *     totpId: totp._id,
+ *     lastUsedAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const totpUpdateLastUsed: any;
+/**
+ * Delete a TOTP enrollment from the `TotpFactor` table.
+ *
+ * Permanently removes the TOTP factor record, including its shared
+ * secret. After deletion the user can no longer use this factor for
+ * two-factor authentication. Typically called when a user disables
+ * TOTP 2FA or wants to re-enroll with a new secret.
+ *
+ * @param totpId - The `_id` of the `TotpFactor` document to delete.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * // User disables TOTP 2FA
+ * await ctx.runMutation(
+ *   components.auth.factors.totp.totpDelete,
+ *   { totpId: totp._id },
+ * );
+ * ```
+ */
+declare const totpDelete: any;
+//#endregion
+export { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, totp_d_exports };
+//# sourceMappingURL=totp.d.ts.map

package/dist/component/public/factors/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","names":[],"sources":["../../../../src/component/public/factors/totp.ts"],"mappings":";;;;;;;;;;;;;;;AAyCA;;;;;AAwCA;;;;;AAoCA;;;;;AAkCA;;;;;AAkCA;;;;;cAhJa,UAAA;;;;;AA6Mb;;;;;;;;;;;;;;;;;;;;cArKa,uBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAoCA,gBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAkCA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkCA,gBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAgCA,kBAAA;;;;;;;;;;;;;;;;;;;;;cA6BA,UAAA"}