@effect-auth/core 0.1.0-alpha.10 → 0.1.0-alpha.13

package/dist/HttpApi/Api.js

@@ -1,22 +1,26 @@
-import { Effect, Layer, Option, Redacted } from "effect";
-import { HttpServerResponse } from "effect/unstable/http";
+import { Context, Effect, Encoding, Layer, Option, Redacted, Result } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { HttpApi, HttpApiBuilder, HttpApiGroup } from "effect/unstable/httpapi";
 import { ApiKeyId } from "../ApiKey.js";
+import { Jwks } from "../Jwt.js";
 import { AuthFlow, AuthFlowState, AuthResult, LoginApprovalFinalize, } from "../AuthFlow.js";
 import { EmailOtpLogin } from "../EmailOtp.js";
 import { EmailDeliveryError, EmailVerification, EmailVerificationFlow, EmailVerificationIssueError, } from "../EmailVerification.js";
+import { OAuthClientId as makeOAuthClientId } from "../Identifiers.js";
 import { currentUnixMillis } from "../Internal.js";
 import { LoginApproval, LoginApprovalReview } from "../LoginApproval.js";
 import { LoginNotification } from "../LoginNotification.js";
 import { MagicLinkLogin } from "../MagicLink.js";
+import { OAuthAuthorizationCode, OAuthAuthorizationCodeTokenGrant, OAuthClientCredentialsGrant, OAuthProviderAuthorization, OAuthRefreshToken, OAuthRefreshTokenGrant, OAuthTokenIntrospection, OAuthTokenRevocation, OAuthCodeVerifier as makeOAuthCodeVerifier, } from "../OAuth.js";
 import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset, } from "../Password.js";
 import { PasskeyCredentialId } from "../Passkey.js";
 import { CurrentSession, SessionCookie, Sessions, sessionRequestMetadataKey, upgradeCurrentSession, } from "../Sessions.js";
 import { SecurityTimelineStore } from "../SecurityTimeline.js";
 import { UserStore } from "../Storage.js";
 import { TrustedDevice, TrustedDeviceCookie, TrustedDeviceStore, } from "../TrustedDevice.js";
-import { apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint, currentSessionEndpoint, emailOtpStartEndpoint, emailOtpVerifyEndpoint, emailVerificationStartEndpoint, emailVerificationVerifyEndpoint, loginApprovalApproveEndpoint, loginApprovalFinalizeEndpoint, loginApprovalStatusEndpoint, loginNotificationReportEndpoint, jwtIntrospectEndpoint, jwtRevokeEndpoint, listSessionsEndpoint, logoutEndpoint, magicLinkStartEndpoint, magicLinkVerifyEndpoint, mfaOptionsEndpoint, oauthAccountUnlinkEndpoint, oauthAuthorizationStartEndpoint, oauthLinkConfirmationConfirmEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationStartEndpoint, passwordChangeEndpoint, passwordResetStartEndpoint, passwordResetVerifyEndpoint, passwordSetEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, refreshTokenRefreshEndpoint, refreshSessionEndpoint, revokeOtherSessionsEndpoint, revokeSessionEndpoint, securityTimelineListEndpoint, stepUpOptionsEndpoint, stepUpPasskeyStartEndpoint, stepUpPasskeyVerifyEndpoint, stepUpRecoveryCodeVerifyEndpoint, stepUpTotpVerifyEndpoint, trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, } from "./Endpoints.js";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, } from "./Errors.js";
+import { adminSecurityTimelineListEndpoint, adminSessionListEndpoint, adminSessionRevokeAllEndpoint, adminSessionRevokeEndpoint, adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint, apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint, currentSessionEndpoint, emailOtpStartEndpoint, emailOtpVerifyEndpoint, emailVerificationStartEndpoint, emailVerificationVerifyEndpoint, loginApprovalApproveEndpoint, loginApprovalFinalizeEndpoint, loginApprovalStatusEndpoint, loginNotificationReportEndpoint, jwtIntrospectEndpoint, jwtJwksEndpoint, jwtRevokeEndpoint, listSessionsEndpoint, logoutEndpoint, magicLinkStartEndpoint, magicLinkVerifyEndpoint, mfaOptionsEndpoint, oauthAccountUnlinkEndpoint, oauthAuthorizationStartEndpoint, oauthLinkConfirmationConfirmEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationStartEndpoint, oauthProviderAuthorizeEndpoint, oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint, oidcDiscoveryMetadataEndpoint, passwordChangeEndpoint, passwordResetStartEndpoint, passwordResetVerifyEndpoint, passwordSetEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, refreshTokenRefreshEndpoint, refreshSessionEndpoint, revokeOtherSessionsEndpoint, revokeSessionEndpoint, securityTimelineListEndpoint, stepUpOptionsEndpoint, stepUpPasskeyStartEndpoint, stepUpPasskeyVerifyEndpoint, stepUpRecoveryCodeVerifyEndpoint, stepUpTotpVerifyEndpoint, trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, } from "./Endpoints.js";
+import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError, } from "./Errors.js";
+import { OAuthProviderAuthorizationQuery, OAuthTokenRequestBody, OAuthTokenIntrospectionRequestBody, OAuthTokenIntrospectionResponseBody, OAuthTokenRevocationRequestBody, } from "./Schemas.js";
 import { AuthApiRateLimit, AuthApiRateLimitLive, AuthApiRateLimitNoopLive, AuthHttpApiConfig, AuthOriginCheckMiddleware, AuthOriginCheckMiddlewareConfigLive, AuthRateLimitMiddleware, makeAuthRequestMetadata, } from "./Security.js";
 import { AuthHttp, LoginApprovalPendingCookie, makeLoginApprovalPendingCookie, } from "./Transport.js";
 const canStartRequiredEmailVerification = (result) => result._tag === "RequiresEmailVerification" &&
@@ -257,6 +261,259 @@ export const oauthAuthorizationCallbackInput = (payload, options) => Effect.gen(
             : { tokenParams: options.tokenParams }),
     };
 });
+const oauthTokenTextDecoder = new TextDecoder();
+const oauthTokenEndpointError = (reason, errorDescription) => new OAuthTokenEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthTokenRevocationEndpointError = (reason, errorDescription) => new OAuthTokenRevocationEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthTokenIntrospectionEndpointError = (reason, errorDescription) => new OAuthTokenIntrospectionEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthAuthorizationEndpointError = (reason, errorDescription) => new OAuthAuthorizationEndpointError({
+    error: reason,
+    ...(errorDescription === undefined ? {} : { errorDescription }),
+});
+const oauthAuthorizationRedirect = (redirectUri, params) => {
+    const url = new URL(redirectUri);
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined) {
+            url.searchParams.set(key, value);
+        }
+    }
+    return HttpServerResponse.empty({
+        status: 302,
+        headers: { location: url.toString() },
+    });
+};
+const oauthTokenGrantString = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+const formUrlDecodeComponent = (value) => {
+    try {
+        return new URLSearchParams(`value=${value}`).get("value") ?? value;
+    }
+    catch {
+        return value;
+    }
+};
+const decodeOAuthBasicAuthentication = (request, invalidClient) => {
+    const { authorization } = request.headers;
+    if (authorization === undefined || authorization.trim() === "") {
+        return Effect.succeed(Option.none());
+    }
+    if (!authorization.toLowerCase().startsWith("basic ")) {
+        return Effect.fail(invalidClient());
+    }
+    const encoded = authorization.slice("Basic ".length).trim();
+    if (encoded === "") {
+        return Effect.fail(invalidClient());
+    }
+    return Result.match(Encoding.decodeBase64(encoded), {
+        onFailure: () => Effect.fail(invalidClient()),
+        onSuccess: (bytes) => {
+            const decoded = oauthTokenTextDecoder.decode(bytes);
+            const separator = decoded.indexOf(":");
+            if (separator <= 0) {
+                return Effect.fail(invalidClient());
+            }
+            const clientId = oauthTokenGrantString(formUrlDecodeComponent(decoded.slice(0, separator)));
+            const clientSecret = formUrlDecodeComponent(decoded.slice(separator + 1));
+            if (clientId === undefined || clientSecret === "") {
+                return Effect.fail(invalidClient());
+            }
+            return Effect.succeed(Option.some({
+                clientId: makeOAuthClientId(clientId),
+                method: "client_secret_basic",
+                clientSecret: Redacted.make(clientSecret),
+            }));
+        },
+    });
+};
+const oauthTokenRequestBody = (request) => HttpServerRequest.schemaBodyUrlParams(OAuthTokenRequestBody).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.mapError(() => oauthTokenEndpointError("invalid_request")));
+const oauthTokenRevocationRequestBody = (request) => HttpServerRequest.schemaBodyUrlParams(OAuthTokenRevocationRequestBody).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.mapError(() => oauthTokenRevocationEndpointError("invalid_request")));
+const oauthTokenIntrospectionRequestBody = (request) => HttpServerRequest.schemaBodyUrlParams(OAuthTokenIntrospectionRequestBody).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.mapError(() => oauthTokenIntrospectionEndpointError("invalid_request")));
+const oauthPostClientAuthentication = (payload) => {
+    const clientSecret = oauthTokenGrantString(payload.client_secret);
+    const clientId = oauthTokenGrantString(payload.client_id);
+    if (clientSecret === undefined) {
+        return undefined;
+    }
+    return clientId === undefined
+        ? undefined
+        : {
+            clientId: makeOAuthClientId(clientId),
+            method: "client_secret_post",
+            clientSecret: Redacted.make(clientSecret),
+        };
+};
+const oauthClientEndpointAuthentication = (input) => Effect.gen(function* () {
+    const basicAuth = yield* decodeOAuthBasicAuthentication(input.request, input.invalidClient);
+    const postAuth = oauthPostClientAuthentication(input.payload);
+    if (Option.isSome(basicAuth) && input.payload.client_secret !== undefined) {
+        return yield* Effect.fail(input.invalidRequest());
+    }
+    if (input.payload.client_secret !== undefined && postAuth === undefined) {
+        return yield* Effect.fail(input.invalidRequest());
+    }
+    const authentication = Option.isSome(basicAuth) ? basicAuth.value : postAuth;
+    const payloadClientId = oauthTokenGrantString(input.payload.client_id);
+    if (authentication !== undefined &&
+        payloadClientId !== undefined &&
+        authentication.clientId !== payloadClientId) {
+        return yield* Effect.fail(input.invalidRequest());
+    }
+    const clientAuthenticated = authentication === undefined
+        ? false
+        : yield* Effect.gen(function* () {
+            if (input.authenticateClient === undefined) {
+                return yield* Effect.fail(input.invalidClient());
+            }
+            const authenticated = yield* input
+                .authenticateClient({
+                clientId: authentication.clientId,
+                method: authentication.method,
+                clientSecret: authentication.clientSecret,
+                request: input.request,
+            })
+                .pipe(Effect.mapError(() => oauthInternalError("Failed to authenticate OAuth client")));
+            if (!authenticated) {
+                return yield* Effect.fail(input.invalidClient());
+            }
+            return true;
+        });
+    const clientId = authentication === undefined
+        ? payloadClientId === undefined
+            ? undefined
+            : makeOAuthClientId(payloadClientId)
+        : authentication.clientId;
+    return {
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    };
+});
+const oauthTokenResponseHttpBody = (tokens) => ({
+    access_token: Redacted.value(tokens.accessToken),
+    token_type: tokens.tokenType,
+    ...(tokens.expiresIn === undefined ? {} : { expires_in: tokens.expiresIn }),
+    ...(tokens.refreshToken === undefined
+        ? {}
+        : { refresh_token: Redacted.value(tokens.refreshToken) }),
+    ...(tokens.idToken === undefined
+        ? {}
+        : { id_token: Redacted.value(tokens.idToken) }),
+    ...(tokens.scopes === undefined ? {} : { scope: tokens.scopes.join(" ") }),
+    ...(tokens.extra === undefined ? {} : { extra: tokens.extra }),
+});
+const oauthUnixMillisToSeconds = (value) => Math.floor(Number(value) / 1000);
+const oauthTokenIntrospectionResponseHttpBody = (introspection) => {
+    if (!introspection.active) {
+        return { active: false };
+    }
+    return {
+        active: true,
+        ...(introspection.scopes === undefined
+            ? {}
+            : { scope: introspection.scopes.join(" ") }),
+        ...(introspection.clientId === undefined
+            ? {}
+            : { client_id: String(introspection.clientId) }),
+        ...(introspection.username === undefined
+            ? {}
+            : { username: introspection.username }),
+        ...(introspection.tokenType === undefined
+            ? {}
+            : { token_type: introspection.tokenType }),
+        ...(introspection.expiresAt === undefined
+            ? {}
+            : { exp: oauthUnixMillisToSeconds(introspection.expiresAt) }),
+        ...(introspection.issuedAt === undefined
+            ? {}
+            : { iat: oauthUnixMillisToSeconds(introspection.issuedAt) }),
+        ...(introspection.notBefore === undefined
+            ? {}
+            : { nbf: oauthUnixMillisToSeconds(introspection.notBefore) }),
+        ...(introspection.subject === undefined ? {} : { sub: introspection.subject }),
+        ...(introspection.audience === undefined
+            ? {}
+            : {
+                aud: Array.isArray(introspection.audience)
+                    ? [...introspection.audience]
+                    : introspection.audience,
+            }),
+        ...(introspection.issuer === undefined ? {} : { iss: introspection.issuer }),
+        ...(introspection.jwtId === undefined ? {} : { jti: introspection.jwtId }),
+        ...(introspection.extra === undefined ? {} : { extra: introspection.extra }),
+    };
+};
+const oauthRefreshTokenResponse = (input) => Effect.gen(function* () {
+    if (input.dependencies.refreshTokenGrant === undefined) {
+        return yield* oauthTokenEndpointError("unsupported_grant_type");
+    }
+    const refreshToken = oauthTokenGrantString(input.payload.refresh_token);
+    const scope = oauthTokenGrantString(input.payload.scope);
+    const result = yield* input.dependencies.refreshTokenGrant
+        .exchange({
+        grantType: input.payload.grant_type,
+        ...(refreshToken === undefined
+            ? {}
+            : { refreshToken: Redacted.make(OAuthRefreshToken(refreshToken)) }),
+        ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+        ...(scope === undefined ? {} : { scopes: scope }),
+        clientAuthenticated: input.clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenEndpointError(result.reason);
+    }
+    return oauthTokenResponseHttpBody(result.tokens);
+});
+const oauthClientCredentialsTokenResponse = (input) => Effect.gen(function* () {
+    if (input.dependencies.clientCredentialsGrant === undefined) {
+        return yield* oauthTokenEndpointError("unsupported_grant_type");
+    }
+    const scope = oauthTokenGrantString(input.payload.scope);
+    const result = yield* input.dependencies.clientCredentialsGrant
+        .exchange({
+        grantType: input.payload.grant_type,
+        ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+        ...(scope === undefined ? {} : { scopes: scope }),
+        clientAuthenticated: input.clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenEndpointError(result.reason);
+    }
+    return oauthTokenResponseHttpBody(result.tokens);
+});
+const oauthAuthorizationCodeTokenResponse = (input) => Effect.gen(function* () {
+    const code = oauthTokenGrantString(input.payload.code);
+    const codeVerifier = oauthTokenGrantString(input.payload.code_verifier);
+    const redirectUri = oauthTokenGrantString(input.payload.redirect_uri);
+    const result = yield* input.dependencies.tokenGrant
+        .exchange({
+        grantType: input.payload.grant_type,
+        ...(code === undefined
+            ? {}
+            : { code: Redacted.make(OAuthAuthorizationCode(code)) }),
+        ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+        ...(redirectUri === undefined ? {} : { redirectUri }),
+        ...(codeVerifier === undefined
+            ? {}
+            : { codeVerifier: Redacted.make(makeOAuthCodeVerifier(codeVerifier)) }),
+        clientAuthenticated: input.clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenEndpointError(result.reason);
+    }
+    return oauthTokenResponseHttpBody(result.tokens);
+});
 const oauthLinkedAccountHttpBody = (account) => ({
     accountId: account.id,
     providerId: account.providerId,
@@ -593,6 +850,9 @@ const jwtIntrospectionHttpBody = (result) => result.active
             ? {}
             : { revokedReason: result.revokedReason }),
     };
+export const jwtJwksHttpBody = (document) => ({
+    keys: document.keys,
+});
 export const totpMfaVerifyInput = (payload, options = {}) => ({
     userId: payload.userId,
     code: Redacted.make(payload.code),
@@ -776,6 +1036,38 @@ const activeSessionBody = (session, currentSessionId) => {
         ...(session.metadata === undefined ? {} : { metadata: session.metadata }),
     };
 };
+export const adminSessionHttpBody = (session) => {
+    const request = sessionRequestMetadata(session.metadata);
+    const ip = metadataString(request, "ip");
+    const userAgent = metadataString(request, "userAgent");
+    const country = metadataString(request, "country");
+    const region = metadataString(request, "region");
+    const city = metadataString(request, "city");
+    const latitude = metadataNumber(request, "latitude");
+    const longitude = metadataNumber(request, "longitude");
+    return {
+        sessionId: session.sessionId,
+        userId: session.userId,
+        createdAt: session.createdAt,
+        authTime: session.authTime,
+        ...(session.lastSeenAt === undefined
+            ? {}
+            : { lastSeenAt: session.lastSeenAt }),
+        expiresAt: session.expiresAt,
+        aal: session.aal,
+        amr: session.amr,
+        ...(session.mfaVerifiedAt === undefined
+            ? {}
+            : { mfaVerifiedAt: session.mfaVerifiedAt }),
+        ...(ip === undefined ? {} : { ip }),
+        ...(userAgent === undefined ? {} : { userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+    };
+};
 export const stepUpAuthenticatedHttpBody = (session) => {
     const body = {
         type: "authenticated",
@@ -1050,6 +1342,27 @@ const trustedDeviceSetCookies = (dependencies) => Effect.gen(function* () {
     return [cookie];
 });
 const catchAuthApiRateLimit = (effect, internalMessage) => effect.pipe(Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(rateLimited(error.retryAfter))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(passwordInternalError(internalMessage))), Effect.catchTag("PrivacyError", () => Effect.fail(passwordInternalError(internalMessage))));
+export class AdminSessionAuthorization extends Context.Service()("auth/AdminSessionAuthorization") {
+}
+(function (AdminSessionAuthorization) {
+    AdminSessionAuthorization.make = (service) => AdminSessionAuthorization.of(service);
+})(AdminSessionAuthorization || (AdminSessionAuthorization = {}));
+export class AdminSecurityTimelineAuthorization extends Context.Service()("auth/AdminSecurityTimelineAuthorization") {
+}
+(function (AdminSecurityTimelineAuthorization) {
+    AdminSecurityTimelineAuthorization.make = (service) => AdminSecurityTimelineAuthorization.of(service);
+})(AdminSecurityTimelineAuthorization || (AdminSecurityTimelineAuthorization = {}));
+export class AdminTrustedDeviceAuthorization extends Context.Service()("auth/AdminTrustedDeviceAuthorization") {
+}
+(function (AdminTrustedDeviceAuthorization) {
+    AdminTrustedDeviceAuthorization.make = (service) => AdminTrustedDeviceAuthorization.of(service);
+})(AdminTrustedDeviceAuthorization || (AdminTrustedDeviceAuthorization = {}));
+export class OidcDiscoveryMetadata extends Context.Service()("auth/OidcDiscoveryMetadata") {
+}
+(function (OidcDiscoveryMetadata) {
+    OidcDiscoveryMetadata.make = (service) => OidcDiscoveryMetadata.of(service);
+})(OidcDiscoveryMetadata || (OidcDiscoveryMetadata = {}));
+export const OidcDiscoveryMetadataLive = (metadata) => Layer.succeed(OidcDiscoveryMetadata, OidcDiscoveryMetadata.make({ load: () => Effect.succeed(metadata) }));
 export const makePasswordSignInHandler = (dependencies) => Effect.fn("auth.http.password.sign_in")(function* ({ payload, request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_in");
     const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
@@ -1263,6 +1576,60 @@ export const makeRevokeOtherSessionsHandler = (dependencies) => Effect.fn("auth.
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
+export const makeAdminSessionListHandler = (dependencies) => Effect.fn("auth.http.admin_session.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: query.userId,
+        action: "list",
+        request,
+    });
+    const sessions = yield* dependencies.sessions
+        .listForUser({ userId: query.userId })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list admin sessions",
+    })));
+    return { sessions: sessions.map(adminSessionHttpBody) };
+});
+export const makeAdminSessionRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: payload.userId,
+        action: "revoke",
+        request,
+        sessionId: payload.sessionId,
+    });
+    yield* dependencies.sessions
+        .revokeForUser({
+        userId: payload.userId,
+        sessionId: payload.sessionId,
+        reason: "admin_revoked_session",
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke admin session",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeAdminSessionRevokeAllHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke_all")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.revoke_all");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: payload.userId,
+        action: "revoke_all",
+        request,
+    });
+    yield* dependencies.sessions.revokeAllForUser(payload.userId).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke admin sessions",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
 export const makeLoginNotificationReportHandler = (dependencies) => Effect.fn("auth.http.security.login_notification.report")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security.login_notification.report");
     if (dependencies.loginNotification === undefined) {
@@ -1314,6 +1681,7 @@ const securityTimelineListInput = (query, userId) => ({
     ...(query.types === undefined ? {} : { types: query.types }),
     ...(query.categories === undefined ? {} : { categories: query.categories }),
 });
+const adminSecurityTimelineListInput = (query) => securityTimelineListInput(query, query.userId);
 export const makeSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.security_timeline.list")(function* ({ query, request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security_timeline.list");
     const current = yield* readRequiredSession(dependencies, request);
@@ -1325,6 +1693,22 @@ export const makeSecurityTimelineListHandler = (dependencies) => Effect.fn("auth
     })));
     return { events: events.map(securityTimelineEventHttpBody) };
 });
+export const makeAdminSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.admin_security_timeline.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_security_timeline.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: query.userId,
+        request,
+    });
+    const events = yield* dependencies.securityTimeline
+        .listByUser(adminSecurityTimelineListInput(query))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list admin security timeline",
+    })));
+    return { events: events.map(securityTimelineEventHttpBody) };
+});
 export const trustedDeviceHttpBody = (device) => ({
     deviceId: device.tokenHash,
     createdAt: device.createdAt,
@@ -1358,6 +1742,45 @@ export const makeTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
+export const makeAdminTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.list")(function* ({ query, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_trusted_device.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: query.userId,
+        action: "list",
+        request,
+    });
+    const now = yield* currentUnixMillis;
+    const devices = yield* dependencies.trustedDevices
+        .listForUser({ userId: query.userId, now })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list admin trusted devices",
+    })));
+    return { devices: devices.map(trustedDeviceHttpBody) };
+});
+export const makeAdminTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_trusted_device.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.authorization.authorize({
+        currentSession: current.currentSession,
+        targetUserId: payload.userId,
+        action: "revoke",
+        request,
+        deviceId: payload.deviceId,
+    });
+    yield* dependencies.trustedDevices
+        .revokeForUser({
+        userId: payload.userId,
+        tokenHash: payload.deviceId,
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke admin trusted device",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
 export const makeEmailVerificationStartHandler = (dependencies) => Effect.fn("auth.http.email_verification.start")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_verification.start");
     const input = emailVerificationStartInput(payload);
@@ -1458,6 +1881,133 @@ export const makeOAuthAuthorizationStartHandler = (dependencies) => Effect.fn("a
     }
     return oauthAuthorizationStartedHttpBody(started);
 });
+export const makeOAuthProviderAuthorizationHandler = (dependencies) => Effect.fn("auth.http.oauth.authorize")(function* ({ query, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.authorize");
+    const result = yield* dependencies.authorization
+        .authorize({
+        responseType: query.response_type,
+        ...(query.client_id === undefined ? {} : { clientId: query.client_id }),
+        ...(query.redirect_uri === undefined
+            ? {}
+            : { redirectUri: query.redirect_uri }),
+        ...(query.scope === undefined ? {} : { scopes: query.scope }),
+        ...(query.state === undefined ? {} : { state: query.state }),
+        ...(query.code_challenge === undefined
+            ? {}
+            : { codeChallenge: query.code_challenge }),
+        ...(query.code_challenge_method === undefined
+            ? {}
+            : { codeChallengeMethod: query.code_challenge_method }),
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to authorize OAuth request")));
+    if (result.valid) {
+        return oauthAuthorizationRedirect(result.redirectUri, {
+            code: Redacted.value(result.code.code),
+            state: result.state,
+        });
+    }
+    if (result.redirectUri !== undefined) {
+        return oauthAuthorizationRedirect(result.redirectUri, {
+            error: result.reason,
+            error_description: result.errorDescription,
+            state: result.state,
+        });
+    }
+    return yield* oauthAuthorizationEndpointError(result.reason, result.errorDescription);
+});
+export const makeOAuthAuthorizationCodeTokenHandler = (dependencies) => Effect.fn("auth.http.oauth.token")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.token");
+    const payload = yield* oauthTokenRequestBody(request);
+    const { clientId, clientAuthenticated } = yield* oauthClientEndpointAuthentication({
+        request,
+        payload,
+        authenticateClient: dependencies.authenticateClient,
+        invalidRequest: () => oauthTokenEndpointError("invalid_request"),
+        invalidClient: () => oauthTokenEndpointError("invalid_client"),
+    });
+    if (payload.grant_type === "refresh_token") {
+        return yield* oauthRefreshTokenResponse({
+            dependencies,
+            payload,
+            ...(clientId === undefined ? {} : { clientId }),
+            clientAuthenticated,
+        });
+    }
+    if (payload.grant_type === "client_credentials") {
+        return yield* oauthClientCredentialsTokenResponse({
+            dependencies,
+            payload,
+            ...(clientId === undefined ? {} : { clientId }),
+            clientAuthenticated,
+        });
+    }
+    return yield* oauthAuthorizationCodeTokenResponse({
+        dependencies,
+        payload,
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    });
+});
+export const makeOAuthTokenRevocationHandler = (dependencies) => Effect.fn("auth.http.oauth.revoke")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.revoke");
+    const payload = yield* oauthTokenRevocationRequestBody(request);
+    const { clientId, clientAuthenticated } = yield* oauthClientEndpointAuthentication({
+        request,
+        payload,
+        authenticateClient: dependencies.authenticateClient,
+        invalidRequest: () => oauthTokenRevocationEndpointError("invalid_request"),
+        invalidClient: () => oauthTokenRevocationEndpointError("invalid_client"),
+    });
+    const token = oauthTokenGrantString(payload.token);
+    const tokenTypeHint = oauthTokenGrantString(payload.token_type_hint);
+    const result = yield* dependencies.tokenRevocation
+        .revoke({
+        ...(token === undefined ? {} : { token: Redacted.make(token) }),
+        ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to revoke OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenRevocationEndpointError(result.reason);
+    }
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeOAuthTokenIntrospectionHandler = (dependencies) => Effect.fn("auth.http.oauth.introspect")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.introspect");
+    const payload = yield* oauthTokenIntrospectionRequestBody(request);
+    const { clientId, clientAuthenticated } = yield* oauthClientEndpointAuthentication({
+        request,
+        payload,
+        authenticateClient: dependencies.authenticateClient,
+        invalidRequest: () => oauthTokenIntrospectionEndpointError("invalid_request"),
+        invalidClient: () => oauthTokenIntrospectionEndpointError("invalid_client"),
+    });
+    const token = oauthTokenGrantString(payload.token);
+    const tokenTypeHint = oauthTokenGrantString(payload.token_type_hint);
+    const result = yield* dependencies.tokenIntrospection
+        .introspect({
+        ...(token === undefined ? {} : { token: Redacted.make(token) }),
+        ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+        ...(clientId === undefined ? {} : { clientId }),
+        clientAuthenticated,
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to introspect OAuth token")));
+    if (!result.valid) {
+        return yield* oauthTokenIntrospectionEndpointError(result.reason);
+    }
+    return oauthTokenIntrospectionResponseHttpBody(result.introspection);
+});
+const makeOAuthTokenRevocationNotConfiguredHandler = () => Effect.fn("auth.http.oauth.revoke_not_configured")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.revoke");
+    yield* oauthTokenRevocationRequestBody(request);
+    return yield* oauthTokenRevocationEndpointError("invalid_request");
+});
+const makeOAuthTokenIntrospectionNotConfiguredHandler = () => Effect.fn("auth.http.oauth.introspect_not_configured")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.introspect");
+    yield* oauthTokenIntrospectionRequestBody(request);
+    return yield* oauthTokenIntrospectionEndpointError("invalid_request");
+});
 export const makeOAuthAccountUnlinkHandler = (dependencies) => Effect.fn("auth.http.oauth.account_unlink")(function* ({ payload, request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.account_unlink");
     const session = yield* readRequiredSession(dependencies, request);
@@ -1714,6 +2264,15 @@ export const makeJwtRevokeHandler = (dependencies) => Effect.fn("auth.http.jwt.r
         .pipe(Effect.mapError(jwtRevocationHttpError));
     return HttpServerResponse.empty({ status: 204 });
 });
+export const makeJwtJwksHandler = (dependencies) => Effect.fn("auth.http.jwt.jwks")(function* (_) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.jwks");
+    const document = yield* dependencies.jwks.document().pipe(Effect.mapError(() => jwtInternalError("Failed to load JWT JWKS document")));
+    return jwtJwksHttpBody(document);
+});
+export const makeOidcDiscoveryMetadataHandler = (dependencies) => Effect.fn("auth.http.oidc.discovery_metadata")(function* (_) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oidc.discovery_metadata");
+    return yield* dependencies.metadata.load().pipe(Effect.mapError(() => jwtInternalError("Failed to load OIDC discovery metadata")));
+});
 export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.options")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.options");
     const pending = yield* dependencies.authFlowState
@@ -2051,6 +2610,14 @@ export class SessionApi extends HttpApiGroup.make("session")
     .add(currentSessionEndpoint, refreshSessionEndpoint.middleware(AuthOriginCheckMiddleware), logoutEndpoint.middleware(AuthOriginCheckMiddleware), listSessionsEndpoint, revokeSessionEndpoint.middleware(AuthOriginCheckMiddleware), revokeOtherSessionsEndpoint.middleware(AuthOriginCheckMiddleware))
     .prefix("/auth") {
 }
+export class AdminSessionApi extends HttpApiGroup.make("adminSession")
+    .add(adminSessionListEndpoint, adminSessionRevokeEndpoint, adminSessionRevokeAllEndpoint)
+    .prefix("/auth/admin/sessions")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class AdminSessionHttpApi extends HttpApi.make("AdminSessionHttpApi").add(AdminSessionApi) {
+}
 export class EmailVerificationApi extends HttpApiGroup.make("emailVerification")
     .add(emailVerificationStartEndpoint.middleware(AuthRateLimitMiddleware), emailVerificationVerifyEndpoint)
     .prefix("/auth/email-verification")
@@ -2075,6 +2642,20 @@ export class OAuthApi extends HttpApiGroup.make("oauth")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
+export class OAuthTokenApi extends HttpApiGroup.make("oauthToken")
+    .add(oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint)
+    .prefix("/auth/oauth")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class OAuthTokenHttpApi extends HttpApi.make("OAuthTokenHttpApi").add(OAuthTokenApi) {
+}
+export class OAuthProviderAuthorizationApi extends HttpApiGroup.make("oauthProviderAuthorization")
+    .add(oauthProviderAuthorizeEndpoint)
+    .prefix("/auth/oauth")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class OAuthProviderAuthorizationHttpApi extends HttpApi.make("OAuthProviderAuthorizationHttpApi").add(OAuthProviderAuthorizationApi) {
+}
 export class LoginApprovalApi extends HttpApiGroup.make("loginApproval")
     .add(loginApprovalApproveEndpoint, loginApprovalStatusEndpoint, loginApprovalFinalizeEndpoint)
     .prefix("/auth/login-approval")
@@ -2109,6 +2690,20 @@ export class JwtApi extends HttpApiGroup.make("jwt")
     .prefix("/auth/jwt")
     .middleware(AuthSchemaErrorMiddleware) {
 }
+export class JwtDiscoveryApi extends HttpApiGroup.make("jwtDiscovery")
+    .add(jwtJwksEndpoint)
+    .prefix("/.well-known")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class JwtDiscoveryHttpApi extends HttpApi.make("JwtDiscoveryHttpApi").add(JwtDiscoveryApi) {
+}
+export class OidcDiscoveryApi extends HttpApiGroup.make("oidcDiscovery")
+    .add(oidcDiscoveryMetadataEndpoint)
+    .prefix("/.well-known")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class OidcDiscoveryHttpApi extends HttpApi.make("OidcDiscoveryHttpApi").add(OidcDiscoveryApi) {
+}
 export class SecurityApi extends HttpApiGroup.make("security")
     .add(loginNotificationReportEndpoint)
     .prefix("/auth/security")
@@ -2124,6 +2719,14 @@ export class SecurityTimelineApi extends HttpApiGroup.make("securityTimeline")
 export class SecurityTimelineHttpApi extends HttpApi.make("SecurityTimelineHttpApi")
     .add(SecurityTimelineApi) {
 }
+export class AdminSecurityTimelineApi extends HttpApiGroup.make("adminSecurityTimeline")
+    .add(adminSecurityTimelineListEndpoint)
+    .prefix("/auth/admin/security")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class AdminSecurityTimelineHttpApi extends HttpApi.make("AdminSecurityTimelineHttpApi").add(AdminSecurityTimelineApi) {
+}
 export class TrustedDeviceApi extends HttpApiGroup.make("trustedDevice")
     .add(trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint)
     .prefix("/auth/trusted-devices")
@@ -2133,6 +2736,14 @@ export class TrustedDeviceApi extends HttpApiGroup.make("trustedDevice")
 export class TrustedDeviceHttpApi extends HttpApi.make("TrustedDeviceHttpApi")
     .add(TrustedDeviceApi) {
 }
+export class AdminTrustedDeviceApi extends HttpApiGroup.make("adminTrustedDevice")
+    .add(adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint)
+    .prefix("/auth/admin/trusted-devices")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class AdminTrustedDeviceHttpApi extends HttpApi.make("AdminTrustedDeviceHttpApi").add(AdminTrustedDeviceApi) {
+}
 export class AuthApi extends HttpApi.make("AuthApi")
     .add(PasswordApi)
     .add(SessionApi)
@@ -2199,6 +2810,20 @@ export const SessionApiLive = HttpApiBuilder.group(AuthApi, "session", Effect.fn
         .handle("revoke", makeRevokeSessionHandler({ sessions, sessionCookie, authHttp }))
         .handle("revokeOthers", makeRevokeOtherSessionsHandler({ sessions, sessionCookie }));
 }));
+export const AdminSessionApiLive = HttpApiBuilder.group(AdminSessionHttpApi, "adminSession", Effect.fn("auth.http.admin_session.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authorization = yield* AdminSessionAuthorization;
+    return handlers
+        .handle("list", makeAdminSessionListHandler({ sessions, sessionCookie, authorization }))
+        .handle("revoke", makeAdminSessionRevokeHandler({ sessions, sessionCookie, authorization }))
+        .handle("revokeAll", makeAdminSessionRevokeAllHandler({
+        sessions,
+        sessionCookie,
+        authorization,
+    }));
+}));
+export const AdminSessionHttpApiLive = HttpApiBuilder.layer(AdminSessionHttpApi).pipe(Layer.provide(AdminSessionApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
 export const EmailVerificationApiLive = HttpApiBuilder.group(AuthApi, "emailVerification", Effect.fn("auth.http.email_verification.group")(function* (handlers) {
     const emailVerificationFlow = yield* EmailVerificationFlow;
     const emailVerification = yield* EmailVerification;
@@ -2309,6 +2934,62 @@ export const SecurityTimelineApiLive = HttpApiBuilder.group(SecurityTimelineHttp
     }));
 }));
 export const SecurityTimelineHttpApiLive = HttpApiBuilder.layer(SecurityTimelineHttpApi).pipe(Layer.provide(SecurityTimelineApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OAuthProviderAuthorizationApiLive = HttpApiBuilder.group(OAuthProviderAuthorizationHttpApi, "oauthProviderAuthorization", Effect.fn("auth.http.oauth_provider_authorization.group")(function* (handlers) {
+    const authorization = yield* OAuthProviderAuthorization;
+    return handlers.handle("authorize", makeOAuthProviderAuthorizationHandler({ authorization }));
+}));
+export const OAuthProviderAuthorizationHttpApiLive = HttpApiBuilder.layer(OAuthProviderAuthorizationHttpApi).pipe(Layer.provide(OAuthProviderAuthorizationApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OAuthTokenApiLive = HttpApiBuilder.group(OAuthTokenHttpApi, "oauthToken", Effect.fn("auth.http.oauth_token.group")(function* (handlers) {
+    const tokenGrant = yield* OAuthAuthorizationCodeTokenGrant;
+    const refreshTokenGrant = yield* Effect.serviceOption(OAuthRefreshTokenGrant);
+    const clientCredentialsGrant = yield* Effect.serviceOption(OAuthClientCredentialsGrant);
+    const tokenIntrospection = yield* Effect.serviceOption(OAuthTokenIntrospection);
+    const tokenRevocation = yield* Effect.serviceOption(OAuthTokenRevocation);
+    return handlers
+        .handle("token", makeOAuthAuthorizationCodeTokenHandler({
+        tokenGrant,
+        ...(Option.isNone(refreshTokenGrant)
+            ? {}
+            : { refreshTokenGrant: refreshTokenGrant.value }),
+        ...(Option.isNone(clientCredentialsGrant)
+            ? {}
+            : { clientCredentialsGrant: clientCredentialsGrant.value }),
+    }))
+        .handle("introspect", Option.isNone(tokenIntrospection)
+        ? makeOAuthTokenIntrospectionNotConfiguredHandler()
+        : makeOAuthTokenIntrospectionHandler({
+            tokenIntrospection: tokenIntrospection.value,
+        }))
+        .handle("revoke", Option.isNone(tokenRevocation)
+        ? makeOAuthTokenRevocationNotConfiguredHandler()
+        : makeOAuthTokenRevocationHandler({
+            tokenRevocation: tokenRevocation.value,
+        }));
+}));
+export const OAuthTokenHttpApiLive = HttpApiBuilder.layer(OAuthTokenHttpApi).pipe(Layer.provide(OAuthTokenApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const JwtDiscoveryApiLive = HttpApiBuilder.group(JwtDiscoveryHttpApi, "jwtDiscovery", Effect.fn("auth.http.jwt_discovery.group")(function* (handlers) {
+    const jwks = yield* Jwks;
+    return handlers.handle("jwks", makeJwtJwksHandler({ jwks }));
+}));
+export const JwtDiscoveryHttpApiLive = HttpApiBuilder.layer(JwtDiscoveryHttpApi).pipe(Layer.provide(JwtDiscoveryApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OidcDiscoveryApiLive = HttpApiBuilder.group(OidcDiscoveryHttpApi, "oidcDiscovery", Effect.fn("auth.http.oidc_discovery.group")(function* (handlers) {
+    const metadata = yield* OidcDiscoveryMetadata;
+    return handlers.handle("openidConfiguration", makeOidcDiscoveryMetadataHandler({ metadata }));
+}));
+export const OidcDiscoveryHttpApiLive = HttpApiBuilder.layer(OidcDiscoveryHttpApi).pipe(Layer.provide(OidcDiscoveryApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminSecurityTimelineApiLive = HttpApiBuilder.group(AdminSecurityTimelineHttpApi, "adminSecurityTimeline", Effect.fn("auth.http.admin_security_timeline.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const securityTimeline = yield* SecurityTimelineStore;
+    const authorization = yield* AdminSecurityTimelineAuthorization;
+    return handlers.handle("list", makeAdminSecurityTimelineListHandler({
+        sessions,
+        sessionCookie,
+        securityTimeline,
+        authorization,
+    }));
+}));
+export const AdminSecurityTimelineHttpApiLive = HttpApiBuilder.layer(AdminSecurityTimelineHttpApi).pipe(Layer.provide(AdminSecurityTimelineApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
 export const TrustedDeviceApiLive = HttpApiBuilder.group(TrustedDeviceHttpApi, "trustedDevice", Effect.fn("auth.http.trusted_device.group")(function* (handlers) {
     const sessions = yield* Sessions;
     const sessionCookie = yield* SessionCookie;
@@ -2318,6 +2999,26 @@ export const TrustedDeviceApiLive = HttpApiBuilder.group(TrustedDeviceHttpApi, "
         .handle("revoke", makeTrustedDeviceRevokeHandler({ sessions, sessionCookie, trustedDevices }));
 }));
 export const TrustedDeviceHttpApiLive = HttpApiBuilder.layer(TrustedDeviceHttpApi).pipe(Layer.provide(TrustedDeviceApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminTrustedDeviceApiLive = HttpApiBuilder.group(AdminTrustedDeviceHttpApi, "adminTrustedDevice", Effect.fn("auth.http.admin_trusted_device.group")(function* (handlers) {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const trustedDevices = yield* TrustedDeviceStore;
+    const authorization = yield* AdminTrustedDeviceAuthorization;
+    return handlers
+        .handle("list", makeAdminTrustedDeviceListHandler({
+        sessions,
+        sessionCookie,
+        trustedDevices,
+        authorization,
+    }))
+        .handle("revoke", makeAdminTrustedDeviceRevokeHandler({
+        sessions,
+        sessionCookie,
+        trustedDevices,
+        authorization,
+    }));
+}));
+export const AdminTrustedDeviceHttpApiLive = HttpApiBuilder.layer(AdminTrustedDeviceHttpApi).pipe(Layer.provide(AdminTrustedDeviceApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
 const AuthHttpApiBaseLive = HttpApiBuilder.layer(AuthApi).pipe(Layer.provide(PasswordApiLive), Layer.provide(SessionApiLive), Layer.provide(EmailVerificationApiLive), Layer.provide(EmailOtpApiLive), Layer.provide(MagicLinkApiLive), Layer.provide(LoginApprovalApiLive), Layer.provide(SecurityApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
 export const AuthHttpApiBareLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitNoopLive));
 export const AuthHttpApiLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitLive));