From fad036ef6c2cf727d7b3e1d021a44e14527665bc Mon Sep 17 00:00:00 2001
From: RedStar <redstar071@proton.me>
Date: Mon, 24 Aug 2026 14:24:04 +0200
Subject: [PATCH] feat(auth): add two-factor authentication

---
 README.md                                     |    7 +
 apps/dashboard/app/auth.config.ts             |    6 +
 apps/dashboard/app/pages/two-factor.vue       |  269 ++++
 .../auth/components/TwoFactorError.vue        |   13 +
 .../modules/auth/components/UserMenu.vue      |    3 +
 apps/dashboard/nuxt.config.ts                 |    3 +
 apps/dashboard/package.json                   |    3 +
 apps/dashboard/server/auth.config.ts          |    1 +
 apps/dashboard/test/e2e/auth.spec.ts          |   22 +
 .../test/nuxt/components/UserMenu.spec.ts     |    9 +
 .../test/nuxt/pages/two-factor.spec.ts        |  112 ++
 docs/architecture.md                          |   12 +-
 packages/auth/package.json                    |    1 +
 packages/auth/src/auth.test.ts                |    9 +
 packages/auth/src/auth.ts                     |    7 +
 .../0004_outstanding_mister_sinister.sql      |   16 +
 .../database/drizzle/meta/0004_snapshot.json  | 1313 +++++++++++++++++
 packages/database/drizzle/meta/_journal.json  |    7 +
 packages/database/src/client.test.ts          |    1 +
 packages/database/src/schema/auth.test.ts     |   29 +
 packages/database/src/schema/auth.ts          |   34 +-
 packages/database/src/schema/index.ts         |    5 +-
 packages/i18n/locales/en/auth.json            |   29 +
 packages/i18n/locales/it/auth.json            |   29 +
 packages/i18n/schemas/auth.schema.json        |   87 ++
 pnpm-lock.yaml                                |  167 ++-
 26 files changed, 2183 insertions(+), 11 deletions(-)
 create mode 100644 apps/dashboard/app/pages/two-factor.vue
 create mode 100644 apps/dashboard/modules/auth/components/TwoFactorError.vue
 create mode 100644 apps/dashboard/test/nuxt/pages/two-factor.spec.ts
 create mode 100644 packages/database/drizzle/0004_outstanding_mister_sinister.sql
 create mode 100644 packages/database/drizzle/meta/0004_snapshot.json
 create mode 100644 packages/database/src/schema/auth.test.ts

diff --git a/README.md b/README.md
index 1e21d59..ce08a6d 100644
--- a/README.md
+++ b/README.md
@@ -191,6 +191,13 @@ change them. The flip side of that build-time capture is a deployment contract:
 those policy variables, rebuild the app, or the auth pages will keep advertising the old
 capabilities (the server still enforces its own policy either way).
 
+Every account can enable TOTP two-factor authentication from the signed-in user menu. Setup at
+`/two-factor` requires the account password, displays a QR code plus one-time backup codes, and
+does not become active until the first authenticator code verifies. The same route handles the
+second-factor challenge after password sign-in, including backup-code recovery and an optional
+30-day trusted-device cookie. Apply the checked-in database migrations before deploying this
+feature: the Better Auth plugin adds `user.two_factor_enabled` and the `two_factor` table.
+
 The interface ships English and Italian through `@nuxtjs/i18n`, with dictionaries split by scope in
 `packages/i18n/locales/<locale>/` and shared with the marketing site; each app loads only the
 scopes it renders. `aube run i18n:status` builds a
diff --git a/apps/dashboard/app/auth.config.ts b/apps/dashboard/app/auth.config.ts
index 5446f9d..355a01c 100644
--- a/apps/dashboard/app/auth.config.ts
+++ b/apps/dashboard/app/auth.config.ts
@@ -6,6 +6,7 @@ import {
   lastLoginMethodClient,
   multiSessionClient,
   organizationClient,
+  twoFactorClient,
 } from 'better-auth/client/plugins';
 
 // Better Auth is mounted in this app's own server (`server/auth.config.ts`), so every request is
@@ -39,6 +40,11 @@ export default defineClientAuth(() => {
       betterEnrollmentClient(),
       lastLoginMethodClient(),
       multiSessionClient(),
+      twoFactorClient({
+        onTwoFactorRedirect: async () => {
+          await navigateTo('/two-factor');
+        },
+      }),
       deviceAuthorizationClient(),
       dashClient(),
       // The one entry that is gated, and the only one whose absence changes nothing about the
diff --git a/apps/dashboard/app/pages/two-factor.vue b/apps/dashboard/app/pages/two-factor.vue
new file mode 100644
index 0000000..2804971
--- /dev/null
+++ b/apps/dashboard/app/pages/two-factor.vue
@@ -0,0 +1,269 @@
+<template>
+  <section class="panel w-full max-w-120 p-6">
+    <h1 class="m-0 text-lg font-650 tracking-tight">{{ $t('auth.twoFactor.title') }}</h1>
+
+    <p v-if="!ready" class="mb-0 mt-4 text-xs text-muted">
+      {{ $t('auth.twoFactor.loading') }}
+    </p>
+
+    <template v-else-if="!loggedIn">
+      <p class="mb-0 mt-1 text-xs text-muted">{{ $t('auth.twoFactor.challengeSubtitle') }}</p>
+
+      <div class="mt-5 grid grid-cols-2 gap-2" role="group">
+        <button
+          v-for="factor in factors"
+          :key="factor"
+          class="focus-ring h-9 border text-xs font-650 transition"
+          :class="
+            challengeFactor === factor
+              ? 'border-accent bg-accent/8 text-ink'
+              : 'border-line bg-raised text-muted hover:text-ink'
+          "
+          :data-factor="factor"
+          type="button"
+          @click="challengeFactor = factor"
+        >
+          {{ $t(`auth.twoFactor.factor.${factor}`) }}
+        </button>
+      </div>
+
+      <form data-mode="challenge" class="mt-4 flex flex-col gap-3" @submit.prevent="onChallenge">
+        <label class="flex flex-col gap-1.5">
+          <span class="label-upper">
+            {{
+              challengeFactor === 'totp'
+                ? $t('auth.twoFactor.code')
+                : $t('auth.twoFactor.backupCode')
+            }}
+          </span>
+          <input
+            v-model="code"
+            autocomplete="one-time-code"
+            class="input-field mono"
+            :inputmode="challengeFactor === 'totp' ? 'numeric' : 'text'"
+            required
+            spellcheck="false"
+            type="text"
+          />
+        </label>
+
+        <label class="flex items-center gap-2 text-xs text-muted">
+          <input v-model="trustDevice" type="checkbox" />
+          {{ $t('auth.twoFactor.trustDevice') }}
+        </label>
+
+        <TwoFactorError :message="errorMessage" />
+
+        <button class="btn-accent" :disabled="isPending" type="submit">
+          {{ isPending ? $t('auth.twoFactor.verifyPending') : $t('auth.twoFactor.verify') }}
+        </button>
+      </form>
+    </template>
+
+    <template v-else-if="twoFactorEnabled">
+      <p class="mb-0 mt-1 text-xs text-muted">{{ $t('auth.twoFactor.enabled') }}</p>
+
+      <form data-mode="disable" class="mt-5 flex flex-col gap-3" @submit.prevent="onDisable">
+        <label class="flex flex-col gap-1.5">
+          <span class="label-upper">{{ $t('auth.login.password') }}</span>
+          <input
+            v-model="password"
+            autocomplete="current-password"
+            class="input-field"
+            required
+            type="password"
+          />
+        </label>
+
+        <TwoFactorError :message="errorMessage" />
+
+        <button class="btn-subtle" :disabled="isPending" type="submit">
+          {{ isPending ? $t('auth.twoFactor.disablePending') : $t('auth.twoFactor.disable') }}
+        </button>
+      </form>
+    </template>
+
+    <template v-else-if="totpUri">
+      <p class="mb-0 mt-1 text-xs text-muted">{{ $t('auth.twoFactor.scan') }}</p>
+
+      <div class="mt-5 grid gap-5 md:grid-cols-[12rem_1fr]">
+        <div class="grid place-items-center border border-line bg-white p-3">
+          <img v-if="qrImage" class="h-44 w-44" :src="qrImage" :alt="$t('auth.twoFactor.qrAlt')" />
+          <code v-else class="break-all text-3xs text-canvas">{{ totpUri }}</code>
+        </div>
+
+        <div>
+          <h2 class="m-0 text-sm font-650">{{ $t('auth.twoFactor.backupCodesTitle') }}</h2>
+          <p class="mb-3 mt-1 text-xs text-muted">{{ $t('auth.twoFactor.backupCodesHint') }}</p>
+          <ul class="m-0 grid grid-cols-2 gap-1 border border-line bg-raised p-3 list-none">
+            <li v-for="backupCode in backupCodes" :key="backupCode" class="mono text-xs">
+              {{ backupCode }}
+            </li>
+          </ul>
+        </div>
+      </div>
+
+      <form data-mode="confirm" class="mt-5 flex flex-col gap-3" @submit.prevent="onConfirm">
+        <label class="flex flex-col gap-1.5">
+          <span class="label-upper">{{ $t('auth.twoFactor.confirmCode') }}</span>
+          <input
+            v-model="code"
+            autocomplete="one-time-code"
+            class="input-field mono"
+            inputmode="numeric"
+            required
+            spellcheck="false"
+            type="text"
+          />
+        </label>
+
+        <TwoFactorError :message="errorMessage" />
+
+        <button class="btn-accent" :disabled="isPending" type="submit">
+          {{ isPending ? $t('auth.twoFactor.confirmPending') : $t('auth.twoFactor.confirm') }}
+        </button>
+      </form>
+    </template>
+
+    <template v-else>
+      <p class="mb-0 mt-1 text-xs text-muted">{{ $t('auth.twoFactor.disabled') }}</p>
+
+      <form data-mode="enable" class="mt-5 flex flex-col gap-3" @submit.prevent="onEnable">
+        <label class="flex flex-col gap-1.5">
+          <span class="label-upper">{{ $t('auth.login.password') }}</span>
+          <input
+            v-model="password"
+            autocomplete="current-password"
+            class="input-field"
+            required
+            type="password"
+          />
+        </label>
+
+        <TwoFactorError :message="errorMessage" />
+
+        <button class="btn-accent" :disabled="isPending" type="submit">
+          {{ isPending ? $t('auth.twoFactor.enablePending') : $t('auth.twoFactor.enable') }}
+        </button>
+      </form>
+    </template>
+  </section>
+</template>
+
+<script setup lang="ts">
+import QRCode from 'qrcode';
+import { useI18n } from 'vue-i18n';
+
+definePageMeta({ layout: 'auth' });
+
+const { user, loggedIn, ready, fetchSession } = useUserSession();
+const i18n = useI18n();
+
+const factors = ['totp', 'backup'] as const;
+type ChallengeFactor = (typeof factors)[number];
+
+const challengeFactor = ref<ChallengeFactor>('totp');
+const trustDevice = ref(true);
+const password = ref('');
+const code = ref('');
+const totpUri = ref('');
+const qrImage = ref('');
+const backupCodes = ref<string[]>([]);
+const isPending = ref(false);
+const errorMessage = ref<string>();
+
+const twoFactorEnabled = computed(() =>
+  Boolean(user.value && 'twoFactorEnabled' in user.value && user.value.twoFactorEnabled),
+);
+
+function authClient() {
+  const client = useAuthClient();
+  if (!client) throw new Error('auth client unavailable');
+  return client;
+}
+
+function responseFailed(result: { error?: unknown }): boolean {
+  if (!result.error) return false;
+  errorMessage.value = i18n.t('auth.twoFactor.error');
+  return true;
+}
+
+async function onChallenge(): Promise<void> {
+  if (isPending.value) return;
+  isPending.value = true;
+  errorMessage.value = undefined;
+  try {
+    const value = code.value.trim();
+    const result =
+      challengeFactor.value === 'totp'
+        ? await authClient().twoFactor.verifyTotp({ code: value, trustDevice: trustDevice.value })
+        : await authClient().twoFactor.verifyBackupCode({
+            code: value,
+            trustDevice: trustDevice.value,
+          });
+    if (!responseFailed(result)) await navigateTo('/');
+  } catch {
+    errorMessage.value = i18n.t('auth.twoFactor.error');
+  } finally {
+    isPending.value = false;
+  }
+}
+
+async function onEnable(): Promise<void> {
+  if (isPending.value) return;
+  isPending.value = true;
+  errorMessage.value = undefined;
+  try {
+    const result = await authClient().twoFactor.enable({ password: password.value });
+    if (responseFailed(result) || !result.data) return;
+
+    totpUri.value = result.data.totpURI;
+    backupCodes.value = result.data.backupCodes;
+    password.value = '';
+    qrImage.value = await QRCode.toDataURL(result.data.totpURI, {
+      errorCorrectionLevel: 'M',
+      margin: 1,
+      width: 352,
+    });
+  } catch {
+    errorMessage.value = i18n.t('auth.twoFactor.error');
+  } finally {
+    isPending.value = false;
+  }
+}
+
+async function onConfirm(): Promise<void> {
+  if (isPending.value) return;
+  isPending.value = true;
+  errorMessage.value = undefined;
+  try {
+    const result = await authClient().twoFactor.verifyTotp({ code: code.value.trim() });
+    if (responseFailed(result)) return;
+    await fetchSession({ force: true });
+    totpUri.value = '';
+    qrImage.value = '';
+    backupCodes.value = [];
+    code.value = '';
+  } catch {
+    errorMessage.value = i18n.t('auth.twoFactor.error');
+  } finally {
+    isPending.value = false;
+  }
+}
+
+async function onDisable(): Promise<void> {
+  if (isPending.value) return;
+  isPending.value = true;
+  errorMessage.value = undefined;
+  try {
+    const result = await authClient().twoFactor.disable({ password: password.value });
+    if (responseFailed(result)) return;
+    password.value = '';
+    await fetchSession({ force: true });
+  } catch {
+    errorMessage.value = i18n.t('auth.twoFactor.error');
+  } finally {
+    isPending.value = false;
+  }
+}
+</script>
diff --git a/apps/dashboard/modules/auth/components/TwoFactorError.vue b/apps/dashboard/modules/auth/components/TwoFactorError.vue
new file mode 100644
index 0000000..7577a33
--- /dev/null
+++ b/apps/dashboard/modules/auth/components/TwoFactorError.vue
@@ -0,0 +1,13 @@
+<template>
+  <p
+    v-if="message"
+    class="m-0 border border-danger/35 bg-danger/8 p-2.5 text-xs text-danger"
+    role="alert"
+  >
+    {{ message }}
+  </p>
+</template>
+
+<script setup lang="ts">
+defineProps<{ message?: string }>();
+</script>
diff --git a/apps/dashboard/modules/auth/components/UserMenu.vue b/apps/dashboard/modules/auth/components/UserMenu.vue
index 1479c85..e635a5e 100644
--- a/apps/dashboard/modules/auth/components/UserMenu.vue
+++ b/apps/dashboard/modules/auth/components/UserMenu.vue
@@ -6,6 +6,9 @@
     <p class="m-0 mt-1 truncate text-xs font-650" :title="user?.email">
       {{ user?.name || user?.email }}
     </p>
+    <NuxtLink class="btn-link mt-2.5 block text-xs" to="/two-factor">
+      {{ $t('auth.twoFactor.link') }}
+    </NuxtLink>
     <button
       class="focus-ring mt-2.5 h-8 w-full border border-line bg-raised text-xs text-ink font-650 transition hover:border-muted"
       type="button"
diff --git a/apps/dashboard/nuxt.config.ts b/apps/dashboard/nuxt.config.ts
index 32d126a..2358c78 100644
--- a/apps/dashboard/nuxt.config.ts
+++ b/apps/dashboard/nuxt.config.ts
@@ -239,6 +239,9 @@ export default defineNuxtConfig({
     // than being shown the form. The auth layout, not the shell, because the visitor arriving here
     // typed a code off a terminal and has no business in the navigation.
     '/device': { auth: { only: 'user' } },
+    // Serves both authenticated enrollment and the pre-session challenge after password sign-in.
+    // The Better Auth endpoints enforce the relevant cookie/session for each operation.
+    '/two-factor': { auth: false },
     // Reached from an invitation email, so the visitor is frequently signed out at that moment:
     // requiring a session sends them through /login and back, rather than rejecting the link.
     '/organizations/accept-invitation/**': { appLayout: 'default', auth: { only: 'user' } },
diff --git a/apps/dashboard/package.json b/apps/dashboard/package.json
index 565d7d7..216dbae 100644
--- a/apps/dashboard/package.json
+++ b/apps/dashboard/package.json
@@ -41,9 +41,11 @@
     "@tanstack/vue-query": "^5.101.4",
     "@tanstack/vue-table": "^9.1.2",
     "better-auth": "^1.6.26",
+    "drizzle-orm": "^0.45.2",
     "evlog": "^2.26.0",
     "h3": "^1.15.11",
     "nuxt": "^4.5.2",
+    "qrcode": "^1.5.4",
     "vite-hub": "^0.0.3",
     "vue": "^3.5.40",
     "vue-i18n": "^11.4.8"
@@ -56,6 +58,7 @@
     "@nuxtjs/color-mode": "4.0.1",
     "@nuxtjs/i18n": "^10.6.0",
     "@playwright/test": "^1.62.0",
+    "@types/qrcode": "^1.5.6",
     "@unocss/nuxt": "^66.7.5",
     "@unocss/preset-wind4": "^66.7.5",
     "@vue/test-utils": "^2.4.6",
diff --git a/apps/dashboard/server/auth.config.ts b/apps/dashboard/server/auth.config.ts
index ada7e21..85c3d39 100644
--- a/apps/dashboard/server/auth.config.ts
+++ b/apps/dashboard/server/auth.config.ts
@@ -103,6 +103,7 @@ export default defineServerAuth(
           invite: [],
           inviteUse: [],
           deviceCode: [],
+          twoFactor: [],
         }),
         // Test-only, and deliberately added here rather than in `packages/auth`: `testUtils`
         // registers no HTTP route, but it hangs privileged helpers off the auth context that can
diff --git a/apps/dashboard/test/e2e/auth.spec.ts b/apps/dashboard/test/e2e/auth.spec.ts
index 6fdf0fe..ccc7b42 100644
--- a/apps/dashboard/test/e2e/auth.spec.ts
+++ b/apps/dashboard/test/e2e/auth.spec.ts
@@ -31,6 +31,28 @@ test.describe('Authentication', () => {
     await expect(page.getByRole('button', { name: 'Sign out' })).toBeVisible();
   });
 
+  test('offers two-factor setup to a signed-in operator', async ({ page, goto }) => {
+    await mockAuthSession(page, true);
+
+    await goto('/two-factor', { waitUntil: 'networkidle' });
+
+    await expect(
+      page.getByRole('heading', { name: 'Two-factor authentication', level: 1 }),
+    ).toBeVisible();
+    await expect(
+      page.getByRole('button', { name: 'Set up two-factor authentication' }),
+    ).toBeVisible();
+  });
+
+  test('shows the second-factor challenge before a session exists', async ({ page, goto }) => {
+    await mockAuthSession(page, false);
+
+    await goto('/two-factor', { waitUntil: 'networkidle' });
+
+    await expect(page.getByRole('button', { name: 'Verify and sign in' })).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Backup code' })).toBeVisible();
+  });
+
   test('hides disabled sign-in methods on the login page', async ({ page, goto }) => {
     await mockAuthSession(page, false);
 
diff --git a/apps/dashboard/test/nuxt/components/UserMenu.spec.ts b/apps/dashboard/test/nuxt/components/UserMenu.spec.ts
index 6eb7ad7..b2cdf4e 100644
--- a/apps/dashboard/test/nuxt/components/UserMenu.spec.ts
+++ b/apps/dashboard/test/nuxt/components/UserMenu.spec.ts
@@ -54,6 +54,15 @@ describe('UserMenu', () => {
     expect(wrapper.get('[title]').attributes('title')).toBe('operator@example.test');
   });
 
+  it('links a signed-in operator to two-factor security settings', async () => {
+    mockReady.value = true;
+    mockUser.value = OPERATOR;
+
+    const wrapper = await mountSuspended(UserMenu);
+
+    expect(wrapper.get('a[href="/two-factor"]').text()).toBe('Two-factor authentication');
+  });
+
   it('falls back to the email when the account has no display name', async () => {
     mockReady.value = true;
     mockUser.value = { name: '', email: 'operator@example.test' };
diff --git a/apps/dashboard/test/nuxt/pages/two-factor.spec.ts b/apps/dashboard/test/nuxt/pages/two-factor.spec.ts
new file mode 100644
index 0000000..1a9b460
--- /dev/null
+++ b/apps/dashboard/test/nuxt/pages/two-factor.spec.ts
@@ -0,0 +1,112 @@
+import { mockNuxtImport, mountSuspended } from '@nuxt/test-utils/runtime';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { computed, ref } from 'vue';
+
+import TwoFactorPage from '~/pages/two-factor.vue';
+
+vi.mock('qrcode', () => ({
+  default: { toDataURL: vi.fn(() => Promise.resolve('data:image/png;base64,qr')) },
+}));
+
+const user = ref<{ twoFactorEnabled: boolean } | null>(null);
+const { fetchSession, navigateTo, enable, disable, verifyTotp, verifyBackupCode } = vi.hoisted(
+  () => ({
+    fetchSession: vi.fn(() => Promise.resolve()),
+    navigateTo: vi.fn(() => Promise.resolve()),
+    enable: vi.fn(),
+    disable: vi.fn(),
+    verifyTotp: vi.fn(),
+    verifyBackupCode: vi.fn(),
+  }),
+);
+
+mockNuxtImport('navigateTo', () => navigateTo);
+mockNuxtImport('useUserSession', () => () => ({
+  user,
+  loggedIn: computed(() => user.value !== null),
+  ready: computed(() => true),
+  fetchSession,
+}));
+mockNuxtImport('useAuthClient', () => () => ({
+  twoFactor: { enable, disable, verifyTotp, verifyBackupCode },
+}));
+
+describe('two-factor page', () => {
+  beforeEach(() => {
+    user.value = null;
+    fetchSession.mockClear();
+    navigateTo.mockClear();
+    enable.mockReset();
+    disable.mockReset();
+    verifyTotp.mockReset();
+    verifyBackupCode.mockReset();
+  });
+
+  it('completes a sign-in challenge with a trusted-device TOTP code', async () => {
+    verifyTotp.mockResolvedValue({});
+    const wrapper = await mountSuspended(TwoFactorPage);
+
+    await wrapper.get('input[autocomplete="one-time-code"]').setValue('123456');
+    await wrapper.get('form[data-mode="challenge"]').trigger('submit');
+
+    expect(verifyTotp).toHaveBeenCalledWith({ code: '123456', trustDevice: true });
+    expect(navigateTo).toHaveBeenCalledWith('/');
+  });
+
+  it('accepts a backup code during sign-in', async () => {
+    verifyBackupCode.mockResolvedValue({});
+    const wrapper = await mountSuspended(TwoFactorPage);
+
+    await wrapper.get('button[data-factor="backup"]').trigger('click');
+    await wrapper.get('input[autocomplete="one-time-code"]').setValue('backup-code');
+    await wrapper.get('form[data-mode="challenge"]').trigger('submit');
+
+    expect(verifyBackupCode).toHaveBeenCalledWith({ code: 'backup-code', trustDevice: true });
+  });
+
+  it('shows the QR code and one-time backup codes after password confirmation', async () => {
+    user.value = { twoFactorEnabled: false };
+    enable.mockResolvedValue({
+      data: { totpURI: 'otpauth://totp/Agent%20Zero', backupCodes: ['one', 'two'] },
+    });
+    const wrapper = await mountSuspended(TwoFactorPage);
+
+    await wrapper.get('input[autocomplete="current-password"]').setValue('correct-password');
+    await wrapper.get('form[data-mode="enable"]').trigger('submit');
+    await vi.waitFor(() =>
+      expect(wrapper.get('img').attributes('src')).toContain('data:image/png'),
+    );
+
+    expect(enable).toHaveBeenCalledWith({ password: 'correct-password' });
+    expect(wrapper.text()).toContain('one');
+    expect(wrapper.text()).toContain('two');
+  });
+
+  it('verifies the first TOTP code before considering enrollment complete', async () => {
+    user.value = { twoFactorEnabled: false };
+    enable.mockResolvedValue({
+      data: { totpURI: 'otpauth://totp/Agent%20Zero', backupCodes: ['one'] },
+    });
+    verifyTotp.mockResolvedValue({});
+    const wrapper = await mountSuspended(TwoFactorPage);
+
+    await wrapper.get('form[data-mode="enable"]').trigger('submit');
+    await wrapper.get('input[autocomplete="one-time-code"]').setValue('654321');
+    await wrapper.get('form[data-mode="confirm"]').trigger('submit');
+
+    expect(verifyTotp).toHaveBeenCalledWith({ code: '654321' });
+    expect(fetchSession).toHaveBeenCalledWith({ force: true });
+  });
+
+  it('requires the password to disable an active second factor', async () => {
+    user.value = { twoFactorEnabled: true };
+    disable.mockResolvedValue({});
+    const wrapper = await mountSuspended(TwoFactorPage);
+
+    await wrapper.get('input[autocomplete="current-password"]').setValue('correct-password');
+    await wrapper.get('form[data-mode="disable"]').trigger('submit');
+
+    expect(disable).toHaveBeenCalledWith({ password: 'correct-password' });
+    expect(fetchSession).toHaveBeenCalledWith({ force: true });
+  });
+});
diff --git a/docs/architecture.md b/docs/architecture.md
index f54ad9a..b3adb35 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -141,6 +141,16 @@ The app-wide `user.role` column belongs to this boundary too, and is distinct fr
 
 The dashboard renders with SSR. The session cookie is scoped to the app's own origin, so the server resolves it directly from the incoming request before the first paint, rather than rendering a signed-out shell that a client-side check then corrects.
 
+TOTP two-factor authentication is composed unconditionally in `packages/auth`: enabling it is an
+account decision, not a deployment-wide widening of sign-in policy. Enrollment requires an
+existing session and password confirmation, persists an encrypted TOTP secret and encrypted
+one-time backup codes, and only sets `user.twoFactorEnabled` after the first TOTP verification.
+`apps/dashboard` registers the matching client plugin and serves `/two-factor` without a blanket
+route-rule redirect because the page has two mutually exclusive states: an authenticated account
+manages enrollment there, while a password-authenticated visitor who has not received a full
+session yet completes the second-factor challenge there. The Better Auth endpoints authorize each
+state with their own session or signed challenge cookie.
+
 <!-- #endregion authentication-boundary -->
 
 <!-- #region persistence-boundary -->
@@ -155,7 +165,7 @@ Declaring the schema here rather than letting Better Auth's own migration CLI ge
 
 `DATABASE_URL` is the connection string a deployment sets. `AUTH_DATABASE_URL` is still accepted, because the store used to live inside `packages/auth` and a deployment configured before the split must not fail to start on upgrade.
 
-The same rule covers the tables a Better Auth plugin brings with it. `invite` and `invite_use` (Better Enrollment) are declared here alongside `organization` and `member`, so a deployment that never enables the feature still migrates them and simply never writes to them — the alternative is a schema that depends on which flags were set when the migration ran. Two of their columns are deliberate exceptions to the repository's usual habits: an accepted invitation is a permanent audit record, so it carries no foreign key to the organization, team, or account it names and denormalizes `inviter_name`/`inviter_email` in order to survive their deletion; and `invite_use` carries only `used_at` rather than the shared timestamp pair, because a use is a point-in-time fact that must not look rewritable.
+The same rule covers the tables a Better Auth plugin brings with it. `invite` and `invite_use` (Better Enrollment), `two_factor` (TOTP and backup codes), and the organization tables are declared here, so every deployment migrates one deterministic schema. Two invitation columns are deliberate exceptions to the repository's usual habits: an accepted invitation is a permanent audit record, so it carries no foreign key to the organization, team, or account it names and denormalizes `inviter_name`/`inviter_email` in order to survive their deletion; and `invite_use` carries only `used_at` rather than the shared timestamp pair, because a use is a point-in-time fact that must not look rewritable.
 
 <!-- #endregion persistence-boundary -->
 
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 380d1a8..cbfb7fe 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -41,6 +41,7 @@
     "@better-auth/infra": "^0.4.0",
     "@octopi-ai/better-enrollment": "^0.4.0",
     "better-auth": "^1.6.26",
+    "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
diff --git a/packages/auth/src/auth.test.ts b/packages/auth/src/auth.test.ts
index db77d20..b77bf81 100644
--- a/packages/auth/src/auth.test.ts
+++ b/packages/auth/src/auth.test.ts
@@ -210,6 +210,15 @@ describe('createAuth with organizations', () => {
     expect(ids).toContain('last-login-method');
   });
 
+  it('always registers TOTP two-factor authentication', () => {
+    const ids = authBetterAuthOptions({
+      databaseUrl: completeEnvironment.DATABASE_URL,
+      config: defaultAuthConfig,
+    }).plugins.map((plugin) => plugin.id);
+
+    expect(ids).toContain('two-factor');
+  });
+
   it('withholds the device flow until an operator grants it', () => {
     const off = authBetterAuthOptions({
       databaseUrl: completeEnvironment.DATABASE_URL,
diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts
index e7cfabf..72f3047 100644
--- a/packages/auth/src/auth.ts
+++ b/packages/auth/src/auth.ts
@@ -12,6 +12,7 @@ import {
   multiSession,
   oAuthProxy,
   organization,
+  twoFactor,
 } from 'better-auth/plugins';
 import type { OrganizationOptions } from 'better-auth/plugins';
 
@@ -221,6 +222,12 @@ function authPlugins(options: AuthDatabaseOptions): BetterAuthPlugin[] {
   // without this the second sign-in silently evicts the first.
   plugins.push(multiSession({ maximumSessions: config.maximumDeviceSessions }));
 
+  // TOTP and one-time backup codes are available to every account. Registering the plugin does
+  // not weaken sign-in on its own: a user must re-enter their password, enroll a secret, and
+  // verify the first authenticator code before Better Auth marks `twoFactorEnabled`. Failed
+  // sign-in challenges use Better Auth's account-level lockout defaults.
+  plugins.push(twoFactor({ issuer: 'Agent Zero' }));
+
   // Only on the deployments that need it — a preview or local origin the OAuth provider has no
   // callback registered for. `oauthProxyFromEnvironment` withholds the settings unless both the
   // production origin and the shared secret are configured, and the plugin itself declines to
diff --git a/packages/database/drizzle/0004_outstanding_mister_sinister.sql b/packages/database/drizzle/0004_outstanding_mister_sinister.sql
new file mode 100644
index 0000000..800a88e
--- /dev/null
+++ b/packages/database/drizzle/0004_outstanding_mister_sinister.sql
@@ -0,0 +1,16 @@
+CREATE TABLE "two_factor" (
+	"id" text PRIMARY KEY NOT NULL,
+	"secret" text NOT NULL,
+	"backup_codes" text NOT NULL,
+	"user_id" text NOT NULL,
+	"verified" boolean DEFAULT true NOT NULL,
+	"failed_verification_count" integer DEFAULT 0 NOT NULL,
+	"locked_until" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "two_factor_enabled" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "two_factor" ADD CONSTRAINT "two_factor_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "two_factor_secret_idx" ON "two_factor" USING btree ("secret");--> statement-breakpoint
+CREATE INDEX "two_factor_user_id_idx" ON "two_factor" USING btree ("user_id");
\ No newline at end of file
diff --git a/packages/database/drizzle/meta/0004_snapshot.json b/packages/database/drizzle/meta/0004_snapshot.json
new file mode 100644
index 0000000..34f0c80
--- /dev/null
+++ b/packages/database/drizzle/meta/0004_snapshot.json
@@ -0,0 +1,1313 @@
+{
+  "id": "4574657d-7f9b-45dc-b798-8279b16b53d4",
+  "prevId": "5c7c03cc-23e1-44b1-a9a3-56ed7c6ba23f",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "account_user_id_idx": {
+          "name": "account_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.device_code": {
+      "name": "device_code",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "device_code": {
+          "name": "device_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_code": {
+          "name": "user_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "last_polled_at": {
+          "name": "last_polled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "polling_interval": {
+          "name": "polling_interval",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "device_code_device_code_unique": {
+          "name": "device_code_device_code_unique",
+          "columns": [
+            {
+              "expression": "device_code",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "device_code_user_code_unique": {
+          "name": "device_code_user_code_unique",
+          "columns": [
+            {
+              "expression": "user_code",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "device_code_user_id_idx": {
+          "name": "device_code_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "device_code_expires_at_idx": {
+          "name": "device_code_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "device_code_user_id_user_id_fk": {
+          "name": "device_code_user_id_user_id_fk",
+          "tableFrom": "device_code",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invitation": {
+      "name": "invitation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inviter_id": {
+          "name": "inviter_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invitation_organization_id_idx": {
+          "name": "invitation_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_email_idx": {
+          "name": "invitation_email_idx",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invitation_organization_id_organization_id_fk": {
+          "name": "invitation_organization_id_organization_id_fk",
+          "tableFrom": "invitation",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "invitation_inviter_id_user_id_fk": {
+          "name": "invitation_inviter_id_user_id_fk",
+          "tableFrom": "invitation",
+          "tableTo": "user",
+          "columnsFrom": ["inviter_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invite": {
+      "name": "invite",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'app'"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_role": {
+          "name": "organization_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preset_seat_limit": {
+          "name": "preset_seat_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pre_created_user_id": {
+          "name": "pre_created_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inviter_name": {
+          "name": "inviter_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inviter_email": {
+          "name": "inviter_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "max_uses": {
+          "name": "max_uses",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "use_count": {
+          "name": "use_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invite_token_hash_unique": {
+          "name": "invite_token_hash_unique",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invite_email_idx": {
+          "name": "invite_email_idx",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invite_status_idx": {
+          "name": "invite_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invite_organization_id_idx": {
+          "name": "invite_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invite_created_by_user_id_idx": {
+          "name": "invite_created_by_user_id_idx",
+          "columns": [
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invite_expires_at_idx": {
+          "name": "invite_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invite_use": {
+      "name": "invite_use",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_by_user_id": {
+          "name": "used_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invitee_email": {
+          "name": "invitee_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invite_use_invite_id_idx": {
+          "name": "invite_use_invite_id_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invite_use_invite_id_invite_id_fk": {
+          "name": "invite_use_invite_id_invite_id_fk",
+          "tableFrom": "invite_use",
+          "tableTo": "invite",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.member": {
+      "name": "member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "member_organization_user_unique": {
+          "name": "member_organization_user_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "member_user_id_idx": {
+          "name": "member_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "member_organization_id_organization_id_fk": {
+          "name": "member_organization_id_organization_id_fk",
+          "tableFrom": "member",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "member_user_id_user_id_fk": {
+          "name": "member_user_id_user_id_fk",
+          "tableFrom": "member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization": {
+      "name": "organization",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "logo": {
+          "name": "logo",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seat_limit": {
+          "name": "seat_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "organization_slug_unique": {
+          "name": "organization_slug_unique",
+          "columns": [
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active_organization_id": {
+          "name": "active_organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "session_token_unique": {
+          "name": "session_token_unique",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "session_user_id_idx": {
+          "name": "session_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.two_factor": {
+      "name": "two_factor",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "secret": {
+          "name": "secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "backup_codes": {
+          "name": "backup_codes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified": {
+          "name": "verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "failed_verification_count": {
+          "name": "failed_verification_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "locked_until": {
+          "name": "locked_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "two_factor_secret_idx": {
+          "name": "two_factor_secret_idx",
+          "columns": [
+            {
+              "expression": "secret",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "two_factor_user_id_idx": {
+          "name": "two_factor_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "two_factor_user_id_user_id_fk": {
+          "name": "two_factor_user_id_user_id_fk",
+          "tableFrom": "two_factor",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_login_method": {
+          "name": "last_login_method",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "two_factor_enabled": {
+          "name": "two_factor_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_email_unique": {
+          "name": "user_email_unique",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "verification_identifier_idx": {
+          "name": "verification_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/packages/database/drizzle/meta/_journal.json b/packages/database/drizzle/meta/_journal.json
index 4272b7d..2814f43 100644
--- a/packages/database/drizzle/meta/_journal.json
+++ b/packages/database/drizzle/meta/_journal.json
@@ -29,6 +29,13 @@
       "when": 1787157872233,
       "tag": "0003_messy_hitman",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1787509629014,
+      "tag": "0004_outstanding_mister_sinister",
+      "breakpoints": true
     }
   ]
 }
diff --git a/packages/database/src/client.test.ts b/packages/database/src/client.test.ts
index e48137c..f1827d7 100644
--- a/packages/database/src/client.test.ts
+++ b/packages/database/src/client.test.ts
@@ -95,6 +95,7 @@ describe('schema', () => {
       'member',
       'organization',
       'session',
+      'twoFactor',
       'user',
       'verification',
     ]);
diff --git a/packages/database/src/schema/auth.test.ts b/packages/database/src/schema/auth.test.ts
new file mode 100644
index 0000000..0ead413
--- /dev/null
+++ b/packages/database/src/schema/auth.test.ts
@@ -0,0 +1,29 @@
+import { getTableConfig } from 'drizzle-orm/pg-core';
+import { describe, expect, it } from 'vitest';
+
+import { schema } from './index.js';
+
+describe('two-factor authentication schema', () => {
+  it('persists whether a user has completed two-factor setup', () => {
+    const columns = getTableConfig(schema.user).columns.map((column) => column.name);
+
+    expect(columns).toContain('two_factor_enabled');
+  });
+
+  it('persists TOTP secrets and backup codes in the Better Auth model', () => {
+    const table = schema.twoFactor;
+
+    expect(table).toBeDefined();
+    expect(getTableConfig(table).columns.map((column) => column.name)).toEqual([
+      'id',
+      'secret',
+      'backup_codes',
+      'user_id',
+      'verified',
+      'failed_verification_count',
+      'locked_until',
+      'created_at',
+      'updated_at',
+    ]);
+  });
+});
diff --git a/packages/database/src/schema/auth.ts b/packages/database/src/schema/auth.ts
index a249a67..6694816 100644
--- a/packages/database/src/schema/auth.ts
+++ b/packages/database/src/schema/auth.ts
@@ -1,4 +1,12 @@
-import { boolean, index, pgTable, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
+import {
+  boolean,
+  index,
+  integer,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+} from 'drizzle-orm/pg-core';
 
 import { timestampColumns } from './columns.js';
 
@@ -36,11 +44,35 @@ export const user = pgTable(
      * because every account predates its first sign-in under this plugin.
      */
     lastLoginMethod: text('last_login_method'),
+    // Set only after the first authenticator code verifies the pending TOTP enrollment.
+    twoFactorEnabled: boolean('two_factor_enabled').notNull().default(false),
     ...timestampColumns,
   },
   (table) => [uniqueIndex('user_email_unique').on(table.email)],
 );
 
+/** TOTP material managed by Better Auth's two-factor plugin. */
+export const twoFactor = pgTable(
+  'two_factor',
+  {
+    id: text('id').primaryKey(),
+    // Better Auth encrypts both values with the deployment's auth secret before persistence.
+    secret: text('secret').notNull(),
+    backupCodes: text('backup_codes').notNull(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    verified: boolean('verified').notNull().default(true),
+    failedVerificationCount: integer('failed_verification_count').notNull().default(0),
+    lockedUntil: timestamp('locked_until', { withTimezone: true }),
+    ...timestampColumns,
+  },
+  (table) => [
+    index('two_factor_secret_idx').on(table.secret),
+    index('two_factor_user_id_idx').on(table.userId),
+  ],
+);
+
 export const session = pgTable(
   'session',
   {
diff --git a/packages/database/src/schema/index.ts b/packages/database/src/schema/index.ts
index f0385f0..732f7ce 100644
--- a/packages/database/src/schema/index.ts
+++ b/packages/database/src/schema/index.ts
@@ -1,9 +1,9 @@
-import { account, session, user, verification } from './auth.js';
+import { account, session, twoFactor, user, verification } from './auth.js';
 import { deviceCode } from './device.js';
 import { invite, inviteUse } from './enrollment.js';
 import { invitation, member, organization } from './organization.js';
 
-export { account, session, user, verification } from './auth.js';
+export { account, session, twoFactor, user, verification } from './auth.js';
 export { timestampColumns } from './columns.js';
 export { deviceCode } from './device.js';
 export { invite, inviteUse } from './enrollment.js';
@@ -25,6 +25,7 @@ export const schema = {
   session,
   account,
   verification,
+  twoFactor,
   organization,
   member,
   invitation,
diff --git a/packages/i18n/locales/en/auth.json b/packages/i18n/locales/en/auth.json
index f240ec1..c0b777d 100644
--- a/packages/i18n/locales/en/auth.json
+++ b/packages/i18n/locales/en/auth.json
@@ -59,6 +59,35 @@
       "signedInAs": "Signed in as",
       "signOut": "Sign out"
     },
+    "twoFactor": {
+      "link": "Two-factor authentication",
+      "title": "Two-factor authentication",
+      "loading": "Checking your security settings…",
+      "challengeSubtitle": "Enter a code to finish signing in.",
+      "factor": {
+        "totp": "Authenticator code",
+        "backup": "Backup code"
+      },
+      "code": "Six-digit code",
+      "backupCode": "Backup code",
+      "trustDevice": "Trust this device for 30 days",
+      "verify": "Verify and sign in",
+      "verifyPending": "Verifying…",
+      "enabled": "Your account is protected with an authenticator app.",
+      "disabled": "Add an authenticator app and one-time backup codes to protect your account.",
+      "enable": "Set up two-factor authentication",
+      "enablePending": "Preparing setup…",
+      "disable": "Disable two-factor authentication",
+      "disablePending": "Disabling…",
+      "scan": "Scan the QR code, save every backup code, then verify one authenticator code.",
+      "qrAlt": "QR code for adding Agent Zero to an authenticator app",
+      "backupCodesTitle": "Backup codes",
+      "backupCodesHint": "Store these codes securely. Each code works once and will not be shown again.",
+      "confirmCode": "Code from your authenticator app",
+      "confirm": "Confirm setup",
+      "confirmPending": "Confirming…",
+      "error": "The two-factor request failed. Check the password or code and try again."
+    },
     "errors": {
       "GENERIC": "Sign-in failed. Check your credentials and try again.",
       "INVALID_EMAIL_OR_PASSWORD": "That email and password combination is not valid.",
diff --git a/packages/i18n/locales/it/auth.json b/packages/i18n/locales/it/auth.json
index 1e05219..35ee79f 100644
--- a/packages/i18n/locales/it/auth.json
+++ b/packages/i18n/locales/it/auth.json
@@ -59,6 +59,35 @@
       "signedInAs": "Accesso come",
       "signOut": "Esci"
     },
+    "twoFactor": {
+      "link": "Autenticazione a due fattori",
+      "title": "Autenticazione a due fattori",
+      "loading": "Verifica delle impostazioni di sicurezza…",
+      "challengeSubtitle": "Inserisci un codice per completare l'accesso.",
+      "factor": {
+        "totp": "Codice autenticatore",
+        "backup": "Codice di recupero"
+      },
+      "code": "Codice a sei cifre",
+      "backupCode": "Codice di recupero",
+      "trustDevice": "Considera attendibile questo dispositivo per 30 giorni",
+      "verify": "Verifica e accedi",
+      "verifyPending": "Verifica in corso…",
+      "enabled": "Il tuo account è protetto con un'app di autenticazione.",
+      "disabled": "Aggiungi un'app di autenticazione e codici di recupero monouso per proteggere l'account.",
+      "enable": "Configura l'autenticazione a due fattori",
+      "enablePending": "Preparazione in corso…",
+      "disable": "Disattiva l'autenticazione a due fattori",
+      "disablePending": "Disattivazione in corso…",
+      "scan": "Scansiona il codice QR, salva tutti i codici di recupero e poi verifica un codice dell'autenticatore.",
+      "qrAlt": "Codice QR per aggiungere Agent Zero a un'app di autenticazione",
+      "backupCodesTitle": "Codici di recupero",
+      "backupCodesHint": "Conserva questi codici in modo sicuro. Ogni codice funziona una volta e non verrà mostrato di nuovo.",
+      "confirmCode": "Codice dell'app di autenticazione",
+      "confirm": "Conferma configurazione",
+      "confirmPending": "Conferma in corso…",
+      "error": "La richiesta a due fattori non è riuscita. Controlla la password o il codice e riprova."
+    },
     "errors": {
       "GENERIC": "Accesso non riuscito. Controlla le credenziali e riprova.",
       "INVALID_EMAIL_OR_PASSWORD": "La combinazione di email e password non è valida.",
diff --git a/packages/i18n/schemas/auth.schema.json b/packages/i18n/schemas/auth.schema.json
index d5493d8..e9dee51 100644
--- a/packages/i18n/schemas/auth.schema.json
+++ b/packages/i18n/schemas/auth.schema.json
@@ -181,6 +181,93 @@
           },
           "additionalProperties": false
         },
+        "twoFactor": {
+          "type": "object",
+          "properties": {
+            "link": {
+              "type": "string"
+            },
+            "title": {
+              "type": "string"
+            },
+            "loading": {
+              "type": "string"
+            },
+            "challengeSubtitle": {
+              "type": "string"
+            },
+            "factor": {
+              "type": "object",
+              "properties": {
+                "totp": {
+                  "type": "string"
+                },
+                "backup": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            },
+            "code": {
+              "type": "string"
+            },
+            "backupCode": {
+              "type": "string"
+            },
+            "trustDevice": {
+              "type": "string"
+            },
+            "verify": {
+              "type": "string"
+            },
+            "verifyPending": {
+              "type": "string"
+            },
+            "enabled": {
+              "type": "string"
+            },
+            "disabled": {
+              "type": "string"
+            },
+            "enable": {
+              "type": "string"
+            },
+            "enablePending": {
+              "type": "string"
+            },
+            "disable": {
+              "type": "string"
+            },
+            "disablePending": {
+              "type": "string"
+            },
+            "scan": {
+              "type": "string"
+            },
+            "qrAlt": {
+              "type": "string"
+            },
+            "backupCodesTitle": {
+              "type": "string"
+            },
+            "backupCodesHint": {
+              "type": "string"
+            },
+            "confirmCode": {
+              "type": "string"
+            },
+            "confirm": {
+              "type": "string"
+            },
+            "confirmPending": {
+              "type": "string"
+            },
+            "error": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
         "errors": {
           "type": "object",
           "properties": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 82b7f23..86e08cc 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -147,6 +147,9 @@ importers:
       better-auth:
         specifier: ^1.6.26
         version: 1.6.26(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2))(mongodb@7.5.0(@mongodb-js/zstd@7.0.0)(socks@2.8.9))(mysql2@3.15.3)(pg@8.23.0)(prisma@7.9.1)(react@19.2.8)(react-dom@19.2.8(react@19.2.8))(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(happy-dom@20.11.2)(vite@8.2.1(@types/node@24.13.3)(@vitejs/devtools@0.4.12)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0)))(vue@3.5.41)
+      drizzle-orm:
+        specifier: ^0.45.2
+        version: 0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2)
       evlog:
         specifier: ^2.26.0
         version: 2.26.0(@nestjs/common@11.2.1(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nuxt/kit@4.5.2)(ai@6.0.228(zod@4.4.3))(express@5.2.1)(h3@1.15.11)(hono@4.13.2)(nitropack@2.13.4)(ofetch@1.5.1)(react@19.2.8)(vite@8.2.1(@types/node@24.13.3)(@vitejs/devtools@0.4.12)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0))
@@ -156,6 +159,9 @@ importers:
       nuxt:
         specifier: ^4.5.2
         version: 4.5.2(@types/node@24.13.3)(rolldown@1.2.4)
+      qrcode:
+        specifier: ^1.5.4
+        version: 1.5.4
       rolldown:
         specifier: ~1.2.1
         version: 1.2.4
@@ -193,6 +199,9 @@ importers:
       '@playwright/test':
         specifier: ^1.62.0
         version: 1.62.1
+      '@types/qrcode':
+        specifier: ^1.5.6
+        version: 1.5.6
       '@unocss/nuxt':
         specifier: ^66.7.5
         version: 66.7.5(magic-string@0.30.21)(magicast@0.5.4)(rolldown@1.2.4)(vite@8.2.1(@types/node@24.13.3)(@vitejs/devtools@0.4.12)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0))(webpack@5.109.2)
@@ -467,6 +476,9 @@ importers:
       better-auth:
         specifier: ^1.6.26
         version: 1.6.26(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2))(mongodb@7.5.0(@mongodb-js/zstd@7.0.0)(socks@2.8.9))(mysql2@3.15.3)(pg@8.23.0)(prisma@7.9.1)(react@19.2.8)(react-dom@19.2.8(react@19.2.8))(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(happy-dom@20.11.2)(vite@8.2.1(@types/node@24.13.3)(@vitejs/devtools@0.4.12)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0)))(vue@3.5.41)
+      drizzle-orm:
+        specifier: ^0.45.2
+        version: 0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2)
       zod:
         specifier: ^4.4.3
         version: 4.4.3
@@ -7591,6 +7603,9 @@ packages:
   '@types/pg@8.23.0':
     resolution: {integrity: sha512-gPGYzOgqj8wcPJ3GSojYWD1i3wjym3ezWgis/Zk2gY8u29x9tEsP3oaBYFwqsFYmKOm6sawDu3IHNwladQc0ig==}
 
+  '@types/qrcode@1.5.6':
+    resolution: {integrity: sha512-te7NQcV2BOvdj2b1hCAHzAoMNuj65kNBMz0KBaxM6c3VGBOhU0dURQKOtH8CFNI/dsKkwlv32p26qYQTWoB5bw==}
+
   '@types/react@19.2.18':
     resolution: {integrity: sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==}
 
@@ -7615,9 +7630,6 @@ packages:
   '@types/unist@3.0.3':
     resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
 
-  '@types/web-bluetooth@0.0.20':
-    resolution: {integrity: sha512-g9gZnnXVq7gM7v3tJCWV/qw7w+KeOlSHAhgF9RytFyifW6AF61hdT2ucrYhPq9hLs5JIryeupHV3qGk95dH9ow==}
-
   '@types/web-bluetooth@0.0.21':
     resolution: {integrity: sha512-oIQLCGWtcFZy2JW77j9k8nHzAOpqMHLQejDA48XXMWH6tjCQHz5RCFz1bzsmROyL6PUm+LLnUiI4BCn221inxA==}
 
@@ -9504,6 +9516,10 @@ packages:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
     engines: {node: '>=6'}
 
+  camelcase@5.3.1:
+    resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
+    engines: {node: '>=6'}
+
   camelcase@8.0.0:
     resolution: {integrity: sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA==}
     engines: {node: '>=16'}
@@ -9652,6 +9668,9 @@ packages:
     resolution: {integrity: sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==}
     engines: {node: 10.* || >= 12.*}
 
+  cliui@6.0.0:
+    resolution: {integrity: sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==}
+
   cliui@7.0.4:
     resolution: {integrity: sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==}
 
@@ -10079,6 +10098,10 @@ packages:
   decache@4.6.2:
     resolution: {integrity: sha512-2LPqkLeu8XWHU8qNCS3kcF6sCcb5zIzvWaAHYSvPfwhdd7mHuah29NssMzrTYyHN4F5oFy2ko9OBYxegtU0FEw==}
 
+  decamelize@1.2.0:
+    resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==}
+    engines: {node: '>=0.10.0'}
+
   decode-bmp@0.2.1:
     resolution: {integrity: sha512-NiOaGe+GN0KJqi2STf24hfMkFitDUaIoUU3eKvP/wAbLe8o6FuW5n/x7MHPR0HKvBokp6MQY/j7w8lewEeVCIA==}
     engines: {node: '>=8.6.0'}
@@ -10225,6 +10248,9 @@ packages:
     resolution: {integrity: sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==}
     engines: {node: '>=0.3.1'}
 
+  dijkstrajs@1.0.3:
+    resolution: {integrity: sha512-qiSlmBq9+BCdCA/L46dw8Uy93mloxsPSbwnm5yrKn2vMPiy8KyAskTF6zuV/j5BMsmOGZDPs7KjU+mjb670kfA==}
+
   docus@5.12.3:
     resolution: {integrity: sha512-v5CF/Ta3+aAzuUKwPsFwSSCACXh9QRWbBZENwUyheajATnPrSnql+oHbDzANM+GBwDvmPpCBhzHsjKrdZZR0cw==}
     peerDependencies:
@@ -11132,6 +11158,10 @@ packages:
     resolution: {integrity: sha512-f2JHn75x2JlwUwLenZypgczR7YWMb/uO9BvUXtus+JMgkbIkLADd38cI4EiV+OQqrGo1Zlq6V8wnqMJ8e62wUQ==}
     engines: {node: '>=20'}
 
+  find-up@4.1.0:
+    resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
+    engines: {node: '>=8'}
+
   find-up@5.0.0:
     resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
     engines: {node: '>=10'}
@@ -12515,6 +12545,10 @@ packages:
     resolution: {integrity: sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==}
     engines: {node: '>=14'}
 
+  locate-path@5.0.0:
+    resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
+    engines: {node: '>=8'}
+
   locate-path@6.0.0:
     resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
     engines: {node: '>=10'}
@@ -13640,6 +13674,10 @@ packages:
     resolution: {integrity: sha512-Q6Bekk5wpzW5qIyUP4gdMEujObYstZl6DMMOSenwBvV0BlE5LkDwkjs5yHbZmdCEq2o4RJx4tE1vwxFVf2FG1w==}
     engines: {node: '>=16.17'}
 
+  p-limit@2.3.0:
+    resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
+    engines: {node: '>=6'}
+
   p-limit@3.1.0:
     resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
     engines: {node: '>=10'}
@@ -13652,6 +13690,10 @@ packages:
     resolution: {integrity: sha512-0trZaiG7Y7kN/Egy9a8j47t9osC0Tch4PaIWd9yGF6bvmlk7muExRvGNYb8sXBwEKMoNKsbNN9P8EefuQekE4Q==}
     engines: {node: '>=20'}
 
+  p-locate@4.1.0:
+    resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
+    engines: {node: '>=8'}
+
   p-locate@5.0.0:
     resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
     engines: {node: '>=10'}
@@ -13672,6 +13714,10 @@ packages:
     resolution: {integrity: sha512-MyIV3ZA/PmyBN/ud8vV9XzwTrNtR4jFrObymZYnZqMmW0zA8Z17vnT0rBgFE/TlohB+YCHqXMgZzb3Csp49vqg==}
     engines: {node: '>=14.16'}
 
+  p-try@2.2.0:
+    resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
+    engines: {node: '>=6'}
+
   pac-proxy-agent@7.2.0:
     resolution: {integrity: sha512-TEB8ESquiLMc0lV8vcd5Ql/JAKAoyzHFXaStwjkzpOpC5Yv+pIzLfHvjTSdf3vpa2bMiUQrg9i6276yn8666aA==}
     engines: {node: '>= 14'}
@@ -13877,6 +13923,10 @@ packages:
     engines: {node: '>=20'}
     hasBin: true
 
+  pngjs@5.0.0:
+    resolution: {integrity: sha512-40QW5YalBNfQo5yRYmiw7Yz6TKKVr3h6970B2YE+3fQpsWcrbj1PzJgxeJ19DRQjhMbKPIuMY8rFaXc8moolVw==}
+    engines: {node: '>=10.13.0'}
+
   possible-typed-array-names@1.1.0:
     resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
@@ -14253,6 +14303,11 @@ packages:
   pure-rand@8.4.2:
     resolution: {integrity: sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==}
 
+  qrcode@1.5.4:
+    resolution: {integrity: sha512-1ca71Zgiu6ORjHqFBDpnSMTR2ReToX4l1Au1VFLyVeBTFavzQnv5JxMFr3ukHVKpSrSA2MCk0lNJSykjUfz7Zg==}
+    engines: {node: '>=10.13.0'}
+    hasBin: true
+
   qs@6.15.3:
     resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
     engines: {node: '>=0.6'}
@@ -14478,6 +14533,9 @@ packages:
     resolution: {integrity: sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==}
     engines: {node: '>=9.3.0 || >=8.10.0 <9.0.0'}
 
+  require-main-filename@2.0.0:
+    resolution: {integrity: sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==}
+
   resend@6.18.0:
     resolution: {integrity: sha512-EjxZ9AVzywJgOlUoIJe9ytBWVrfbUtJbjeoLnRSvpU1sv97Hh9DSwhw+k8kiujrG4Rg4bzTBsjlmwWWuoOxSug==}
     engines: {node: '>=20'}
@@ -14774,6 +14832,9 @@ packages:
     resolution: {integrity: sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
     engines: {node: '>= 18'}
 
+  set-blocking@2.0.0:
+    resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
+
   set-cookie-parser@3.1.2:
     resolution: {integrity: sha512-5/r/lTwbJ3zQ+qwdUFZYeRNqda7P5HD8zQKqlSjdGt1/S0cjLAphHusj4Y58ahDtWn/g32xrIS58/ikOvwl0Lw==}
 
@@ -16526,6 +16587,9 @@ packages:
     resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
     engines: {node: '>= 0.4'}
 
+  which-module@2.0.1:
+    resolution: {integrity: sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==}
+
   which-typed-array@1.1.22:
     resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
     engines: {node: '>= 0.4'}
@@ -16622,6 +16686,10 @@ packages:
     resolution: {integrity: sha512-SGcvg80f0wUy2/fXES19feHMz8E0JoXv2uNgHOu4Dgi2OrCy1lqwFYEJz1BLbDI0exjPMe/ZdzZ/YpGECBG/aQ==}
     engines: {node: '>=20'}
 
+  wrap-ansi@6.2.0:
+    resolution: {integrity: sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
+    engines: {node: '>=8'}
+
   wrap-ansi@7.0.0:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
     engines: {node: '>=10'}
@@ -16687,6 +16755,9 @@ packages:
     peerDependencies:
       yjs: ^13.0.0
 
+  y18n@4.0.3:
+    resolution: {integrity: sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
+
   y18n@5.0.8:
     resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
     engines: {node: '>=10'}
@@ -16707,6 +16778,10 @@ packages:
     engines: {node: '>= 14.6'}
     hasBin: true
 
+  yargs-parser@18.1.3:
+    resolution: {integrity: sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==}
+    engines: {node: '>=6'}
+
   yargs-parser@20.2.9:
     resolution: {integrity: sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==}
     engines: {node: '>=10'}
@@ -16715,6 +16790,10 @@ packages:
     resolution: {integrity: sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=23}
 
+  yargs@15.4.1:
+    resolution: {integrity: sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==}
+    engines: {node: '>=8'}
+
   yargs@16.2.2:
     resolution: {integrity: sha512-Nt9ZJjXTv5R8MHbqby/wXQ6Gi0Bb3TcYZkR1bzuL4yB2OxWPkXknz513gEF0GoA6tn00UpbPvERW8rzCuWCA6w==}
     engines: {node: '>=10'}
@@ -18145,7 +18224,7 @@ snapshots:
       '@better-auth/core': 1.6.26(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.1)
       '@better-auth/utils': 0.4.2
     optionalDependencies:
-      drizzle-orm: 0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2)
+      drizzle-orm: 0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1)(sql.js@1.14.2)
 
   '@better-auth/drizzle-adapter@1.7.0-rc.5(@better-auth/core@1.7.0-rc.5(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2))':
     dependencies:
@@ -23027,6 +23106,10 @@ snapshots:
       pg-types: 2.2.0
     optional: true
 
+  '@types/qrcode@1.5.6':
+    dependencies:
+      '@types/node': 26.2.0
+
   '@types/react@19.2.18':
     dependencies:
       csstype: 3.2.3
@@ -23050,8 +23133,6 @@ snapshots:
 
   '@types/unist@3.0.3': {}
 
-  '@types/web-bluetooth@0.0.20': {}
-
   '@types/web-bluetooth@0.0.21': {}
 
   '@types/webidl-conversions@7.0.3': {}
@@ -25030,7 +25111,7 @@ snapshots:
     optionalDependencies:
       '@prisma/client': 5.22.0(prisma@7.9.1)
       drizzle-kit: 0.31.10
-      drizzle-orm: 0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1(better-sqlite3@12.11.1))(sql.js@1.14.2)
+      drizzle-orm: 0.45.2(@electric-sql/pglite@0.4.3)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.1)(@prisma/client@5.22.0(prisma@7.9.1(better-sqlite3@12.11.1)))(@types/pg@8.23.0)(better-sqlite3@12.11.1)(kysely@0.29.5)(mysql2@3.15.3)(pg@8.23.0)(postgres@3.4.9)(prisma@7.9.1)(sql.js@1.14.2)
       mongodb: 7.5.0(@mongodb-js/zstd@7.0.0)(socks@2.8.9)
       mysql2: 3.15.3
       pg: 8.23.0
@@ -25298,6 +25379,8 @@ snapshots:
 
   callsites@3.1.0: {}
 
+  camelcase@5.3.1: {}
+
   camelcase@8.0.0: {}
 
   caniuse-api@4.0.0:
@@ -25457,6 +25540,12 @@ snapshots:
     optionalDependencies:
       '@colors/colors': 1.5.0
 
+  cliui@6.0.0:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 6.2.0
+
   cliui@7.0.4:
     dependencies:
       string-width: 4.2.3
@@ -25839,6 +25928,8 @@ snapshots:
     dependencies:
       callsite: 1.0.0
 
+  decamelize@1.2.0: {}
+
   decode-bmp@0.2.1:
     dependencies:
       '@canvas/image-data': 1.1.0
@@ -25961,6 +26052,8 @@ snapshots:
 
   diff@9.0.0: {}
 
+  dijkstrajs@1.0.3: {}
+
   docus@5.12.3(better-sqlite3@12.11.1)(nuxt@4.5.2(@types/node@24.13.3)(rolldown@1.2.4)):
     dependencies:
       '@ai-sdk/gateway': 3.0.151(zod@4.4.3)
@@ -26955,6 +27048,11 @@ snapshots:
       fast-querystring: 1.1.2
       safe-regex2: 5.1.1
 
+  find-up@4.1.0:
+    dependencies:
+      locate-path: 5.0.0
+      path-exists: 4.0.0
+
   find-up@5.0.0:
     dependencies:
       locate-path: 6.0.0
@@ -28492,6 +28590,10 @@ snapshots:
       pkg-types: 2.3.1
       quansync: 0.2.11
 
+  locate-path@5.0.0:
+    dependencies:
+      p-locate: 4.1.0
+
   locate-path@6.0.0:
     dependencies:
       p-locate: 5.0.0
@@ -30211,6 +30313,10 @@ snapshots:
     dependencies:
       p-timeout: 6.1.4
 
+  p-limit@2.3.0:
+    dependencies:
+      p-try: 2.2.0
+
   p-limit@3.1.0:
     dependencies:
       yocto-queue: 0.1.0
@@ -30223,6 +30329,10 @@ snapshots:
     dependencies:
       yocto-queue: 1.2.2
 
+  p-locate@4.1.0:
+    dependencies:
+      p-limit: 2.3.0
+
   p-locate@5.0.0:
     dependencies:
       p-limit: 3.1.0
@@ -30240,6 +30350,8 @@ snapshots:
 
   p-timeout@6.1.4: {}
 
+  p-try@2.2.0: {}
+
   pac-proxy-agent@7.2.0(supports-color@8.1.1):
     dependencies:
       '@tootallnate/quickjs-emscripten': 0.23.0
@@ -30436,6 +30548,8 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.2
 
+  pngjs@5.0.0: {}
+
   possible-typed-array-names@1.1.0: {}
 
   postal-mime@2.7.5: {}
@@ -30844,6 +30958,12 @@ snapshots:
 
   pure-rand@8.4.2: {}
 
+  qrcode@1.5.4:
+    dependencies:
+      dijkstrajs: 1.0.3
+      pngjs: 5.0.0
+      yargs: 15.4.1
+
   qs@6.15.3:
     dependencies:
       es-define-property: 1.0.1
@@ -31176,6 +31296,8 @@ snapshots:
       debug: 4.4.3(supports-color@8.1.1)
       module-details-from-path: 1.0.4
 
+  require-main-filename@2.0.0: {}
+
   resend@6.18.0:
     dependencies:
       postal-mime: 2.7.5
@@ -31466,6 +31588,8 @@ snapshots:
       parseurl: 1.3.3
       send: 1.2.1(supports-color@8.1.1)
 
+  set-blocking@2.0.0: {}
+
   set-cookie-parser@3.1.2: {}
 
   set-function-length@1.2.2:
@@ -33451,6 +33575,8 @@ snapshots:
       is-weakmap: 2.0.2
       is-weakset: 2.0.4
 
+  which-module@2.0.1: {}
+
   which-typed-array@1.1.22:
     dependencies:
       available-typed-arrays: 1.0.7
@@ -33624,6 +33750,12 @@ snapshots:
       string-width: 8.2.2
       strip-ansi: 7.2.0
 
+  wrap-ansi@6.2.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
   wrap-ansi@7.0.0:
     dependencies:
       ansi-styles: 4.3.0
@@ -33679,6 +33811,8 @@ snapshots:
       lib0: 0.2.117
       yjs: 13.6.32
 
+  y18n@4.0.3: {}
+
   y18n@5.0.8: {}
 
   yallist@3.1.1: {}
@@ -33692,10 +33826,29 @@ snapshots:
 
   yaml@2.9.0: {}
 
+  yargs-parser@18.1.3:
+    dependencies:
+      camelcase: 5.3.1
+      decamelize: 1.2.0
+
   yargs-parser@20.2.9: {}
 
   yargs-parser@22.0.0: {}
 
+  yargs@15.4.1:
+    dependencies:
+      cliui: 6.0.0
+      decamelize: 1.2.0
+      find-up: 4.1.0
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      require-main-filename: 2.0.0
+      set-blocking: 2.0.0
+      string-width: 4.2.3
+      which-module: 2.0.1
+      y18n: 4.0.3
+      yargs-parser: 18.1.3
+
   yargs@16.2.2:
     dependencies:
       cliui: 7.0.4