Module model 

Canonical identity records and the DTOs the flows exchange.

Structs

Identity

The canonical user record. PII fields (email, phone) are expected to be encrypted at rest by the app’s UserStore via the compliance CryptoVault; this struct is the decrypted view a handler sees.

MfaState

Which second factors an identity has enrolled.

RegisterRequest

Registration input. Password is optional to support passwordless-first signup.

TokenResponse

The token pair returned to a successful authentication. Shape mirrors the familiar OAuth2 token response so existing clients need no changes.

Enums

AccountStatus

Lifecycle state of an account. Only Active may authenticate.

LoginOutcome

The result of a login attempt: either fully authenticated (tokens issued) or a second factor is still required.