@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/HttpApi/Api.js

@@ -0,0 +1,3026 @@
+import { Context, Effect, Encoding, Layer, Option, Redacted, Result } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { HttpApi, HttpApiBuilder, HttpApiGroup } from "effect/unstable/httpapi";
+import { ApiKeyId } from "../ApiKey.js";
+import { Jwks } from "../Jwt.js";
+import { AuthFlow, AuthFlowState, AuthResult, LoginApprovalFinalize, } from "../AuthFlow.js";
+import { EmailOtpLogin } from "../EmailOtp.js";
+import { EmailDeliveryError, EmailVerification, EmailVerificationFlow, EmailVerificationIssueError, } from "../EmailVerification.js";
+import { OAuthClientId as makeOAuthClientId } from "../Identifiers.js";
+import { currentUnixMillis } from "../Internal.js";
+import { LoginApproval, LoginApprovalReview } from "../LoginApproval.js";
+import { LoginNotification } from "../LoginNotification.js";
+import { MagicLinkLogin } from "../MagicLink.js";
+import { OAuthAuthorizationCode, OAuthAuthorizationCodeTokenGrant, OAuthClientCredentialsGrant, OAuthProviderAuthorization, OAuthRefreshToken, OAuthRefreshTokenGrant, OAuthTokenIntrospection, OAuthTokenRevocation, OAuthCodeVerifier as makeOAuthCodeVerifier, } from "../OAuth.js";
+import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset, } from "../Password.js";
+import { PasskeyCredentialId } from "../Passkey.js";
+import { CurrentSession, SessionCookie, Sessions, sessionRequestMetadataKey, upgradeCurrentSession, } from "../Sessions.js";
+import { SecurityTimelineStore } from "../SecurityTimeline.js";
+import { UserStore } from "../Storage.js";
+import { TrustedDevice, TrustedDeviceCookie, TrustedDeviceStore, } from "../TrustedDevice.js";
+import { adminSecurityTimelineListEndpoint, adminSessionListEndpoint, adminSessionRevokeAllEndpoint, adminSessionRevokeEndpoint, adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint, apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint, currentSessionEndpoint, emailOtpStartEndpoint, emailOtpVerifyEndpoint, emailVerificationStartEndpoint, emailVerificationVerifyEndpoint, loginApprovalApproveEndpoint, loginApprovalFinalizeEndpoint, loginApprovalStatusEndpoint, loginNotificationReportEndpoint, jwtIntrospectEndpoint, jwtJwksEndpoint, jwtRevokeEndpoint, listSessionsEndpoint, logoutEndpoint, magicLinkStartEndpoint, magicLinkVerifyEndpoint, mfaOptionsEndpoint, oauthAccountUnlinkEndpoint, oauthAuthorizationStartEndpoint, oauthLinkConfirmationConfirmEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationStartEndpoint, oauthProviderAuthorizeEndpoint, oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint, oidcDiscoveryMetadataEndpoint, passwordChangeEndpoint, passwordResetStartEndpoint, passwordResetVerifyEndpoint, passwordSetEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, refreshTokenRefreshEndpoint, refreshSessionEndpoint, revokeOtherSessionsEndpoint, revokeSessionEndpoint, securityTimelineListEndpoint, stepUpOptionsEndpoint, stepUpPasskeyStartEndpoint, stepUpPasskeyVerifyEndpoint, stepUpRecoveryCodeVerifyEndpoint, stepUpTotpVerifyEndpoint, trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, } from "./Endpoints.js";
+import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError, } from "./Errors.js";
+import { OAuthProviderAuthorizationQuery, OAuthTokenRequestBody, OAuthTokenIntrospectionRequestBody, OAuthTokenIntrospectionResponseBody, OAuthTokenRevocationRequestBody, } from "./Schemas.js";
+import { AuthApiRateLimit, AuthApiRateLimitLive, AuthApiRateLimitNoopLive, AuthHttpApiConfig, AuthOriginCheckMiddleware, AuthOriginCheckMiddlewareConfigLive, AuthRateLimitMiddleware, makeAuthRequestMetadata, } from "./Security.js";
+import { AuthHttp, LoginApprovalPendingCookie, makeLoginApprovalPendingCookie, } from "./Transport.js";
+const canStartRequiredEmailVerification = (result) => result._tag === "RequiresEmailVerification" &&
+    result.userId !== undefined &&
+    result.email !== undefined;
+const noopAuthApiRateLimit = AuthApiRateLimit.make({
+    request: () => Effect.void,
+    passwordSignIn: () => Effect.void,
+    passwordSignUp: () => Effect.void,
+    passwordResetStart: () => Effect.void,
+    emailOtpStart: () => Effect.void,
+    magicLinkStart: () => Effect.void,
+    emailVerificationStart: () => Effect.void,
+});
+export const passwordSignInInput = (payload, trustedDeviceToken, request) => ({
+    ...payload,
+    password: Redacted.make(payload.password),
+    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+    ...(request === undefined ? {} : { request }),
+});
+export const passwordSignUpInput = (payload, request) => ({
+    ...payload,
+    password: Redacted.make(payload.password),
+    ...(request === undefined ? {} : { request }),
+});
+export const passwordResetStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const passwordResetVerifyInput = (payload) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    password: Redacted.make(payload.password),
+});
+export const passwordSetInput = (userId, payload) => ({
+    userId,
+    password: Redacted.make(payload.password),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passwordChangeInput = (userId, payload) => ({
+    userId,
+    currentPassword: Redacted.make(payload.currentPassword),
+    newPassword: Redacted.make(payload.newPassword),
+});
+export const emailVerificationStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const emailVerificationVerifyInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const emailOtpStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const emailOtpVerifyInput = (payload, trustedDeviceToken, request) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+    ...(request === undefined ? {} : { request }),
+});
+export const magicLinkStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const magicLinkVerifyInput = (payload, trustedDeviceToken, request) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+    ...(request === undefined ? {} : { request }),
+});
+export const oauthAuthorizationStartInput = (payload, provider, options = {}) => ({
+    provider,
+    ...(options.ttl === undefined ? {} : { ttl: options.ttl }),
+    ...(payload.redirectUri === undefined ? {} : { redirectUri: payload.redirectUri }),
+    ...(payload.scopes === undefined ? {} : { scopes: payload.scopes }),
+    ...(payload.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: payload.authorizationParams }),
+    ...(payload.codeVerifier === undefined
+        ? {}
+        : { codeVerifier: Redacted.make(payload.codeVerifier) }),
+    ...(payload.includeNonce === undefined
+        ? {}
+        : { includeNonce: payload.includeNonce }),
+    ...(payload.nonce === undefined ? {} : { nonce: payload.nonce }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const oauthAuthorizationStartedHttpBody = (started) => ({
+    providerId: started.providerId,
+    authorizationUrl: started.authorizationUrl,
+    state: started.state,
+    challengeId: started.challengeId,
+    expiresAt: started.expiresAt,
+    codeChallenge: started.codeChallenge,
+    codeChallengeMethod: started.codeChallengeMethod,
+    ...(started.nonce === undefined ? {} : { nonce: started.nonce }),
+    redirectUri: started.redirectUri,
+    scopes: started.scopes,
+});
+const oauthVerifiedIdentityInput = (identity) => ({
+    providerId: identity.providerId,
+    providerAccountId: identity.providerAccountId,
+    ...(identity.email === undefined ? {} : { email: identity.email }),
+    ...(identity.emailVerified === undefined
+        ? {}
+        : { emailVerified: identity.emailVerified }),
+    ...(identity.metadata === undefined ? {} : { metadata: identity.metadata }),
+});
+export const oauthLinkConfirmationStartInput = (payload, options = {}) => Effect.gen(function* () {
+    if (payload.userId === undefined) {
+        return yield* oauthBadRequest("OAuth link confirmation is missing userId");
+    }
+    if (payload.identity === undefined) {
+        return yield* oauthBadRequest("OAuth link confirmation is missing identity");
+    }
+    return {
+        userId: payload.userId,
+        identity: oauthVerifiedIdentityInput(payload.identity),
+        ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+        ...(options.ttl === undefined ? {} : { ttl: options.ttl }),
+        ...(payload.secret === undefined
+            ? {}
+            : { secret: Redacted.make(payload.secret) }),
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    };
+});
+export const oauthLinkConfirmationInspectInput = (payload) => ({
+    challengeId: payload.challengeId,
+    ...(payload.secret === undefined ? {} : { secret: Redacted.make(payload.secret) }),
+});
+export const oauthLinkConfirmationConfirmInput = (payload, currentUserId) => ({
+    challengeId: payload.challengeId,
+    ...(payload.secret === undefined ? {} : { secret: Redacted.make(payload.secret) }),
+    ...(currentUserId === undefined ? {} : { currentUserId }),
+    ...(payload.expectedProviderId === undefined
+        ? {}
+        : { expectedProviderId: payload.expectedProviderId }),
+    ...(payload.expectedProviderAccountId === undefined
+        ? {}
+        : { expectedProviderAccountId: payload.expectedProviderAccountId }),
+});
+const oauthPublicVerifiedIdentityHttpBody = (identity) => ({
+    providerId: identity.providerId,
+    providerAccountId: identity.providerAccountId,
+    ...(identity.email === undefined ? {} : { email: identity.email }),
+    ...(identity.emailVerified === undefined
+        ? {}
+        : { emailVerified: identity.emailVerified }),
+});
+export const oauthLinkConfirmationStartedHttpBody = (started) => ({
+    challengeId: started.challengeId,
+    userId: started.userId,
+    identity: oauthPublicVerifiedIdentityHttpBody(started.identity),
+    reason: started.reason,
+    expiresAt: started.expiresAt,
+});
+export const oauthLinkConfirmationPendingHttpBody = (pending) => ({
+    challengeId: pending.challengeId,
+    userId: pending.userId,
+    identity: oauthPublicVerifiedIdentityHttpBody(pending.identity),
+    reason: pending.reason,
+    expiresAt: pending.expiresAt,
+});
+const oauthAuthorizationCallbackField = (fields, name) => {
+    const maybeSearchParams = fields;
+    const value = typeof maybeSearchParams.get === "function"
+        ? maybeSearchParams.get(name)
+        : fields[name];
+    const stringValue = Array.isArray(value) ? value[0] : value;
+    return typeof stringValue === "string" && stringValue.trim() !== ""
+        ? stringValue
+        : undefined;
+};
+const oauthAuthorizationCallbackPayload = (input, options) => Effect.gen(function* () {
+    const state = oauthAuthorizationCallbackField(input.fields, "state");
+    const code = oauthAuthorizationCallbackField(input.fields, "code");
+    const error = oauthAuthorizationCallbackField(input.fields, "error");
+    const errorDescription = oauthAuthorizationCallbackField(input.fields, "error_description");
+    const errorUri = oauthAuthorizationCallbackField(input.fields, "error_uri");
+    if (state === undefined) {
+        return yield* oauthBadRequest("OAuth callback is missing state");
+    }
+    const authorizationUser = options.includeAuthorizationUser
+        ? oauthAuthorizationCallbackField(input.fields, "user")
+        : undefined;
+    return {
+        providerId: input.providerId,
+        state,
+        ...(code === undefined ? {} : { code }),
+        ...(error === undefined ? {} : { error }),
+        ...(errorDescription === undefined ? {} : { errorDescription }),
+        ...(errorUri === undefined ? {} : { errorUri }),
+        ...(authorizationUser === undefined ? {} : { authorizationUser }),
+    };
+});
+export const oauthAuthorizationCallbackQueryPayload = (input) => oauthAuthorizationCallbackPayload(input, { includeAuthorizationUser: false });
+export const oauthAuthorizationCallbackFormPostPayload = (input) => oauthAuthorizationCallbackPayload(input, { includeAuthorizationUser: true });
+export const oauthAuthorizationCallbackInput = (payload, options) => Effect.gen(function* () {
+    if (payload.providerId !== options.provider.id) {
+        return yield* oauthBadRequest("OAuth callback provider mismatch");
+    }
+    if (payload.error !== undefined) {
+        return yield* oauthBadRequest("OAuth provider returned an error");
+    }
+    if (payload.code === undefined || payload.code.trim() === "") {
+        return yield* oauthBadRequest("OAuth callback is missing code");
+    }
+    return {
+        provider: options.provider,
+        state: payload.state,
+        code: payload.code,
+        codeVerifier: options.codeVerifier,
+        ...(options.redirectUri === undefined
+            ? {}
+            : { redirectUri: options.redirectUri }),
+        ...(options.clientAuthentication === undefined
+            ? {}
+            : { clientAuthentication: options.clientAuthentication }),
+        ...(options.tokenParams === undefined
+            ? {}
+            : { tokenParams: options.tokenParams }),
+    };
+});
+const oauthTokenTextDecoder = new TextDecoder();
+const oauthTokenEndpointError = (reason, errorDescription) => new OAuthTokenEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthTokenRevocationEndpointError = (reason, errorDescription) => new OAuthTokenRevocationEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthTokenIntrospectionEndpointError = (reason, errorDescription) => new OAuthTokenIntrospectionEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthAuthorizationEndpointError = (reason, errorDescription) => new OAuthAuthorizationEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthAuthorizationRedirect = (redirectUri, params) => {
+    const url = new URL(redirectUri);
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined) {
+            url.searchParams.set(key, value);
+        }
+    }
+    return HttpServerResponse.empty({
+        status: 302,
+        headers: { location: url.toString() },
+    });
+};
+const oauthTokenGrantString = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+const formUrlDecodeComponent = (value) => {
+    try {
+        return new URLSearchParams(`value=${value}`).get("value") ?? value;
+    }
+    catch {
+        return value;
+    }
+};
+const decodeOAuthBasicAuthentication = (request, invalidClient) => {
+    const { authorization } = request.headers;
+    if (authorization === undefined || authorization.trim() === "") {
+        return Effect.succeed(Option.none());
+    }
+    if (!authorization.toLowerCase().startsWith("basic ")) {
+        return Effect.fail(invalidClient());
+    }
+    const encoded = authorization.slice("Basic ".length).trim();
+    if (encoded === "") {
+        return Effect.fail(invalidClient());
+    }
+    return Result.match(Encoding.decodeBase64(encoded), {
+        onFailure: () => Effect.fail(invalidClient()),
+        onSuccess: (bytes) => {
+            const decoded = oauthTokenTextDecoder.decode(bytes);
+            const separator = decoded.indexOf(":");
+            if (separator <= 0) {
+                return Effect.fail(invalidClient());
+            }
+            const clientId = oauthTokenGrantString(formUrlDecodeComponent(decoded.slice(0, separator)));
+            const clientSecret = formUrlDecodeComponent(decoded.slice(separator + 1));
+            if (clientId === undefined || clientSecret === "") {
+                return Effect.fail(invalidClient());
+            }
+            return Effect.succeed(Option.some({
+                clientId: makeOAuthClientId(clientId),
+                method: "client_secret_basic",
+                clientSecret: Redacted.make(clientSecret),
+            }));
+        },
+    });
+};
+const oauthTokenRequestBody = (request) => HttpServerRequest.schemaBodyUrlParams(OAuthTokenRequestBody).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.mapError(() => oauthTokenEndpointError("invalid_request")));
+const oauthTokenRevocationRequestBody = (request) => HttpServerRequest.schemaBodyUrlParams(OAuthTokenRevocationRequestBody).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.mapError(() => oauthTokenRevocationEndpointError("invalid_request")));
+const oauthTokenIntrospectionRequestBody = (request) => HttpServerRequest.schemaBodyUrlParams(OAuthTokenIntrospectionRequestBody).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.mapError(() => oauthTokenIntrospectionEndpointError("invalid_request")));
+const oauthPostClientAuthentication = (payload) => {
+    const clientSecret = oauthTokenGrantString(payload.client_secret);
+    const clientId = oauthTokenGrantString(payload.client_id);
+    if (clientSecret === undefined) {
+        return undefined;
+    }
+    return clientId === undefined
+        ? undefined
+        : {
+            clientId: makeOAuthClientId(clientId),
+            method: "client_secret_post",
+            clientSecret: Redacted.make(clientSecret),
+        };
+};
+const oauthClientEndpointAuthentication = (input) => Effect.gen(function* () {
+    const basicAuth = yield* decodeOAuthBasicAuthentication(input.request, input.invalidClient);
+    const postAuth = oauthPostClientAuthentication(input.payload);
+    if (Option.isSome(basicAuth) && input.payload.client_secret !== undefined) {
+        return yield* Effect.fail(input.invalidRequest());
+    }
+    if (input.payload.client_secret !== undefined && postAuth === undefined) {
+        return yield* Effect.fail(input.invalidRequest());
+    }
+    const authentication = Option.isSome(basicAuth) ? basicAuth.value : postAuth;
+    const payloadClientId = oauthTokenGrantString(input.payload.client_id);
+    if (authentication !== undefined &&
+        payloadClientId !== undefined &&
+        authentication.clientId !== payloadClientId) {
+        return yield* Effect.fail(input.invalidRequest());
+    }
+    const clientAuthenticated = authentication === undefined
+        ? false
+        : yield* Effect.gen(function* () {
+            if (input.authenticateClient === undefined) {
+                return yield* Effect.fail(input.invalidClient());
+            }
+            const authenticated = yield* input
+                .authenticateClient({
+                clientId: authentication.clientId,
+                method: authentication.method,
+                clientSecret: authentication.clientSecret,
+                request: input.request,
+            })
+                .pipe(Effect.mapError(() => oauthInternalError("Failed to authenticate OAuth client")));
+            if (!authenticated) {
+                return yield* Effect.fail(input.invalidClient());
+            }
+            return true;
+        });
+    const clientId = authentication === undefined
+        ? payloadClientId === undefined
+            ? undefined
+            : makeOAuthClientId(payloadClientId)
+        : authentication.clientId;
+    return {
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    };
+});
+const oauthTokenResponseHttpBody = (tokens) => ({
+    access_token: Redacted.value(tokens.accessToken),
+    token_type: tokens.tokenType,
+    ...(tokens.expiresIn === undefined ? {} : { expires_in: tokens.expiresIn }),
+    ...(tokens.refreshToken === undefined
+        ? {}
+        : { refresh_token: Redacted.value(tokens.refreshToken) }),
+    ...(tokens.idToken === undefined
+        ? {}
+        : { id_token: Redacted.value(tokens.idToken) }),
+    ...(tokens.scopes === undefined ? {} : { scope: tokens.scopes.join(" ") }),
+    ...(tokens.extra === undefined ? {} : { extra: tokens.extra }),
+});
+const oauthUnixMillisToSeconds = (value) => Math.floor(Number(value) / 1000);
+const oauthTokenIntrospectionResponseHttpBody = (introspection) => {
+    if (!introspection.active) {
+        return { active: false };
+    }
+    return {
+        active: true,
+        ...(introspection.scopes === undefined
+            ? {}
+            : { scope: introspection.scopes.join(" ") }),
+        ...(introspection.clientId === undefined
+            ? {}
+            : { client_id: String(introspection.clientId) }),
+        ...(introspection.username === undefined
+            ? {}
+            : { username: introspection.username }),
+        ...(introspection.tokenType === undefined
+            ? {}
+            : { token_type: introspection.tokenType }),
+        ...(introspection.expiresAt === undefined
+            ? {}
+            : { exp: oauthUnixMillisToSeconds(introspection.expiresAt) }),
+        ...(introspection.issuedAt === undefined
+            ? {}
+            : { iat: oauthUnixMillisToSeconds(introspection.issuedAt) }),
+        ...(introspection.notBefore === undefined
+            ? {}
+            : { nbf: oauthUnixMillisToSeconds(introspection.notBefore) }),
+        ...(introspection.subject === undefined ? {} : { sub: introspection.subject }),
+        ...(introspection.audience === undefined
+            ? {}
+            : {
+                aud: Array.isArray(introspection.audience)
+                    ? [...introspection.audience]
+                    : introspection.audience,
+            }),
+        ...(introspection.issuer === undefined ? {} : { iss: introspection.issuer }),
+        ...(introspection.jwtId === undefined ? {} : { jti: introspection.jwtId }),
+        ...(introspection.extra === undefined ? {} : { extra: introspection.extra }),
+    };
+};
+const oauthRefreshTokenResponse = (input) => Effect.gen(function* () {
+    if (input.dependencies.refreshTokenGrant === undefined) {
+        return yield* oauthTokenEndpointError("unsupported_grant_type");
+    }
+    const refreshToken = oauthTokenGrantString(input.payload.refresh_token);
+    const scope = oauthTokenGrantString(input.payload.scope);
+    const result = yield* input.dependencies.refreshTokenGrant
+        .exchange({
+        grantType: input.payload.grant_type,
+        ...(refreshToken === undefined
+            ? {}
+            : { refreshToken: Redacted.make(OAuthRefreshToken(refreshToken)) }),
+        ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+        ...(scope === undefined ? {} : { scopes: scope }),
+        clientAuthenticated: input.clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenEndpointError(result.reason);
+    }
+    return oauthTokenResponseHttpBody(result.tokens);
+});
+const oauthClientCredentialsTokenResponse = (input) => Effect.gen(function* () {
+    if (input.dependencies.clientCredentialsGrant === undefined) {
+        return yield* oauthTokenEndpointError("unsupported_grant_type");
+    }
+    const scope = oauthTokenGrantString(input.payload.scope);
+    const result = yield* input.dependencies.clientCredentialsGrant
+        .exchange({
+        grantType: input.payload.grant_type,
+        ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+        ...(scope === undefined ? {} : { scopes: scope }),
+        clientAuthenticated: input.clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenEndpointError(result.reason);
+    }
+    return oauthTokenResponseHttpBody(result.tokens);
+});
+const oauthAuthorizationCodeTokenResponse = (input) => Effect.gen(function* () {
+    const code = oauthTokenGrantString(input.payload.code);
+    const codeVerifier = oauthTokenGrantString(input.payload.code_verifier);
+    const redirectUri = oauthTokenGrantString(input.payload.redirect_uri);
+    const result = yield* input.dependencies.tokenGrant
+        .exchange({
+        grantType: input.payload.grant_type,
+        ...(code === undefined
+            ? {}
+            : { code: Redacted.make(OAuthAuthorizationCode(code)) }),
+        ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+        ...(redirectUri === undefined ? {} : { redirectUri }),
+        ...(codeVerifier === undefined
+            ? {}
+            : { codeVerifier: Redacted.make(makeOAuthCodeVerifier(codeVerifier)) }),
+        clientAuthenticated: input.clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenEndpointError(result.reason);
+    }
+    return oauthTokenResponseHttpBody(result.tokens);
+});
+const oauthLinkedAccountHttpBody = (account) => ({
+    accountId: account.id,
+    providerId: account.providerId,
+    providerAccountId: account.providerAccountId,
+});
+export const oauthLinkConfirmationConfirmedHttpBody = (confirmed, options = {}) => ({
+    challengeId: confirmed.challengeId,
+    userId: confirmed.userId,
+    identity: oauthPublicVerifiedIdentityHttpBody(confirmed.identity),
+    reason: confirmed.reason,
+    ...(confirmed.existingAccount === undefined
+        ? {}
+        : { existingAccount: oauthLinkedAccountHttpBody(confirmed.existingAccount) }),
+    linked: options.linked === true || confirmed.existingAccount !== undefined,
+});
+export const oauthAccountUnlinkResolutionHttpBody = (resolution, options = {}) => {
+    switch (resolution.type) {
+        case "allow": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                account: oauthLinkedAccountHttpBody(resolution.account),
+                remainingAccounts: resolution.remainingAccounts.map(oauthLinkedAccountHttpBody),
+                unlinked: options.unlinked === true,
+            };
+        }
+        case "requires-step-up": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                account: oauthLinkedAccountHttpBody(resolution.account),
+                remainingAccounts: resolution.remainingAccounts.map(oauthLinkedAccountHttpBody),
+            };
+        }
+        case "deny-last-account": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                account: oauthLinkedAccountHttpBody(resolution.account),
+            };
+        }
+        case "deny-not-owner": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                providerId: resolution.account.providerId,
+                providerAccountId: resolution.account.providerAccountId,
+            };
+        }
+        case "deny-not-found": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                providerId: resolution.providerId,
+                providerAccountId: resolution.providerAccountId,
+            };
+        }
+    }
+};
+export const passkeyRegistrationStartInput = (payload, options) => ({
+    relyingParty: options.relyingParty,
+    userId: payload.userId,
+    userName: payload.userName,
+    userDisplayName: payload.userDisplayName,
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    ...(options.pubKeyCredParams === undefined
+        ? {}
+        : { pubKeyCredParams: options.pubKeyCredParams }),
+    ...(options.authenticatorSelection === undefined
+        ? {}
+        : { authenticatorSelection: options.authenticatorSelection }),
+    ...(options.attestation === undefined ? {} : { attestation: options.attestation }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyAuthenticationStartInput = (payload, options) => ({
+    relyingPartyId: options.relyingPartyId,
+    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    ...(options.userVerification === undefined
+        ? {}
+        : { userVerification: options.userVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyMfaStartInput = (userId, payload, options) => ({
+    relyingPartyId: options.relyingPartyId,
+    userId,
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    userVerification: options.userVerification ?? "required",
+    metadata: {
+        ...payload.metadata,
+        flowId: payload.flowId,
+    },
+});
+export const passkeyRegistrationFinishInput = (payload, options) => ({
+    challengeId: payload.challengeId,
+    userId: payload.userId,
+    response: payload.credential,
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyAuthenticationFinishInput = (payload, options) => ({
+    challengeId: payload.challengeId,
+    response: payload.credential,
+    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyMfaVerifyInput = (payload, options) => ({
+    challengeId: payload.challengeId,
+    response: payload.credential,
+    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyCredentialRevokeInput = (userId, payload) => ({
+    userId,
+    credentialId: PasskeyCredentialId(payload.credentialId),
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const passkeyCredentialInfoHttpBody = (credential) => ({
+    credentialId: credential.credentialId,
+    ...(credential.transports === undefined
+        ? {}
+        : { transports: credential.transports }),
+    ...(credential.backedUp === undefined ? {} : { backedUp: credential.backedUp }),
+    createdAt: credential.createdAt,
+    ...(credential.lastUsedAt === undefined
+        ? {}
+        : { lastUsedAt: credential.lastUsedAt }),
+    ...(credential.revokedAt === undefined
+        ? {}
+        : { revokedAt: credential.revokedAt }),
+    ...(credential.metadata === undefined ? {} : { metadata: credential.metadata }),
+});
+export const totpEnrollmentStartInput = (userId, payload, options) => ({
+    userId,
+    issuer: options.issuer,
+    accountName: payload.accountName,
+    ...(options.secretBytes === undefined ? {} : { secretBytes: options.secretBytes }),
+    ...(options.algorithm === undefined ? {} : { algorithm: options.algorithm }),
+    ...(options.digits === undefined ? {} : { digits: options.digits }),
+    ...(options.period === undefined ? {} : { period: options.period }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpEnrollmentConfirmInput = (userId, payload, options = {}) => ({
+    userId,
+    factorId: payload.factorId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpVerifyInput = (userId, payload, options = {}) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpFactorRevokeInput = (userId, payload) => ({
+    userId,
+    factorId: payload.factorId,
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const totpFactorInfoHttpBody = (factor) => ({
+    factorId: factor.id,
+    algorithm: factor.algorithm,
+    digits: factor.digits,
+    period: factor.period,
+    createdAt: factor.createdAt,
+    ...(factor.confirmedAt === undefined ? {} : { confirmedAt: factor.confirmedAt }),
+    ...(factor.lastUsedAt === undefined ? {} : { lastUsedAt: factor.lastUsedAt }),
+    ...(factor.revokedAt === undefined ? {} : { revokedAt: factor.revokedAt }),
+    ...(factor.metadata === undefined ? {} : { metadata: factor.metadata }),
+});
+const totpEnrollmentStartedHttpBody = (started) => ({
+    factor: totpFactorInfoHttpBody(started.factor),
+    secret: Redacted.value(started.secret),
+    uri: Redacted.value(started.uri),
+});
+const totpVerifyResultHttpBody = (result) => ({
+    valid: result.valid,
+    ...(result.factor === undefined
+        ? {}
+        : { factor: totpFactorInfoHttpBody(result.factor) }),
+    ...(result.delta === undefined ? {} : { delta: result.delta }),
+});
+export const recoveryCodeGenerateInput = (userId, payload, options = {}) => ({
+    userId,
+    ...(options.count === undefined ? {} : { count: options.count }),
+    ...(options.length === undefined ? {} : { length: options.length }),
+    ...(options.groupSize === undefined ? {} : { groupSize: options.groupSize }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeVerifyInput = (userId, payload) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeRevokeInput = (userId, payload) => ({
+    userId,
+    codeId: payload.codeId,
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const recoveryCodeInfoHttpBody = (code) => ({
+    codeId: code.id,
+    createdAt: code.createdAt,
+    ...(code.usedAt === undefined ? {} : { usedAt: code.usedAt }),
+    ...(code.revokedAt === undefined ? {} : { revokedAt: code.revokedAt }),
+    ...(code.metadata === undefined ? {} : { metadata: code.metadata }),
+});
+const recoveryCodesGeneratedHttpBody = (generated) => ({
+    codes: generated.codes.map(Redacted.value),
+    records: generated.records.map(recoveryCodeInfoHttpBody),
+});
+const recoveryCodeVerifyResultHttpBody = (result) => ({
+    valid: result.valid,
+    ...(result.code === undefined
+        ? {}
+        : { code: recoveryCodeInfoHttpBody(result.code) }),
+});
+export const apiKeyCreateInput = (userId, payload) => ({
+    userId,
+    ...(payload.scopes === undefined ? {} : { scopes: payload.scopes }),
+    ...(payload.expiresAt === undefined ? {} : { expiresAt: payload.expiresAt }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const apiKeyRevokeInput = (userId, payload) => ({
+    userId,
+    keyId: ApiKeyId(payload.keyId),
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const apiKeyInfoHttpBody = (key) => ({
+    keyId: key.id,
+    prefix: key.prefix,
+    scopes: key.scopes,
+    createdAt: key.createdAt,
+    ...(key.expiresAt === undefined ? {} : { expiresAt: key.expiresAt }),
+    ...(key.lastUsedAt === undefined ? {} : { lastUsedAt: key.lastUsedAt }),
+    ...(key.revokedAt === undefined ? {} : { revokedAt: key.revokedAt }),
+    ...(key.metadata === undefined ? {} : { metadata: key.metadata }),
+});
+const apiKeyCreatedHttpBody = (created) => ({
+    secret: Redacted.value(created.secret),
+    key: apiKeyInfoHttpBody(created.key),
+});
+export const refreshTokenRefreshInput = (payload, now, expiresAt) => ({
+    token: Redacted.make(payload.refreshToken),
+    now,
+    expiresAt,
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+const refreshTokenInfoHttpBody = (refreshToken) => ({
+    tokenId: refreshToken.id,
+    familyId: refreshToken.familyId,
+    createdAt: refreshToken.createdAt,
+    expiresAt: refreshToken.expiresAt,
+    ...(refreshToken.lastUsedAt === undefined
+        ? {}
+        : { lastUsedAt: refreshToken.lastUsedAt }),
+    ...(refreshToken.rotatedAt === undefined
+        ? {}
+        : { rotatedAt: refreshToken.rotatedAt }),
+    ...(refreshToken.replacedById === undefined
+        ? {}
+        : { replacedById: refreshToken.replacedById }),
+    ...(refreshToken.revokedAt === undefined
+        ? {}
+        : { revokedAt: refreshToken.revokedAt }),
+    ...(refreshToken.reuseDetectedAt === undefined
+        ? {}
+        : { reuseDetectedAt: refreshToken.reuseDetectedAt }),
+    ...(refreshToken.metadata === undefined ? {} : { metadata: refreshToken.metadata }),
+});
+const issuedJwtExpiresAt = (issued) => typeof issued.claims.exp === "number"
+    ? (issued.claims.exp * 1000)
+    : undefined;
+const refreshTokenRefreshedHttpBody = (input) => ({
+    accessToken: Redacted.value(input.accessToken.token),
+    ...(issuedJwtExpiresAt(input.accessToken) === undefined
+        ? {}
+        : { accessTokenExpiresAt: issuedJwtExpiresAt(input.accessToken) }),
+    refreshToken: input.refreshToken,
+    refreshTokenRecord: refreshTokenInfoHttpBody(input.refreshTokenRecord),
+});
+export const jwtIntrospectInput = (payload, options = {}) => ({
+    token: Redacted.make(payload.token),
+    ...(options.issuer === undefined ? {} : { issuer: options.issuer }),
+    ...(options.audience === undefined ? {} : { audience: options.audience }),
+    ...(options.clockTolerance === undefined
+        ? {}
+        : { clockTolerance: options.clockTolerance }),
+});
+export const jwtRevokeInput = (payload) => ({
+    jwtId: payload.jwtId,
+    ...(payload.expiresAt === undefined ? {} : { expiresAt: payload.expiresAt }),
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const jwtKeyInfoHttpBody = (result) => ({
+    keyId: result.key.id,
+    alg: result.key.alg,
+    status: result.key.status,
+    ...(result.key.createdAt === undefined ? {} : { createdAt: result.key.createdAt }),
+    ...(result.key.expiresAt === undefined ? {} : { expiresAt: result.key.expiresAt }),
+    ...(result.key.metadata === undefined ? {} : { metadata: result.key.metadata }),
+});
+const jwtIntrospectionHttpBody = (result) => result.active
+    ? {
+        active: true,
+        header: result.header,
+        claims: result.claims,
+        key: jwtKeyInfoHttpBody(result),
+        ...(result.jwtId === undefined ? {} : { jwtId: result.jwtId }),
+        ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
+        revoked: false,
+    }
+    : {
+        active: false,
+        reason: result.reason,
+        ...(result.jwtId === undefined ? {} : { jwtId: result.jwtId }),
+        ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
+        ...(result.revokedAt === undefined ? {} : { revokedAt: result.revokedAt }),
+        ...(result.revokedReason === undefined
+            ? {}
+            : { revokedReason: result.revokedReason }),
+    };
+export const jwtJwksHttpBody = (document) => ({
+    keys: document.keys,
+});
+export const totpMfaVerifyInput = (payload, options = {}) => ({
+    userId: payload.userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpMfaVerifyForFlowInput = (userId, payload, options = {}) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeMfaVerifyInput = (payload) => ({
+    userId: payload.userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeMfaVerifyForFlowInput = (userId, payload) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const stepUpTotpVerifyInput = (userId, payload, options = {}) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const stepUpRecoveryCodeVerifyInput = (userId, payload) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const stepUpPasskeyStartInput = (userId, payload, options) => ({
+    relyingPartyId: options.relyingPartyId,
+    userId,
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    userVerification: options.userVerification ?? "required",
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const stepUpPasskeyVerifyInput = (userId, payload, options) => ({
+    challengeId: payload.challengeId,
+    response: payload.credential,
+    userId,
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const loginApprovalApproveInput = (payload) => ({
+    flowId: payload.flowId,
+    approval: {
+        challengeId: payload.approvalChallengeId,
+        ...(payload.secret === undefined
+            ? {}
+            : { secret: Redacted.make(payload.secret) }),
+    },
+    rememberDevice: payload.rememberDevice ?? false,
+});
+export const loginApprovalStatusInput = (payload) => ({
+    flowId: payload.flowId,
+    approvalChallengeId: payload.approvalChallengeId,
+});
+export const loginApprovalFinalizeInput = (payload) => ({
+    flowId: payload.flowId,
+    approvalChallengeId: payload.approvalChallengeId,
+    rememberDevice: payload.rememberDevice ?? false,
+});
+export const loginNotificationReportInput = (payload) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+});
+const webRequestFromHeaders = (headers) => new Request("http://localhost", { headers });
+const firstHeaderValue = (value) => {
+    const first = value?.split(",", 1)[0]?.trim();
+    return first === "" ? undefined : first;
+};
+const headerNumber = (value) => {
+    const parsed = Number(firstHeaderValue(value));
+    return Number.isFinite(parsed) ? parsed : undefined;
+};
+const authRequestMetadataOptions = Effect.gen(function* () {
+    const config = yield* Effect.serviceOption(AuthHttpApiConfig);
+    return Option.isSome(config) ? (config.value.requestMetadata ?? {}) : {};
+});
+const loginRequestContextFromRequest = (request, options) => {
+    if (request === undefined) {
+        return undefined;
+    }
+    const metadata = makeAuthRequestMetadata(request, options);
+    const trustProxyHeaders = options.trustProxyHeaders ?? false;
+    const { headers } = request;
+    const country = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-ipcountry"])
+        : undefined;
+    const region = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-region"])
+        : undefined;
+    const city = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-ipcity"])
+        : undefined;
+    const latitude = trustProxyHeaders
+        ? headerNumber(headers["cf-iplatitude"])
+        : undefined;
+    const longitude = trustProxyHeaders
+        ? headerNumber(headers["cf-iplongitude"])
+        : undefined;
+    const context = {
+        ...(metadata.ipAddress === undefined
+            ? {}
+            : { ip: String(metadata.ipAddress) }),
+        ...(metadata.userAgent === undefined
+            ? {}
+            : { userAgent: metadata.userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+    };
+    return Object.keys(context).length === 0 ? undefined : context;
+};
+const trustedDeviceTokenFromRequest = (trustedDeviceCookie, request) => trustedDeviceCookie === undefined || request === undefined
+    ? Effect.succeed(Option.none())
+    : trustedDeviceCookie.read(new Request("http://localhost", { headers: request.headers }));
+const metadataString = (metadata, key) => {
+    const value = metadata?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+const emailVerifiedClaims = (claims) => {
+    const requirements = claims?.requirements?.filter((requirement) => requirement !== "email_verification");
+    return {
+        ...claims,
+        emailVerified: true,
+        ...(requirements === undefined ? {} : { requirements }),
+    };
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const metadataNumber = (metadata, key) => {
+    const value = metadata?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+};
+const sessionRequestMetadata = (metadata) => {
+    const value = metadata?.[sessionRequestMetadataKey];
+    return isRecord(value) ? value : undefined;
+};
+const activeSessionBody = (session, currentSessionId) => {
+    const request = sessionRequestMetadata(session.metadata);
+    const ip = metadataString(request, "ip");
+    const userAgent = metadataString(request, "userAgent");
+    const country = metadataString(request, "country");
+    const region = metadataString(request, "region");
+    const city = metadataString(request, "city");
+    const latitude = metadataNumber(request, "latitude");
+    const longitude = metadataNumber(request, "longitude");
+    return {
+        sessionId: session.sessionId,
+        userId: session.userId,
+        createdAt: session.createdAt,
+        authTime: session.authTime,
+        ...(session.lastSeenAt === undefined
+            ? {}
+            : { lastSeenAt: session.lastSeenAt }),
+        expiresAt: session.expiresAt,
+        aal: session.aal,
+        amr: session.amr,
+        ...(session.mfaVerifiedAt === undefined
+            ? {}
+            : { mfaVerifiedAt: session.mfaVerifiedAt }),
+        current: session.sessionId === currentSessionId,
+        ...(session.claims === undefined ? {} : { claims: session.claims }),
+        ...(ip === undefined ? {} : { ip }),
+        ...(userAgent === undefined ? {} : { userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+        ...(session.metadata === undefined ? {} : { metadata: session.metadata }),
+    };
+};
+export const adminSessionHttpBody = (session) => {
+    const request = sessionRequestMetadata(session.metadata);
+    const ip = metadataString(request, "ip");
+    const userAgent = metadataString(request, "userAgent");
+    const country = metadataString(request, "country");
+    const region = metadataString(request, "region");
+    const city = metadataString(request, "city");
+    const latitude = metadataNumber(request, "latitude");
+    const longitude = metadataNumber(request, "longitude");
+    return {
+        sessionId: session.sessionId,
+        userId: session.userId,
+        createdAt: session.createdAt,
+        authTime: session.authTime,
+        ...(session.lastSeenAt === undefined
+            ? {}
+            : { lastSeenAt: session.lastSeenAt }),
+        expiresAt: session.expiresAt,
+        aal: session.aal,
+        amr: session.amr,
+        ...(session.mfaVerifiedAt === undefined
+            ? {}
+            : { mfaVerifiedAt: session.mfaVerifiedAt }),
+        ...(ip === undefined ? {} : { ip }),
+        ...(userAgent === undefined ? {} : { userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+    };
+};
+export const stepUpAuthenticatedHttpBody = (session) => {
+    const body = {
+        type: "authenticated",
+        expiresAt: Number(session.expiresAt),
+        aal: session.aal,
+        amr: session.amr,
+        ...(session.mfaVerifiedAt === undefined
+            ? {}
+            : { mfaVerifiedAt: session.mfaVerifiedAt }),
+    };
+    return session.claims === undefined ? body : { ...body, claims: session.claims };
+};
+const readOptionalSession = (dependencies, request) => Effect.gen(function* () {
+    const tokenOption = yield* dependencies.sessionCookie
+        .read(webRequestFromHeaders(request.headers))
+        .pipe(Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
+        ? Effect.succeed(Option.none())
+        : Effect.fail(new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to validate session",
+        }))));
+    if (Option.isNone(tokenOption)) {
+        return Option.none();
+    }
+    return yield* dependencies.sessions.validate(tokenOption.value).pipe(Effect.map(Option.some), Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
+        ? Effect.succeed(Option.none())
+        : Effect.fail(new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to validate session",
+        }))));
+});
+const readRequiredSession = (dependencies, request) => readOptionalSession(dependencies, request).pipe(Effect.flatMap((sessionOption) => Option.isSome(sessionOption)
+    ? Effect.succeed(sessionOption.value)
+    : Effect.fail(new AuthUnauthenticatedError({
+        code: "unauthenticated",
+        message: "Unauthenticated",
+    }))));
+const upgradeVerifiedEmailSession = (dependencies, request, verified) => Effect.gen(function* () {
+    const sessionOption = yield* readOptionalSession(dependencies, request);
+    if (Option.isNone(sessionOption)) {
+        return;
+    }
+    const session = sessionOption.value.currentSession;
+    if (session.userId !== verified.user.id) {
+        return;
+    }
+    yield* dependencies.sessions
+        .updateClaims({
+        sessionId: session.sessionId,
+        claims: emailVerifiedClaims(session.claims),
+        reason: "email_verification",
+    })
+        .pipe(Effect.catchTag("SessionUpdateClaimsError", (error) => error.cause === undefined
+        ? Effect.void
+        : Effect.fail(new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to update session claims",
+        }))));
+});
+const startRequiredEmailVerification = (dependencies, result) => Effect.gen(function* () {
+    if (dependencies.emailVerificationFlow === undefined ||
+        !canStartRequiredEmailVerification(result)) {
+        return result;
+    }
+    const input = {
+        userId: result.userId,
+        email: result.email,
+    };
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.emailVerificationStart(input), "Failed to start email verification");
+    yield* dependencies.emailVerificationFlow
+        .start(input)
+        .pipe(Effect.catchTag("EmailVerificationFlowStartError", () => Effect.fail(passwordInternalError("Failed to start email verification"))));
+    return result;
+});
+const rateLimited = (retryAfter) => new AuthRateLimitedError({
+    code: "rate_limited",
+    message: "Too many authentication attempts",
+    retryAfter,
+});
+const passwordInternalError = (message) => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const loginApprovalBadRequest = () => new AuthBadRequestError({
+    code: "bad_request",
+    message: "Invalid login approval request",
+});
+const loginApprovalSameDeviceDenied = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval must be completed on the same device",
+});
+const loginApprovalNoSessionBindingDenied = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval does not create a user session",
+});
+const loginApprovalReviewNotConfigured = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval review is not configured",
+});
+const loginApprovalFinalizeNotConfigured = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval finalization is not configured",
+});
+const loginApprovalPolicyDenied = (reason) => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: reason ?? "Login approval denied",
+});
+const loginNotificationNotConfigured = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login notification reporting is not configured",
+});
+const loginNotificationBadRequest = () => new AuthBadRequestError({
+    code: "bad_request",
+    message: "Invalid login notification report",
+});
+const oauthBadRequest = (message = "Invalid OAuth request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const oauthInternalError = (message = "Failed to complete OAuth request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const oauthHookHttpError = (error, internalMessage) => error instanceof AuthBadRequestError || error instanceof AuthUnauthenticatedError
+    ? error
+    : oauthInternalError(internalMessage);
+const oauthLinkConfirmationHttpError = (error, internalMessage) => error.message === "OAuth provider account is already linked to this user" ||
+    error.message === "OAuth provider account is linked to a different user" ||
+    error.message === "Invalid OAuth link confirmation challenge" ||
+    error.message === "OAuth link confirmation does not match current user" ||
+    error.message === "OAuth link confirmation provider mismatch" ||
+    error.message === "OAuth link confirmation provider account mismatch"
+    ? oauthBadRequest(error.message)
+    : oauthInternalError(internalMessage);
+const passkeyInternalError = (message = "Failed to complete passkey request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const passkeyBadRequest = (message = "Invalid passkey request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const passkeyVerificationHttpError = (error) => error.message === "Failed to load passkey credential" ||
+    error.message === "Failed to store passkey credential" ||
+    error.message === "Failed to update passkey credential" ||
+    error.message === "Failed to generate passkey credential record id"
+    ? passkeyInternalError()
+    : passkeyBadRequest();
+const passkeyCredentialManagementHttpError = (error) => error.message === "Passkey credential not found"
+    ? passkeyBadRequest("Invalid passkey credential")
+    : passkeyInternalError("Failed to update passkey credentials");
+const totpInternalError = (message = "Failed to complete TOTP request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const totpBadRequest = (message = "Invalid TOTP request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const totpFactorManagementHttpError = (error) => {
+    switch (error.message) {
+        case "Failed to build TOTP enrollment URI":
+        case "TOTP factor not found":
+        case "TOTP factor already confirmed":
+        case "Invalid TOTP code": {
+            return totpBadRequest();
+        }
+        default: {
+            return totpInternalError();
+        }
+    }
+};
+const recoveryCodeInternalError = (message = "Failed to complete recovery code request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const recoveryCodeBadRequest = (message = "Invalid recovery code request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const recoveryCodeManagementHttpError = (error) => {
+    switch (error.message) {
+        case "Recovery code not found": {
+            return recoveryCodeBadRequest();
+        }
+        default: {
+            return recoveryCodeInternalError();
+        }
+    }
+};
+const apiKeyInternalError = (message = "Failed to complete API key request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const apiKeyBadRequest = (message = "Invalid API key request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const apiKeyManagementHttpError = (error) => {
+    switch (error.message) {
+        case "API key not found": {
+            return apiKeyBadRequest();
+        }
+        default: {
+            return apiKeyInternalError();
+        }
+    }
+};
+const refreshTokenInternalError = (message = "Failed to complete refresh token request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const refreshTokenInvalidCredentials = (message = "Invalid refresh token") => new AuthInvalidCredentialsError({
+    code: "invalid_credentials",
+    message,
+});
+const jwtInternalError = (message = "Failed to complete JWT request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const jwtBadRequest = (message = "Invalid JWT request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const jwtRevocationHttpError = (error) => error.message === "JWT ID must not be empty" ? jwtBadRequest() : jwtInternalError();
+const mfaInternalError = (message = "Failed to complete MFA request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const mfaBadRequest = (message = "Invalid MFA request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const mfaInvalidCredentials = () => new AuthInvalidCredentialsError({
+    code: "invalid_credentials",
+    message: "Invalid MFA code",
+});
+const mfaPolicyDenied = (reason) => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: reason ?? "MFA policy denied the request",
+});
+const authFlowMfaHttpError = (error) => error._tag === "AuthFlowStateError" ? mfaBadRequest() : mfaInternalError();
+const stepUpInternalError = (message = "Failed to complete step-up request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const stepUpBadRequest = (message = "Invalid step-up request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const stepUpInvalidCredentials = () => new AuthInvalidCredentialsError({
+    code: "invalid_credentials",
+    message: "Invalid step-up factor",
+});
+const stepUpPolicyDenied = (message = "Step-up policy denied the request") => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message,
+});
+const trustedDeviceSetCookies = (dependencies) => Effect.gen(function* () {
+    if (!dependencies.rememberDevice ||
+        dependencies.trustedDevice === undefined ||
+        dependencies.trustedDeviceCookie === undefined) {
+        return [];
+    }
+    const token = yield* dependencies.trustedDevice
+        .trust({ userId: dependencies.userId })
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to remember trusted device")));
+    const cookie = yield* dependencies.trustedDeviceCookie
+        .commit({ token })
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to remember trusted device")));
+    return [cookie];
+});
+const catchAuthApiRateLimit = (effect, internalMessage) => effect.pipe(Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(rateLimited(error.retryAfter))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(passwordInternalError(internalMessage))), Effect.catchTag("PrivacyError", () => Effect.fail(passwordInternalError(internalMessage))));
+export class AdminSessionAuthorization extends Context.Service()("auth/AdminSessionAuthorization") {
+}
+(function (AdminSessionAuthorization) {
+    AdminSessionAuthorization.make = (service) => AdminSessionAuthorization.of(service);
+})(AdminSessionAuthorization || (AdminSessionAuthorization = {}));
+export class AdminSecurityTimelineAuthorization extends Context.Service()("auth/AdminSecurityTimelineAuthorization") {
+}
+(function (AdminSecurityTimelineAuthorization) {
+    AdminSecurityTimelineAuthorization.make = (service) => AdminSecurityTimelineAuthorization.of(service);
+})(AdminSecurityTimelineAuthorization || (AdminSecurityTimelineAuthorization = {}));
+export class AdminTrustedDeviceAuthorization extends Context.Service()("auth/AdminTrustedDeviceAuthorization") {
+}
+(function (AdminTrustedDeviceAuthorization) {
+    AdminTrustedDeviceAuthorization.make = (service) => AdminTrustedDeviceAuthorization.of(service);
+})(AdminTrustedDeviceAuthorization || (AdminTrustedDeviceAuthorization = {}));
+export class OidcDiscoveryMetadata extends Context.Service()("auth/OidcDiscoveryMetadata") {
+}
+(function (OidcDiscoveryMetadata) {
+    OidcDiscoveryMetadata.make = (service) => OidcDiscoveryMetadata.of(service);
+})(OidcDiscoveryMetadata || (OidcDiscoveryMetadata = {}));
+export const OidcDiscoveryMetadataLive = (metadata) => Layer.succeed(OidcDiscoveryMetadata, OidcDiscoveryMetadata.make({ load: () => Effect.succeed(metadata) }));
+export const makePasswordSignInHandler = (dependencies) => Effect.fn("auth.http.password.sign_in")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_in");
+    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
+    const input = passwordSignInInput(payload, Option.isSome(trustedDeviceToken) ? trustedDeviceToken.value : undefined, requestContext);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.passwordSignIn(input), "Failed to sign in with password");
+    const result = yield* dependencies.password.signIn(input).pipe(Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("TrustedDeviceError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginRiskError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("AuthFlowStateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginApprovalReviewError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginApprovalFlowStartError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))));
+    yield* startRequiredEmailVerification(dependencies, result);
+    return yield* dependencies.authHttp.commitPasswordSignInResult(result);
+});
+export const makePasswordSignUpHandler = (dependencies) => Effect.fn("auth.http.password.sign_up")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_up");
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const input = passwordSignUpInput(payload, loginRequestContextFromRequest(request, requestMetadataOptions));
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.passwordSignUp(input), "Failed to sign up with password");
+    const result = yield* dependencies.registration.signUp(input).pipe(Effect.catchTag("EmailAlreadyRegisteredError", () => Effect.fail(new AuthEmailAlreadyRegisteredError({
+        code: "email_already_registered",
+        message: "Email is already registered",
+    }))), Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("CryptoError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("TrustedDeviceError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginRiskError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("AuthFlowStateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginApprovalReviewError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginApprovalFlowStartError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))));
+    yield* startRequiredEmailVerification(dependencies, result);
+    return yield* dependencies.authHttp.commitPasswordSignUpResult(result);
+});
+export const makePasswordResetStartHandler = (dependencies) => Effect.fn("auth.http.password.reset_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.reset_start");
+    const input = passwordResetStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.passwordResetStart(input), "Failed to start password reset");
+    yield* dependencies.passwordReset.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start password reset",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makePasswordResetVerifyHandler = (dependencies) => Effect.fn("auth.http.password.reset_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.reset_verify");
+    yield* dependencies.passwordReset
+        .verify(passwordResetVerifyInput(payload))
+        .pipe(Effect.mapError(() => new AuthBadRequestError({
+        code: "bad_request",
+        message: "Invalid password reset request",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+const passwordManagementError = (error) => error.reason === "internal"
+    ? new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to update password",
+    })
+    : new AuthBadRequestError({
+        code: "bad_request",
+        message: "Invalid password update request",
+    });
+export const makePasswordSetHandler = (dependencies) => Effect.fn("auth.http.password.set")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.set");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.passwordManagement
+        .set(passwordSetInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(passwordManagementError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makePasswordChangeHandler = (dependencies) => Effect.fn("auth.http.password.change")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.change");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.passwordManagement
+        .change(passwordChangeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(passwordManagementError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeCurrentSessionHandler = (dependencies) => Effect.fn("auth.http.session.current")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.current");
+    const tokenOption = yield* dependencies.sessionCookie
+        .read(webRequestFromHeaders(request.headers))
+        .pipe(Effect.mapError((error) => error.cause === undefined
+        ? new AuthUnauthenticatedError({
+            code: "unauthenticated",
+            message: "Unauthenticated",
+        })
+        : new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to validate session",
+        })));
+    if (Option.isNone(tokenOption)) {
+        return yield* new AuthUnauthenticatedError({
+            code: "unauthenticated",
+            message: "Unauthenticated",
+        });
+    }
+    const session = yield* dependencies.sessions
+        .validate(tokenOption.value)
+        .pipe(Effect.mapError((error) => error.cause === undefined
+        ? new AuthUnauthenticatedError({
+            code: "unauthenticated",
+            message: "Unauthenticated",
+        })
+        : new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to validate session",
+        })));
+    return yield* dependencies.authHttp.commitCurrentSession(session);
+});
+export const makeRefreshSessionHandler = (dependencies) => Effect.fn("auth.http.session.refresh")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.refresh");
+    const tokenOption = yield* dependencies.sessionCookie
+        .read(webRequestFromHeaders(request.headers))
+        .pipe(Effect.mapError((error) => error.cause === undefined
+        ? new AuthUnauthenticatedError({
+            code: "unauthenticated",
+            message: "Unauthenticated",
+        })
+        : new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to validate session",
+        })));
+    if (Option.isNone(tokenOption)) {
+        return yield* new AuthUnauthenticatedError({
+            code: "unauthenticated",
+            message: "Unauthenticated",
+        });
+    }
+    const session = yield* dependencies.sessions
+        .refresh(tokenOption.value)
+        .pipe(Effect.mapError((error) => error.cause === undefined
+        ? new AuthUnauthenticatedError({
+            code: "unauthenticated",
+            message: "Unauthenticated",
+        })
+        : new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to refresh session",
+        })));
+    return yield* dependencies.authHttp.commitSessionRefreshed(session);
+});
+export const makeLogoutHandler = (dependencies) => Effect.fn("auth.http.session.logout")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.logout");
+    const tokenOption = yield* dependencies.sessionCookie
+        .read(webRequestFromHeaders(request.headers))
+        .pipe(Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
+        ? Effect.succeed(Option.none())
+        : Effect.fail(new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to validate session",
+        }))));
+    if (Option.isSome(tokenOption)) {
+        const sessionOption = yield* dependencies.sessions
+            .validate(tokenOption.value)
+            .pipe(Effect.map(Option.some), Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
+            ? Effect.succeed(Option.none())
+            : Effect.fail(new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to validate session",
+            }))));
+        if (Option.isSome(sessionOption)) {
+            yield* dependencies.sessions
+                .revoke({
+                sessionId: sessionOption.value.currentSession.sessionId,
+                reason: "logout",
+            })
+                .pipe(Effect.mapError(() => new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to revoke session",
+            })));
+        }
+    }
+    return yield* dependencies.authHttp.commitSessionCleared();
+});
+export const makeListSessionsHandler = (dependencies) => Effect.fn("auth.http.session.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const sessions = yield* dependencies.sessions
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list sessions",
+    })));
+    return {
+        sessions: sessions.map((session) => activeSessionBody(session, current.currentSession.sessionId)),
+    };
+});
+export const makeRevokeSessionHandler = (dependencies) => Effect.fn("auth.http.session.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.sessions
+        .revokeForUser({
+        userId: current.currentSession.userId,
+        sessionId: payload.sessionId,
+        reason: "user_revoked_session",
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke session",
+    })));
+    return payload.sessionId === current.currentSession.sessionId
+        ? yield* dependencies.authHttp.commitSessionCleared()
+        : HttpServerResponse.empty({ status: 204 });
+});
+export const makeRevokeOtherSessionsHandler = (dependencies) => Effect.fn("auth.http.session.revoke_others")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.revoke_others");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.sessions
+        .revokeAllForUserExcept({
+        userId: current.currentSession.userId,
+        exceptSessionId: current.currentSession.sessionId,
+        reason: "user_revoked_other_sessions",
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke other sessions",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeAdminSessionListHandler = (dependencies) => Effect.fn("auth.http.admin_session.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: query.userId,
+        action: "list",
+        request,
+    });
+    const sessions = yield* dependencies.sessions
+        .listForUser({ userId: query.userId })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list admin sessions",
+    })));
+    return { sessions: sessions.map(adminSessionHttpBody) };
+});
+export const makeAdminSessionRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: payload.userId,
+        action: "revoke",
+        request,
+        sessionId: payload.sessionId,
+    });
+    yield* dependencies.sessions
+        .revokeForUser({
+        userId: payload.userId,
+        sessionId: payload.sessionId,
+        reason: "admin_revoked_session",
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke admin session",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeAdminSessionRevokeAllHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke_all")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.revoke_all");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: payload.userId,
+        action: "revoke_all",
+        request,
+    });
+    yield* dependencies.sessions.revokeAllForUser(payload.userId).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke admin sessions",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeLoginNotificationReportHandler = (dependencies) => Effect.fn("auth.http.security.login_notification.report")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security.login_notification.report");
+    if (dependencies.loginNotification === undefined) {
+        return yield* loginNotificationNotConfigured();
+    }
+    yield* dependencies.loginNotification
+        .report(loginNotificationReportInput(payload))
+        .pipe(Effect.mapError((error) => error.reason === "invalid_report"
+        ? loginNotificationBadRequest()
+        : new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to process login notification report",
+        })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+const securityTimelineActorHttpBody = (actor) => actor.type === "anonymous"
+    ? { type: "anonymous" }
+    : {
+        type: "user",
+        ...(actor.sessionId === undefined ? {} : { sessionId: actor.sessionId }),
+    };
+const securityTimelineRequestHttpBody = (request) => ({
+    ...(request.ipHash === undefined ? {} : { ipHash: request.ipHash }),
+    ...(request.userAgentHash === undefined
+        ? {}
+        : { userAgentHash: request.userAgentHash }),
+});
+export const securityTimelineEventHttpBody = (event) => ({
+    eventId: event.id,
+    type: event.type,
+    category: event.category,
+    severity: event.severity,
+    occurredAt: event.occurredAt,
+    summary: event.summary,
+    ...(event.actor === undefined
+        ? {}
+        : { actor: securityTimelineActorHttpBody(event.actor) }),
+    ...(event.request === undefined
+        ? {}
+        : { request: securityTimelineRequestHttpBody(event.request) }),
+    ...(event.metadata === undefined ? {} : { metadata: event.metadata }),
+});
+const securityTimelineListInput = (query, userId) => ({
+    userId,
+    ...(query.limit === undefined ? {} : { limit: query.limit }),
+    ...(query.beforeOccurredAt === undefined
+        ? {}
+        : { beforeOccurredAt: query.beforeOccurredAt }),
+    ...(query.types === undefined ? {} : { types: query.types }),
+    ...(query.categories === undefined ? {} : { categories: query.categories }),
+});
+const adminSecurityTimelineListInput = (query) => securityTimelineListInput(query, query.userId);
+export const makeSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.security_timeline.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security_timeline.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const events = yield* dependencies.securityTimeline
+        .listByUser(securityTimelineListInput(query, current.currentSession.userId))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list security timeline",
+    })));
+    return { events: events.map(securityTimelineEventHttpBody) };
+});
+export const makeAdminSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.admin_security_timeline.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_security_timeline.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: query.userId,
+        request,
+    });
+    const events = yield* dependencies.securityTimeline
+        .listByUser(adminSecurityTimelineListInput(query))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list admin security timeline",
+    })));
+    return { events: events.map(securityTimelineEventHttpBody) };
+});
+export const trustedDeviceHttpBody = (device) => ({
+    deviceId: device.tokenHash,
+    createdAt: device.createdAt,
+    lastSeenAt: device.lastSeenAt,
+    expiresAt: device.expiresAt,
+    ...(device.metadata === undefined ? {} : { metadata: device.metadata }),
+});
+export const makeTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.trusted_device.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "trusted_device.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const now = yield* currentUnixMillis;
+    const devices = yield* dependencies.trustedDevices
+        .listForUser({ userId: current.currentSession.userId, now })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list trusted devices",
+    })));
+    return { devices: devices.map(trustedDeviceHttpBody) };
+});
+export const makeTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.trusted_device.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "trusted_device.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.trustedDevices
+        .revokeForUser({
+        userId: current.currentSession.userId,
+        tokenHash: payload.deviceId,
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke trusted device",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeAdminTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_trusted_device.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: query.userId,
+        action: "list",
+        request,
+    });
+    const now = yield* currentUnixMillis;
+    const devices = yield* dependencies.trustedDevices
+        .listForUser({ userId: query.userId, now })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list admin trusted devices",
+    })));
+    return { devices: devices.map(trustedDeviceHttpBody) };
+});
+export const makeAdminTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_trusted_device.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: payload.userId,
+        action: "revoke",
+        request,
+        deviceId: payload.deviceId,
+    });
+    yield* dependencies.trustedDevices
+        .revokeForUser({
+        userId: payload.userId,
+        tokenHash: payload.deviceId,
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke admin trusted device",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeEmailVerificationStartHandler = (dependencies) => Effect.fn("auth.http.email_verification.start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_verification.start");
+    const input = emailVerificationStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.emailVerificationStart(input), "Failed to start email verification");
+    yield* dependencies.emailVerificationFlow.start(input).pipe(Effect.catchTag("EmailVerificationFlowStartError", (error) => Effect.fail(error.cause instanceof EmailVerificationIssueError
+        ? new AuthBadRequestError({
+            code: "bad_request",
+            message: "Invalid email verification request",
+        })
+        : error.cause instanceof EmailDeliveryError
+            ? new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to send email verification",
+            })
+            : new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to start email verification",
+            }))));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeEmailVerificationVerifyHandler = (dependencies) => Effect.fn("auth.http.email_verification.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_verification.verify");
+    const verified = yield* dependencies.emailVerification
+        .verify(emailVerificationVerifyInput(payload))
+        .pipe(Effect.mapError(() => new AuthBadRequestError({
+        code: "bad_request",
+        message: "Invalid email verification request",
+    })));
+    yield* upgradeVerifiedEmailSession(dependencies, request, verified);
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeEmailOtpStartHandler = (dependencies) => Effect.fn("auth.http.email_otp.start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_otp.start");
+    const input = emailOtpStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.emailOtpStart(input), "Failed to start email OTP");
+    return yield* dependencies.emailOtp.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start email OTP",
+    })));
+});
+export const makeEmailOtpVerifyHandler = (dependencies) => Effect.fn("auth.http.email_otp.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_otp.verify");
+    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
+    const result = yield* dependencies.emailOtp
+        .verify(emailOtpVerifyInput(payload, Option.isSome(trustedDeviceToken)
+        ? trustedDeviceToken.value
+        : undefined, requestContext))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to verify email OTP",
+    })));
+    return yield* dependencies.authHttp.commitEmailOtpVerifyResult(result);
+});
+export const makeMagicLinkStartHandler = (dependencies) => Effect.fn("auth.http.magic_link.start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "magic_link.start");
+    const input = magicLinkStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.magicLinkStart(input), "Failed to start magic link");
+    const started = yield* dependencies.magicLink.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start magic link",
+    })));
+    return {
+        email: started.email,
+        expiresAt: started.expiresAt,
+    };
+});
+export const makeMagicLinkVerifyHandler = (dependencies) => Effect.fn("auth.http.magic_link.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "magic_link.verify");
+    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
+    const result = yield* dependencies.magicLink
+        .verify(magicLinkVerifyInput(payload, Option.isSome(trustedDeviceToken)
+        ? trustedDeviceToken.value
+        : undefined, requestContext))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to verify magic link",
+    })));
+    return yield* dependencies.authHttp.commitMagicLinkVerifyResult(result);
+});
+export const makeOAuthAuthorizationStartHandler = (dependencies) => Effect.fn("auth.http.oauth.authorization_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.authorization_start");
+    const provider = yield* dependencies.oauthProviders.get(payload.providerId).pipe(Effect.mapError(() => oauthInternalError("Failed to load OAuth provider")));
+    if (Option.isNone(provider)) {
+        return yield* oauthBadRequest("Unknown OAuth provider");
+    }
+    const started = yield* dependencies.oauthState
+        .start(oauthAuthorizationStartInput(payload, provider.value, dependencies))
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to start OAuth authorization")));
+    if (dependencies.storeCodeVerifier !== undefined) {
+        yield* dependencies.storeCodeVerifier({ payload, started }).pipe(Effect.mapError(() => oauthInternalError("Failed to store OAuth verifier")));
+    }
+    return oauthAuthorizationStartedHttpBody(started);
+});
+export const makeOAuthProviderAuthorizationHandler = (dependencies) => Effect.fn("auth.http.oauth.authorize")(function* ({ query, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.authorize");
+    const result = yield* dependencies.authorization
+        .authorize({
+        responseType: query.response_type,
+        ...(query.client_id === undefined ? {} : { clientId: query.client_id }),
+        ...(query.redirect_uri === undefined
+            ? {}
+            : { redirectUri: query.redirect_uri }),
+        ...(query.scope === undefined ? {} : { scopes: query.scope }),
+        ...(query.state === undefined ? {} : { state: query.state }),
+        ...(query.code_challenge === undefined
+            ? {}
+            : { codeChallenge: query.code_challenge }),
+        ...(query.code_challenge_method === undefined
+            ? {}
+            : { codeChallengeMethod: query.code_challenge_method }),
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to authorize OAuth request")));
+    if (result.valid) {
+        return oauthAuthorizationRedirect(result.redirectUri, {
+            code: Redacted.value(result.code.code),
+            state: result.state,
+        });
+    }
+    if (result.redirectUri !== undefined) {
+        return oauthAuthorizationRedirect(result.redirectUri, {
+            error: result.reason,
+            error_description: result.errorDescription,
+            state: result.state,
+        });
+    }
+    return yield* oauthAuthorizationEndpointError(result.reason, result.errorDescription);
+});
+export const makeOAuthAuthorizationCodeTokenHandler = (dependencies) => Effect.fn("auth.http.oauth.token")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.token");
+    const payload = yield* oauthTokenRequestBody(request);
+    const { clientId, clientAuthenticated } = yield* oauthClientEndpointAuthentication({
+        request,
+        payload,
+        authenticateClient: dependencies.authenticateClient,
+        invalidRequest: () => oauthTokenEndpointError("invalid_request"),
+        invalidClient: () => oauthTokenEndpointError("invalid_client"),
+    });
+    if (payload.grant_type === "refresh_token") {
+        return yield* oauthRefreshTokenResponse({
+            dependencies,
+            payload,
+            ...(clientId === undefined ? {} : { clientId }),
+            clientAuthenticated,
+        });
+    }
+    if (payload.grant_type === "client_credentials") {
+        return yield* oauthClientCredentialsTokenResponse({
+            dependencies,
+            payload,
+            ...(clientId === undefined ? {} : { clientId }),
+            clientAuthenticated,
+        });
+    }
+    return yield* oauthAuthorizationCodeTokenResponse({
+        dependencies,
+        payload,
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    });
+});
+export const makeOAuthTokenRevocationHandler = (dependencies) => Effect.fn("auth.http.oauth.revoke")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.revoke");
+    const payload = yield* oauthTokenRevocationRequestBody(request);
+    const { clientId, clientAuthenticated } = yield* oauthClientEndpointAuthentication({
+        request,
+        payload,
+        authenticateClient: dependencies.authenticateClient,
+        invalidRequest: () => oauthTokenRevocationEndpointError("invalid_request"),
+        invalidClient: () => oauthTokenRevocationEndpointError("invalid_client"),
+    });
+    const token = oauthTokenGrantString(payload.token);
+    const tokenTypeHint = oauthTokenGrantString(payload.token_type_hint);
+    const result = yield* dependencies.tokenRevocation
+        .revoke({
+        ...(token === undefined ? {} : { token: Redacted.make(token) }),
+        ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to revoke OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenRevocationEndpointError(result.reason);
+    }
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeOAuthTokenIntrospectionHandler = (dependencies) => Effect.fn("auth.http.oauth.introspect")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.introspect");
+    const payload = yield* oauthTokenIntrospectionRequestBody(request);
+    const { clientId, clientAuthenticated } = yield* oauthClientEndpointAuthentication({
+        request,
+        payload,
+        authenticateClient: dependencies.authenticateClient,
+        invalidRequest: () => oauthTokenIntrospectionEndpointError("invalid_request"),
+        invalidClient: () => oauthTokenIntrospectionEndpointError("invalid_client"),
+    });
+    const token = oauthTokenGrantString(payload.token);
+    const tokenTypeHint = oauthTokenGrantString(payload.token_type_hint);
+    const result = yield* dependencies.tokenIntrospection
+        .introspect({
+        ...(token === undefined ? {} : { token: Redacted.make(token) }),
+        ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to introspect OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenIntrospectionEndpointError(result.reason);
+    }
+    return oauthTokenIntrospectionResponseHttpBody(result.introspection);
+});
+const makeOAuthTokenRevocationNotConfiguredHandler = () => Effect.fn("auth.http.oauth.revoke_not_configured")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.revoke");
+    yield* oauthTokenRevocationRequestBody(request);
+    return yield* oauthTokenRevocationEndpointError("invalid_request");
+});
+const makeOAuthTokenIntrospectionNotConfiguredHandler = () => Effect.fn("auth.http.oauth.introspect_not_configured")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.introspect");
+    yield* oauthTokenIntrospectionRequestBody(request);
+    return yield* oauthTokenIntrospectionEndpointError("invalid_request");
+});
+export const makeOAuthAccountUnlinkHandler = (dependencies) => Effect.fn("auth.http.oauth.account_unlink")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.account_unlink");
+    const session = yield* readRequiredSession(dependencies, request);
+    const stepUpSatisfied = dependencies.stepUpSatisfied === undefined
+        ? undefined
+        : yield* dependencies.stepUpSatisfied({ payload, request, session }).pipe(Effect.mapError(() => oauthInternalError("Failed to evaluate OAuth unlink step-up")));
+    const decision = yield* dependencies.oauthAccountUnlinking
+        .resolve({
+        userId: session.currentSession.userId,
+        providerId: payload.providerId,
+        providerAccountId: payload.providerAccountId,
+        ...(stepUpSatisfied === undefined ? {} : { stepUpSatisfied }),
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to resolve OAuth account unlinking")));
+    if (decision.type !== "allow") {
+        return oauthAccountUnlinkResolutionHttpBody(decision);
+    }
+    if (dependencies.unlinkAfterAllow !== undefined) {
+        yield* dependencies
+            .unlinkAfterAllow({ payload, request, session, decision })
+            .pipe(Effect.mapError(() => oauthInternalError("Failed to unlink OAuth account")));
+    }
+    return oauthAccountUnlinkResolutionHttpBody(decision, {
+        unlinked: dependencies.unlinkAfterAllow !== undefined,
+    });
+});
+export const makeOAuthLinkConfirmationStartHandler = (dependencies) => Effect.fn("auth.http.oauth.link_confirmation_start")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.link_confirmation_start");
+    const baseInput = dependencies.startInput === undefined
+        ? yield* oauthLinkConfirmationStartInput(payload, dependencies)
+        : yield* dependencies.startInput({ payload, request }).pipe(Effect.mapError((error) => oauthHookHttpError(error, "Failed to resolve OAuth link confirmation input")));
+    const input = {
+        ...baseInput,
+        ...(baseInput.ttl === undefined && dependencies.ttl !== undefined
+            ? { ttl: dependencies.ttl }
+            : {}),
+    };
+    const started = yield* dependencies.oauthLinkConfirmation.start(input).pipe(Effect.mapError((error) => oauthLinkConfirmationHttpError(error, "Failed to start OAuth link confirmation")));
+    if (dependencies.onStarted !== undefined) {
+        yield* dependencies.onStarted({ payload, request, started }).pipe(Effect.mapError(() => oauthInternalError("Failed to deliver OAuth link confirmation")));
+    }
+    return oauthLinkConfirmationStartedHttpBody(started);
+});
+export const makeOAuthLinkConfirmationInspectHandler = (dependencies) => Effect.fn("auth.http.oauth.link_confirmation_inspect")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.link_confirmation_inspect");
+    const pending = yield* dependencies.oauthLinkConfirmation
+        .inspect(oauthLinkConfirmationInspectInput(payload))
+        .pipe(Effect.mapError((error) => oauthLinkConfirmationHttpError(error, "Failed to inspect OAuth link confirmation")));
+    return oauthLinkConfirmationPendingHttpBody(pending);
+});
+export const makeOAuthLinkConfirmationConfirmHandler = (dependencies) => Effect.fn("auth.http.oauth.link_confirmation_confirm")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.link_confirmation_confirm");
+    const currentUserId = dependencies.currentUserId === undefined
+        ? undefined
+        : yield* dependencies.currentUserId({ payload, request }).pipe(Effect.mapError((error) => oauthHookHttpError(error, "Failed to resolve current OAuth user")));
+    const confirmed = yield* dependencies.oauthLinkConfirmation
+        .confirm(oauthLinkConfirmationConfirmInput(payload, currentUserId))
+        .pipe(Effect.mapError((error) => oauthLinkConfirmationHttpError(error, "Failed to confirm OAuth link confirmation")));
+    if (dependencies.linkAfterConfirm !== undefined) {
+        yield* dependencies.linkAfterConfirm({ payload, request, confirmed }).pipe(Effect.mapError(() => oauthInternalError("Failed to link OAuth account")));
+    }
+    return oauthLinkConfirmationConfirmedHttpBody(confirmed, {
+        linked: dependencies.linkAfterConfirm !== undefined,
+    });
+});
+export const makePasskeyRegistrationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.registration_start");
+    return yield* dependencies.passkeyOptions
+        .startRegistration(passkeyRegistrationStartInput(payload, dependencies))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey registration")));
+});
+export const makePasskeyRegistrationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_finish")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.registration_finish");
+    const finished = yield* dependencies.passkeyVerification
+        .finishRegistration(passkeyRegistrationFinishInput(payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    return { credentialId: finished.credential.credentialId };
+});
+export const makePasskeyAuthenticationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.authentication_start");
+    return yield* dependencies.passkeyOptions
+        .startAuthentication(passkeyAuthenticationStartInput(payload, dependencies))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey authentication")));
+});
+export const makePasskeyAuthenticationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_finish")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.authentication_finish");
+    const finished = yield* dependencies.passkeyVerification
+        .finishAuthentication(passkeyAuthenticationFinishInput(payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    const session = yield* dependencies.sessions
+        .create(dependencies.makeSessionInput({
+        finished,
+        payload,
+        ...(request === undefined ? {} : { request }),
+    }))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to create passkey session")));
+    return yield* dependencies.authHttp.commitAuthenticatedSession(session);
+});
+export const makePasskeyCredentialListHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.credential_list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const credentials = yield* dependencies.passkeyCredentialManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to list passkey credentials")));
+    return {
+        credentials: credentials.map(passkeyCredentialInfoHttpBody),
+    };
+});
+export const makePasskeyCredentialRevokeHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.credential_revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.passkeyCredentialManagement
+        .revokeForUser(passkeyCredentialRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(passkeyCredentialManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeTotpEnrollmentStartHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_start")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.enrollment_start");
+    const current = yield* readRequiredSession(dependencies, request);
+    const started = yield* dependencies.totpFactorManagement
+        .startEnrollment(totpEnrollmentStartInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(totpFactorManagementHttpError));
+    return totpEnrollmentStartedHttpBody(started);
+});
+export const makeTotpEnrollmentConfirmHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_confirm")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.enrollment_confirm");
+    const current = yield* readRequiredSession(dependencies, request);
+    const confirmed = yield* dependencies.totpFactorManagement
+        .confirmEnrollment(totpEnrollmentConfirmInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(totpFactorManagementHttpError));
+    return totpFactorInfoHttpBody(confirmed);
+});
+export const makeTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.totp.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const result = yield* dependencies.totpFactorManagement
+        .verifyForUser(totpVerifyInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => totpInternalError("Failed to verify TOTP factor")));
+    return totpVerifyResultHttpBody(result);
+});
+export const makeTotpFactorListHandler = (dependencies) => Effect.fn("auth.http.totp.factor_list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.factor_list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const factors = yield* dependencies.totpFactorManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => totpInternalError("Failed to list TOTP factors")));
+    return { factors: factors.map(totpFactorInfoHttpBody) };
+});
+export const makeTotpFactorRevokeHandler = (dependencies) => Effect.fn("auth.http.totp.factor_revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.factor_revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.totpFactorManagement
+        .revokeForUser(totpFactorRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(totpFactorManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeRecoveryCodeGenerateHandler = (dependencies) => Effect.fn("auth.http.recovery_code.generate")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.generate");
+    const current = yield* readRequiredSession(dependencies, request);
+    const generated = yield* dependencies.recoveryCodeManagement
+        .generateForUser(recoveryCodeGenerateInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(recoveryCodeManagementHttpError));
+    return recoveryCodesGeneratedHttpBody(generated);
+});
+export const makeRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.recovery_code.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const result = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(recoveryCodeVerifyInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(() => recoveryCodeInternalError("Failed to verify recovery code")));
+    return recoveryCodeVerifyResultHttpBody(result);
+});
+export const makeRecoveryCodeListHandler = (dependencies) => Effect.fn("auth.http.recovery_code.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const codes = yield* dependencies.recoveryCodeManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => recoveryCodeInternalError("Failed to list recovery codes")));
+    return { codes: codes.map(recoveryCodeInfoHttpBody) };
+});
+export const makeRecoveryCodeRevokeHandler = (dependencies) => Effect.fn("auth.http.recovery_code.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.recoveryCodeManagement
+        .revokeForUser(recoveryCodeRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(recoveryCodeManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeApiKeyCreateHandler = (dependencies) => Effect.fn("auth.http.api_key.create")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.create");
+    const current = yield* readRequiredSession(dependencies, request);
+    const created = yield* dependencies.apiKeyManagement
+        .createForUser(apiKeyCreateInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(apiKeyManagementHttpError));
+    return apiKeyCreatedHttpBody(created);
+});
+export const makeApiKeyListHandler = (dependencies) => Effect.fn("auth.http.api_key.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const keys = yield* dependencies.apiKeyManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => apiKeyInternalError("Failed to list API keys")));
+    return { keys: keys.map(apiKeyInfoHttpBody) };
+});
+export const makeApiKeyRevokeHandler = (dependencies) => Effect.fn("auth.http.api_key.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.apiKeyManagement
+        .revokeForUser(apiKeyRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(apiKeyManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeRefreshTokenRefreshHandler = (dependencies) => Effect.fn("auth.http.refresh_token.refresh")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "refresh_token.refresh");
+    const now = yield* currentUnixMillis;
+    const expiresAt = dependencies.refreshTokenExpiresAt({ now });
+    const rotated = yield* dependencies.refreshTokenManagement
+        .rotate(refreshTokenRefreshInput(payload, now, expiresAt))
+        .pipe(Effect.mapError(() => refreshTokenInternalError("Failed to rotate refresh token")));
+    switch (rotated._tag) {
+        case "Invalid": {
+            return yield* refreshTokenInvalidCredentials();
+        }
+        case "ReuseDetected": {
+            return yield* refreshTokenInvalidCredentials("Refresh token reuse detected");
+        }
+        case "Rotated": {
+            const accessToken = yield* dependencies.jwtIssuer
+                .issue(dependencies.accessToken({
+                now,
+                refreshToken: rotated.refreshToken,
+                previousToken: rotated.previousToken,
+            }))
+                .pipe(Effect.mapError(() => refreshTokenInternalError("Failed to issue access token")));
+            return refreshTokenRefreshedHttpBody({
+                accessToken,
+                refreshToken: Redacted.value(rotated.token),
+                refreshTokenRecord: rotated.refreshToken,
+            });
+        }
+    }
+});
+export const makeJwtIntrospectHandler = (dependencies) => Effect.fn("auth.http.jwt.introspect")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.introspect");
+    const result = yield* dependencies.jwtRevocation
+        .introspect(jwtIntrospectInput(payload, dependencies))
+        .pipe(Effect.mapError(() => jwtInternalError("Failed to introspect JWT access token")));
+    return jwtIntrospectionHttpBody(result);
+});
+export const makeJwtRevokeHandler = (dependencies) => Effect.fn("auth.http.jwt.revoke")(function* ({ payload }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.revoke");
+    yield* dependencies.jwtRevocation
+        .revokeJwtId(jwtRevokeInput(payload))
+        .pipe(Effect.mapError(jwtRevocationHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeJwtJwksHandler = (dependencies) => Effect.fn("auth.http.jwt.jwks")(function* (_) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.jwks");
+    const document = yield* dependencies.jwks.document().pipe(Effect.mapError(() => jwtInternalError("Failed to load JWT JWKS document")));
+    return jwtJwksHttpBody(document);
+});
+export const makeOidcDiscoveryMetadataHandler = (dependencies) => Effect.fn("auth.http.oidc.discovery_metadata")(function* (_) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oidc.discovery_metadata");
+    return yield* dependencies.metadata.load().pipe(Effect.mapError(() => jwtInternalError("Failed to load OIDC discovery metadata")));
+});
+export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.options")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.options");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    const factors = [];
+    if (dependencies.totpFactorManagement !== undefined) {
+        const totpFactors = yield* dependencies.totpFactorManagement
+            .listForUser({ userId: pending.userId })
+            .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
+        if (totpFactors.length > 0) {
+            factors.push({ type: "totp" });
+        }
+    }
+    if (dependencies.recoveryCodeManagement !== undefined) {
+        const recoveryCodes = yield* dependencies.recoveryCodeManagement
+            .listForUser({ userId: pending.userId })
+            .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
+        if (recoveryCodes.length > 0) {
+            factors.push({ type: "backup-code" });
+        }
+    }
+    if (dependencies.passkeyCredentialManagement !== undefined) {
+        const credentials = yield* dependencies.passkeyCredentialManagement
+            .listForUser({ userId: pending.userId })
+            .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
+        if (credentials.length > 0) {
+            factors.push({ type: "passkey" });
+        }
+    }
+    return { factors };
+});
+export const makeTotpMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.totp_verify");
+    const verified = yield* dependencies.totpFactorManagement
+        .verifyForUser(totpMfaVerifyInput(payload, dependencies))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify TOTP MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: payload.userId,
+        method: "totp",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeTotpMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify_for_flow")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.totp_verify_for_flow");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    const verified = yield* dependencies.totpFactorManagement
+        .verifyForUser(totpMfaVerifyForFlowInput(pending.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify TOTP MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: pending.userId,
+        method: "totp",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeRecoveryCodeMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.recovery_code_verify");
+    const verified = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(recoveryCodeMfaVerifyInput(payload))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify recovery code MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: payload.userId,
+        method: "backup-code",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeRecoveryCodeMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify_for_flow")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.recovery_code_verify_for_flow");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    const verified = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(recoveryCodeMfaVerifyForFlowInput(pending.userId, payload))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify recovery code MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: pending.userId,
+        method: "backup-code",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makePasskeyMfaStartHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.passkey_start");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    return yield* dependencies.passkeyOptions
+        .startAuthentication(passkeyMfaStartInput(pending.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey MFA authentication")));
+});
+export const makePasskeyMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.passkey_verify");
+    const finished = yield* dependencies.passkeyVerification
+        .finishAuthentication(passkeyMfaVerifyInput(payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: finished.userId,
+        method: "passkey",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+const upgradeStepUpSession = (dependencies, current, method) => upgradeCurrentSession({ method, reason: "step_up" }).pipe(Effect.provideService(CurrentSession, CurrentSession.make(current.currentSession)), Effect.provideService(Sessions, dependencies.sessions), Effect.map(stepUpAuthenticatedHttpBody), Effect.mapError(() => stepUpInternalError("Failed to upgrade current session")));
+export const makeStepUpOptionsHandler = (dependencies) => Effect.fn("auth.http.step_up.options")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.options");
+    const current = yield* readRequiredSession(dependencies, request);
+    const { userId } = current.currentSession;
+    const factors = [];
+    if (dependencies.totpFactorManagement !== undefined) {
+        const totpFactors = yield* dependencies.totpFactorManagement
+            .listForUser({ userId })
+            .pipe(Effect.mapError(() => stepUpInternalError("Failed to list step-up options")));
+        if (totpFactors.length > 0) {
+            factors.push({ type: "totp" });
+        }
+    }
+    if (dependencies.recoveryCodeManagement !== undefined) {
+        const recoveryCodes = yield* dependencies.recoveryCodeManagement
+            .listForUser({ userId })
+            .pipe(Effect.mapError(() => stepUpInternalError("Failed to list step-up options")));
+        if (recoveryCodes.length > 0) {
+            factors.push({ type: "backup-code" });
+        }
+    }
+    if (dependencies.passkeyCredentialManagement !== undefined) {
+        const credentials = yield* dependencies.passkeyCredentialManagement
+            .listForUser({ userId })
+            .pipe(Effect.mapError(() => stepUpInternalError("Failed to list step-up options")));
+        if (credentials.length > 0) {
+            factors.push({ type: "passkey" });
+        }
+    }
+    return { factors };
+});
+export const makeStepUpTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.totp_verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.totp_verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const verified = yield* dependencies.totpFactorManagement
+        .verifyForUser(stepUpTotpVerifyInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => stepUpInternalError("Failed to verify TOTP step-up factor")));
+    if (!verified.valid) {
+        return yield* stepUpInvalidCredentials();
+    }
+    return yield* upgradeStepUpSession(dependencies, current, "totp");
+});
+export const makeStepUpRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.recovery_code_verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.recovery_code_verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const verified = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(stepUpRecoveryCodeVerifyInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(() => stepUpInternalError("Failed to verify recovery-code step-up factor")));
+    if (!verified.valid) {
+        return yield* stepUpInvalidCredentials();
+    }
+    return yield* upgradeStepUpSession(dependencies, current, "backup_code");
+});
+export const makeStepUpPasskeyStartHandler = (dependencies) => Effect.fn("auth.http.step_up.passkey_start")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.passkey_start");
+    const current = yield* readRequiredSession(dependencies, request);
+    return yield* dependencies.passkeyOptions
+        .startAuthentication(stepUpPasskeyStartInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError((error) => error.cause === undefined
+        ? stepUpBadRequest()
+        : stepUpInternalError("Failed to start passkey step-up")));
+});
+export const makeStepUpPasskeyVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.passkey_verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.passkey_verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const finished = yield* dependencies.passkeyVerification
+        .finishAuthentication(stepUpPasskeyVerifyInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    if (finished.userId !== current.currentSession.userId) {
+        return yield* stepUpPolicyDenied("Passkey belongs to a different user");
+    }
+    return yield* upgradeStepUpSession(dependencies, current, "passkey");
+});
+export const makeLoginApprovalApproveHandler = (dependencies) => Effect.fn("auth.http.login_approval.approve")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.approve");
+    const input = loginApprovalApproveInput(payload);
+    const approval = yield* dependencies.loginApproval
+        .verify(input.approval)
+        .pipe(Effect.mapError(() => loginApprovalBadRequest()));
+    const approvedFlowId = metadataString(approval.metadata, "flowId");
+    if (approvedFlowId !== input.flowId) {
+        return yield* loginApprovalBadRequest();
+    }
+    if (approval.sessionBinding === "none") {
+        return yield* loginApprovalNoSessionBindingDenied();
+    }
+    const sameDeviceSecret = approval.sameDeviceRequired
+        ? yield* dependencies.loginApprovalPendingCookie
+            .read(new Request("http://localhost", { headers: request.headers }))
+            .pipe(Effect.flatMap((secret) => Option.isSome(secret)
+            ? Effect.succeed(secret.value)
+            : Effect.fail(loginApprovalSameDeviceDenied())))
+        : undefined;
+    const consumed = yield* dependencies.authFlowState
+        .consume(input.flowId, sameDeviceSecret)
+        .pipe(Effect.mapError(() => approval.sameDeviceRequired
+        ? loginApprovalSameDeviceDenied()
+        : loginApprovalBadRequest()));
+    if (consumed.userId !== approval.userId) {
+        return yield* loginApprovalBadRequest();
+    }
+    if (approval.markEmailVerified === true) {
+        const updated = yield* dependencies.users
+            .markEmailVerified({
+            userId: approval.userId,
+            updatedAt: yield* currentUnixMillis,
+        })
+            .pipe(Effect.mapError(() => passwordInternalError("Failed to mark email verified")));
+        if (Option.isNone(updated)) {
+            return yield* loginApprovalBadRequest();
+        }
+    }
+    const result = yield* dependencies.authFlow
+        .complete(consumed)
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to complete login approval")));
+    const setCookies = yield* trustedDeviceSetCookies({
+        trustedDevice: dependencies.trustedDevice,
+        trustedDeviceCookie: dependencies.trustedDeviceCookie,
+        userId: consumed.userId,
+        rememberDevice: input.rememberDevice,
+    });
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session, { setCookies });
+});
+export const makeLoginApprovalStatusHandler = (dependencies) => Effect.fn("auth.http.login_approval.status")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.status");
+    if (dependencies.loginApprovalReview === undefined) {
+        return yield* loginApprovalReviewNotConfigured();
+    }
+    const input = loginApprovalStatusInput(payload);
+    const recordOption = yield* dependencies.loginApprovalReview
+        .status({ approvalChallengeId: input.approvalChallengeId })
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to load login approval review")));
+    if (Option.isNone(recordOption)) {
+        return yield* loginApprovalBadRequest();
+    }
+    const record = recordOption.value;
+    if (record.flowId !== input.flowId) {
+        return yield* loginApprovalBadRequest();
+    }
+    const now = yield* currentUnixMillis;
+    const status = Number(record.expiresAt) <= Number(now)
+        ? "expired"
+        : record.status;
+    return {
+        status,
+        expiresAt: record.expiresAt,
+    };
+});
+export const makeLoginApprovalFinalizeHandler = (dependencies) => Effect.fn("auth.http.login_approval.finalize")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.finalize");
+    if (dependencies.loginApprovalFinalize === undefined) {
+        return yield* loginApprovalFinalizeNotConfigured();
+    }
+    const input = loginApprovalFinalizeInput(payload);
+    const sameDeviceSecret = yield* dependencies.loginApprovalPendingCookie.read(new Request("http://localhost", { headers: request.headers }));
+    const result = yield* dependencies.loginApprovalFinalize
+        .complete({
+        flowId: input.flowId,
+        approvalChallengeId: input.approvalChallengeId,
+        ...(Option.isSome(sameDeviceSecret)
+            ? { sameDeviceSecret: sameDeviceSecret.value }
+            : {}),
+    })
+        .pipe(Effect.mapError((error) => error._tag === "AuthFlowStateError"
+        ? loginApprovalSameDeviceDenied()
+        : passwordInternalError("Failed to finalize login approval")));
+    if (result._tag === "PolicyDenied") {
+        return yield* loginApprovalPolicyDenied(result.reason);
+    }
+    const setCookies = yield* trustedDeviceSetCookies({
+        trustedDevice: dependencies.trustedDevice,
+        trustedDeviceCookie: dependencies.trustedDeviceCookie,
+        userId: result.session.userId,
+        rememberDevice: input.rememberDevice,
+    });
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session, { setCookies });
+});
+export class PasswordApi extends HttpApiGroup.make("password")
+    .add(passwordSignInEndpoint.middleware(AuthRateLimitMiddleware), passwordSignUpEndpoint.middleware(AuthRateLimitMiddleware), passwordResetStartEndpoint.middleware(AuthRateLimitMiddleware), passwordResetVerifyEndpoint.middleware(AuthRateLimitMiddleware), passwordSetEndpoint.middleware(AuthOriginCheckMiddleware), passwordChangeEndpoint.middleware(AuthOriginCheckMiddleware))
+    .prefix("/auth/password")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class SessionApi extends HttpApiGroup.make("session")
+    .add(currentSessionEndpoint, refreshSessionEndpoint.middleware(AuthOriginCheckMiddleware), logoutEndpoint.middleware(AuthOriginCheckMiddleware), listSessionsEndpoint, revokeSessionEndpoint.middleware(AuthOriginCheckMiddleware), revokeOtherSessionsEndpoint.middleware(AuthOriginCheckMiddleware))
+    .prefix("/auth") {
+}
+export class AdminSessionApi extends HttpApiGroup.make("adminSession")
+    .add(adminSessionListEndpoint, adminSessionRevokeEndpoint, adminSessionRevokeAllEndpoint)
+    .prefix("/auth/admin/sessions")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class AdminSessionHttpApi extends HttpApi.make("AdminSessionHttpApi").add(AdminSessionApi) {
+}
+export class EmailVerificationApi extends HttpApiGroup.make("emailVerification")
+    .add(emailVerificationStartEndpoint.middleware(AuthRateLimitMiddleware), emailVerificationVerifyEndpoint)
+    .prefix("/auth/email-verification")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class EmailOtpApi extends HttpApiGroup.make("emailOtp")
+    .add(emailOtpStartEndpoint.middleware(AuthRateLimitMiddleware), emailOtpVerifyEndpoint.middleware(AuthRateLimitMiddleware))
+    .prefix("/auth/email-otp")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class MagicLinkApi extends HttpApiGroup.make("magicLink")
+    .add(magicLinkStartEndpoint.middleware(AuthRateLimitMiddleware), magicLinkVerifyEndpoint.middleware(AuthRateLimitMiddleware))
+    .prefix("/auth/magic-link")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class OAuthApi extends HttpApiGroup.make("oauth")
+    .add(oauthAuthorizationStartEndpoint, oauthAccountUnlinkEndpoint, oauthLinkConfirmationStartEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationConfirmEndpoint)
+    .prefix("/auth/oauth")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class OAuthTokenApi extends HttpApiGroup.make("oauthToken")
+    .add(oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint)
+    .prefix("/auth/oauth")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class OAuthTokenHttpApi extends HttpApi.make("OAuthTokenHttpApi").add(OAuthTokenApi) {
+}
+export class OAuthProviderAuthorizationApi extends HttpApiGroup.make("oauthProviderAuthorization")
+    .add(oauthProviderAuthorizeEndpoint)
+    .prefix("/auth/oauth")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class OAuthProviderAuthorizationHttpApi extends HttpApi.make("OAuthProviderAuthorizationHttpApi").add(OAuthProviderAuthorizationApi) {
+}
+export class LoginApprovalApi extends HttpApiGroup.make("loginApproval")
+    .add(loginApprovalApproveEndpoint, loginApprovalStatusEndpoint, loginApprovalFinalizeEndpoint)
+    .prefix("/auth/login-approval")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class MfaApi extends HttpApiGroup.make("mfa")
+    .add(mfaOptionsEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint)
+    .prefix("/auth/mfa")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class StepUpApi extends HttpApiGroup.make("stepUp")
+    .add(stepUpOptionsEndpoint, stepUpTotpVerifyEndpoint, stepUpRecoveryCodeVerifyEndpoint, stepUpPasskeyStartEndpoint, stepUpPasskeyVerifyEndpoint)
+    .prefix("/auth/step-up")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class ApiKeyApi extends HttpApiGroup.make("apiKey")
+    .add(apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint)
+    .prefix("/auth/api-keys")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class RefreshTokenApi extends HttpApiGroup.make("refreshToken")
+    .add(refreshTokenRefreshEndpoint)
+    .prefix("/auth/token")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class JwtApi extends HttpApiGroup.make("jwt")
+    .add(jwtIntrospectEndpoint, jwtRevokeEndpoint)
+    .prefix("/auth/jwt")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class JwtDiscoveryApi extends HttpApiGroup.make("jwtDiscovery")
+    .add(jwtJwksEndpoint)
+    .prefix("/.well-known")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class JwtDiscoveryHttpApi extends HttpApi.make("JwtDiscoveryHttpApi").add(JwtDiscoveryApi) {
+}
+export class OidcDiscoveryApi extends HttpApiGroup.make("oidcDiscovery")
+    .add(oidcDiscoveryMetadataEndpoint)
+    .prefix("/.well-known")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class OidcDiscoveryHttpApi extends HttpApi.make("OidcDiscoveryHttpApi").add(OidcDiscoveryApi) {
+}
+export class SecurityApi extends HttpApiGroup.make("security")
+    .add(loginNotificationReportEndpoint)
+    .prefix("/auth/security")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class SecurityTimelineApi extends HttpApiGroup.make("securityTimeline")
+    .add(securityTimelineListEndpoint)
+    .prefix("/auth/security")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class SecurityTimelineHttpApi extends HttpApi.make("SecurityTimelineHttpApi")
+    .add(SecurityTimelineApi) {
+}
+export class AdminSecurityTimelineApi extends HttpApiGroup.make("adminSecurityTimeline")
+    .add(adminSecurityTimelineListEndpoint)
+    .prefix("/auth/admin/security")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class AdminSecurityTimelineHttpApi extends HttpApi.make("AdminSecurityTimelineHttpApi").add(AdminSecurityTimelineApi) {
+}
+export class TrustedDeviceApi extends HttpApiGroup.make("trustedDevice")
+    .add(trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint)
+    .prefix("/auth/trusted-devices")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class TrustedDeviceHttpApi extends HttpApi.make("TrustedDeviceHttpApi")
+    .add(TrustedDeviceApi) {
+}
+export class AdminTrustedDeviceApi extends HttpApiGroup.make("adminTrustedDevice")
+    .add(adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint)
+    .prefix("/auth/admin/trusted-devices")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class AdminTrustedDeviceHttpApi extends HttpApi.make("AdminTrustedDeviceHttpApi").add(AdminTrustedDeviceApi) {
+}
+export class AuthApi extends HttpApi.make("AuthApi")
+    .add(PasswordApi)
+    .add(SessionApi)
+    .add(EmailVerificationApi)
+    .add(EmailOtpApi)
+    .add(MagicLinkApi)
+    .add(LoginApprovalApi)
+    .add(SecurityApi) {
+}
+export const PasswordApiLive = HttpApiBuilder.group(AuthApi, "password", Effect.fn("auth.http.password.group")(function* (handlers) {
+    const password = yield* PasswordLogin;
+    const registration = yield* PasswordRegistration;
+    const passwordReset = yield* PasswordReset;
+    const passwordManagement = yield* PasswordManagement;
+    const authHttp = yield* AuthHttp;
+    const emailVerificationFlow = yield* EmailVerificationFlow;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    return handlers
+        .handle("signIn", makePasswordSignInHandler({
+        password,
+        authHttp,
+        emailVerificationFlow,
+        authApiRateLimit,
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }))
+        .handle("signUp", makePasswordSignUpHandler({
+        registration,
+        authHttp,
+        emailVerificationFlow,
+        authApiRateLimit,
+    }))
+        .handle("resetStart", makePasswordResetStartHandler({
+        passwordReset,
+        authApiRateLimit,
+    }))
+        .handle("resetVerify", makePasswordResetVerifyHandler({
+        passwordReset,
+    }))
+        .handle("set", makePasswordSetHandler({
+        passwordManagement,
+        sessions,
+        sessionCookie,
+    }))
+        .handle("change", makePasswordChangeHandler({
+        passwordManagement,
+        sessions,
+        sessionCookie,
+    }));
+}));
+export const SessionApiLive = HttpApiBuilder.group(AuthApi, "session", Effect.fn("auth.http.session.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authHttp = yield* AuthHttp;
+    return handlers
+        .handle("current", makeCurrentSessionHandler({ sessions, sessionCookie, authHttp }))
+        .handle("refresh", makeRefreshSessionHandler({ sessions, sessionCookie, authHttp }))
+        .handle("logout", makeLogoutHandler({ sessions, sessionCookie, authHttp }))
+        .handle("list", makeListSessionsHandler({ sessions, sessionCookie }))
+        .handle("revoke", makeRevokeSessionHandler({ sessions, sessionCookie, authHttp }))
+        .handle("revokeOthers", makeRevokeOtherSessionsHandler({ sessions, sessionCookie }));
+}));
+export const AdminSessionApiLive = HttpApiBuilder.group(AdminSessionHttpApi, "adminSession", Effect.fn("auth.http.admin_session.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authorization = yield* AdminSessionAuthorization;
+    return handlers
+        .handle("list", makeAdminSessionListHandler({ sessions, sessionCookie, authorization }))
+        .handle("revoke", makeAdminSessionRevokeHandler({ sessions, sessionCookie, authorization }))
+        .handle("revokeAll", makeAdminSessionRevokeAllHandler({
+        sessions,
+        sessionCookie,
+        authorization,
+    }));
+}));
+export const AdminSessionHttpApiLive = HttpApiBuilder.layer(AdminSessionHttpApi).pipe(Layer.provide(AdminSessionApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const EmailVerificationApiLive = HttpApiBuilder.group(AuthApi, "emailVerification", Effect.fn("auth.http.email_verification.group")(function* (handlers) {
+    const emailVerificationFlow = yield* EmailVerificationFlow;
+    const emailVerification = yield* EmailVerification;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    return handlers
+        .handle("start", makeEmailVerificationStartHandler({
+        emailVerificationFlow,
+        authApiRateLimit,
+    }))
+        .handle("verify", makeEmailVerificationVerifyHandler({
+        emailVerification,
+        sessions,
+        sessionCookie,
+    }));
+}));
+export const EmailOtpApiLive = HttpApiBuilder.group(AuthApi, "emailOtp", Effect.fn("auth.http.email_otp.group")(function* (handlers) {
+    const emailOtp = yield* EmailOtpLogin;
+    const authHttp = yield* AuthHttp;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    return handlers
+        .handle("start", makeEmailOtpStartHandler({ emailOtp, authApiRateLimit }))
+        .handle("verify", makeEmailOtpVerifyHandler({
+        emailOtp,
+        authHttp,
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }));
+}));
+export const MagicLinkApiLive = HttpApiBuilder.group(AuthApi, "magicLink", Effect.fn("auth.http.magic_link.group")(function* (handlers) {
+    const magicLink = yield* MagicLinkLogin;
+    const authHttp = yield* AuthHttp;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    return handlers
+        .handle("start", makeMagicLinkStartHandler({ magicLink, authApiRateLimit }))
+        .handle("verify", makeMagicLinkVerifyHandler({
+        magicLink,
+        authHttp,
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }));
+}));
+export const LoginApprovalApiLive = HttpApiBuilder.group(AuthApi, "loginApproval", Effect.fn("auth.http.login_approval.group")(function* (handlers) {
+    const loginApproval = yield* LoginApproval;
+    const authFlowState = yield* AuthFlowState;
+    const authFlow = yield* AuthFlow;
+    const users = yield* UserStore;
+    const authHttp = yield* AuthHttp;
+    const loginApprovalReview = yield* Effect.serviceOption(LoginApprovalReview);
+    const loginApprovalFinalize = yield* Effect.serviceOption(LoginApprovalFinalize);
+    const pendingCookieOption = yield* Effect.serviceOption(LoginApprovalPendingCookie);
+    const trustedDevice = yield* Effect.serviceOption(TrustedDevice);
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    const loginApprovalPendingCookie = Option.isSome(pendingCookieOption)
+        ? pendingCookieOption.value
+        : makeLoginApprovalPendingCookie();
+    return handlers
+        .handle("approve", makeLoginApprovalApproveHandler({
+        loginApproval,
+        authFlowState,
+        authFlow,
+        users,
+        authHttp,
+        loginApprovalPendingCookie,
+        ...(Option.isSome(trustedDevice)
+            ? { trustedDevice: trustedDevice.value }
+            : {}),
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }))
+        .handle("status", makeLoginApprovalStatusHandler(Option.isSome(loginApprovalReview)
+        ? { loginApprovalReview: loginApprovalReview.value }
+        : {}))
+        .handle("finalize", makeLoginApprovalFinalizeHandler({
+        authHttp,
+        loginApprovalPendingCookie,
+        ...(Option.isSome(loginApprovalFinalize)
+            ? { loginApprovalFinalize: loginApprovalFinalize.value }
+            : {}),
+        ...(Option.isSome(trustedDevice)
+            ? { trustedDevice: trustedDevice.value }
+            : {}),
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }));
+}));
+export const SecurityApiLive = HttpApiBuilder.group(AuthApi, "security", Effect.fn("auth.http.security.group")(function* (handlers) {
+    const loginNotification = yield* Effect.serviceOption(LoginNotification);
+    return handlers.handle("reportLogin", makeLoginNotificationReportHandler(Option.isSome(loginNotification)
+        ? { loginNotification: loginNotification.value }
+        : {}));
+}));
+export const SecurityTimelineApiLive = HttpApiBuilder.group(SecurityTimelineHttpApi, "securityTimeline", Effect.fn("auth.http.security_timeline.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const securityTimeline = yield* SecurityTimelineStore;
+    return handlers.handle("list", makeSecurityTimelineListHandler({
+        sessions,
+        sessionCookie,
+        securityTimeline,
+    }));
+}));
+export const SecurityTimelineHttpApiLive = HttpApiBuilder.layer(SecurityTimelineHttpApi).pipe(Layer.provide(SecurityTimelineApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OAuthProviderAuthorizationApiLive = HttpApiBuilder.group(OAuthProviderAuthorizationHttpApi, "oauthProviderAuthorization", Effect.fn("auth.http.oauth_provider_authorization.group")(function* (handlers) {
+    const authorization = yield* OAuthProviderAuthorization;
+    return handlers.handle("authorize", makeOAuthProviderAuthorizationHandler({ authorization }));
+}));
+export const OAuthProviderAuthorizationHttpApiLive = HttpApiBuilder.layer(OAuthProviderAuthorizationHttpApi).pipe(Layer.provide(OAuthProviderAuthorizationApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OAuthTokenApiLive = HttpApiBuilder.group(OAuthTokenHttpApi, "oauthToken", Effect.fn("auth.http.oauth_token.group")(function* (handlers) {
+    const tokenGrant = yield* OAuthAuthorizationCodeTokenGrant;
+    const refreshTokenGrant = yield* Effect.serviceOption(OAuthRefreshTokenGrant);
+    const clientCredentialsGrant = yield* Effect.serviceOption(OAuthClientCredentialsGrant);
+    const tokenIntrospection = yield* Effect.serviceOption(OAuthTokenIntrospection);
+    const tokenRevocation = yield* Effect.serviceOption(OAuthTokenRevocation);
+    return handlers
+        .handle("token", makeOAuthAuthorizationCodeTokenHandler({
+        tokenGrant,
+        ...(Option.isNone(refreshTokenGrant)
+            ? {}
+            : { refreshTokenGrant: refreshTokenGrant.value }),
+        ...(Option.isNone(clientCredentialsGrant)
+            ? {}
+            : { clientCredentialsGrant: clientCredentialsGrant.value }),
+    }))
+        .handle("introspect", Option.isNone(tokenIntrospection)
+        ? makeOAuthTokenIntrospectionNotConfiguredHandler()
+        : makeOAuthTokenIntrospectionHandler({
+            tokenIntrospection: tokenIntrospection.value,
+        }))
+        .handle("revoke", Option.isNone(tokenRevocation)
+        ? makeOAuthTokenRevocationNotConfiguredHandler()
+        : makeOAuthTokenRevocationHandler({
+            tokenRevocation: tokenRevocation.value,
+        }));
+}));
+export const OAuthTokenHttpApiLive = HttpApiBuilder.layer(OAuthTokenHttpApi).pipe(Layer.provide(OAuthTokenApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const JwtDiscoveryApiLive = HttpApiBuilder.group(JwtDiscoveryHttpApi, "jwtDiscovery", Effect.fn("auth.http.jwt_discovery.group")(function* (handlers) {
+    const jwks = yield* Jwks;
+    return handlers.handle("jwks", makeJwtJwksHandler({ jwks }));
+}));
+export const JwtDiscoveryHttpApiLive = HttpApiBuilder.layer(JwtDiscoveryHttpApi).pipe(Layer.provide(JwtDiscoveryApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OidcDiscoveryApiLive = HttpApiBuilder.group(OidcDiscoveryHttpApi, "oidcDiscovery", Effect.fn("auth.http.oidc_discovery.group")(function* (handlers) {
+    const metadata = yield* OidcDiscoveryMetadata;
+    return handlers.handle("openidConfiguration", makeOidcDiscoveryMetadataHandler({ metadata }));
+}));
+export const OidcDiscoveryHttpApiLive = HttpApiBuilder.layer(OidcDiscoveryHttpApi).pipe(Layer.provide(OidcDiscoveryApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminSecurityTimelineApiLive = HttpApiBuilder.group(AdminSecurityTimelineHttpApi, "adminSecurityTimeline", Effect.fn("auth.http.admin_security_timeline.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const securityTimeline = yield* SecurityTimelineStore;
+    const authorization = yield* AdminSecurityTimelineAuthorization;
+    return handlers.handle("list", makeAdminSecurityTimelineListHandler({
+        sessions,
+        sessionCookie,
+        securityTimeline,
+        authorization,
+    }));
+}));
+export const AdminSecurityTimelineHttpApiLive = HttpApiBuilder.layer(AdminSecurityTimelineHttpApi).pipe(Layer.provide(AdminSecurityTimelineApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const TrustedDeviceApiLive = HttpApiBuilder.group(TrustedDeviceHttpApi, "trustedDevice", Effect.fn("auth.http.trusted_device.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const trustedDevices = yield* TrustedDeviceStore;
+    return handlers
+        .handle("list", makeTrustedDeviceListHandler({ sessions, sessionCookie, trustedDevices }))
+        .handle("revoke", makeTrustedDeviceRevokeHandler({ sessions, sessionCookie, trustedDevices }));
+}));
+export const TrustedDeviceHttpApiLive = HttpApiBuilder.layer(TrustedDeviceHttpApi).pipe(Layer.provide(TrustedDeviceApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminTrustedDeviceApiLive = HttpApiBuilder.group(AdminTrustedDeviceHttpApi, "adminTrustedDevice", Effect.fn("auth.http.admin_trusted_device.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const trustedDevices = yield* TrustedDeviceStore;
+    const authorization = yield* AdminTrustedDeviceAuthorization;
+    return handlers
+        .handle("list", makeAdminTrustedDeviceListHandler({
+        sessions,
+        sessionCookie,
+        trustedDevices,
+        authorization,
+    }))
+        .handle("revoke", makeAdminTrustedDeviceRevokeHandler({
+        sessions,
+        sessionCookie,
+        trustedDevices,
+        authorization,
+    }));
+}));
+export const AdminTrustedDeviceHttpApiLive = HttpApiBuilder.layer(AdminTrustedDeviceHttpApi).pipe(Layer.provide(AdminTrustedDeviceApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+const AuthHttpApiBaseLive = HttpApiBuilder.layer(AuthApi).pipe(Layer.provide(PasswordApiLive), Layer.provide(SessionApiLive), Layer.provide(EmailVerificationApiLive), Layer.provide(EmailOtpApiLive), Layer.provide(MagicLinkApiLive), Layer.provide(LoginApprovalApiLive), Layer.provide(SecurityApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AuthHttpApiBareLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitNoopLive));
+export const AuthHttpApiLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitLive));
+export { AuthResult };
+//# sourceMappingURL=Api.js.map