The enable-2FA flow around its one irreversible step — QR plus a copyable manual key, a six-digit check whose attempt budget only ever goes down, and recovery codes rendered once behind a finish button that refuses to fire until they are saved.
npx shadcn@latest add @zyeon/two-factor-setupZyeon UI limits how often it can be asked, and Two-Factor Setup hasn't had its turn. Its source will show here once it has.