@vsaas/loopback 12.1.1 → 12.2.1

package/dist/lib/two-factor/service.cjs

@@ -0,0 +1,1108 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_lib_two_factor_errors = require("./errors.cjs");
+const require_lib_two_factor_crypto = require("./crypto.cjs");
+const require_lib_two_factor_totp = require("./totp.cjs");
+const require_lib_two_factor_recovery_codes = require("./recovery-codes.cjs");
+//#region src/lib/two-factor/service.ts
+function count(result) {
+	return typeof result === "number" ? result : Number(result?.count || 0);
+}
+function optionalCallback(promise, callback) {
+	if (typeof callback !== "function") return promise;
+	promise.then((result) => callback(null, result), callback);
+}
+function invoke(target, name, args) {
+	return new Promise((resolve, reject) => {
+		let completed = false;
+		const done = (error, value) => {
+			if (completed) return;
+			completed = true;
+			error ? reject(error) : resolve(value);
+		};
+		let result;
+		try {
+			result = target[name](...args, done);
+		} catch (error) {
+			done(error);
+			return;
+		}
+		if (result && typeof result.then === "function") result.then((value) => done(null, value), done);
+	});
+}
+function includeUser(include) {
+	if (Array.isArray(include)) return include.map(String).map((v) => v.toLowerCase()).includes("user");
+	return String(include || "").toLowerCase() === "user";
+}
+function loginError() {
+	const error = /* @__PURE__ */ new Error("login failed");
+	error.statusCode = 401;
+	error.code = "LOGIN_FAILED";
+	return error;
+}
+var TwoFactorService;
+var init_service = require_runtime.__esmMin((() => {
+	require_lib_two_factor_errors.init_errors();
+	require_lib_two_factor_crypto.init_crypto();
+	require_lib_two_factor_totp.init_totp();
+	require_lib_two_factor_recovery_codes.init_recovery_codes();
+	TwoFactorService = class {
+		User;
+		config;
+		rateLimiter;
+		app;
+		Credential;
+		Challenge;
+		RecoveryCode;
+		dummyPasswordUser;
+		constructor(User, config, rateLimiter, app) {
+			this.User = User;
+			this.config = config;
+			this.rateLimiter = rateLimiter;
+			this.app = app;
+			this.Credential = app.models.TwoFactorCredential;
+			this.Challenge = app.models.TwoFactorChallenge;
+			this.RecoveryCode = app.models.TwoFactorRecoveryCode;
+			this.dummyPasswordUser = {
+				password: this.User._hashPasswordWithoutValidation(require_lib_two_factor_crypto.randomToken(24)),
+				hasPassword: this.User.prototype.hasPassword
+			};
+		}
+		login(credentials, include, options, callback) {
+			return optionalCallback(this.loginInternal(credentials || {}, include, options || {}), callback);
+		}
+		verifyTwoFactor(verification, options, callback) {
+			if (typeof options === "function") {
+				callback = options;
+				options = {};
+			}
+			return optionalCallback(this.verifyChallengeInternal(verification || {}, options || {}), callback);
+		}
+		beginEnrollment(userId, request, options, callback) {
+			return optionalCallback(this.beginEnrollmentInternal(userId, request || {}, options || {}), callback);
+		}
+		confirmEnrollment(userId, request, options, callback) {
+			return optionalCallback(this.confirmEnrollmentInternal(userId, request || {}, options || {}), callback);
+		}
+		regenerateRecoveryCodes(userId, request, options, callback) {
+			return optionalCallback(this.regenerateRecoveryCodesInternal(userId, request || {}, options || {}), callback);
+		}
+		disable(userId, request, options, callback) {
+			return optionalCallback(this.disableInternal(userId, request || {}, options || {}), callback);
+		}
+		deletePrincipals(principalIds, callback) {
+			return optionalCallback(this.deletePrincipalsInternal(principalIds.map(String)), callback);
+		}
+		rotateEncryption(options = {}, callback) {
+			return optionalCallback(this.rotateEncryptionInternal(options || {}), callback);
+		}
+		requireConfig(enrollment = false) {
+			if (!this.config) throw require_lib_two_factor_errors.authError("TWO_FACTOR_NOT_CONFIGURED", 404);
+			if (enrollment && (this.config.mode === "disabled" || this.config.mode === "verify-only")) throw require_lib_two_factor_errors.authError("TWO_FACTOR_ENROLLMENT_DISABLED", 403);
+			return this.config;
+		}
+		async loginInternal(credentials, include, options) {
+			const normalizedInclude = Array.isArray(include) ? include.map((value) => String(value).toLowerCase()) : String(include || "").toLowerCase();
+			const realmRequired = !!(this.User.settings.realmRequired || this.User.settings.realmDelimiter);
+			const query = this.User.normalizeCredentials(credentials, realmRequired, this.User.settings.realmDelimiter);
+			this.validateLoginQuery(query, realmRequired);
+			const identifier = this.canonicalIdentifier(query);
+			const observed = [];
+			const source = await this.resolveSource(options);
+			if (this.rateLimiter) {
+				if (source && this.rateLimiter.sourceEnabled) await this.rateLimiter.consume(this.rateLimiter.sourceRule("login", source));
+			}
+			let user;
+			try {
+				user = await this.User.findOne({ where: query });
+			} catch {
+				throw loginError();
+			}
+			const resolvedPrincipalId = user ? String(user[this.User.definition.idName() || "id"]) : null;
+			if (this.rateLimiter) {
+				const rule = resolvedPrincipalId ? this.rateLimiter.rule("password", "principal", resolvedPrincipalId) : this.rateLimiter.rule("password", "identifier", identifier);
+				const result = await this.rateLimiter.inspect(rule);
+				observed.push({
+					rule,
+					revision: result.decision.revision
+				});
+			}
+			if (!await this.hasPassword(user || this.dummyPasswordUser, credentials.password)) {
+				if (this.rateLimiter) await this.consumePasswordFailures(identifier, user);
+				throw loginError();
+			}
+			if (this.User.settings.emailVerificationRequired && !user.emailVerified) {
+				const error = /* @__PURE__ */ new Error("login failed as the email has not been verified");
+				error.statusCode = 401;
+				error.code = "LOGIN_FAILED_EMAIL_NOT_VERIFIED";
+				error.details = { userId: user.id };
+				throw error;
+			}
+			const principalId = resolvedPrincipalId;
+			const credential = this.config && this.config.mode !== "disabled" ? await this.Credential.findOne({ where: {
+				principalType: this.User.modelName,
+				principalId,
+				provider: "totp",
+				status: "enabled"
+			} }) : null;
+			if (!credential) {
+				if (this.rateLimiter) await this.rateLimiter.reset(observed);
+				return this.issueAccessToken(user, credentials, normalizedInclude, false);
+			}
+			const secondFactorObserved = [];
+			if (this.rateLimiter) {
+				const rule = this.rateLimiter.rule("secondFactor", "principal", principalId);
+				const result = await this.rateLimiter.inspect(rule);
+				secondFactorObserved.push({
+					rule,
+					revision: result.decision.revision
+				});
+				if (source && this.rateLimiter.sourceEnabled && credentials.twoFactorCode) await this.rateLimiter.consume(this.rateLimiter.sourceRule("secondFactor", source));
+			}
+			if (credentials.twoFactorCode) {
+				const method = credentials.twoFactorMethod || "totp";
+				const binding = await this.principalBinding(user);
+				const inlineChallenge = method === "recovery" ? await this.createInlineRecoveryOperation(user, credential, binding) : null;
+				const factor = await this.verifyCredentialFactor(credential, method, credentials.twoFactorCode, inlineChallenge ? `challenge:${inlineChallenge.id}` : `inline:${require_lib_two_factor_crypto.randomToken(12)}`);
+				if (!factor.valid) {
+					if (inlineChallenge) await this.Challenge.updateAll({
+						id: inlineChallenge.id,
+						status: "verifying"
+					}, { status: "locked" });
+					if (this.rateLimiter) await this.rateLimiter.consume(this.rateLimiter.rule("secondFactor", "principal", principalId));
+					throw require_lib_two_factor_errors.invalidFactor();
+				}
+				let token;
+				try {
+					if (inlineChallenge) {
+						if (count(await this.Challenge.updateAll({
+							id: inlineChallenge.id,
+							status: "verifying"
+						}, { status: "consuming" })) !== 1) throw require_lib_two_factor_errors.invalidChallenge();
+					}
+					const reloadedUser = await this.User.findById(principalId);
+					if (!reloadedUser) throw require_lib_two_factor_errors.invalidChallenge();
+					await this.assertPrincipalBinding(reloadedUser, binding, options);
+					if (this.rateLimiter) await this.rateLimiter.reset([...observed, ...secondFactorObserved]);
+					token = await this.issueAccessToken(reloadedUser, credentials, normalizedInclude, true, options);
+					if (inlineChallenge) {
+						if (count(await this.Challenge.updateAll({
+							id: inlineChallenge.id,
+							status: "consuming"
+						}, {
+							status: "consumed",
+							consumedAt: /* @__PURE__ */ new Date()
+						})) !== 1) throw new Error("Inline challenge completion conflict");
+					}
+					if (factor.reservation) await this.confirmRecoveryReservation(factor.reservation);
+					return token;
+				} catch (error) {
+					if (inlineChallenge) await this.compensateChallengeFailure(inlineChallenge.id, token || error?.issuedToken, factor.reservation);
+					throw error;
+				}
+			}
+			if (this.rateLimiter) await this.rateLimiter.consume(this.rateLimiter.rule("challengeIssuance", "principal", principalId));
+			const protectedTokenOptions = await this.buildTwoFactorTokenOptions(credentials, options);
+			const challenge = await this.createChallenge(user, credential, {
+				tokenOptions: protectedTokenOptions,
+				rateLimitObserved: observed
+			}, includeUser(normalizedInclude), options);
+			throw require_lib_two_factor_errors.twoFactorRequired(challenge.raw, Math.ceil(this.config.challengeTtlMs / 1e3), credential.activeRecoveryCodeSetId ? ["totp", "recovery"] : ["totp"]);
+		}
+		validateLoginQuery(query, realmRequired) {
+			const invalid = (code, message) => {
+				const error = new Error(message);
+				error.statusCode = 400;
+				error.code = code;
+				throw error;
+			};
+			if (realmRequired && !query.realm) invalid("REALM_REQUIRED", "realm is required");
+			if (query.realm != null && typeof query.realm !== "string") invalid("INVALID_REALM", "Invalid realm");
+			if (!query.email && !query.username) invalid("USERNAME_EMAIL_REQUIRED", "username or email is required");
+			if (query.username != null && typeof query.username !== "string") invalid("INVALID_USERNAME", "Invalid username");
+			if (query.email != null && typeof query.email !== "string") invalid("INVALID_EMAIL", "Invalid email");
+		}
+		canonicalIdentifier(query) {
+			const kind = query.email ? "email" : "username";
+			let value = String(query[kind]).trim();
+			if (kind === "email" && !this.User.settings.caseSensitiveEmail) value = value.toLowerCase();
+			return JSON.stringify([
+				String(query.realm || ""),
+				kind,
+				value
+			]);
+		}
+		async consumePasswordFailures(identifier, user) {
+			if (user) {
+				await this.rateLimiter.consume(this.rateLimiter.rule("password", "principal", String(user[this.User.definition.idName() || "id"])));
+				return;
+			}
+			await this.rateLimiter.consume(this.rateLimiter.rule("password", "identifier", identifier));
+		}
+		async resolveSource(options) {
+			if (!this.rateLimiter) return null;
+			if (typeof this.User.resolveAuthenticationRateLimitSource === "function") {
+				const value = await invoke(this.User, "resolveAuthenticationRateLimitSource", [options]);
+				return value == null || value === "" ? null : String(value);
+			}
+			return options.authenticationSource ? String(options.authenticationSource) : null;
+		}
+		async hasPassword(user, password) {
+			try {
+				return await invoke(user, "hasPassword", [password]);
+			} catch {
+				return false;
+			}
+		}
+		async issueAccessToken(user, tokenInput, include, protectedPath, securityOptions = {}) {
+			let tokenOptions = tokenInput;
+			if (protectedPath) tokenOptions = await this.buildTwoFactorTokenOptions(tokenInput, securityOptions);
+			let token;
+			if (user.createAccessToken.length === 2) token = await invoke(user, "createAccessToken", [tokenOptions.ttl]);
+			else token = await invoke(user, "createAccessToken", [tokenOptions.ttl, tokenOptions]);
+			if (!token?.id) {
+				const error = require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+				error.issuedToken = token;
+				throw error;
+			}
+			if (includeUser(include)) token.__data.user = user;
+			return token;
+		}
+		async buildTwoFactorTokenOptions(credentials, options) {
+			return invoke(this.User, "buildTwoFactorLoginContext", [credentials, options]);
+		}
+		secretAad(credential) {
+			return [
+				"two-factor-secret:v1",
+				this.User.modelName,
+				String(credential.principalId),
+				String(credential.id),
+				String(credential.version)
+			];
+		}
+		challengeAad(challenge) {
+			return [
+				"two-factor-login-context:v1",
+				this.User.modelName,
+				String(challenge.principalId),
+				String(challenge.id),
+				String(challenge.credentialVersion)
+			];
+		}
+		async principalBinding(user, keyId) {
+			const config = this.requireConfig();
+			const material = await invoke(this.User, "getTwoFactorPrincipalBindingMaterial", [user, {}]);
+			if (typeof material !== "string" && !Buffer.isBuffer(material) || Buffer.byteLength(material) > config.loginContextMaxBytes) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+			const principalId = String(user[this.User.definition.idName() || "id"]);
+			return require_lib_two_factor_crypto.keyedDigest("two-factor-principal-binding:v1", [
+				this.User.modelName,
+				principalId,
+				material
+			], config.principalBindingHmac, keyId);
+		}
+		async assertPrincipalBinding(user, expected, options) {
+			const current = await this.principalBinding(user, expected.keyId);
+			if (!require_lib_two_factor_crypto.timingSafeEqual(current.digest, expected.digest)) throw require_lib_two_factor_errors.invalidChallenge();
+			if (typeof this.User.validateTwoFactorLoginPrincipal === "function") {
+				if (await invoke(this.User, "validateTwoFactorLoginPrincipal", [user, options]) === false) throw require_lib_two_factor_errors.invalidChallenge();
+			}
+		}
+		async createChallenge(user, credential, tokenContext, shouldIncludeUser, options) {
+			const config = this.requireConfig();
+			const raw = require_lib_two_factor_crypto.randomToken(32);
+			const id = require_lib_two_factor_crypto.sha256(raw);
+			const principalId = String(user[this.User.definition.idName() || "id"]);
+			const binding = await this.principalBinding(user);
+			const base = {
+				id,
+				principalType: this.User.modelName,
+				principalId,
+				credentialId: String(credential.id),
+				credentialVersion: Number(credential.version),
+				flowType: "external",
+				principalBindingKeyId: binding.keyId,
+				principalBindingDigest: binding.digest,
+				status: "pending",
+				attempts: 0,
+				maxAttempts: config.maxAttempts,
+				includeUser: shouldIncludeUser,
+				createdAt: /* @__PURE__ */ new Date(),
+				expiresAt: new Date(Date.now() + config.challengeTtlMs)
+			};
+			const serialized = Buffer.from(JSON.stringify(tokenContext));
+			if (serialized.length > config.loginContextMaxBytes) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+			const encrypted = require_lib_two_factor_crypto.encrypt(serialized, config.encryption, this.challengeAad(base));
+			await this.Challenge.create({
+				...base,
+				encryptedLoginContext: encrypted.envelope,
+				loginContextKeyId: encrypted.keyId
+			});
+			this.audit("twoFactorChallengeCreated", {
+				principalId,
+				credentialId: String(credential.id),
+				challengeDigestPrefix: id.slice(0, 12)
+			});
+			return {
+				raw,
+				id
+			};
+		}
+		async createInlineRecoveryOperation(user, credential, binding, flowType = "inline-recovery") {
+			const config = this.requireConfig();
+			const id = require_lib_two_factor_crypto.sha256(require_lib_two_factor_crypto.randomToken(32));
+			const principalId = String(user[this.User.definition.idName() || "id"]);
+			const base = {
+				id,
+				principalType: this.User.modelName,
+				principalId,
+				credentialId: String(credential.id),
+				credentialVersion: Number(credential.version),
+				flowType,
+				principalBindingKeyId: binding.keyId,
+				principalBindingDigest: binding.digest,
+				status: "verifying",
+				attempts: 1,
+				maxAttempts: 1,
+				includeUser: false,
+				createdAt: /* @__PURE__ */ new Date(),
+				expiresAt: new Date(Date.now() + config.challengeTtlMs),
+				claimedAt: /* @__PURE__ */ new Date()
+			};
+			const encrypted = require_lib_two_factor_crypto.encrypt("{}", config.encryption, this.challengeAad(base));
+			await this.Challenge.create({
+				...base,
+				encryptedLoginContext: encrypted.envelope,
+				loginContextKeyId: encrypted.keyId
+			});
+			return { id };
+		}
+		async verifyChallengeInternal(verification, options) {
+			const config = this.requireConfig();
+			if (config.mode === "disabled") throw require_lib_two_factor_errors.invalidChallenge();
+			if (typeof verification.challengeId !== "string") throw require_lib_two_factor_errors.invalidChallenge();
+			const source = await this.resolveSource(options);
+			if (this.rateLimiter?.sourceEnabled && source) await this.rateLimiter.consume(this.rateLimiter.sourceRule("secondFactor", source));
+			const id = require_lib_two_factor_crypto.sha256(verification.challengeId);
+			let challenge = await this.Challenge.findById(id);
+			if (challenge?.status === "verifying" && challenge.verificationLeaseExpiresAt && new Date(challenge.verificationLeaseExpiresAt).getTime() <= Date.now()) {
+				await this.Challenge.updateAll({
+					id,
+					status: "verifying",
+					verificationLeaseId: challenge.verificationLeaseId
+				}, {
+					status: "pending",
+					verificationLeaseId: null,
+					verificationLeaseExpiresAt: null
+				});
+				challenge = await this.Challenge.findById(id);
+			}
+			if (!challenge || challenge.principalType !== this.User.modelName || challenge.status !== "pending" || new Date(challenge.expiresAt).getTime() <= Date.now()) {
+				if (challenge?.status === "pending" && new Date(challenge.expiresAt).getTime() <= Date.now()) await this.Challenge.updateAll({
+					id,
+					status: "pending"
+				}, { status: "expired" });
+				throw require_lib_two_factor_errors.invalidChallenge();
+			}
+			const principalId = String(challenge.principalId);
+			const observed = [];
+			if (this.rateLimiter) {
+				const rule = this.rateLimiter.rule("secondFactor", "principal", principalId);
+				const result = await this.rateLimiter.inspect(rule);
+				observed.push({
+					rule,
+					revision: result.decision.revision
+				});
+			}
+			const leaseId = require_lib_two_factor_crypto.randomToken(16);
+			const attempts = Number(challenge.attempts);
+			if (count(await this.Challenge.updateAll({
+				id,
+				status: "pending",
+				attempts
+			}, {
+				status: "verifying",
+				attempts: attempts + 1,
+				verificationLeaseId: leaseId,
+				verificationLeaseExpiresAt: new Date(Date.now() + config.verificationLeaseTtlMs),
+				claimedAt: /* @__PURE__ */ new Date()
+			})) !== 1) throw require_lib_two_factor_errors.invalidChallenge();
+			challenge = await this.Challenge.findById(id);
+			try {
+				const credential = await this.Credential.findOne({ where: {
+					id: challenge.credentialId,
+					principalType: this.User.modelName,
+					principalId,
+					status: "enabled",
+					version: challenge.credentialVersion
+				} });
+				const user = await this.User.findById(principalId);
+				if (!credential || !user) throw require_lib_two_factor_errors.invalidChallenge();
+				await this.assertPrincipalBinding(user, {
+					keyId: challenge.principalBindingKeyId,
+					digest: challenge.principalBindingDigest
+				}, options);
+				const factor = await this.verifyCredentialFactor(credential, verification.method, verification.code, `challenge:${id}`);
+				if (!factor.valid) {
+					const locked = attempts + 1 >= Number(challenge.maxAttempts);
+					await this.Challenge.updateAll({
+						id,
+						status: "verifying",
+						verificationLeaseId: leaseId
+					}, {
+						status: locked ? "locked" : "pending",
+						verificationLeaseId: null,
+						verificationLeaseExpiresAt: null
+					});
+					if (this.rateLimiter) await this.rateLimiter.consume(this.rateLimiter.rule("secondFactor", "principal", principalId));
+					throw require_lib_two_factor_errors.invalidFactor();
+				}
+				let token;
+				try {
+					if (count(await this.Challenge.updateAll({
+						id,
+						status: "verifying",
+						verificationLeaseId: leaseId
+					}, { status: "consuming" })) !== 1) throw require_lib_two_factor_errors.invalidChallenge();
+					const tokenContext = JSON.parse(require_lib_two_factor_crypto.decrypt(challenge.encryptedLoginContext, config.encryption, this.challengeAad(challenge)).toString("utf8"));
+					if (this.rateLimiter) await this.rateLimiter.reset([...tokenContext.rateLimitObserved || [], ...observed]);
+					token = await this.issueAccessToken(user, tokenContext.tokenOptions || {}, challenge.includeUser ? "user" : "", false, options);
+					if (count(await this.Challenge.updateAll({
+						id,
+						status: "consuming"
+					}, {
+						status: "consumed",
+						consumedAt: /* @__PURE__ */ new Date()
+					})) !== 1) throw new Error("Challenge completion conflict");
+					if (factor.reservation) await this.confirmRecoveryReservation(factor.reservation);
+					return token;
+				} catch (error) {
+					await this.compensateChallengeFailure(id, token || error?.issuedToken, factor.reservation);
+					throw error;
+				}
+			} catch (error) {
+				if (error instanceof require_lib_two_factor_errors.AuthenticationSecurityError) throw error;
+				throw require_lib_two_factor_errors.invalidChallenge();
+			}
+		}
+		async verifyCredentialFactor(credential, method, code, ownerId) {
+			const config = this.requireConfig();
+			if (method === "recovery") {
+				const reservation = await this.reserveRecoveryCode(credential, code, ownerId);
+				return {
+					valid: !!reservation,
+					reservation: reservation || void 0
+				};
+			}
+			if (method !== "totp") return { valid: false };
+			let secret;
+			try {
+				secret = require_lib_two_factor_crypto.decrypt(credential.encryptedSecret, config.encryption, this.secretAad(credential)).toString("utf8");
+			} catch {
+				throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+			}
+			const verification = require_lib_two_factor_totp.verifyTotp(secret, code, {
+				algorithm: credential.totpAlgorithm,
+				digits: credential.totpDigits,
+				period: credential.totpPeriod
+			}, config.maxClockSkewSteps);
+			if (!verification.valid || verification.counter <= Number(credential.lastUsedCounter)) return { valid: false };
+			return { valid: count(await this.Credential.updateAll({
+				id: credential.id,
+				status: "enabled",
+				version: credential.version,
+				lastUsedCounter: credential.lastUsedCounter
+			}, {
+				lastUsedCounter: verification.counter,
+				updatedAt: /* @__PURE__ */ new Date()
+			})) === 1 };
+		}
+		async reserveRecoveryCode(credential, code, ownerId) {
+			const config = this.requireConfig();
+			const normalized = require_lib_two_factor_recovery_codes.normalizeRecoveryCode(code);
+			if (!normalized || !credential.activeRecoveryCodeSetId || credential.activeRecoveryCodeFormatVersion !== 1 || normalized.length !== Number(credential.activeRecoveryCodeLength)) return null;
+			for (const keyId of Object.keys(config.recoveryCodeHmac.keys)) {
+				const candidate = require_lib_two_factor_recovery_codes.recoveryCodeId(String(credential.id), credential.activeRecoveryCodeSetId, normalized, config.recoveryCodeHmac, keyId);
+				const reservationId = require_lib_two_factor_crypto.randomToken(16);
+				if (count(await this.RecoveryCode.updateAll({
+					id: candidate.digest,
+					credentialId: String(credential.id),
+					setId: credential.activeRecoveryCodeSetId,
+					keyId,
+					status: "unused"
+				}, {
+					status: "reserved",
+					reservationId,
+					reservationExpiresAt: new Date(Date.now() + config.challengeTtlMs),
+					reservationOwnerType: "two-factor-operation",
+					reservationOwnerId: ownerId
+				})) === 1) return {
+					id: candidate.digest,
+					reservationId,
+					ownerId
+				};
+			}
+			return null;
+		}
+		async confirmRecoveryReservation(reservation) {
+			if (count(await this.RecoveryCode.updateAll({
+				id: reservation.id,
+				status: "reserved",
+				reservationId: reservation.reservationId,
+				reservationOwnerId: reservation.ownerId
+			}, {
+				status: "used",
+				usedAt: /* @__PURE__ */ new Date(),
+				reservationId: null,
+				reservationExpiresAt: null,
+				reservationOwnerType: null,
+				reservationOwnerId: null
+			})) !== 1) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+		}
+		async releaseRecoveryReservation(reservation) {
+			if (count(await this.RecoveryCode.updateAll({
+				id: reservation.id,
+				status: "reserved",
+				reservationId: reservation.reservationId,
+				reservationOwnerId: reservation.ownerId
+			}, {
+				status: "unused",
+				reservationId: null,
+				reservationExpiresAt: null,
+				reservationOwnerType: null,
+				reservationOwnerId: null
+			})) !== 1) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+		}
+		async compensateChallengeFailure(challengeId, token, reservation) {
+			let revocationConfirmed = token == null;
+			let revocationError = token && !token.id ? /* @__PURE__ */ new Error("Issued access token has no durable identifier") : null;
+			if (token?.id) try {
+				await this.revokeToken(token);
+				revocationConfirmed = true;
+			} catch (error) {
+				revocationError = error;
+			}
+			await this.Challenge.updateAll({
+				id: challengeId,
+				status: { inq: [
+					"pending",
+					"verifying",
+					"reconciling_no_token",
+					"consuming",
+					"consumed",
+					"token_revocation_pending"
+				] }
+			}, {
+				status: revocationConfirmed ? "token_failed" : "token_revocation_pending",
+				issuedTokenId: token?.id == null ? null : String(token.id),
+				verificationLeaseId: null,
+				verificationLeaseExpiresAt: null
+			}).catch(() => void 0);
+			if (reservation && revocationConfirmed) await this.releaseRecoveryReservation(reservation);
+			if (!revocationConfirmed) {
+				this.audit("twoFactorTokenRevocationPending", {
+					challengeId,
+					tokenId: String(token.id),
+					cause: revocationError?.message
+				});
+				throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503, "Authentication security reconciliation required");
+			}
+		}
+		async beginEnrollmentInternal(userId, request, options) {
+			const config = this.requireConfig(true);
+			const user = await this.authenticatedUser(userId, options);
+			const managementObserved = await this.reauthenticateManagement(user, request.currentPassword);
+			const principalId = String(userId);
+			const existing = await this.Credential.findOne({ where: {
+				principalType: this.User.modelName,
+				principalId,
+				provider: "totp"
+			} });
+			if (existing?.status === "enabled") throw require_lib_two_factor_errors.authError("TWO_FACTOR_ALREADY_ENABLED", 409);
+			const id = existing ? String(existing.id) : require_lib_two_factor_crypto.randomToken(24);
+			const version = existing ? Number(existing.version) + 1 : 1;
+			const secret = require_lib_two_factor_totp.generateTotpSecret(config.totp.secretBytes);
+			const enrollmentId = require_lib_two_factor_crypto.randomToken(32);
+			const base = {
+				id,
+				principalType: this.User.modelName,
+				principalId,
+				provider: "totp",
+				totpAlgorithm: config.totp.algorithm,
+				totpDigits: config.totp.digits,
+				totpPeriod: config.totp.period,
+				status: "pending",
+				version,
+				enrollmentTokenDigest: require_lib_two_factor_crypto.sha256(enrollmentId),
+				activeRecoveryCodeSetId: null,
+				activeRecoveryCodeFormatVersion: null,
+				activeRecoveryCodeLength: null,
+				lastUsedCounter: -1,
+				pendingExpiresAt: new Date(Date.now() + config.enrollmentTtlMs),
+				confirmedAt: null,
+				disabledAt: null,
+				updatedAt: /* @__PURE__ */ new Date()
+			};
+			const encrypted = require_lib_two_factor_crypto.encrypt(secret, config.encryption, this.secretAad(base));
+			const data = {
+				...base,
+				encryptedSecret: encrypted.envelope,
+				secretKeyId: encrypted.keyId
+			};
+			if (existing) {
+				if (count(await this.Credential.updateAll({
+					id,
+					version: existing.version,
+					status: existing.status
+				}, data)) !== 1) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+			} else await this.Credential.create({
+				...data,
+				createdAt: /* @__PURE__ */ new Date()
+			});
+			this.audit("twoFactorEnrollmentStarted", {
+				principalId,
+				credentialId: id
+			});
+			if (this.rateLimiter && managementObserved) await this.rateLimiter.reset([managementObserved]);
+			return {
+				enrollmentId,
+				secret,
+				keyUri: require_lib_two_factor_totp.generateTotpUri(secret, config.issuer, String(user.email || user.username || principalId), config.totp),
+				expiresIn: Math.ceil(config.enrollmentTtlMs / 1e3)
+			};
+		}
+		async confirmEnrollmentInternal(userId, request, options) {
+			const config = this.requireConfig(true);
+			await this.authenticatedUser(userId, options);
+			const principalId = String(userId);
+			let managementObserved = null;
+			if (this.rateLimiter) {
+				const rule = this.rateLimiter.rule("management", "principal", principalId);
+				managementObserved = {
+					rule,
+					revision: (await this.rateLimiter.inspect(rule)).decision.revision
+				};
+			}
+			const credential = await this.Credential.findOne({ where: {
+				principalType: this.User.modelName,
+				principalId,
+				provider: "totp",
+				status: "pending"
+			} });
+			if (!credential) throw require_lib_two_factor_errors.authError("TWO_FACTOR_ENROLLMENT_EXPIRED", 410);
+			if (new Date(credential.pendingExpiresAt).getTime() <= Date.now()) throw require_lib_two_factor_errors.authError("TWO_FACTOR_ENROLLMENT_EXPIRED", 410);
+			if (typeof request.enrollmentId !== "string" || !require_lib_two_factor_crypto.timingSafeEqual(require_lib_two_factor_crypto.sha256(request.enrollmentId), credential.enrollmentTokenDigest)) {
+				await this.consumeManagementFailure(principalId);
+				throw require_lib_two_factor_errors.authError("TWO_FACTOR_ENROLLMENT_EXPIRED", 410);
+			}
+			const secret = require_lib_two_factor_crypto.decrypt(credential.encryptedSecret, config.encryption, this.secretAad(credential)).toString("utf8");
+			const verification = require_lib_two_factor_totp.verifyTotp(secret, request.code, {
+				algorithm: credential.totpAlgorithm,
+				digits: credential.totpDigits,
+				period: credential.totpPeriod
+			}, config.maxClockSkewSteps);
+			if (!verification.valid) {
+				await this.consumeManagementFailure(principalId);
+				throw require_lib_two_factor_errors.invalidFactor();
+			}
+			const generated = require_lib_two_factor_recovery_codes.generateRecoveryCodes(config.recoveryCodeCount, config.recoveryCodeBytes);
+			await this.persistRecoverySet(credential, generated);
+			try {
+				await this.revokeSessions(principalId, options, config.sessions.onEnable);
+				if (count(await this.Credential.updateAll({
+					id: credential.id,
+					status: "pending",
+					version: credential.version
+				}, {
+					status: "enabled",
+					enrollmentTokenDigest: null,
+					pendingExpiresAt: null,
+					lastUsedCounter: verification.counter,
+					activeRecoveryCodeSetId: generated.setId,
+					activeRecoveryCodeFormatVersion: 1,
+					activeRecoveryCodeLength: generated.normalized[0].length,
+					confirmedAt: /* @__PURE__ */ new Date(),
+					updatedAt: /* @__PURE__ */ new Date()
+				})) !== 1) throw new Error("Credential activation conflict");
+			} catch (error) {
+				await this.RecoveryCode.destroyAll({
+					credentialId: String(credential.id),
+					setId: generated.setId
+				}).catch(() => void 0);
+				throw error;
+			}
+			this.audit("twoFactorEnabled", {
+				principalId,
+				credentialId: String(credential.id)
+			});
+			if (this.rateLimiter && managementObserved) await this.rateLimiter.reset([managementObserved]);
+			return {
+				enabled: true,
+				recoveryCodes: generated.codes
+			};
+		}
+		async regenerateRecoveryCodesInternal(userId, request, options) {
+			const config = this.requireConfig();
+			if (config.mode === "disabled") throw require_lib_two_factor_errors.authError("TWO_FACTOR_NOT_ENABLED", 409);
+			const user = await this.authenticatedUser(userId, options);
+			const managementObserved = await this.reauthenticateManagement(user, request.currentPassword);
+			const credential = await this.enabledCredential(String(userId));
+			const recoveryOperation = request.method === "recovery" ? await this.createInlineRecoveryOperation(user, credential, await this.principalBinding(user), "management-recovery-regeneration") : null;
+			const factor = await this.verifyCredentialFactor(credential, request.method, request.code, recoveryOperation ? `challenge:${recoveryOperation.id}` : `management:${require_lib_two_factor_crypto.randomToken(16)}`);
+			if (!factor.valid) {
+				if (recoveryOperation) await this.Challenge.updateAll({
+					id: recoveryOperation.id,
+					status: "verifying"
+				}, { status: "locked" });
+				await this.consumeManagementFailure(String(userId));
+				throw require_lib_two_factor_errors.invalidFactor();
+			}
+			let generated = null;
+			let reservationConfirmed = false;
+			let switched = false;
+			const previousSetId = credential.activeRecoveryCodeSetId;
+			try {
+				if (recoveryOperation) {
+					if (count(await this.Challenge.updateAll({
+						id: recoveryOperation.id,
+						status: "verifying"
+					}, { status: "consuming" })) !== 1) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+				}
+				if (this.rateLimiter && managementObserved) await this.rateLimiter.reset([managementObserved]);
+				generated = require_lib_two_factor_recovery_codes.generateRecoveryCodes(config.recoveryCodeCount, config.recoveryCodeBytes);
+				await this.persistRecoverySet(credential, generated);
+				await this.revokeSessions(String(userId), options, config.sessions.onRecoveryCodesRegenerated);
+				if (factor.reservation) {
+					await this.confirmRecoveryReservation(factor.reservation);
+					reservationConfirmed = true;
+				}
+				if (count(await this.Credential.updateAll({
+					id: credential.id,
+					status: "enabled",
+					activeRecoveryCodeSetId: previousSetId
+				}, {
+					activeRecoveryCodeSetId: generated.setId,
+					activeRecoveryCodeFormatVersion: 1,
+					activeRecoveryCodeLength: generated.normalized[0].length,
+					updatedAt: /* @__PURE__ */ new Date()
+				})) !== 1) throw new Error("Recovery set switch conflict");
+				switched = true;
+				if (recoveryOperation) await this.Challenge.updateAll({
+					id: recoveryOperation.id,
+					status: "consuming"
+				}, {
+					status: "consumed",
+					consumedAt: /* @__PURE__ */ new Date()
+				}).catch((error) => this.reportCleanupError(error));
+			} catch (error) {
+				if (generated && !switched) await this.RecoveryCode.destroyAll({
+					credentialId: String(credential.id),
+					setId: generated.setId
+				}).catch((cleanupError) => this.reportCleanupError(cleanupError));
+				if (factor.reservation && !reservationConfirmed) await this.releaseRecoveryReservation(factor.reservation);
+				if (recoveryOperation) await this.Challenge.updateAll({
+					id: recoveryOperation.id,
+					status: { inq: ["verifying", "consuming"] }
+				}, { status: "token_failed" }).catch((cleanupError) => this.reportCleanupError(cleanupError));
+				throw error;
+			}
+			if (previousSetId) await this.RecoveryCode.destroyAll({
+				credentialId: String(credential.id),
+				setId: previousSetId
+			}).catch((error) => this.reportCleanupError(error));
+			this.audit("twoFactorRecoveryCodesRegenerated", {
+				principalId: String(userId),
+				credentialId: String(credential.id)
+			});
+			return { recoveryCodes: generated.codes };
+		}
+		async disableInternal(userId, request, options) {
+			const config = this.requireConfig();
+			if (config.mode === "disabled") throw require_lib_two_factor_errors.authError("TWO_FACTOR_NOT_ENABLED", 409);
+			const user = await this.authenticatedUser(userId, options);
+			const managementObserved = await this.reauthenticateManagement(user, request.currentPassword);
+			const credential = await this.enabledCredential(String(userId));
+			const recoveryOperation = request.method === "recovery" ? await this.createInlineRecoveryOperation(user, credential, await this.principalBinding(user), "management-recovery-disable") : null;
+			const factor = await this.verifyCredentialFactor(credential, request.method, request.code, recoveryOperation ? `challenge:${recoveryOperation.id}` : `management:${require_lib_two_factor_crypto.randomToken(16)}`);
+			if (!factor.valid) {
+				if (recoveryOperation) await this.Challenge.updateAll({
+					id: recoveryOperation.id,
+					status: "verifying"
+				}, { status: "locked" });
+				await this.consumeManagementFailure(String(userId));
+				throw require_lib_two_factor_errors.invalidFactor();
+			}
+			let reservationConfirmed = false;
+			try {
+				if (recoveryOperation) {
+					if (count(await this.Challenge.updateAll({
+						id: recoveryOperation.id,
+						status: "verifying"
+					}, { status: "consuming" })) !== 1) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+				}
+				if (this.rateLimiter && managementObserved) await this.rateLimiter.reset([managementObserved]);
+				await this.revokeSessions(String(userId), options, config.sessions.onDisable);
+				if (factor.reservation) {
+					await this.confirmRecoveryReservation(factor.reservation);
+					reservationConfirmed = true;
+				}
+				if (count(await this.Credential.updateAll({
+					id: credential.id,
+					status: "enabled",
+					version: credential.version
+				}, {
+					status: "disabled",
+					version: Number(credential.version) + 1,
+					encryptedSecret: null,
+					secretKeyId: null,
+					activeRecoveryCodeSetId: null,
+					activeRecoveryCodeFormatVersion: null,
+					activeRecoveryCodeLength: null,
+					disabledAt: /* @__PURE__ */ new Date(),
+					updatedAt: /* @__PURE__ */ new Date()
+				})) !== 1) throw new Error("Credential disable conflict");
+				if (recoveryOperation) await this.Challenge.updateAll({
+					id: recoveryOperation.id,
+					status: "consuming"
+				}, {
+					status: "consumed",
+					consumedAt: /* @__PURE__ */ new Date()
+				}).catch((error) => this.reportCleanupError(error));
+			} catch (error) {
+				if (factor.reservation && !reservationConfirmed) await this.releaseRecoveryReservation(factor.reservation);
+				if (recoveryOperation) await this.Challenge.updateAll({
+					id: recoveryOperation.id,
+					status: { inq: ["verifying", "consuming"] }
+				}, { status: "token_failed" }).catch((cleanupError) => this.reportCleanupError(cleanupError));
+				throw error;
+			}
+			await Promise.all([this.RecoveryCode.destroyAll({ credentialId: String(credential.id) }), this.Challenge.updateAll({
+				credentialId: String(credential.id),
+				status: { inq: ["pending", "verifying"] }
+			}, { status: "expired" })]).catch((error) => this.reportCleanupError(error));
+			this.audit("twoFactorDisabled", {
+				principalId: String(userId),
+				credentialId: String(credential.id)
+			});
+			return { enabled: false };
+		}
+		async authenticatedUser(userId, options) {
+			const token = options?.accessToken;
+			if (!token || String(token.userId) !== String(userId) || "principalType" in token && token.principalType !== this.User.modelName) throw require_lib_two_factor_errors.authError("AUTHORIZATION_REQUIRED", 401, "Authorization required");
+			const user = await this.User.findById(userId);
+			if (!user) throw require_lib_two_factor_errors.authError("AUTHORIZATION_REQUIRED", 401, "Authorization required");
+			return user;
+		}
+		async reauthenticateManagement(user, currentPassword) {
+			const principalId = String(user[this.User.definition.idName() || "id"]);
+			let observed = null;
+			if (this.rateLimiter) {
+				const rule = this.rateLimiter.rule("management", "principal", principalId);
+				observed = {
+					rule,
+					revision: (await this.rateLimiter.inspect(rule)).decision.revision
+				};
+			}
+			if (!await this.hasPassword(user, currentPassword)) {
+				await this.consumeManagementFailure(principalId);
+				throw loginError();
+			}
+			return observed;
+		}
+		async consumeManagementFailure(principalId) {
+			if (this.rateLimiter) await this.rateLimiter.consume(this.rateLimiter.rule("management", "principal", principalId));
+		}
+		async enabledCredential(principalId) {
+			const credential = await this.Credential.findOne({ where: {
+				principalType: this.User.modelName,
+				principalId,
+				provider: "totp",
+				status: "enabled"
+			} });
+			if (!credential) throw require_lib_two_factor_errors.authError("TWO_FACTOR_NOT_ENABLED", 409);
+			return credential;
+		}
+		async persistRecoverySet(credential, generated) {
+			const config = this.requireConfig();
+			const rows = generated.normalized.map((code) => {
+				const digest = require_lib_two_factor_recovery_codes.recoveryCodeId(String(credential.id), generated.setId, code, config.recoveryCodeHmac);
+				return {
+					id: digest.digest,
+					credentialId: String(credential.id),
+					setId: generated.setId,
+					keyId: digest.keyId,
+					status: "unused",
+					createdAt: /* @__PURE__ */ new Date()
+				};
+			});
+			await this.RecoveryCode.create(rows);
+			if (await this.RecoveryCode.count({
+				credentialId: String(credential.id),
+				setId: generated.setId,
+				status: "unused"
+			}) !== rows.length) throw new Error("Incomplete recovery code set");
+		}
+		async deletePrincipalsInternal(principalIds) {
+			if (!principalIds.length) return;
+			const credentialIds = (await this.Credential.find({
+				where: {
+					principalType: this.User.modelName,
+					principalId: { inq: principalIds }
+				},
+				fields: { id: true }
+			})).map((credential) => String(credential.id));
+			await Promise.all([
+				credentialIds.length ? this.RecoveryCode.destroyAll({ credentialId: { inq: credentialIds } }) : Promise.resolve(),
+				this.Challenge.destroyAll({
+					principalType: this.User.modelName,
+					principalId: { inq: principalIds }
+				}),
+				this.Credential.destroyAll({
+					principalType: this.User.modelName,
+					principalId: { inq: principalIds }
+				}),
+				this.rateLimiter ? Promise.all(principalIds.map((principalId) => this.rateLimiter.deletePrincipal(principalId))) : Promise.resolve()
+			]);
+		}
+		async rotateEncryptionInternal(options) {
+			const config = this.requireConfig();
+			const batchSize = options.batchSize == null ? 100 : Number(options.batchSize);
+			const maxBatches = options.maxBatches == null ? 1e4 : Number(options.maxBatches);
+			if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 1e3) throw new Error("batchSize must be an integer between 1 and 1000");
+			if (!Number.isSafeInteger(maxBatches) || maxBatches < 1 || maxBatches > 1e5) throw new Error("maxBatches must be an integer between 1 and 100000");
+			const currentKeyId = config.encryption.currentKeyId;
+			const result = {
+				credentialsReencrypted: 0,
+				challengesReencrypted: 0,
+				conflicts: 0,
+				remainingCredentials: 0,
+				remainingChallenges: 0
+			};
+			for (let batch = 0; batch < maxBatches; batch++) {
+				const credentials = await this.Credential.find({
+					where: {
+						principalType: this.User.modelName,
+						encryptedSecret: { neq: null },
+						secretKeyId: { neq: currentKeyId }
+					},
+					limit: batchSize
+				});
+				if (!credentials.length) break;
+				let progress = 0;
+				for (const credential of credentials) {
+					let plaintext;
+					try {
+						plaintext = require_lib_two_factor_crypto.decrypt(credential.encryptedSecret, config.encryption, this.secretAad(credential));
+					} catch {
+						throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503, "Unable to decrypt a two-factor credential during key rotation");
+					}
+					const encrypted = require_lib_two_factor_crypto.encrypt(plaintext, config.encryption, this.secretAad(credential));
+					if (count(await this.Credential.updateAll({
+						id: credential.id,
+						principalType: this.User.modelName,
+						version: credential.version,
+						encryptedSecret: credential.encryptedSecret,
+						secretKeyId: credential.secretKeyId
+					}, {
+						encryptedSecret: encrypted.envelope,
+						secretKeyId: encrypted.keyId,
+						updatedAt: /* @__PURE__ */ new Date()
+					})) === 1) {
+						result.credentialsReencrypted++;
+						progress++;
+					} else result.conflicts++;
+				}
+				if (progress === 0) break;
+			}
+			const liveChallengeWhere = {
+				principalType: this.User.modelName,
+				loginContextKeyId: { neq: currentKeyId },
+				expiresAt: { gt: /* @__PURE__ */ new Date() },
+				status: { inq: [
+					"pending",
+					"verifying",
+					"reconciling_no_token",
+					"consuming",
+					"token_revocation_pending"
+				] }
+			};
+			for (let batch = 0; batch < maxBatches; batch++) {
+				const challenges = await this.Challenge.find({
+					where: liveChallengeWhere,
+					limit: batchSize
+				});
+				if (!challenges.length) break;
+				let progress = 0;
+				for (const challenge of challenges) {
+					let plaintext;
+					try {
+						plaintext = require_lib_two_factor_crypto.decrypt(challenge.encryptedLoginContext, config.encryption, this.challengeAad(challenge));
+					} catch {
+						throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503, "Unable to decrypt a two-factor challenge during key rotation");
+					}
+					const encrypted = require_lib_two_factor_crypto.encrypt(plaintext, config.encryption, this.challengeAad(challenge));
+					if (count(await this.Challenge.updateAll({
+						id: challenge.id,
+						principalType: this.User.modelName,
+						status: challenge.status,
+						encryptedLoginContext: challenge.encryptedLoginContext,
+						loginContextKeyId: challenge.loginContextKeyId
+					}, {
+						encryptedLoginContext: encrypted.envelope,
+						loginContextKeyId: encrypted.keyId
+					})) === 1) {
+						result.challengesReencrypted++;
+						progress++;
+					} else result.conflicts++;
+				}
+				if (progress === 0) break;
+			}
+			result.remainingCredentials = await this.Credential.count({
+				principalType: this.User.modelName,
+				encryptedSecret: { neq: null },
+				secretKeyId: { neq: currentKeyId }
+			});
+			result.remainingChallenges = await this.Challenge.count(liveChallengeWhere);
+			this.audit("twoFactorEncryptionRotated", {
+				keyId: currentKeyId,
+				...result
+			});
+			return result;
+		}
+		async revokeSessions(principalId, options, policy) {
+			const AccessToken = this.User.relations.accessTokens?.modelTo;
+			if (!AccessToken) return;
+			const where = { userId: principalId };
+			if (policy === "revoke-others" && options?.accessToken?.id) where.id = { neq: options.accessToken.id };
+			if (AccessToken.relations?.user?.polymorphic) where.principalType = this.User.modelName;
+			await AccessToken.destroyAll(where, options || {});
+		}
+		async revokeToken(token) {
+			const AccessToken = this.User.relations.accessTokens?.modelTo;
+			if (!AccessToken) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+			await AccessToken.destroyById(token.id);
+			if (await AccessToken.findById(token.id)) throw require_lib_two_factor_errors.authError("AUTHENTICATION_SECURITY_UNAVAILABLE", 503);
+		}
+		reportCleanupError(error) {
+			try {
+				this.app.emit("authenticationSecurityCleanupError", error);
+			} catch {}
+		}
+		audit(event, values) {
+			this.User.emit(event, {
+				principalType: this.User.modelName,
+				modelName: this.User.modelName,
+				timestamp: /* @__PURE__ */ new Date(),
+				...values
+			});
+		}
+	};
+}));
+//#endregion
+init_service();
+exports.TwoFactorService = TwoFactorService;
+Object.defineProperty(exports, "init_service", {
+	enumerable: true,
+	get: function() {
+		return init_service;
+	}
+});