@effect-auth/core 0.1.0-alpha.10 → 0.1.0-alpha.14

package/dist/HttpApi/Api.d.ts

@@ -1,25 +1,26 @@
-import { Effect, Layer, Redacted } from "effect";
+import { Context, Effect, Layer, Redacted } from "effect";
 import type { Duration, Schema } from "effect";
-import type { HttpServerRequest } from "effect/unstable/http";
-import { HttpServerResponse } from "effect/unstable/http";
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";
 import { ApiKeyId } from "../ApiKey.js";
 import type { ApiKeyCreateForUserInput, ApiKeyManagementRevokeInput, ApiKeyManagementService } from "../ApiKey.js";
-import type { JwtAudience, JwtIssueInput, JwtIssuerService, JwtRevokeJwtIdInput, JwtRevocationService, JwtVerifyInput } from "../Jwt.js";
+import type { JwksDocument, JwksService, JwtAudience, JwtIssueInput, JwtIssuerService, JwtRevokeJwtIdInput, JwtRevocationService, JwtVerifyInput } from "../Jwt.js";
+import { Jwks } from "../Jwt.js";
 import { AuthFlow, AuthFlowState, AuthResult } from "../AuthFlow.js";
 import type { AuthFlowService, AuthFlowStateService, LoginApprovalFinalizeService } from "../AuthFlow.js";
 import { EmailOtpLogin } from "../EmailOtp.js";
 import type { EmailOtpLoginService, EmailOtpStartInput, EmailOtpVerifyInput } from "../EmailOtp.js";
 import { EmailVerification, EmailVerificationFlow } from "../EmailVerification.js";
 import type { EmailVerificationFlowService, EmailVerificationService, EmailVerificationIssueInput, EmailVerificationVerifyInput } from "../EmailVerification.js";
-import type { Email, OAuthProviderId, UnixMillis, UserId } from "../Identifiers.js";
+import type { Email, OAuthClientId, OAuthProviderId, SessionId, UnixMillis, UserId } from "../Identifiers.js";
 import { LoginApproval } from "../LoginApproval.js";
 import type { LoginApprovalReviewService, LoginApprovalService, LoginApprovalVerifyInput } from "../LoginApproval.js";
 import type { LoginRequestContext } from "../LoginRisk.js";
 import type { LoginNotificationReportInput, LoginNotificationService } from "../LoginNotification.js";
 import { MagicLinkLogin } from "../MagicLink.js";
 import type { MagicLinkLoginService, MagicLinkStartInput, MagicLinkVerifyInput } from "../MagicLink.js";
-import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderConfig, OAuthProvidersService, OAuthStateService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
+import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationCodeTokenGrantService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientCredentialsGrantService, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderAuthorizationService, OAuthProviderConfig, OAuthProvidersService, OAuthRefreshTokenGrantService, OAuthStateService, OAuthTokenIntrospectionService, OAuthTokenRevocationService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
+import { OAuthAuthorizationCodeTokenGrant, OAuthProviderAuthorization } from "../OAuth.js";
 import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset } from "../Password.js";
 import { PasskeyCredentialId } from "../Passkey.js";
 import type { FinishedPasskeyAuthentication, PasskeyAttestation, PasskeyAuthenticationFinishInput, PasskeyAuthenticationStartInput, PasskeyAuthenticatorSelection, PasskeyCredentialManagementService, PasskeyOptionsService, PasskeyPublicKeyCredentialParameters, PasskeyRelyingParty, PasskeyUserVerification, PasskeyVerificationService } from "../Passkey.js";
@@ -27,7 +28,7 @@ import type { PasswordChangeInput, PasswordManagementService, PasswordLoginServi
 import type { RecoveryCodeGenerateForUserInput, RecoveryCodeManagementRevokeInput, RecoveryCodeManagementService, RecoveryCodeVerifyForUserInput } from "../RecoveryCode.js";
 import type { RefreshTokenInfo, RefreshTokenManagementService, RefreshTokenRotateInput } from "../RefreshToken.js";
 import { SessionCookie, Sessions } from "../Sessions.js";
-import type { AuthMethodReference, CurrentSessionShape, SessionClaims, SessionCookieService, SessionCreateInput, SessionsService, ValidatedSession } from "../Sessions.js";
+import type { AuthMethodReference, CurrentSessionShape, SessionClaims, SessionCookieService, SessionCreateInput, SessionInfoShape, SessionsService, ValidatedSession } from "../Sessions.js";
 import { SecurityTimelineStore } from "../SecurityTimeline.js";
 import type { SecurityTimelineEvent, SecurityTimelineStoreService } from "../SecurityTimeline.js";
 import { UserStore } from "../Storage.js";
@@ -35,8 +36,9 @@ import type { UserStoreService } from "../Storage.js";
 import type { TotpAlgorithm, TotpEnrollmentConfirmInput, TotpEnrollmentStartInput, TotpFactorManagementService, TotpFactorManagementRevokeInput, TotpVerifyForUserInput } from "../Totp.js";
 import { TrustedDeviceStore } from "../TrustedDevice.js";
 import type { TrustedDeviceRecord, TrustedDeviceCookieService, TrustedDeviceService, TrustedDeviceStoreService } from "../TrustedDevice.js";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError } from "./Errors.js";
-import type { ApiKeyCreateBody, ApiKeyRevokeBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtRevokeBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasswordChangeBody, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
+import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError } from "./Errors.js";
+import { OAuthProviderAuthorizationQuery } from "./Schemas.js";
+import type { AdminSecurityTimelineListQuery, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, ApiKeyCreateBody, ApiKeyRevokeBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtJwksBody, JwtRevokeBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasswordChangeBody, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
 import { AuthApiRateLimit, AuthOriginCheckMiddleware, AuthRateLimitMiddleware } from "./Security.js";
 import type { AuthApiRateLimitService } from "./Security.js";
 import { AuthHttp } from "./Transport.js";
@@ -68,6 +70,21 @@ export interface OAuthAuthorizationCallbackHttpOptions {
     readonly clientAuthentication?: OAuthClientAuthentication;
     readonly tokenParams?: Readonly<Record<string, string>>;
 }
+export interface OAuthTokenClientAuthenticationInput {
+    readonly clientId: OAuthClientId;
+    readonly method: "client_secret_basic" | "client_secret_post";
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}
+export interface OAuthTokenClientAuthenticationHttpOptions {
+    readonly authenticateClient?: (input: OAuthTokenClientAuthenticationInput) => Effect.Effect<boolean, unknown>;
+}
+export interface OAuthAuthorizationCodeTokenHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
+}
+export interface OAuthTokenRevocationHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
+}
+export interface OAuthTokenIntrospectionHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
+}
 export type OAuthAuthorizationCallbackFieldValue = string | readonly string[] | null | undefined;
 export interface OAuthAuthorizationCallbackSearchParams {
     readonly get: (name: string) => string | null;
@@ -295,6 +312,7 @@ export interface JwtIntrospectionHttpOptions {
 }
 export declare const jwtIntrospectInput: (payload: Schema.Schema.Type<typeof JwtIntrospectBody>, options?: JwtIntrospectionHttpOptions) => JwtVerifyInput;
 export declare const jwtRevokeInput: (payload: Schema.Schema.Type<typeof JwtRevokeBody>) => JwtRevokeJwtIdInput;
+export declare const jwtJwksHttpBody: (document: JwksDocument) => Schema.Schema.Type<typeof JwtJwksBody>;
 export declare const totpMfaVerifyInput: (payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
 export declare const totpMfaVerifyForFlowInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpMfaVerifyForFlowBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
 export declare const recoveryCodeMfaVerifyInput: (payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>) => RecoveryCodeVerifyForUserInput;
@@ -321,6 +339,24 @@ export interface LoginApprovalFinalizeHttpInput {
 }
 export declare const loginApprovalFinalizeInput: (payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>) => LoginApprovalFinalizeHttpInput;
 export declare const loginNotificationReportInput: (payload: Schema.Schema.Type<typeof LoginNotificationReportBody>) => LoginNotificationReportInput;
+export declare const adminSessionHttpBody: (session: SessionInfoShape) => {
+    longitude?: number | undefined;
+    latitude?: number | undefined;
+    city?: string | undefined;
+    region?: string | undefined;
+    country?: string | undefined;
+    userAgent?: string | undefined;
+    ip?: string | undefined;
+    mfaVerifiedAt?: UnixMillis | undefined;
+    expiresAt: UnixMillis;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+    lastSeenAt?: UnixMillis | undefined;
+    sessionId: SessionId;
+    userId: UserId;
+    createdAt: UnixMillis;
+    authTime: UnixMillis;
+};
 export declare const stepUpAuthenticatedHttpBody: (session: CurrentSessionShape) => {
     mfaVerifiedAt?: UnixMillis | undefined;
     type: "authenticated";
@@ -364,6 +400,35 @@ export type SessionRevokeHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof SessionRevokeBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type AdminSessionListHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof AdminSessionListQuery>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminSessionRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof AdminSessionRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminSessionRevokeAllHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof AdminSessionRevokeAllBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminSessionAuthorizationAction = "list" | "revoke" | "revoke_all";
+export interface AdminSessionAuthorizationInput {
+    readonly currentSession: CurrentSessionShape;
+    readonly targetUserId: UserId;
+    readonly action: AdminSessionAuthorizationAction;
+    readonly request: HttpServerRequest.HttpServerRequest;
+    readonly sessionId?: SessionId;
+}
+export interface AdminSessionAuthorizationService {
+    readonly authorize: (input: AdminSessionAuthorizationInput) => Effect.Effect<void, AuthPolicyDeniedError | AuthInternalError>;
+}
+declare const AdminSessionAuthorization_base: Context.ServiceClass<AdminSessionAuthorization, "auth/AdminSessionAuthorization", AdminSessionAuthorizationService>;
+export declare class AdminSessionAuthorization extends AdminSessionAuthorization_base {
+}
+export declare namespace AdminSessionAuthorization {
+    const make: (service: AdminSessionAuthorizationService) => AdminSessionAuthorizationService;
+}
 export type LoginNotificationReportHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof LoginNotificationReportBody>;
 };
@@ -371,6 +436,24 @@ export type SecurityTimelineListHandlerRequest = {
     readonly query: Schema.Schema.Type<typeof SecurityTimelineListQuery>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type AdminSecurityTimelineListHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof AdminSecurityTimelineListQuery>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export interface AdminSecurityTimelineAuthorizationInput {
+    readonly currentSession: CurrentSessionShape;
+    readonly targetUserId: UserId;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}
+export interface AdminSecurityTimelineAuthorizationService {
+    readonly authorize: (input: AdminSecurityTimelineAuthorizationInput) => Effect.Effect<void, AuthPolicyDeniedError | AuthInternalError>;
+}
+declare const AdminSecurityTimelineAuthorization_base: Context.ServiceClass<AdminSecurityTimelineAuthorization, "auth/AdminSecurityTimelineAuthorization", AdminSecurityTimelineAuthorizationService>;
+export declare class AdminSecurityTimelineAuthorization extends AdminSecurityTimelineAuthorization_base {
+}
+export declare namespace AdminSecurityTimelineAuthorization {
+    const make: (service: AdminSecurityTimelineAuthorizationService) => AdminSecurityTimelineAuthorizationService;
+}
 export type TrustedDeviceListHandlerRequest = {
     readonly request: HttpServerRequest.HttpServerRequest;
 };
@@ -378,6 +461,31 @@ export type TrustedDeviceRevokeHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof TrustedDeviceRevokeBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type AdminTrustedDeviceListHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof AdminTrustedDeviceListQuery>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminTrustedDeviceRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof AdminTrustedDeviceRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminTrustedDeviceAuthorizationAction = "list" | "revoke";
+export interface AdminTrustedDeviceAuthorizationInput {
+    readonly currentSession: CurrentSessionShape;
+    readonly targetUserId: UserId;
+    readonly action: AdminTrustedDeviceAuthorizationAction;
+    readonly request: HttpServerRequest.HttpServerRequest;
+    readonly deviceId?: string;
+}
+export interface AdminTrustedDeviceAuthorizationService {
+    readonly authorize: (input: AdminTrustedDeviceAuthorizationInput) => Effect.Effect<void, AuthPolicyDeniedError | AuthInternalError>;
+}
+declare const AdminTrustedDeviceAuthorization_base: Context.ServiceClass<AdminTrustedDeviceAuthorization, "auth/AdminTrustedDeviceAuthorization", AdminTrustedDeviceAuthorizationService>;
+export declare class AdminTrustedDeviceAuthorization extends AdminTrustedDeviceAuthorization_base {
+}
+export declare namespace AdminTrustedDeviceAuthorization {
+    const make: (service: AdminTrustedDeviceAuthorizationService) => AdminTrustedDeviceAuthorizationService;
+}
 export type EmailVerificationStartHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof EmailVerificationStartBody>;
 };
@@ -402,6 +510,18 @@ export type MagicLinkVerifyHandlerRequest = {
 export type OAuthAuthorizationStartHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>;
 };
+export type OAuthProviderAuthorizationHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof OAuthProviderAuthorizationQuery>;
+};
+export type OAuthTokenHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type OAuthTokenRevocationHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type OAuthTokenIntrospectionHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
 export type OAuthAccountUnlinkHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof OAuthAccountUnlinkBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
@@ -491,6 +611,19 @@ export type JwtIntrospectHandlerRequest = {
 export type JwtRevokeHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof JwtRevokeBody>;
 };
+export type JwtJwksHandlerRequest = Record<never, never>;
+export type OidcDiscoveryMetadataHandlerRequest = Record<never, never>;
+export type OidcDiscoveryMetadataShape = Schema.Schema.Type<typeof OidcDiscoveryMetadataBody>;
+export interface OidcDiscoveryMetadataService {
+    readonly load: () => Effect.Effect<OidcDiscoveryMetadataShape, unknown>;
+}
+declare const OidcDiscoveryMetadata_base: Context.ServiceClass<OidcDiscoveryMetadata, "auth/OidcDiscoveryMetadata", OidcDiscoveryMetadataService>;
+export declare class OidcDiscoveryMetadata extends OidcDiscoveryMetadata_base {
+}
+export declare namespace OidcDiscoveryMetadata {
+    const make: (service: OidcDiscoveryMetadataService) => OidcDiscoveryMetadataService;
+}
+export declare const OidcDiscoveryMetadataLive: (metadata: OidcDiscoveryMetadataShape) => Layer.Layer<OidcDiscoveryMetadata, never, never>;
 export type TotpMfaVerifyHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>;
 };
@@ -612,7 +745,7 @@ export declare const makeListSessionsHandler: (dependencies: {
         aal: import("../Sessions.js").AuthAssuranceLevel;
         amr: readonly AuthMethodReference[];
         lastSeenAt?: UnixMillis | undefined;
-        sessionId: import("../Identifiers.js").SessionId;
+        sessionId: SessionId;
         userId: UserId;
         createdAt: UnixMillis;
         authTime: UnixMillis;
@@ -627,6 +760,40 @@ export declare const makeRevokeOtherSessionsHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeAdminSessionListHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authorization: AdminSessionAuthorizationService;
+}) => (args_0: AdminSessionListHandlerRequest) => Effect.Effect<{
+    sessions: {
+        longitude?: number | undefined;
+        latitude?: number | undefined;
+        city?: string | undefined;
+        region?: string | undefined;
+        country?: string | undefined;
+        userAgent?: string | undefined;
+        ip?: string | undefined;
+        mfaVerifiedAt?: UnixMillis | undefined;
+        expiresAt: UnixMillis;
+        aal: import("../Sessions.js").AuthAssuranceLevel;
+        amr: readonly AuthMethodReference[];
+        lastSeenAt?: UnixMillis | undefined;
+        sessionId: SessionId;
+        userId: UserId;
+        createdAt: UnixMillis;
+        authTime: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeAdminSessionRevokeHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authorization: AdminSessionAuthorizationService;
+}) => (args_0: AdminSessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeAdminSessionRevokeAllHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authorization: AdminSessionAuthorizationService;
+}) => (args_0: AdminSessionRevokeAllHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
 export declare const makeLoginNotificationReportHandler: (dependencies: {
     readonly loginNotification?: LoginNotificationService;
 }) => (args_0: LoginNotificationReportHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
@@ -639,11 +806,11 @@ export declare const securityTimelineEventHttpBody: (event: SecurityTimelineEven
     actor?: {
         type: "anonymous";
     } | {
-        sessionId?: import("../Identifiers.js").SessionId | undefined;
+        sessionId?: SessionId | undefined;
         type: "user";
     } | undefined;
     eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-    type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.jwt.introspected" | "auth.jwt.revoked";
+    type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.risk.assessed" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked";
     category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
     severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
     occurredAt: UnixMillis;
@@ -663,17 +830,43 @@ export declare const makeSecurityTimelineListHandler: (dependencies: {
         actor?: {
             type: "anonymous";
         } | {
-            sessionId?: import("../Identifiers.js").SessionId | undefined;
+            sessionId?: SessionId | undefined;
             type: "user";
         } | undefined;
         eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-        type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.jwt.introspected" | "auth.jwt.revoked";
+        type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.risk.assessed" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked";
         category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
         severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
         occurredAt: UnixMillis;
         summary: string;
     }[];
 }, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeAdminSecurityTimelineListHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly securityTimeline: SecurityTimelineStoreService;
+    readonly authorization: AdminSecurityTimelineAuthorizationService;
+}) => (args_0: AdminSecurityTimelineListHandlerRequest) => Effect.Effect<{
+    events: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        request?: {
+            userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
+            ipHash?: import("../Identifiers.js").IpHash | undefined;
+        } | undefined;
+        actor?: {
+            type: "anonymous";
+        } | {
+            sessionId?: SessionId | undefined;
+            type: "user";
+        } | undefined;
+        eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
+        type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.risk.assessed" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked";
+        category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
+        severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
+        occurredAt: UnixMillis;
+        summary: string;
+    }[];
+}, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
 export declare const trustedDeviceHttpBody: (device: TrustedDeviceRecord) => {
     metadata?: Readonly<Record<string, unknown>> | undefined;
     deviceId: string;
@@ -699,6 +892,26 @@ export declare const makeTrustedDeviceRevokeHandler: (dependencies: {
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
 }) => (args_0: TrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeAdminTrustedDeviceListHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly trustedDevices: TrustedDeviceStoreService;
+    readonly authorization: AdminTrustedDeviceAuthorizationService;
+}) => (args_0: AdminTrustedDeviceListHandlerRequest) => Effect.Effect<{
+    devices: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        deviceId: string;
+        createdAt: UnixMillis;
+        lastSeenAt: UnixMillis;
+        expiresAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeAdminTrustedDeviceRevokeHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly trustedDevices: TrustedDeviceStoreService;
+    readonly authorization: AdminTrustedDeviceAuthorizationService;
+}) => (args_0: AdminTrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
 export declare const makeEmailVerificationStartHandler: (dependencies: {
     readonly emailVerificationFlow: EmailVerificationFlowService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
@@ -744,6 +957,46 @@ export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
     codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
     codeChallengeMethod: "S256";
 }, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeOAuthProviderAuthorizationHandler: (dependencies: {
+    readonly authorization: OAuthProviderAuthorizationService;
+}) => (args_0: OAuthProviderAuthorizationHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | OAuthAuthorizationEndpointError, never>;
+export declare const makeOAuthAuthorizationCodeTokenHandler: (dependencies: {
+    readonly tokenGrant: OAuthAuthorizationCodeTokenGrantService;
+    readonly refreshTokenGrant?: OAuthRefreshTokenGrantService;
+    readonly clientCredentialsGrant?: OAuthClientCredentialsGrantService;
+} & OAuthAuthorizationCodeTokenHttpOptions) => (args_0: OAuthTokenHandlerRequest) => Effect.Effect<{
+    readonly access_token: string;
+    readonly token_type: string;
+    readonly expires_in?: number | undefined;
+    readonly refresh_token?: string | undefined;
+    readonly id_token?: string | undefined;
+    readonly scope?: string | undefined;
+    readonly extra?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+}, AuthInternalError | OAuthTokenEndpointError, never>;
+export declare const makeOAuthTokenRevocationHandler: (dependencies: {
+    readonly tokenRevocation: OAuthTokenRevocationService;
+} & OAuthTokenRevocationHttpOptions) => (args_0: OAuthTokenRevocationHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | OAuthTokenRevocationEndpointError, never>;
+export declare const makeOAuthTokenIntrospectionHandler: (dependencies: {
+    readonly tokenIntrospection: OAuthTokenIntrospectionService;
+} & OAuthTokenIntrospectionHttpOptions) => (args_0: OAuthTokenIntrospectionHandlerRequest) => Effect.Effect<{
+    readonly active: boolean;
+    readonly scope?: string | undefined;
+    readonly client_id?: string | undefined;
+    readonly username?: string | undefined;
+    readonly token_type?: string | undefined;
+    readonly exp?: number | undefined;
+    readonly iat?: number | undefined;
+    readonly nbf?: number | undefined;
+    readonly sub?: string | undefined;
+    readonly aud?: string | readonly string[] | undefined;
+    readonly iss?: string | undefined;
+    readonly jti?: string | undefined;
+    readonly extra?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+}, AuthInternalError | OAuthTokenIntrospectionEndpointError, never>;
 export declare const makeOAuthAccountUnlinkHandler: (dependencies: {
     readonly oauthAccountUnlinking: OAuthAccountUnlinkingService;
     readonly sessions: SessionsService;
@@ -1093,6 +1346,35 @@ export declare const makeJwtIntrospectHandler: (dependencies: {
 export declare const makeJwtRevokeHandler: (dependencies: {
     readonly jwtRevocation: JwtRevocationService;
 }) => (args_0: JwtRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeJwtJwksHandler: (dependencies: {
+    readonly jwks: JwksService;
+}) => (_: JwtJwksHandlerRequest) => Effect.Effect<{
+    readonly keys: readonly {
+        readonly [x: string]: unknown;
+    }[];
+}, AuthInternalError, never>;
+export declare const makeOidcDiscoveryMetadataHandler: (dependencies: {
+    readonly metadata: OidcDiscoveryMetadataService;
+}) => (_: OidcDiscoveryMetadataHandlerRequest) => Effect.Effect<{
+    readonly issuer: string;
+    readonly authorization_endpoint: string;
+    readonly token_endpoint: string;
+    readonly jwks_uri: string;
+    readonly response_types_supported: readonly string[];
+    readonly subject_types_supported: readonly string[];
+    readonly id_token_signing_alg_values_supported: readonly string[];
+    readonly scopes_supported?: readonly string[] | undefined;
+    readonly claims_supported?: readonly string[] | undefined;
+    readonly grant_types_supported?: readonly string[] | undefined;
+    readonly token_endpoint_auth_methods_supported?: readonly string[] | undefined;
+    readonly introspection_endpoint_auth_methods_supported?: readonly string[] | undefined;
+    readonly code_challenge_methods_supported?: readonly string[] | undefined;
+    readonly userinfo_endpoint?: string | undefined;
+    readonly end_session_endpoint?: string | undefined;
+    readonly introspection_endpoint?: string | undefined;
+    readonly revocation_endpoint?: string | undefined;
+    readonly revocation_endpoint_auth_methods_supported?: readonly string[] | undefined;
+}, AuthInternalError, never>;
 export declare const makeMfaOptionsHandler: (dependencies: {
     readonly authFlowState: AuthFlowStateService;
     readonly totpFactorManagement?: TotpFactorManagementService;
@@ -1196,7 +1478,7 @@ export declare const makeLoginApprovalApproveHandler: (dependencies: {
 export declare const makeLoginApprovalStatusHandler: (dependencies: {
     readonly loginApprovalReview?: LoginApprovalReviewService;
 }) => (args_0: LoginApprovalStatusHandlerRequest) => Effect.Effect<{
-    status: import("../LoginApproval.js").LoginApprovalReviewStatus | "expired";
+    status: "expired" | import("../LoginApproval.js").LoginApprovalReviewStatus;
     expiresAt: UnixMillis;
 }, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
 export declare const makeLoginApprovalFinalizeHandler: (dependencies: {
@@ -1348,6 +1630,38 @@ declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effe
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeOthers", "POST", "/auth/sessions/revoke-others", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never>, false>;
 export declare class SessionApi extends SessionApi_base {
 }
+declare const AdminSessionApi_base: HttpApiGroup.HttpApiGroup<"adminSession", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/sessions/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly sessions: Schema.$Array<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly authTime: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastSeenAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+        readonly amr: Schema.$Array<Schema.String>;
+        readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly ip: Schema.optional<Schema.String>;
+        readonly userAgent: Schema.optional<Schema.String>;
+        readonly country: Schema.optional<Schema.String>;
+        readonly region: Schema.optional<Schema.String>;
+        readonly city: Schema.optional<Schema.String>;
+        readonly latitude: Schema.optional<Schema.Number>;
+        readonly longitude: Schema.optional<Schema.Number>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class AdminSessionApi extends AdminSessionApi_base {
+}
+declare const AdminSessionHttpApi_base: HttpApi.HttpApi<"AdminSessionHttpApi", typeof AdminSessionApi>;
+export declare class AdminSessionHttpApi extends AdminSessionHttpApi_base {
+}
 declare const EmailVerificationApi_base: HttpApiGroup.HttpApiGroup<"emailVerification", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-verification/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
@@ -1578,6 +1892,48 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
 export declare class OAuthApi extends OAuthApi_base {
 }
+declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"token", "POST", "/auth/oauth/token", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly access_token: Schema.String;
+    readonly token_type: Schema.String;
+    readonly expires_in: Schema.optional<Schema.Number>;
+    readonly refresh_token: Schema.optional<Schema.String>;
+    readonly id_token: Schema.optional<Schema.String>;
+    readonly scope: Schema.optional<Schema.String>;
+    readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly active: Schema.Boolean;
+    readonly scope: Schema.optional<Schema.String>;
+    readonly client_id: Schema.optional<Schema.String>;
+    readonly username: Schema.optional<Schema.String>;
+    readonly token_type: Schema.optional<Schema.String>;
+    readonly exp: Schema.optional<Schema.Number>;
+    readonly iat: Schema.optional<Schema.Number>;
+    readonly nbf: Schema.optional<Schema.Number>;
+    readonly sub: Schema.optional<Schema.String>;
+    readonly aud: Schema.optional<Schema.Union<readonly [Schema.String, Schema.$Array<Schema.String>]>>;
+    readonly iss: Schema.optional<Schema.String>;
+    readonly jti: Schema.optional<Schema.String>;
+    readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthTokenApi extends OAuthTokenApi_base {
+}
+declare const OAuthTokenHttpApi_base: HttpApi.HttpApi<"OAuthTokenHttpApi", typeof OAuthTokenApi>;
+export declare class OAuthTokenHttpApi extends OAuthTokenHttpApi_base {
+}
+declare const OAuthProviderAuthorizationApi_base: HttpApiGroup.HttpApiGroup<"oauthProviderAuthorization", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"authorize", "GET", "/auth/oauth/authorize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+    readonly response_type: Schema.String;
+    readonly client_id: Schema.optional<Schema.String>;
+    readonly redirect_uri: Schema.optional<Schema.String>;
+    readonly scope: Schema.optional<Schema.String>;
+    readonly state: Schema.optional<Schema.String>;
+    readonly code_challenge: Schema.optional<Schema.String>;
+    readonly code_challenge_method: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthAuthorizationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthProviderAuthorizationApi extends OAuthProviderAuthorizationApi_base {
+}
+declare const OAuthProviderAuthorizationHttpApi_base: HttpApi.HttpApi<"OAuthProviderAuthorizationHttpApi", typeof OAuthProviderAuthorizationApi>;
+export declare class OAuthProviderAuthorizationHttpApi extends OAuthProviderAuthorizationHttpApi_base {
+}
 declare const LoginApprovalApi_base: HttpApiGroup.HttpApiGroup<"loginApproval", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"approve", "POST", "/auth/login-approval/approve", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
     readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
@@ -1883,6 +2239,39 @@ declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unsta
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
 export declare class JwtApi extends JwtApi_base {
 }
+declare const JwtDiscoveryApi_base: HttpApiGroup.HttpApiGroup<"jwtDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"jwks", "GET", "/.well-known/jwks.json", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keys: Schema.$Array<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class JwtDiscoveryApi extends JwtDiscoveryApi_base {
+}
+declare const JwtDiscoveryHttpApi_base: HttpApi.HttpApi<"JwtDiscoveryHttpApi", typeof JwtDiscoveryApi>;
+export declare class JwtDiscoveryHttpApi extends JwtDiscoveryHttpApi_base {
+}
+declare const OidcDiscoveryApi_base: HttpApiGroup.HttpApiGroup<"oidcDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"openidConfiguration", "GET", "/.well-known/openid-configuration", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly issuer: Schema.String;
+    readonly authorization_endpoint: Schema.String;
+    readonly token_endpoint: Schema.String;
+    readonly jwks_uri: Schema.String;
+    readonly response_types_supported: Schema.$Array<Schema.String>;
+    readonly subject_types_supported: Schema.$Array<Schema.String>;
+    readonly id_token_signing_alg_values_supported: Schema.$Array<Schema.String>;
+    readonly scopes_supported: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly claims_supported: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly grant_types_supported: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly token_endpoint_auth_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly introspection_endpoint_auth_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly code_challenge_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly userinfo_endpoint: Schema.optional<Schema.String>;
+    readonly end_session_endpoint: Schema.optional<Schema.String>;
+    readonly introspection_endpoint: Schema.optional<Schema.String>;
+    readonly revocation_endpoint: Schema.optional<Schema.String>;
+    readonly revocation_endpoint_auth_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OidcDiscoveryApi extends OidcDiscoveryApi_base {
+}
+declare const OidcDiscoveryHttpApi_base: HttpApi.HttpApi<"OidcDiscoveryHttpApi", typeof OidcDiscoveryApi>;
+export declare class OidcDiscoveryHttpApi extends OidcDiscoveryHttpApi_base {
+}
 declare const SecurityApi_base: HttpApiGroup.HttpApiGroup<"security", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"reportLogin", "POST", "/auth/security/login/report", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
@@ -1892,13 +2281,13 @@ export declare class SecurityApi extends SecurityApi_base {
 declare const SecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"securityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/security/timeline", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
     readonly limit: Schema.optional<Schema.Number>;
     readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "jwt", "mfa", "oauth", "policy", "refresh_token", "session"]>>>;
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly events: Schema.$Array<Schema.Struct<{
         readonly eventId: Schema.String;
-        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-        readonly category: Schema.Literals<readonly ["api_key", "auth", "jwt", "mfa", "oauth", "policy", "refresh_token", "session"]>;
+        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
+        readonly category: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
         readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
         readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly summary: Schema.String;
@@ -1920,6 +2309,38 @@ export declare class SecurityTimelineApi extends SecurityTimelineApi_base {
 declare const SecurityTimelineHttpApi_base: HttpApi.HttpApi<"SecurityTimelineHttpApi", typeof SecurityTimelineApi>;
 export declare class SecurityTimelineHttpApi extends SecurityTimelineHttpApi_base {
 }
+declare const AdminSecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"adminSecurityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/security/timeline", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly limit: Schema.optional<Schema.Number>;
+    readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly events: Schema.$Array<Schema.Struct<{
+        readonly eventId: Schema.String;
+        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
+        readonly category: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+        readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
+        readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly summary: Schema.String;
+        readonly actor: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"anonymous">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"user">;
+            readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+        }>]>>;
+        readonly request: Schema.optional<Schema.Struct<{
+            readonly ipHash: Schema.optional<Schema.String>;
+            readonly userAgentHash: Schema.optional<Schema.String>;
+        }>>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class AdminSecurityTimelineApi extends AdminSecurityTimelineApi_base {
+}
+declare const AdminSecurityTimelineHttpApi_base: HttpApi.HttpApi<"AdminSecurityTimelineHttpApi", typeof AdminSecurityTimelineApi>;
+export declare class AdminSecurityTimelineHttpApi extends AdminSecurityTimelineHttpApi_base {
+}
 declare const TrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"trustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/trusted-devices/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly devices: Schema.$Array<Schema.Struct<{
         readonly deviceId: Schema.String;
@@ -1936,11 +2357,32 @@ export declare class TrustedDeviceApi extends TrustedDeviceApi_base {
 declare const TrustedDeviceHttpApi_base: HttpApi.HttpApi<"TrustedDeviceHttpApi", typeof TrustedDeviceApi>;
 export declare class TrustedDeviceHttpApi extends TrustedDeviceHttpApi_base {
 }
+declare const AdminTrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"adminTrustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/trusted-devices/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly devices: Schema.$Array<Schema.Struct<{
+        readonly deviceId: Schema.String;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastSeenAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly deviceId: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class AdminTrustedDeviceApi extends AdminTrustedDeviceApi_base {
+}
+declare const AdminTrustedDeviceHttpApi_base: HttpApi.HttpApi<"AdminTrustedDeviceHttpApi", typeof AdminTrustedDeviceApi>;
+export declare class AdminTrustedDeviceHttpApi extends AdminTrustedDeviceHttpApi_base {
+}
 declare const AuthApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordApi | typeof SessionApi | typeof EmailVerificationApi | typeof EmailOtpApi | typeof MagicLinkApi | typeof LoginApprovalApi | typeof SecurityApi>;
 export declare class AuthApi extends AuthApi_base {
 }
 export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, Sessions | SessionCookie | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthSchemaErrorMiddleware | AuthHttp | EmailVerificationFlow | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
 export declare const SessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "session">, never, Sessions | SessionCookie | AuthHttp | AuthOriginCheckMiddleware>;
+export declare const AdminSessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSessionHttpApi", "adminSession">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AdminSessionAuthorization>;
+export declare const AdminSessionHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | import("effect/FileSystem").FileSystem | import("effect/Path").Path | AdminSessionAuthorization | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
 export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | EmailVerificationFlow | EmailVerification | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
 export declare const EmailOtpApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailOtp">, never, EmailOtpLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
 export declare const MagicLinkApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "magicLink">, never, MagicLinkLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
@@ -1948,9 +2390,21 @@ export declare const LoginApprovalApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"Au
 export declare const SecurityApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "security">, never, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
 export declare const SecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"SecurityTimelineHttpApi", "securityTimeline">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | SecurityTimelineStore | AuthOriginCheckMiddleware>;
 export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | SecurityTimelineStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const TrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"TrustedDeviceHttpApi", "trustedDevice">, never, Sessions | SessionCookie | TrustedDeviceStore | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
-export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | TrustedDeviceStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AuthHttpApiBareLive: Layer.Layer<never, never, UserStore | Sessions | SessionCookie | LoginApproval | AuthFlowState | AuthFlow | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AuthHttpApiLive: Layer.Layer<never, never, UserStore | Sessions | SessionCookie | LoginApproval | AuthFlowState | AuthFlow | import("../Privacy.js").Privacy | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("../RateLimiter.js").RateLimiter | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const OAuthProviderAuthorizationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OAuthProviderAuthorizationHttpApi", "oauthProviderAuthorization">, never, AuthSchemaErrorMiddleware | OAuthProviderAuthorization>;
+export declare const OAuthProviderAuthorizationHttpApiLive: Layer.Layer<never, never, OAuthProviderAuthorization | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const OAuthTokenApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OAuthTokenHttpApi", "oauthToken">, never, AuthSchemaErrorMiddleware | OAuthAuthorizationCodeTokenGrant>;
+export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, OAuthAuthorizationCodeTokenGrant | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const JwtDiscoveryApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"JwtDiscoveryHttpApi", "jwtDiscovery">, never, AuthSchemaErrorMiddleware | Jwks>;
+export declare const JwtDiscoveryHttpApiLive: Layer.Layer<never, never, Jwks | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const OidcDiscoveryApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OidcDiscoveryHttpApi", "oidcDiscovery">, never, AuthSchemaErrorMiddleware | OidcDiscoveryMetadata>;
+export declare const OidcDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/Path").Path | OidcDiscoveryMetadata | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AdminSecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSecurityTimelineHttpApi", "adminSecurityTimeline">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | SecurityTimelineStore | AuthOriginCheckMiddleware | AdminSecurityTimelineAuthorization>;
+export declare const AdminSecurityTimelineHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | SecurityTimelineStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | AdminSecurityTimelineAuthorization | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const TrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"TrustedDeviceHttpApi", "trustedDevice">, never, Sessions | TrustedDeviceStore | SessionCookie | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
+export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, Sessions | TrustedDeviceStore | SessionCookie | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AdminTrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminTrustedDeviceHttpApi", "adminTrustedDevice">, never, Sessions | TrustedDeviceStore | SessionCookie | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AdminTrustedDeviceAuthorization>;
+export declare const AdminTrustedDeviceHttpApiLive: Layer.Layer<never, never, Sessions | TrustedDeviceStore | SessionCookie | import("effect/FileSystem").FileSystem | import("effect/Path").Path | AdminTrustedDeviceAuthorization | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AuthHttpApiBareLive: Layer.Layer<never, never, UserStore | LoginApproval | Sessions | AuthFlowState | AuthFlow | SessionCookie | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AuthHttpApiLive: Layer.Layer<never, never, UserStore | LoginApproval | Sessions | AuthFlowState | AuthFlow | import("../Privacy.js").Privacy | SessionCookie | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("../RateLimiter.js").RateLimiter | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
 export { AuthResult };
 //# sourceMappingURL=Api.d.ts.map