@effect-auth/core 0.1.0-alpha.14 → 0.1.0-alpha.16

package/dist/HttpApi/Api.d.ts

@@ -119,9 +119,6 @@ export interface OAuthLinkConfirmationConfirmHttpOptions {
 }
 export declare const oauthAuthorizationStartInput: (payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>, provider: OAuthProviderConfig, options?: OAuthAuthorizationStartHttpOptions) => OAuthAuthorizationStartInput;
 export declare const oauthAuthorizationStartedHttpBody: (started: StartedOAuthAuthorization) => {
-    redirectUri: string;
-    scopes: readonly string[];
-    nonce?: import("../OAuth.js").OAuthNonce | undefined;
     providerId: OAuthProviderId;
     authorizationUrl: string;
     state: import("../OAuth.js").OAuthStateToken;
@@ -129,6 +126,9 @@ export declare const oauthAuthorizationStartedHttpBody: (started: StartedOAuthAu
     expiresAt: UnixMillis;
     codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
     codeChallengeMethod: "S256";
+    nonce?: import("../OAuth.js").OAuthNonce | undefined;
+    redirectUri: string;
+    scopes: readonly string[];
 };
 export declare const oauthLinkConfirmationStartInput: (payload: Schema.Schema.Type<typeof OAuthLinkConfirmationStartBody>, options?: Pick<OAuthLinkConfirmationStartHttpOptions, "ttl">) => Effect.Effect<OAuthLinkConfirmationStartInput, AuthBadRequestError>;
 export declare const oauthLinkConfirmationInspectInput: (payload: Schema.Schema.Type<typeof OAuthLinkConfirmationInspectBody>) => OAuthLinkConfirmationInspectInput;
@@ -191,42 +191,38 @@ export interface RecoveryCodeGenerateHttpOptions {
     readonly groupSize?: number;
 }
 export declare const passkeyRegistrationStartInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>, options: PasskeyRegistrationStartHttpOptions) => {
-    metadata?: {
-        readonly [x: string]: unknown;
-    } | undefined;
-    attestation?: PasskeyAttestation | undefined;
-    authenticatorSelection?: PasskeyAuthenticatorSelection | undefined;
-    pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[] | undefined;
-    timeout?: number | undefined;
     relyingParty: PasskeyRelyingParty;
     userId: string & import("effect/Brand").Brand<"auth/UserId">;
     userName: string;
     userDisplayName: string;
+    timeout?: number | undefined;
+    pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[] | undefined;
+    authenticatorSelection?: PasskeyAuthenticatorSelection | undefined;
+    attestation?: PasskeyAttestation | undefined;
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
 };
 export declare const passkeyAuthenticationStartInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>, options: PasskeyAuthenticationStartHttpOptions) => {
+    relyingPartyId: string;
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    timeout?: number | undefined;
+    userVerification?: PasskeyUserVerification | undefined;
     metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
-    userVerification?: PasskeyUserVerification | undefined;
-    timeout?: number | undefined;
-    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
-    relyingPartyId: string;
 };
 export declare const passkeyMfaStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>, options: PasskeyAuthenticationStartHttpOptions) => PasskeyAuthenticationStartInput;
 export declare const passkeyRegistrationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>, options: PasskeyFinishHttpOptions) => {
-    metadata?: {
-        readonly [x: string]: unknown;
-    } | undefined;
-    requireUserVerification?: boolean | undefined;
     challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
     userId: string & import("effect/Brand").Brand<"auth/UserId">;
     response: {
         readonly id: string;
+        readonly rawId?: string | undefined;
         readonly type: "public-key";
         readonly response: {
             readonly [x: string]: unknown;
         };
-        readonly rawId?: string | undefined;
         readonly authenticatorAttachment?: string | undefined;
         readonly clientExtensionResults?: {
             readonly [x: string]: unknown;
@@ -234,55 +230,59 @@ export declare const passkeyRegistrationFinishInput: (payload: Schema.Schema.Typ
     };
     relyingPartyId: string;
     expectedOrigin: string | readonly string[];
-};
-export declare const passkeyAuthenticationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>, options: PasskeyFinishHttpOptions) => {
+    requireUserVerification?: boolean | undefined;
     metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
-    requireUserVerification?: boolean | undefined;
-    relyingPartyId: string;
-    expectedOrigin: string | readonly string[];
-    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+};
+export declare const passkeyAuthenticationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>, options: PasskeyFinishHttpOptions) => {
     challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
     response: {
         readonly id: string;
+        readonly rawId?: string | undefined;
         readonly type: "public-key";
         readonly response: {
             readonly [x: string]: unknown;
         };
-        readonly rawId?: string | undefined;
         readonly authenticatorAttachment?: string | undefined;
         readonly clientExtensionResults?: {
             readonly [x: string]: unknown;
         } | undefined;
     };
-};
-export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>, options: PasskeyFinishHttpOptions) => {
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    requireUserVerification?: boolean | undefined;
     metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
-    requireUserVerification?: boolean | undefined;
-    relyingPartyId: string;
-    expectedOrigin: string | readonly string[];
-    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+};
+export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>, options: PasskeyFinishHttpOptions) => {
     challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
     response: {
         readonly id: string;
+        readonly rawId?: string | undefined;
         readonly type: "public-key";
         readonly response: {
             readonly [x: string]: unknown;
         };
-        readonly rawId?: string | undefined;
         readonly authenticatorAttachment?: string | undefined;
         readonly clientExtensionResults?: {
             readonly [x: string]: unknown;
         } | undefined;
     };
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    requireUserVerification?: boolean | undefined;
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
 };
 export declare const passkeyCredentialRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyCredentialRevokeBody>) => {
-    reason?: string | undefined;
     userId: UserId;
     credentialId: PasskeyCredentialId;
+    reason?: string | undefined;
 };
 export declare const totpEnrollmentStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpEnrollmentStartBody>, options: TotpEnrollmentStartHttpOptions) => TotpEnrollmentStartInput;
 export declare const totpEnrollmentConfirmInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpEnrollmentConfirmBody>, options?: TotpCodeHttpOptions) => TotpEnrollmentConfirmInput;
@@ -340,36 +340,36 @@ export interface LoginApprovalFinalizeHttpInput {
 export declare const loginApprovalFinalizeInput: (payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>) => LoginApprovalFinalizeHttpInput;
 export declare const loginNotificationReportInput: (payload: Schema.Schema.Type<typeof LoginNotificationReportBody>) => LoginNotificationReportInput;
 export declare const adminSessionHttpBody: (session: SessionInfoShape) => {
-    longitude?: number | undefined;
-    latitude?: number | undefined;
-    city?: string | undefined;
-    region?: string | undefined;
-    country?: string | undefined;
-    userAgent?: string | undefined;
-    ip?: string | undefined;
-    mfaVerifiedAt?: UnixMillis | undefined;
-    expiresAt: UnixMillis;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
-    lastSeenAt?: UnixMillis | undefined;
     sessionId: SessionId;
     userId: UserId;
     createdAt: UnixMillis;
     authTime: UnixMillis;
+    lastSeenAt?: UnixMillis | undefined;
+    expiresAt: UnixMillis;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+    mfaVerifiedAt?: UnixMillis | undefined;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+    country?: string | undefined;
+    region?: string | undefined;
+    city?: string | undefined;
+    latitude?: number | undefined;
+    longitude?: number | undefined;
 };
 export declare const stepUpAuthenticatedHttpBody: (session: CurrentSessionShape) => {
-    mfaVerifiedAt?: UnixMillis | undefined;
     type: "authenticated";
     expiresAt: number;
     aal: import("../Sessions.js").AuthAssuranceLevel;
     amr: readonly AuthMethodReference[];
-} | {
-    claims: SessionClaims;
     mfaVerifiedAt?: UnixMillis | undefined;
+} | {
     type: "authenticated";
     expiresAt: number;
     aal: import("../Sessions.js").AuthAssuranceLevel;
     amr: readonly AuthMethodReference[];
+    mfaVerifiedAt?: UnixMillis | undefined;
+    claims: SessionClaims;
 };
 export type PasswordSignInHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof PasswordSignInBody>;
@@ -692,11 +692,11 @@ export declare const makePasswordSignUpHandler: (dependencies: {
     readonly authHttp: AuthHttpService;
     readonly emailVerificationFlow?: EmailVerificationFlowService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: PasswordSignUpHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | AuthEmailAlreadyRegisteredError | import("./Transport.js").PasswordSignUpHttpError, never>;
+}) => (args_0: PasswordSignUpHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthEmailAlreadyRegisteredError | AuthRateLimitedError | import("./Transport.js").PasswordSignUpHttpError, never>;
 export declare const makePasswordResetStartHandler: (dependencies: {
     readonly passwordReset: PasswordResetService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: PasswordResetStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | AuthInternalError, never>;
+}) => (args_0: PasswordResetStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthRateLimitedError, never>;
 export declare const makePasswordResetVerifyHandler: (dependencies: {
     readonly passwordReset: PasswordResetService;
 }) => (args_0: PasswordResetVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError, never>;
@@ -704,22 +704,22 @@ export declare const makePasswordSetHandler: (dependencies: {
     readonly passwordManagement: PasswordManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasswordSetHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: PasswordSetHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makePasswordChangeHandler: (dependencies: {
     readonly passwordManagement: PasswordManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasswordChangeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: PasswordChangeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeCurrentSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRefreshSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeLogoutHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
@@ -730,91 +730,91 @@ export declare const makeListSessionsHandler: (dependencies: {
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: SessionHandlerRequest) => Effect.Effect<{
     sessions: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        longitude?: number | undefined;
-        latitude?: number | undefined;
-        city?: string | undefined;
-        region?: string | undefined;
-        country?: string | undefined;
-        userAgent?: string | undefined;
-        ip?: string | undefined;
-        claims?: SessionClaims | undefined;
-        current: boolean;
-        mfaVerifiedAt?: UnixMillis | undefined;
-        expiresAt: UnixMillis;
-        aal: import("../Sessions.js").AuthAssuranceLevel;
-        amr: readonly AuthMethodReference[];
-        lastSeenAt?: UnixMillis | undefined;
         sessionId: SessionId;
         userId: UserId;
         createdAt: UnixMillis;
         authTime: UnixMillis;
+        lastSeenAt?: UnixMillis | undefined;
+        expiresAt: UnixMillis;
+        aal: import("../Sessions.js").AuthAssuranceLevel;
+        amr: readonly AuthMethodReference[];
+        mfaVerifiedAt?: UnixMillis | undefined;
+        current: boolean;
+        claims?: SessionClaims | undefined;
+        ip?: string | undefined;
+        userAgent?: string | undefined;
+        country?: string | undefined;
+        region?: string | undefined;
+        city?: string | undefined;
+        latitude?: number | undefined;
+        longitude?: number | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRevokeSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: SessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: SessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRevokeOtherSessionsHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeAdminSessionListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authorization: AdminSessionAuthorizationService;
 }) => (args_0: AdminSessionListHandlerRequest) => Effect.Effect<{
     sessions: {
-        longitude?: number | undefined;
-        latitude?: number | undefined;
-        city?: string | undefined;
-        region?: string | undefined;
-        country?: string | undefined;
-        userAgent?: string | undefined;
-        ip?: string | undefined;
-        mfaVerifiedAt?: UnixMillis | undefined;
-        expiresAt: UnixMillis;
-        aal: import("../Sessions.js").AuthAssuranceLevel;
-        amr: readonly AuthMethodReference[];
-        lastSeenAt?: UnixMillis | undefined;
         sessionId: SessionId;
         userId: UserId;
         createdAt: UnixMillis;
         authTime: UnixMillis;
+        lastSeenAt?: UnixMillis | undefined;
+        expiresAt: UnixMillis;
+        aal: import("../Sessions.js").AuthAssuranceLevel;
+        amr: readonly AuthMethodReference[];
+        mfaVerifiedAt?: UnixMillis | undefined;
+        ip?: string | undefined;
+        userAgent?: string | undefined;
+        country?: string | undefined;
+        region?: string | undefined;
+        city?: string | undefined;
+        latitude?: number | undefined;
+        longitude?: number | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+}, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeAdminSessionRevokeHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authorization: AdminSessionAuthorizationService;
-}) => (args_0: AdminSessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: AdminSessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeAdminSessionRevokeAllHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authorization: AdminSessionAuthorizationService;
-}) => (args_0: AdminSessionRevokeAllHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: AdminSessionRevokeAllHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeLoginNotificationReportHandler: (dependencies: {
     readonly loginNotification?: LoginNotificationService;
-}) => (args_0: LoginNotificationReportHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: LoginNotificationReportHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError, never>;
 export declare const securityTimelineEventHttpBody: (event: SecurityTimelineEvent) => {
-    metadata?: Readonly<Record<string, unknown>> | undefined;
-    request?: {
-        userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
-        ipHash?: import("../Identifiers.js").IpHash | undefined;
-    } | undefined;
-    actor?: {
-        type: "anonymous";
-    } | {
-        sessionId?: SessionId | undefined;
-        type: "user";
-    } | undefined;
     eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-    type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.risk.assessed" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked";
+    type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.session.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
     category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
     severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
     occurredAt: UnixMillis;
     summary: string;
+    actor?: {
+        type: "anonymous";
+    } | {
+        type: "user";
+        sessionId?: SessionId | undefined;
+    } | undefined;
+    request?: {
+        ipHash?: import("../Identifiers.js").IpHash | undefined;
+        userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
+    } | undefined;
+    metadata?: Readonly<Record<string, unknown>> | undefined;
 };
 export declare const makeSecurityTimelineListHandler: (dependencies: {
     readonly sessions: SessionsService;
@@ -822,25 +822,25 @@ export declare const makeSecurityTimelineListHandler: (dependencies: {
     readonly securityTimeline: SecurityTimelineStoreService;
 }) => (args_0: SecurityTimelineListHandlerRequest) => Effect.Effect<{
     events: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        request?: {
-            userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
-            ipHash?: import("../Identifiers.js").IpHash | undefined;
-        } | undefined;
-        actor?: {
-            type: "anonymous";
-        } | {
-            sessionId?: SessionId | undefined;
-            type: "user";
-        } | undefined;
         eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-        type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.risk.assessed" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked";
+        type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.session.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
         category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
         severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
         occurredAt: UnixMillis;
         summary: string;
+        actor?: {
+            type: "anonymous";
+        } | {
+            type: "user";
+            sessionId?: SessionId | undefined;
+        } | undefined;
+        request?: {
+            ipHash?: import("../Identifiers.js").IpHash | undefined;
+            userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
+        } | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeAdminSecurityTimelineListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
@@ -848,31 +848,31 @@ export declare const makeAdminSecurityTimelineListHandler: (dependencies: {
     readonly authorization: AdminSecurityTimelineAuthorizationService;
 }) => (args_0: AdminSecurityTimelineListHandlerRequest) => Effect.Effect<{
     events: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        request?: {
-            userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
-            ipHash?: import("../Identifiers.js").IpHash | undefined;
-        } | undefined;
-        actor?: {
-            type: "anonymous";
-        } | {
-            sessionId?: SessionId | undefined;
-            type: "user";
-        } | undefined;
         eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-        type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.risk.assessed" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked";
+        type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.session.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
         category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
         severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
         occurredAt: UnixMillis;
         summary: string;
+        actor?: {
+            type: "anonymous";
+        } | {
+            type: "user";
+            sessionId?: SessionId | undefined;
+        } | undefined;
+        request?: {
+            ipHash?: import("../Identifiers.js").IpHash | undefined;
+            userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
+        } | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+}, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const trustedDeviceHttpBody: (device: TrustedDeviceRecord) => {
-    metadata?: Readonly<Record<string, unknown>> | undefined;
     deviceId: string;
     createdAt: UnixMillis;
     lastSeenAt: UnixMillis;
     expiresAt: UnixMillis;
+    metadata?: Readonly<Record<string, unknown>> | undefined;
 };
 export declare const makeTrustedDeviceListHandler: (dependencies: {
     readonly sessions: SessionsService;
@@ -880,18 +880,18 @@ export declare const makeTrustedDeviceListHandler: (dependencies: {
     readonly trustedDevices: TrustedDeviceStoreService;
 }) => (args_0: TrustedDeviceListHandlerRequest) => Effect.Effect<{
     devices: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
         deviceId: string;
         createdAt: UnixMillis;
         lastSeenAt: UnixMillis;
         expiresAt: UnixMillis;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeTrustedDeviceRevokeHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
-}) => (args_0: TrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: TrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeAdminTrustedDeviceListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
@@ -899,23 +899,23 @@ export declare const makeAdminTrustedDeviceListHandler: (dependencies: {
     readonly authorization: AdminTrustedDeviceAuthorizationService;
 }) => (args_0: AdminTrustedDeviceListHandlerRequest) => Effect.Effect<{
     devices: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
         deviceId: string;
         createdAt: UnixMillis;
         lastSeenAt: UnixMillis;
         expiresAt: UnixMillis;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+}, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeAdminTrustedDeviceRevokeHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
     readonly authorization: AdminTrustedDeviceAuthorizationService;
-}) => (args_0: AdminTrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: AdminTrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeEmailVerificationStartHandler: (dependencies: {
     readonly emailVerificationFlow: EmailVerificationFlowService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: EmailVerificationStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthRateLimitedError | AuthInternalError, never>;
+}) => (args_0: EmailVerificationStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthRateLimitedError, never>;
 export declare const makeEmailVerificationVerifyHandler: (dependencies: {
     readonly emailVerification: EmailVerificationService;
     readonly sessions: SessionsService;
@@ -924,7 +924,7 @@ export declare const makeEmailVerificationVerifyHandler: (dependencies: {
 export declare const makeEmailOtpStartHandler: (dependencies: {
     readonly emailOtp: EmailOtpLoginService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: EmailOtpStartHandlerRequest) => Effect.Effect<import("../EmailOtp.js").EmailOtpStarted, AuthRateLimitedError | AuthInternalError, never>;
+}) => (args_0: EmailOtpStartHandlerRequest) => Effect.Effect<import("../EmailOtp.js").EmailOtpStarted, AuthInternalError | AuthRateLimitedError, never>;
 export declare const makeEmailOtpVerifyHandler: (dependencies: {
     readonly emailOtp: EmailOtpLoginService;
     readonly authHttp: AuthHttpService;
@@ -936,7 +936,7 @@ export declare const makeMagicLinkStartHandler: (dependencies: {
 }) => (args_0: MagicLinkStartHandlerRequest) => Effect.Effect<{
     email: Email;
     expiresAt: UnixMillis;
-}, AuthRateLimitedError | AuthInternalError, never>;
+}, AuthInternalError | AuthRateLimitedError, never>;
 export declare const makeMagicLinkVerifyHandler: (dependencies: {
     readonly magicLink: MagicLinkLoginService;
     readonly authHttp: AuthHttpService;
@@ -946,9 +946,6 @@ export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
     readonly oauthProviders: OAuthProvidersService;
     readonly oauthState: OAuthStateService;
 } & OAuthAuthorizationStartHttpOptions) => (args_0: OAuthAuthorizationStartHandlerRequest) => Effect.Effect<{
-    redirectUri: string;
-    scopes: readonly string[];
-    nonce?: import("../OAuth.js").OAuthNonce | undefined;
     providerId: OAuthProviderId;
     authorizationUrl: string;
     state: import("../OAuth.js").OAuthStateToken;
@@ -956,6 +953,9 @@ export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
     expiresAt: UnixMillis;
     codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
     codeChallengeMethod: "S256";
+    nonce?: import("../OAuth.js").OAuthNonce | undefined;
+    redirectUri: string;
+    scopes: readonly string[];
 }, AuthBadRequestError | AuthInternalError, never>;
 export declare const makeOAuthProviderAuthorizationHandler: (dependencies: {
     readonly authorization: OAuthProviderAuthorizationService;
@@ -1001,80 +1001,80 @@ export declare const makeOAuthAccountUnlinkHandler: (dependencies: {
     readonly oauthAccountUnlinking: OAuthAccountUnlinkingService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & OAuthAccountUnlinkHttpOptions) => (args_0: OAuthAccountUnlinkHandlerRequest) => Effect.Effect<{
-    readonly type: "allow";
-    readonly reason: "owned-account";
-    readonly account: {
-        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-    };
-    readonly remainingAccounts: readonly {
-        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-    }[];
-    readonly unlinked: boolean;
-} | {
-    readonly type: "requires-step-up";
-    readonly reason: "step-up-required";
-    readonly account: {
-        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-    };
-    readonly remainingAccounts: readonly {
-        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-    }[];
-} | {
-    readonly type: "deny-not-found";
-    readonly reason: "provider-account-not-found";
-    readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-    readonly providerAccountId: string;
-} | {
-    readonly type: "deny-not-owner";
-    readonly reason: "provider-account-linked-to-different-user";
-    readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-    readonly providerAccountId: string;
-} | {
-    readonly type: "deny-last-account";
-    readonly reason: "last-linked-account";
-    readonly account: {
-        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-    };
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+} & OAuthAccountUnlinkHttpOptions) => (args_0: OAuthAccountUnlinkHandlerRequest) => Effect.Effect<Schema.Struct.ReadonlySide<{
+    readonly type: Schema.Literal<"allow">;
+    readonly reason: Schema.Literal<"owned-account">;
+    readonly account: Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>;
+    readonly remainingAccounts: Schema.$Array<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+    readonly unlinked: Schema.Boolean;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly type: Schema.Literal<"requires-step-up">;
+    readonly reason: Schema.Literal<"step-up-required">;
+    readonly account: Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>;
+    readonly remainingAccounts: Schema.$Array<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly type: Schema.Literal<"deny-not-found">;
+    readonly reason: Schema.Literal<"provider-account-not-found">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly type: Schema.Literal<"deny-not-owner">;
+    readonly reason: Schema.Literal<"provider-account-linked-to-different-user">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly type: Schema.Literal<"deny-last-account">;
+    readonly reason: Schema.Literal<"last-linked-account">;
+    readonly account: Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>;
+}, "Type">, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeOAuthLinkConfirmationStartHandler: (dependencies: {
     readonly oauthLinkConfirmation: OAuthLinkConfirmationService;
-} & OAuthLinkConfirmationStartHttpOptions) => (args_0: OAuthLinkConfirmationStartHandlerRequest) => Effect.Effect<{
-    readonly challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
-    readonly userId: string & import("effect/Brand").Brand<"auth/UserId">;
-    readonly identity: {
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-        readonly email?: (string & import("effect/Brand").Brand<"auth/Email">) | undefined;
-        readonly emailVerified?: boolean | undefined;
-    };
-    readonly reason: string;
-    readonly expiresAt: number & import("effect/Brand").Brand<"auth/UnixMillis">;
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+} & OAuthLinkConfirmationStartHttpOptions) => (args_0: OAuthLinkConfirmationStartHandlerRequest) => Effect.Effect<Schema.Struct.ReadonlySide<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}, "Type">, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeOAuthLinkConfirmationInspectHandler: (dependencies: {
     readonly oauthLinkConfirmation: OAuthLinkConfirmationService;
-}) => (args_0: OAuthLinkConfirmationInspectHandlerRequest) => Effect.Effect<{
-    readonly challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
-    readonly userId: string & import("effect/Brand").Brand<"auth/UserId">;
-    readonly identity: {
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-        readonly email?: (string & import("effect/Brand").Brand<"auth/Email">) | undefined;
-        readonly emailVerified?: boolean | undefined;
-    };
-    readonly reason: string;
-    readonly expiresAt: number & import("effect/Brand").Brand<"auth/UnixMillis">;
-}, AuthBadRequestError | AuthInternalError, never>;
+}) => (args_0: OAuthLinkConfirmationInspectHandlerRequest) => Effect.Effect<Schema.Struct.ReadonlySide<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}, "Type">, AuthBadRequestError | AuthInternalError, never>;
 export declare const makeOAuthLinkConfirmationConfirmHandler: (dependencies: {
     readonly oauthLinkConfirmation: OAuthLinkConfirmationService;
 } & OAuthLinkConfirmationConfirmHttpOptions) => (args_0: OAuthLinkConfirmationConfirmHandlerRequest) => Effect.Effect<{
@@ -1087,13 +1087,13 @@ export declare const makeOAuthLinkConfirmationConfirmHandler: (dependencies: {
         readonly emailVerified?: boolean | undefined;
     };
     readonly reason: string;
+    readonly existingAccount?: Schema.Struct.ReadonlySide<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }, "Type"> | undefined;
     readonly linked: boolean;
-    readonly existingAccount?: {
-        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
-        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
-        readonly providerAccountId: string;
-    } | undefined;
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makePasskeyRegistrationStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
 } & PasskeyRegistrationStartHttpOptions) => (args_0: PasskeyRegistrationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyRegistration, AuthInternalError, never>;
@@ -1117,95 +1117,95 @@ export declare const makePasskeyCredentialListHandler: (dependencies: {
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: PasskeyCredentialListHandlerRequest) => Effect.Effect<{
     credentials: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
-        createdAt: UnixMillis;
-        backedUp?: boolean | undefined;
-        transports?: readonly import("../Passkey.js").PasskeyTransport[] | undefined;
         credentialId: PasskeyCredentialId;
+        transports?: readonly import("../Passkey.js").PasskeyTransport[] | undefined;
+        backedUp?: boolean | undefined;
+        createdAt: UnixMillis;
+        lastUsedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makePasskeyCredentialRevokeHandler: (dependencies: {
     readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasskeyCredentialRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: PasskeyCredentialRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeTotpEnrollmentStartHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 } & TotpEnrollmentStartHttpOptions) => (args_0: TotpEnrollmentStartHandlerRequest) => Effect.Effect<{
     factor: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
-        confirmedAt?: UnixMillis | undefined;
         factorId: import("../Identifiers.js").CredentialId;
         algorithm: TotpAlgorithm;
         digits: number;
         period: number;
         createdAt: UnixMillis;
+        confirmedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     };
     secret: import("../Totp.js").TotpSecret;
     uri: string;
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeTotpEnrollmentConfirmHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 } & TotpCodeHttpOptions) => (args_0: TotpEnrollmentConfirmHandlerRequest) => Effect.Effect<{
-    metadata?: Readonly<Record<string, unknown>> | undefined;
-    revokedAt?: UnixMillis | undefined;
-    lastUsedAt?: UnixMillis | undefined;
-    confirmedAt?: UnixMillis | undefined;
     factorId: import("../Identifiers.js").CredentialId;
     algorithm: TotpAlgorithm;
     digits: number;
     period: number;
     createdAt: UnixMillis;
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+    confirmedAt?: UnixMillis | undefined;
+    lastUsedAt?: UnixMillis | undefined;
+    revokedAt?: UnixMillis | undefined;
+    metadata?: Readonly<Record<string, unknown>> | undefined;
+}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeTotpVerifyHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 } & TotpCodeHttpOptions) => (args_0: TotpVerifyHandlerRequest) => Effect.Effect<{
-    delta?: number | undefined;
+    valid: boolean;
     factor?: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
-        confirmedAt?: UnixMillis | undefined;
         factorId: import("../Identifiers.js").CredentialId;
         algorithm: TotpAlgorithm;
         digits: number;
         period: number;
         createdAt: UnixMillis;
+        confirmedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     } | undefined;
-    valid: boolean;
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+    delta?: number | undefined;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeTotpFactorListHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: TotpFactorListHandlerRequest) => Effect.Effect<{
     factors: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
-        confirmedAt?: UnixMillis | undefined;
         factorId: import("../Identifiers.js").CredentialId;
         algorithm: TotpAlgorithm;
         digits: number;
         period: number;
         createdAt: UnixMillis;
+        confirmedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeTotpFactorRevokeHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: TotpFactorRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: TotpFactorRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRecoveryCodeGenerateHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
@@ -1213,45 +1213,45 @@ export declare const makeRecoveryCodeGenerateHandler: (dependencies: {
 } & RecoveryCodeGenerateHttpOptions) => (args_0: RecoveryCodeGenerateHandlerRequest) => Effect.Effect<{
     codes: import("../RecoveryCode.js").RecoveryCode[];
     records: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        usedAt?: UnixMillis | undefined;
         codeId: import("../Identifiers.js").CredentialId;
         createdAt: UnixMillis;
+        usedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRecoveryCodeVerifyHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: RecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
+    valid: boolean;
     code?: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        usedAt?: UnixMillis | undefined;
         codeId: import("../Identifiers.js").CredentialId;
         createdAt: UnixMillis;
+        usedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     } | undefined;
-    valid: boolean;
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRecoveryCodeListHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: RecoveryCodeListHandlerRequest) => Effect.Effect<{
     codes: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        usedAt?: UnixMillis | undefined;
         codeId: import("../Identifiers.js").CredentialId;
         createdAt: UnixMillis;
+        usedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRecoveryCodeRevokeHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: RecoveryCodeRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: RecoveryCodeRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeApiKeyCreateHandler: (dependencies: {
     readonly apiKeyManagement: ApiKeyManagementService;
     readonly sessions: SessionsService;
@@ -1259,85 +1259,85 @@ export declare const makeApiKeyCreateHandler: (dependencies: {
 }) => (args_0: ApiKeyCreateHandlerRequest) => Effect.Effect<{
     secret: import("../ApiKey.js").ApiKeySecret;
     key: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
-        expiresAt?: UnixMillis | undefined;
         keyId: ApiKeyId;
         prefix: import("../ApiKey.js").ApiKeyPrefix;
         scopes: readonly string[];
         createdAt: UnixMillis;
+        expiresAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     };
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeApiKeyListHandler: (dependencies: {
     readonly apiKeyManagement: ApiKeyManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: ApiKeyListHandlerRequest) => Effect.Effect<{
     keys: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        revokedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
-        expiresAt?: UnixMillis | undefined;
         keyId: ApiKeyId;
         prefix: import("../ApiKey.js").ApiKeyPrefix;
         scopes: readonly string[];
         createdAt: UnixMillis;
+        expiresAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeApiKeyRevokeHandler: (dependencies: {
     readonly apiKeyManagement: ApiKeyManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: ApiKeyRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+}) => (args_0: ApiKeyRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRefreshTokenRefreshHandler: (dependencies: {
     readonly refreshTokenManagement: RefreshTokenManagementService;
     readonly jwtIssuer: JwtIssuerService;
 } & RefreshTokenRefreshHttpOptions) => (args_0: RefreshTokenRefreshHandlerRequest) => Effect.Effect<{
+    accessToken: import("../Jwt.js").JwtToken;
+    accessTokenExpiresAt?: UnixMillis | undefined;
     refreshToken: string;
     refreshTokenRecord: {
-        metadata?: Readonly<Record<string, unknown>> | undefined;
-        reuseDetectedAt?: UnixMillis | undefined;
-        revokedAt?: UnixMillis | undefined;
-        replacedById?: import("../RefreshToken.js").RefreshTokenId | undefined;
-        rotatedAt?: UnixMillis | undefined;
-        lastUsedAt?: UnixMillis | undefined;
         tokenId: import("../RefreshToken.js").RefreshTokenId;
         familyId: import("../RefreshToken.js").RefreshTokenFamilyId;
         createdAt: UnixMillis;
         expiresAt: UnixMillis;
+        lastUsedAt?: UnixMillis | undefined;
+        rotatedAt?: UnixMillis | undefined;
+        replacedById?: import("../RefreshToken.js").RefreshTokenId | undefined;
+        revokedAt?: UnixMillis | undefined;
+        reuseDetectedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
     };
-    accessTokenExpiresAt?: UnixMillis | undefined;
-    accessToken: import("../Jwt.js").JwtToken;
-}, AuthInvalidCredentialsError | AuthInternalError, never>;
+}, AuthInternalError | AuthInvalidCredentialsError, never>;
 export declare const makeJwtIntrospectHandler: (dependencies: {
     readonly jwtRevocation: JwtRevocationService;
 } & JwtIntrospectionHttpOptions) => (args_0: JwtIntrospectHandlerRequest) => Effect.Effect<{
     readonly active: true;
-    readonly header: {
-        readonly typ: "JWT";
-        readonly alg: "HS256" | "RS256" | "ES256" | "EdDSA";
-        readonly kid: string;
-    };
+    readonly header: Schema.Struct.ReadonlySide<{
+        readonly typ: Schema.Literal<"JWT">;
+        readonly alg: Schema.Literals<readonly ["HS256", "RS256", "ES256", "EdDSA"]>;
+        readonly kid: Schema.String;
+    }, "Type">;
     readonly claims: {
         readonly [x: string]: unknown;
     };
     readonly key: {
         readonly keyId: string;
-        readonly alg: "HS256" | "RS256" | "ES256" | "EdDSA";
-        readonly status: "active" | "retired" | "disabled";
+        readonly alg: "ES256" | "EdDSA" | "HS256" | "RS256";
+        readonly status: "active" | "disabled" | "retired";
         readonly createdAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
         readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
         readonly metadata?: {
             readonly [x: string]: unknown;
         } | undefined;
     };
-    readonly revoked: false;
     readonly jwtId?: string | undefined;
     readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+    readonly revoked: false;
 } | {
     readonly active: false;
-    readonly reason: "expired" | "revoked" | "malformed" | "unsupported_alg" | "unknown_key" | "invalid_signature" | "not_yet_valid" | "issuer_mismatch" | "audience_mismatch";
+    readonly reason: "audience_mismatch" | "expired" | "invalid_signature" | "issuer_mismatch" | "malformed" | "not_yet_valid" | "revoked" | "unknown_key" | "unsupported_alg";
     readonly jwtId?: string | undefined;
     readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
     readonly revokedAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
@@ -1348,11 +1348,9 @@ export declare const makeJwtRevokeHandler: (dependencies: {
 }) => (args_0: JwtRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
 export declare const makeJwtJwksHandler: (dependencies: {
     readonly jwks: JwksService;
-}) => (_: JwtJwksHandlerRequest) => Effect.Effect<{
-    readonly keys: readonly {
-        readonly [x: string]: unknown;
-    }[];
-}, AuthInternalError, never>;
+}) => (_: JwtJwksHandlerRequest) => Effect.Effect<Schema.Struct.ReadonlySide<{
+    readonly keys: Schema.$Array<Schema.$Record<Schema.String, Schema.Unknown>>;
+}, "Type">, AuthInternalError, never>;
 export declare const makeOidcDiscoveryMetadataHandler: (dependencies: {
     readonly metadata: OidcDiscoveryMetadataService;
 }) => (_: OidcDiscoveryMetadataHandlerRequest) => Effect.Effect<{
@@ -1389,24 +1387,24 @@ export declare const makeTotpMfaVerifyHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
 export declare const makeTotpMfaVerifyForFlowHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
 export declare const makeRecoveryCodeMfaVerifyHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: RecoveryCodeMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: RecoveryCodeMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
 export declare const makeRecoveryCodeMfaVerifyForFlowHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: RecoveryCodeMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: RecoveryCodeMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
 export declare const makePasskeyMfaStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
     readonly authFlowState: AuthFlowStateService;
@@ -1415,7 +1413,7 @@ export declare const makePasskeyMfaVerifyHandler: (dependencies: {
     readonly passkeyVerification: PasskeyVerificationService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-} & PasskeyFinishHttpOptions) => (args_0: PasskeyMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError, never>;
 export declare const makeStepUpOptionsHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
@@ -1426,45 +1424,45 @@ export declare const makeStepUpOptionsHandler: (dependencies: {
     factors: {
         readonly type: "totp" | "backup-code" | "passkey";
     }[];
-}, AuthUnauthenticatedError | AuthInternalError, never>;
+}, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeStepUpTotpVerifyHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 } & TotpCodeHttpOptions) => (args_0: StepUpTotpVerifyHandlerRequest) => Effect.Effect<{
-    mfaVerifiedAt?: UnixMillis | undefined;
     type: "authenticated";
     expiresAt: number;
     aal: import("../Sessions.js").AuthAssuranceLevel;
     amr: readonly AuthMethodReference[];
-}, AuthUnauthenticatedError | AuthInvalidCredentialsError | AuthInternalError, never>;
+    mfaVerifiedAt?: UnixMillis | undefined;
+}, AuthInternalError | AuthInvalidCredentialsError | AuthUnauthenticatedError, never>;
 export declare const makeStepUpRecoveryCodeVerifyHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: StepUpRecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
-    mfaVerifiedAt?: UnixMillis | undefined;
     type: "authenticated";
     expiresAt: number;
     aal: import("../Sessions.js").AuthAssuranceLevel;
     amr: readonly AuthMethodReference[];
-}, AuthUnauthenticatedError | AuthInvalidCredentialsError | AuthInternalError, never>;
+    mfaVerifiedAt?: UnixMillis | undefined;
+}, AuthInternalError | AuthInvalidCredentialsError | AuthUnauthenticatedError, never>;
 export declare const makeStepUpPasskeyStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & PasskeyAuthenticationStartHttpOptions) => (args_0: StepUpPasskeyStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+} & PasskeyAuthenticationStartHttpOptions) => (args_0: StepUpPasskeyStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeStepUpPasskeyVerifyHandler: (dependencies: {
     readonly passkeyVerification: PasskeyVerificationService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 } & PasskeyFinishHttpOptions) => (args_0: StepUpPasskeyVerifyHandlerRequest) => Effect.Effect<{
-    mfaVerifiedAt?: UnixMillis | undefined;
     type: "authenticated";
     expiresAt: number;
     aal: import("../Sessions.js").AuthAssuranceLevel;
     amr: readonly AuthMethodReference[];
-}, AuthBadRequestError | AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+    mfaVerifiedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeLoginApprovalApproveHandler: (dependencies: {
     readonly loginApproval: LoginApprovalService;
     readonly authFlowState: AuthFlowStateService;
@@ -1474,21 +1472,36 @@ export declare const makeLoginApprovalApproveHandler: (dependencies: {
     readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
     readonly trustedDevice?: TrustedDeviceService;
     readonly trustedDeviceCookie?: TrustedDeviceCookieService;
-}) => (args_0: LoginApprovalApproveHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+}) => (args_0: LoginApprovalApproveHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError, never>;
 export declare const makeLoginApprovalStatusHandler: (dependencies: {
     readonly loginApprovalReview?: LoginApprovalReviewService;
 }) => (args_0: LoginApprovalStatusHandlerRequest) => Effect.Effect<{
     status: "expired" | import("../LoginApproval.js").LoginApprovalReviewStatus;
     expiresAt: UnixMillis;
-}, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError, never>;
 export declare const makeLoginApprovalFinalizeHandler: (dependencies: {
     readonly loginApprovalFinalize?: LoginApprovalFinalizeService;
     readonly authHttp: AuthHttpService;
     readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
     readonly trustedDevice?: TrustedDeviceService;
     readonly trustedDeviceCookie?: TrustedDeviceCookieService;
-}) => (args_0: LoginApprovalFinalizeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthPolicyDeniedError | AuthInternalError, never>;
-declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signIn", "POST", "/auth/password/sign-in", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}) => (args_0: LoginApprovalFinalizeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError, never>;
+declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"change", "POST", "/auth/password/change", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly currentPassword: Schema.String;
+    readonly newPassword: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"set", "POST", "/auth/password/set", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly password: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetStart", "POST", "/auth/password/reset/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetVerify", "POST", "/auth/password/reset/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+    readonly password: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signIn", "POST", "/auth/password/sign-in", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly password: Schema.String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
@@ -1521,7 +1534,7 @@ declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("ef
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signUp", "POST", "/auth/password/sign-up", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signUp", "POST", "/auth/password/sign-up", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly password: Schema.String;
     readonly emailVerified: Schema.optional<Schema.Boolean>;
@@ -1556,22 +1569,7 @@ declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("ef
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetStart", "POST", "/auth/password/reset/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly locale: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetVerify", "POST", "/auth/password/reset/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.String;
-    readonly password: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"set", "POST", "/auth/password/set", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly password: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"change", "POST", "/auth/password/change", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly currentPassword: Schema.String;
-    readonly newPassword: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class PasswordApi extends PasswordApi_base {
 }
 declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"current", "GET", "/auth/session", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -1612,7 +1610,7 @@ declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effe
         readonly longitude: Schema.optional<Schema.Number>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/session/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"logout", "POST", "/auth/logout", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/session/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
     readonly userId: Schema.String;
     readonly sessionId: Schema.String;
@@ -1625,7 +1623,7 @@ declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effe
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"logout", "POST", "/auth/logout", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeOthers", "POST", "/auth/sessions/revoke-others", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never>, false>;
 export declare class SessionApi extends SessionApi_base {
@@ -1651,12 +1649,12 @@ declare const AdminSessionApi_base: HttpApiGroup.HttpApiGroup<"adminSession", im
         readonly latitude: Schema.optional<Schema.Number>;
         readonly longitude: Schema.optional<Schema.Number>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class AdminSessionApi extends AdminSessionApi_base {
 }
 declare const AdminSessionHttpApi_base: HttpApi.HttpApi<"AdminSessionHttpApi", typeof AdminSessionApi>;
@@ -1665,12 +1663,12 @@ export declare class AdminSessionHttpApi extends AdminSessionHttpApi_base {
 declare const EmailVerificationApi_base: HttpApiGroup.HttpApiGroup<"emailVerification", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-verification/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-verification/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-verification/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly secret: Schema.optional<Schema.String>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class EmailVerificationApi extends EmailVerificationApi_base {
 }
 declare const EmailOtpApi_base: HttpApiGroup.HttpApiGroup<"emailOtp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-otp/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -1682,7 +1680,7 @@ declare const EmailOtpApi_base: HttpApiGroup.HttpApiGroup<"emailOtp", import("ef
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-otp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-otp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
@@ -1715,7 +1713,7 @@ declare const EmailOtpApi_base: HttpApiGroup.HttpApiGroup<"emailOtp", import("ef
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class EmailOtpApi extends EmailOtpApi_base {
 }
 declare const MagicLinkApi_base: HttpApiGroup.HttpApiGroup<"magicLink", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/magic-link/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -1726,7 +1724,7 @@ declare const MagicLinkApi_base: HttpApiGroup.HttpApiGroup<"magicLink", import("
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/magic-link/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/magic-link/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
@@ -1759,7 +1757,7 @@ declare const MagicLinkApi_base: HttpApiGroup.HttpApiGroup<"magicLink", import("
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class MagicLinkApi extends MagicLinkApi_base {
 }
 declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startAuthorization", "POST", "/auth/oauth/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -1782,7 +1780,7 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
     readonly nonce: Schema.optional<Schema.String>;
     readonly redirectUri: Schema.String;
     readonly scopes: Schema.$Array<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"unlinkAccount", "POST", "/auth/oauth/unlink", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"unlinkAccount", "POST", "/auth/oauth/unlink", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
     readonly providerAccountId: Schema.String;
     readonly reason: Schema.optional<Schema.String>;
@@ -1831,18 +1829,9 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
         readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
         readonly providerAccountId: Schema.String;
     }>;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
-    readonly identity: Schema.optional<Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>>;
-    readonly reason: Schema.optional<Schema.String>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
@@ -1854,9 +1843,18 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
     }>;
     readonly reason: Schema.String;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
+    readonly identity: Schema.optional<Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+    readonly reason: Schema.optional<Schema.String>;
     readonly secret: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
@@ -1868,7 +1866,7 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
     }>;
     readonly reason: Schema.String;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
     readonly expectedProviderId: Schema.optional<Schema.brand<Schema.String, "auth/OAuthProviderId">>;
@@ -1889,7 +1887,7 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
         readonly providerAccountId: Schema.String;
     }>>;
     readonly linked: Schema.Boolean;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class OAuthApi extends OAuthApi_base {
 }
 declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"token", "POST", "/auth/oauth/token", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -1900,7 +1898,7 @@ declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import
     readonly id_token: Schema.optional<Schema.String>;
     readonly scope: Schema.optional<Schema.String>;
     readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly active: Schema.Boolean;
     readonly scope: Schema.optional<Schema.String>;
     readonly client_id: Schema.optional<Schema.String>;
@@ -1914,7 +1912,7 @@ declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import
     readonly iss: Schema.optional<Schema.String>;
     readonly jti: Schema.optional<Schema.String>;
     readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
 export declare class OAuthTokenApi extends OAuthTokenApi_base {
 }
 declare const OAuthTokenHttpApi_base: HttpApi.HttpApi<"OAuthTokenHttpApi", typeof OAuthTokenApi>;
@@ -1949,13 +1947,7 @@ declare const LoginApprovalApi_base: HttpApiGroup.HttpApiGroup<"loginApproval",
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "POST", "/auth/login-approval/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly status: Schema.Literals<readonly ["pending", "approved", "denied", "expired"]>;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"finalize", "POST", "/auth/login-approval/finalize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"finalize", "POST", "/auth/login-approval/finalize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
     readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly rememberDevice: Schema.optional<Schema.Boolean>;
@@ -1969,19 +1961,50 @@ declare const LoginApprovalApi_base: HttpApiGroup.HttpApiGroup<"loginApproval",
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "POST", "/auth/login-approval/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly status: Schema.Literals<readonly ["pending", "approved", "denied", "expired"]>;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class LoginApprovalApi extends LoginApprovalApi_base {
 }
-declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "POST", "/auth/mfa/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/mfa/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly publicKey: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.optional<Schema.Number>;
+        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.String;
+            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>>;
+        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "POST", "/auth/mfa/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly factors: Schema.$Array<Schema.Struct<{
         readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/mfa/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/mfa/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly code: Schema.String;
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly credential: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly rawId: Schema.optional<Schema.String>;
+        readonly type: Schema.Literal<"public-key">;
+        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly authenticatorAttachment: Schema.optional<Schema.String>;
+        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
@@ -1993,8 +2016,9 @@ declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unsta
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotpForFlow", "POST", "/auth/mfa/totp/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/mfa/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2007,9 +2031,8 @@ declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unsta
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/mfa/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/auth/mfa/recovery-code/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2022,8 +2045,9 @@ declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unsta
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/auth/mfa/recovery-code/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/mfa/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2036,35 +2060,9 @@ declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unsta
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/mfa/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly publicKey: Schema.Struct<{
-        readonly challenge: Schema.String;
-        readonly rpId: Schema.String;
-        readonly timeout: Schema.optional<Schema.Number>;
-        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
-            readonly type: Schema.Literal<"public-key">;
-            readonly id: Schema.String;
-            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
-        }>>>;
-        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
-    }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/mfa/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotpForFlow", "POST", "/auth/mfa/totp/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly credential: Schema.Struct<{
-        readonly id: Schema.String;
-        readonly rawId: Schema.optional<Schema.String>;
-        readonly type: Schema.Literal<"public-key">;
-        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
-        readonly authenticatorAttachment: Schema.optional<Schema.String>;
-        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>;
-    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
+    readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
@@ -2076,14 +2074,30 @@ declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unsta
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class MfaApi extends MfaApi_base {
 }
 declare const StepUpApi_base: HttpApiGroup.HttpApiGroup<"stepUp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "GET", "/auth/step-up/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly factors: Schema.$Array<Schema.Struct<{
         readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/step-up/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/step-up/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly publicKey: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.optional<Schema.Number>;
+        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.String;
+            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>>;
+        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/step-up/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2096,7 +2110,7 @@ declare const StepUpApi_base: HttpApiGroup.HttpApiGroup<"stepUp", import("effect
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/step-up/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/step-up/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2109,23 +2123,7 @@ declare const StepUpApi_base: HttpApiGroup.HttpApiGroup<"stepUp", import("effect
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/step-up/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly publicKey: Schema.Struct<{
-        readonly challenge: Schema.String;
-        readonly rpId: Schema.String;
-        readonly timeout: Schema.optional<Schema.Number>;
-        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
-            readonly type: Schema.Literal<"public-key">;
-            readonly id: Schema.String;
-            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
-        }>>>;
-        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
-    }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/step-up/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/step-up/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly credential: Schema.Struct<{
         readonly id: Schema.String;
@@ -2146,16 +2144,11 @@ declare const StepUpApi_base: HttpApiGroup.HttpApiGroup<"stepUp", import("effect
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class StepUpApi extends StepUpApi_base {
 }
-declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
-    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly secret: Schema.String;
-    readonly key: Schema.Struct<{
+declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listApiKeys", "GET", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keys: Schema.$Array<Schema.Struct<{
         readonly keyId: Schema.String;
         readonly prefix: Schema.String;
         readonly scopes: Schema.$Array<Schema.String>;
@@ -2164,9 +2157,17 @@ declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect
         readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listApiKeys", "GET", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly keys: Schema.$Array<Schema.Struct<{
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keyId: Schema.String;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly secret: Schema.String;
+    readonly key: Schema.Struct<{
         readonly keyId: Schema.String;
         readonly prefix: Schema.String;
         readonly scopes: Schema.$Array<Schema.String>;
@@ -2175,11 +2176,8 @@ declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect
         readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly keyId: Schema.String;
-    readonly reason: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class ApiKeyApi extends ApiKeyApi_base {
 }
 declare const RefreshTokenApi_base: HttpApiGroup.HttpApiGroup<"refreshToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/token/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2204,7 +2202,11 @@ declare const RefreshTokenApi_base: HttpApiGroup.HttpApiGroup<"refreshToken", im
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
 export declare class RefreshTokenApi extends RefreshTokenApi_base {
 }
-declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly token: Schema.String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
     readonly active: Schema.Literal<true>;
@@ -2232,11 +2234,7 @@ declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unsta
     readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly revokedReason: Schema.optional<Schema.String>;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly jwtId: Schema.String;
-    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly reason: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
 export declare class JwtApi extends JwtApi_base {
 }
 declare const JwtDiscoveryApi_base: HttpApiGroup.HttpApiGroup<"jwtDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"jwks", "GET", "/.well-known/jwks.json", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -2275,7 +2273,7 @@ export declare class OidcDiscoveryHttpApi extends OidcDiscoveryHttpApi_base {
 declare const SecurityApi_base: HttpApiGroup.HttpApiGroup<"security", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"reportLogin", "POST", "/auth/security/login/report", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class SecurityApi extends SecurityApi_base {
 }
 declare const SecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"securityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/security/timeline", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
@@ -2303,7 +2301,7 @@ declare const SecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"securityTimel
         }>>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class SecurityTimelineApi extends SecurityTimelineApi_base {
 }
 declare const SecurityTimelineHttpApi_base: HttpApi.HttpApi<"SecurityTimelineHttpApi", typeof SecurityTimelineApi>;
@@ -2335,7 +2333,7 @@ declare const AdminSecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"adminSec
         }>>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class AdminSecurityTimelineApi extends AdminSecurityTimelineApi_base {
 }
 declare const AdminSecurityTimelineHttpApi_base: HttpApi.HttpApi<"AdminSecurityTimelineHttpApi", typeof AdminSecurityTimelineApi>;
@@ -2349,9 +2347,9 @@ declare const TrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"trustedDevice",
         readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly deviceId: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class TrustedDeviceApi extends TrustedDeviceApi_base {
 }
 declare const TrustedDeviceHttpApi_base: HttpApi.HttpApi<"TrustedDeviceHttpApi", typeof TrustedDeviceApi>;
@@ -2367,10 +2365,10 @@ declare const AdminTrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"adminTruste
         readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly deviceId: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class AdminTrustedDeviceApi extends AdminTrustedDeviceApi_base {
 }
 declare const AdminTrustedDeviceHttpApi_base: HttpApi.HttpApi<"AdminTrustedDeviceHttpApi", typeof AdminTrustedDeviceApi>;
@@ -2379,32 +2377,32 @@ export declare class AdminTrustedDeviceHttpApi extends AdminTrustedDeviceHttpApi
 declare const AuthApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordApi | typeof SessionApi | typeof EmailVerificationApi | typeof EmailOtpApi | typeof MagicLinkApi | typeof LoginApprovalApi | typeof SecurityApi>;
 export declare class AuthApi extends AuthApi_base {
 }
-export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, Sessions | SessionCookie | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthSchemaErrorMiddleware | AuthHttp | EmailVerificationFlow | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
-export declare const SessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "session">, never, Sessions | SessionCookie | AuthHttp | AuthOriginCheckMiddleware>;
-export declare const AdminSessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSessionHttpApi", "adminSession">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AdminSessionAuthorization>;
-export declare const AdminSessionHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | import("effect/FileSystem").FileSystem | import("effect/Path").Path | AdminSessionAuthorization | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | EmailVerificationFlow | EmailVerification | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
-export declare const EmailOtpApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailOtp">, never, EmailOtpLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
-export declare const MagicLinkApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "magicLink">, never, MagicLinkLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
-export declare const LoginApprovalApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "loginApproval">, never, UserStore | LoginApproval | AuthFlowState | AuthFlow | AuthSchemaErrorMiddleware | AuthHttp | AuthOriginCheckMiddleware>;
-export declare const SecurityApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "security">, never, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
-export declare const SecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"SecurityTimelineHttpApi", "securityTimeline">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | SecurityTimelineStore | AuthOriginCheckMiddleware>;
-export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | SecurityTimelineStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, AuthApiRateLimit | AuthHttp | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | EmailVerificationFlow | PasswordLogin | PasswordManagement | PasswordRegistration | PasswordReset | SessionCookie | Sessions>;
+export declare const SessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "session">, never, AuthHttp | AuthOriginCheckMiddleware | SessionCookie | Sessions>;
+export declare const AdminSessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSessionHttpApi", "adminSession">, never, AdminSessionAuthorization | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SessionCookie | Sessions>;
+export declare const AdminSessionHttpApiLive: Layer.Layer<never, never, AdminSessionAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SessionCookie | Sessions>;
+export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | EmailVerification | EmailVerificationFlow | SessionCookie | Sessions>;
+export declare const EmailOtpApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailOtp">, never, AuthApiRateLimit | AuthHttp | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | EmailOtpLogin>;
+export declare const MagicLinkApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "magicLink">, never, AuthApiRateLimit | AuthHttp | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | MagicLinkLogin>;
+export declare const LoginApprovalApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "loginApproval">, never, AuthFlow | AuthFlowState | AuthHttp | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | LoginApproval | UserStore>;
+export declare const SecurityApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "security">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware>;
+export declare const SecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"SecurityTimelineHttpApi", "securityTimeline">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
 export declare const OAuthProviderAuthorizationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OAuthProviderAuthorizationHttpApi", "oauthProviderAuthorization">, never, AuthSchemaErrorMiddleware | OAuthProviderAuthorization>;
-export declare const OAuthProviderAuthorizationHttpApiLive: Layer.Layer<never, never, OAuthProviderAuthorization | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const OAuthProviderAuthorizationHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | OAuthProviderAuthorization | import("effect/Path").Path>;
 export declare const OAuthTokenApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OAuthTokenHttpApi", "oauthToken">, never, AuthSchemaErrorMiddleware | OAuthAuthorizationCodeTokenGrant>;
-export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, OAuthAuthorizationCodeTokenGrant | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | OAuthAuthorizationCodeTokenGrant | import("effect/Path").Path>;
 export declare const JwtDiscoveryApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"JwtDiscoveryHttpApi", "jwtDiscovery">, never, AuthSchemaErrorMiddleware | Jwks>;
-export declare const JwtDiscoveryHttpApiLive: Layer.Layer<never, never, Jwks | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const JwtDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | Jwks | import("effect/Path").Path>;
 export declare const OidcDiscoveryApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OidcDiscoveryHttpApi", "oidcDiscovery">, never, AuthSchemaErrorMiddleware | OidcDiscoveryMetadata>;
-export declare const OidcDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/Path").Path | OidcDiscoveryMetadata | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AdminSecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSecurityTimelineHttpApi", "adminSecurityTimeline">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | SecurityTimelineStore | AuthOriginCheckMiddleware | AdminSecurityTimelineAuthorization>;
-export declare const AdminSecurityTimelineHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | SecurityTimelineStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | AdminSecurityTimelineAuthorization | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const TrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"TrustedDeviceHttpApi", "trustedDevice">, never, Sessions | TrustedDeviceStore | SessionCookie | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
-export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, Sessions | TrustedDeviceStore | SessionCookie | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AdminTrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminTrustedDeviceHttpApi", "adminTrustedDevice">, never, Sessions | TrustedDeviceStore | SessionCookie | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AdminTrustedDeviceAuthorization>;
-export declare const AdminTrustedDeviceHttpApiLive: Layer.Layer<never, never, Sessions | TrustedDeviceStore | SessionCookie | import("effect/FileSystem").FileSystem | import("effect/Path").Path | AdminTrustedDeviceAuthorization | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AuthHttpApiBareLive: Layer.Layer<never, never, UserStore | LoginApproval | Sessions | AuthFlowState | AuthFlow | SessionCookie | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AuthHttpApiLive: Layer.Layer<never, never, UserStore | LoginApproval | Sessions | AuthFlowState | AuthFlow | import("../Privacy.js").Privacy | SessionCookie | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("../RateLimiter.js").RateLimiter | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const OidcDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | OidcDiscoveryMetadata | import("effect/Path").Path>;
+export declare const AdminSecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSecurityTimelineHttpApi", "adminSecurityTimeline">, never, AdminSecurityTimelineAuthorization | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const AdminSecurityTimelineHttpApiLive: Layer.Layer<never, never, AdminSecurityTimelineAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const TrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"TrustedDeviceHttpApi", "trustedDevice">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const AdminTrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminTrustedDeviceHttpApi", "adminTrustedDevice">, never, AdminTrustedDeviceAuthorization | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const AdminTrustedDeviceHttpApiLive: Layer.Layer<never, never, AdminTrustedDeviceAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const AuthHttpApiBareLive: Layer.Layer<never, never, AuthFlow | AuthFlowState | AuthHttp | EmailOtpLogin | EmailVerification | EmailVerificationFlow | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | LoginApproval | MagicLinkLogin | PasswordLogin | PasswordManagement | PasswordRegistration | PasswordReset | import("effect/Path").Path | SessionCookie | Sessions | UserStore>;
+export declare const AuthHttpApiLive: Layer.Layer<never, never, AuthFlow | AuthFlowState | AuthHttp | EmailOtpLogin | EmailVerification | EmailVerificationFlow | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | LoginApproval | MagicLinkLogin | PasswordLogin | PasswordManagement | PasswordRegistration | PasswordReset | import("effect/Path").Path | import("../Privacy.js").Privacy | import("../RateLimiter.js").RateLimiter | SessionCookie | Sessions | UserStore>;
 export { AuthResult };
 //# sourceMappingURL=Api.d.ts.map