Orchestration + presentation for adding a second auth factor (authenticator/security-key/SMS/email/recovery-codes/custom). The app supplies all operations + state; the component never implements crypto, shows real secrets, stores codes, or claims the account is secure because setup finished. Recovery codes are treated as sensitive; an alternative method is always offered.
pnpm dlx shadcn@latest add "https://motiq.dev/r/two-factor-setup-flow.json"