@cfxlabsinc/b2b-services
    Preparing search index...
    TwoFactorStatus:
        | { state: "off" }
        | { qrPngBase64: string; secret: string; state: "off-enrolling" }
        | { state: "on" }
        | { backupCodes: string[]; state: "on-just-enrolled" }
        | { state: "on-codes-unavailable" }
        | { backupCodes: string[]; state: "on-codes" }

    Off and on each have a resting shape that has fetched nothing. A TOTP secret and the backup codes exist only once the user asks for them, so neither can be read out of a state that never fetched it.