@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/HttpApi/Api.js

@@ -1,80 +1,52 @@
-import { Context, Effect, Encoding, Layer, Option, Redacted, Result } from "effect";
-import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { Context, Effect, Encoding, Layer, Option, Redacted, Result, } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse, } from "effect/unstable/http";
 import { HttpApi, HttpApiBuilder, HttpApiGroup } from "effect/unstable/httpapi";
-import { ApiKeyId } from "../ApiKey.js";
-import { Jwks } from "../Jwt.js";
+import { BotChallengeVerifier, BotProtectionNoopLive, } from "../AbuseProtection.js";
+import { ApiKeyId, ApiKeyManagement } from "../ApiKey.js";
+import { passkeyEvidence, passwordEvidence, recoveryCodeEvidence, totpEvidence, } from "../Assurance.js";
+import * as Audit from "../AuditLog.js";
 import { AuthFlow, AuthFlowState, AuthResult, LoginApprovalFinalize, } from "../AuthFlow.js";
+import { AuthRateLimit } from "../AuthRateLimit.js";
+import { EmailAuth } from "../EmailAuth.js";
 import { EmailOtpLogin } from "../EmailOtp.js";
+import { EmailRiskProviderUnavailableError } from "../EmailRisk.js";
 import { EmailDeliveryError, EmailVerification, EmailVerificationFlow, EmailVerificationIssueError, } from "../EmailVerification.js";
-import { OAuthClientId as makeOAuthClientId } from "../Identifiers.js";
+import { ChallengeId, CredentialId, OAuthClientId as makeOAuthClientId, } from "../Identifiers.js";
+import { IdentityAlreadyExistsError, IdentityConcurrentModificationError, IdentityInactiveError, IdentityIdGenerationError, IdentityManagement, IdentityManagementStorageError, IdentityMutationDeniedError, IdentityNotFoundError, IdentityNotLoginEligibleError, IdentityOwnershipError, IdentityUserNotActiveError, LastLoginIdentityError, } from "../IdentityManagement.js";
 import { currentUnixMillis } from "../Internal.js";
+import { AuthFlowFinalizer, AuthFlowFinalizerLive, } from "../internal/AuthFlowFinalizer.js";
+import { Jwks, JwtIssuer, JwtRevocation } from "../Jwt.js";
 import { LoginApproval, LoginApprovalReview } from "../LoginApproval.js";
 import { LoginNotification } from "../LoginNotification.js";
 import { MagicLinkLogin } from "../MagicLink.js";
-import { OAuthAuthorizationCode, OAuthAuthorizationCodeTokenGrant, OAuthClientCredentialsGrant, OAuthProviderAuthorization, OAuthRefreshToken, OAuthRefreshTokenGrant, OAuthTokenIntrospection, OAuthTokenRevocation, OAuthCodeVerifier as makeOAuthCodeVerifier, } from "../OAuth.js";
-import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset, } from "../Password.js";
-import { PasskeyCredentialId } from "../Passkey.js";
-import { CurrentSession, SessionCookie, Sessions, sessionRequestMetadataKey, upgradeCurrentSession, } from "../Sessions.js";
+import { OAuthAuthorizationCode, OAuthAuthorizationCodeTokenGrant, OAuthAccountUnlinking, OAuthClientCredentialsGrant, OAuthProviderAuthorization, OAuthProviders, OAuthRefreshToken, OAuthRefreshTokenGrant, OAuthTokenIntrospection, OAuthTokenRevocation, OAuthLinkConfirmation, OAuthState, OAuthCodeVerifier as makeOAuthCodeVerifier, } from "../OAuth.js";
+import { PasskeyCredentialId, PasskeyCredentialManagement, PasskeyOptions, PasskeyVerification, } from "../Passkey.js";
+import { PasswordHasher } from "../Password.js";
+import { normalizePermissionDefinitionListLimit, PermissionAdministration, } from "../Permission.js";
+import { RecoveryCodeLoginCommitStore, RecoveryCodeManagement, } from "../RecoveryCode.js";
+import { defaultRecoveryRemediationCapabilities, withRecoveryRemediationRequirement, } from "../RecoveryPolicy.js";
+import { RefreshTokenManagement } from "../RefreshToken.js";
 import { SecurityTimelineStore } from "../SecurityTimeline.js";
-import { UserStore } from "../Storage.js";
+import { SessionCookie, Sessions, RecoveryCodeSessionRotation, TotpSessionRotation, sessionRequestMetadataKey, } from "../Sessions.js";
+import { CredentialStore, IdentityStore, UserStore, VerificationStore, } from "../Storage.js";
+import { StrongFactorRemovalPolicy, strongFactor } from "../StrongFactor.js";
+import { TotpFactorManagement, TotpLoginCommitStore } from "../Totp.js";
 import { TrustedDevice, TrustedDeviceCookie, TrustedDeviceStore, } from "../TrustedDevice.js";
-import { adminSecurityTimelineListEndpoint, adminSessionListEndpoint, adminSessionRevokeAllEndpoint, adminSessionRevokeEndpoint, adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint, apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint, currentSessionEndpoint, emailOtpStartEndpoint, emailOtpVerifyEndpoint, emailVerificationStartEndpoint, emailVerificationVerifyEndpoint, loginApprovalApproveEndpoint, loginApprovalFinalizeEndpoint, loginApprovalStatusEndpoint, loginNotificationReportEndpoint, jwtIntrospectEndpoint, jwtJwksEndpoint, jwtRevokeEndpoint, listSessionsEndpoint, logoutEndpoint, magicLinkStartEndpoint, magicLinkVerifyEndpoint, mfaOptionsEndpoint, oauthAccountUnlinkEndpoint, oauthAuthorizationStartEndpoint, oauthLinkConfirmationConfirmEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationStartEndpoint, oauthProviderAuthorizeEndpoint, oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint, oidcDiscoveryMetadataEndpoint, passwordChangeEndpoint, passwordResetStartEndpoint, passwordResetVerifyEndpoint, passwordSetEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, refreshTokenRefreshEndpoint, refreshSessionEndpoint, revokeOtherSessionsEndpoint, revokeSessionEndpoint, securityTimelineListEndpoint, stepUpOptionsEndpoint, stepUpPasskeyStartEndpoint, stepUpPasskeyVerifyEndpoint, stepUpRecoveryCodeVerifyEndpoint, stepUpTotpVerifyEndpoint, trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, } from "./Endpoints.js";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError, } from "./Errors.js";
+import { EmailAuthHttpApiGroup, EmailOtpHttpApiGroup, EmailVerificationHttpApiGroup, IdentityHttpApiGroup, LoginApprovalHttpApiGroup, MagicLinkHttpApiGroup, MfaHttpApiGroup, PasskeyHttpApiGroup, PasswordHttpApiGroup, RecoveryCodesHttpApiGroup, LoginNotificationHttpApiGroup, SessionHttpApiGroup, StepUpHttpApiGroup, TotpHttpApiGroup, } from "./ClientApi.js";
+import { EmailGuards } from "./EmailGuards.js";
+import { adminSecurityTimelineListEndpoint, adminPermissionDefinitionCreateEndpoint, adminPermissionDefinitionDeleteEndpoint, adminPermissionDefinitionDisableEndpoint, adminPermissionDefinitionEnableEndpoint, adminPermissionDefinitionGetEndpoint, adminPermissionDefinitionListEndpoint, adminPermissionDefinitionUpdateEndpoint, adminSessionListEndpoint, adminSessionRevokeAllEndpoint, adminSessionRevokeEndpoint, adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint, apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint, jwtIntrospectEndpoint, jwtJwksEndpoint, jwtRevokeEndpoint, oauthAccountUnlinkEndpoint, oauthAuthorizationStartEndpoint, oauthLinkConfirmationConfirmEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationStartEndpoint, oauthProviderAuthorizeEndpoint, oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint, oidcDiscoveryMetadataEndpoint, refreshTokenRefreshEndpoint, securityTimelineListEndpoint, trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint, } from "./Endpoints.js";
+import { AuthBadRequestError, AuthConflictError, AuthIdentityAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthNotFoundError, AuthPolicyDeniedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError, } from "./Errors.js";
+import { IdentityGuards } from "./IdentityGuards.js";
+import { AuthOriginCheckMiddleware } from "./Middleware.js";
+import { AdminSecurityTimelineHttpOperations, AdminPermissionDefinitionHttpOperations, AdminSessionHttpOperations, AdminTrustedDeviceHttpOperations, ApiKeyHttpOperations, EmailAuthHttpOperations, EmailOtpHttpOperations, EmailVerificationHttpOperations, JwtDiscoveryHttpOperations, JwtHttpOperations, LoginApprovalHttpOperations, MagicLinkHttpOperations, MfaHttpOperations, OAuthHttpOperations, OAuthProviderAuthorizationHttpOperations, OAuthTokenHttpOperations, OidcDiscoveryHttpOperations, PasskeyHttpOperations, IdentityHttpOperations, RecoveryCodesHttpOperations, RefreshTokenHttpOperations, LoginNotificationHttpOperations, SecurityTimelineHttpOperations, SessionHttpOperations, StepUpHttpOperations, TotpHttpOperations, TrustedDeviceHttpOperations, } from "./Operations/index.js";
+import { PasswordHttpOperationsLive, passwordGroupHandlers, } from "./Password.js";
+import { requireAuthRateLimit } from "./RequestGuards.js";
 import { OAuthProviderAuthorizationQuery, OAuthTokenRequestBody, OAuthTokenIntrospectionRequestBody, OAuthTokenIntrospectionResponseBody, OAuthTokenRevocationRequestBody, } from "./Schemas.js";
-import { AuthApiRateLimit, AuthApiRateLimitLive, AuthApiRateLimitNoopLive, AuthHttpApiConfig, AuthOriginCheckMiddleware, AuthOriginCheckMiddlewareConfigLive, AuthRateLimitMiddleware, makeAuthRequestMetadata, } from "./Security.js";
+import { AuthOriginCheckMiddlewareConfigLive, customEvidencePolicyHttpFailure, } from "./Security.js";
+import { readOptionalSession, readRequiredSession, requireSession, } from "./SessionGuards.js";
 import { AuthHttp, LoginApprovalPendingCookie, makeLoginApprovalPendingCookie, } from "./Transport.js";
-const canStartRequiredEmailVerification = (result) => result._tag === "RequiresEmailVerification" &&
-    result.userId !== undefined &&
-    result.email !== undefined;
-const noopAuthApiRateLimit = AuthApiRateLimit.make({
-    request: () => Effect.void,
-    passwordSignIn: () => Effect.void,
-    passwordSignUp: () => Effect.void,
-    passwordResetStart: () => Effect.void,
-    emailOtpStart: () => Effect.void,
-    magicLinkStart: () => Effect.void,
-    emailVerificationStart: () => Effect.void,
-});
-export const passwordSignInInput = (payload, trustedDeviceToken, request) => ({
-    ...payload,
-    password: Redacted.make(payload.password),
-    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
-    ...(request === undefined ? {} : { request }),
-});
-export const passwordSignUpInput = (payload, request) => ({
-    ...payload,
-    password: Redacted.make(payload.password),
-    ...(request === undefined ? {} : { request }),
-});
-export const passwordResetStartInput = (payload) => {
-    const { secret, ...input } = payload;
-    return {
-        ...input,
-        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
-    };
-};
-export const passwordResetVerifyInput = (payload) => ({
-    challengeId: payload.challengeId,
-    secret: Redacted.make(payload.secret),
-    password: Redacted.make(payload.password),
-});
-export const passwordSetInput = (userId, payload) => ({
-    userId,
-    password: Redacted.make(payload.password),
-    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
-});
-export const passwordChangeInput = (userId, payload) => ({
-    userId,
-    currentPassword: Redacted.make(payload.currentPassword),
-    newPassword: Redacted.make(payload.newPassword),
-});
-export const emailVerificationStartInput = (payload) => {
-    const { secret, ...input } = payload;
-    return {
-        ...input,
-        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
-    };
-};
+export { AuthClientProtocolApi, EmailAuthHttpApiGroup, EmailOtpHttpApiGroup, EmailVerificationHttpApiGroup, IdentityHttpApiGroup, LoginApprovalHttpApiGroup, MagicLinkHttpApiGroup, MfaHttpApiGroup, PasskeyHttpApiGroup, PasswordHttpApiGroup, RecoveryCodesHttpApiGroup, LoginNotificationHttpApiGroup, SessionHttpApiGroup, StepUpHttpApiGroup, TotpHttpApiGroup, } from "./ClientApi.js";
+export { makePasswordChangeHandler, makePasswordResetStartHandler, makePasswordResetVerifyHandler, makePasswordSetHandler, makePasswordSignInHandler, makePasswordSignUpHandler, passwordChangeInput, passwordSetInput, PasswordHttpApi, PasswordHttpApiGroupLive, PasswordHttpApiLive, PasswordHttpOperationsLive, } from "./Password.js";
 export const emailVerificationVerifyInput = (payload) => {
     const { secret, ...input } = payload;
     return {
@@ -82,36 +54,12 @@ export const emailVerificationVerifyInput = (payload) => {
         ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
     };
 };
-export const emailOtpStartInput = (payload) => {
-    const { secret, ...input } = payload;
-    return {
-        ...input,
-        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
-    };
-};
-export const emailOtpVerifyInput = (payload, trustedDeviceToken, request) => ({
-    challengeId: payload.challengeId,
-    secret: Redacted.make(payload.secret),
-    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
-    ...(request === undefined ? {} : { request }),
-});
-export const magicLinkStartInput = (payload) => {
-    const { secret, ...input } = payload;
-    return {
-        ...input,
-        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
-    };
-};
-export const magicLinkVerifyInput = (payload, trustedDeviceToken, request) => ({
-    challengeId: payload.challengeId,
-    secret: Redacted.make(payload.secret),
-    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
-    ...(request === undefined ? {} : { request }),
-});
 export const oauthAuthorizationStartInput = (payload, provider, options = {}) => ({
     provider,
     ...(options.ttl === undefined ? {} : { ttl: options.ttl }),
-    ...(payload.redirectUri === undefined ? {} : { redirectUri: payload.redirectUri }),
+    ...(payload.redirectUri === undefined
+        ? {}
+        : { redirectUri: payload.redirectUri }),
     ...(payload.scopes === undefined ? {} : { scopes: payload.scopes }),
     ...(payload.authorizationParams === undefined
         ? {}
@@ -166,11 +114,15 @@ export const oauthLinkConfirmationStartInput = (payload, options = {}) => Effect
 });
 export const oauthLinkConfirmationInspectInput = (payload) => ({
     challengeId: payload.challengeId,
-    ...(payload.secret === undefined ? {} : { secret: Redacted.make(payload.secret) }),
+    ...(payload.secret === undefined
+        ? {}
+        : { secret: Redacted.make(payload.secret) }),
 });
 export const oauthLinkConfirmationConfirmInput = (payload, currentUserId) => ({
     challengeId: payload.challengeId,
-    ...(payload.secret === undefined ? {} : { secret: Redacted.make(payload.secret) }),
+    ...(payload.secret === undefined
+        ? {}
+        : { secret: Redacted.make(payload.secret) }),
     ...(currentUserId === undefined ? {} : { currentUserId }),
     ...(payload.expectedProviderId === undefined
         ? {}
@@ -361,7 +313,9 @@ const oauthClientEndpointAuthentication = (input) => Effect.gen(function* () {
     if (input.payload.client_secret !== undefined && postAuth === undefined) {
         return yield* Effect.fail(input.invalidRequest());
     }
-    const authentication = Option.isSome(basicAuth) ? basicAuth.value : postAuth;
+    const authentication = Option.isSome(basicAuth)
+        ? basicAuth.value
+        : postAuth;
     const payloadClientId = oauthTokenGrantString(input.payload.client_id);
     if (authentication !== undefined &&
         payloadClientId !== undefined &&
@@ -438,7 +392,9 @@ const oauthTokenIntrospectionResponseHttpBody = (introspection) => {
         ...(introspection.notBefore === undefined
             ? {}
             : { nbf: oauthUnixMillisToSeconds(introspection.notBefore) }),
-        ...(introspection.subject === undefined ? {} : { sub: introspection.subject }),
+        ...(introspection.subject === undefined
+            ? {}
+            : { sub: introspection.subject }),
         ...(introspection.audience === undefined
             ? {}
             : {
@@ -446,9 +402,13 @@ const oauthTokenIntrospectionResponseHttpBody = (introspection) => {
                     ? [...introspection.audience]
                     : introspection.audience,
             }),
-        ...(introspection.issuer === undefined ? {} : { iss: introspection.issuer }),
+        ...(introspection.issuer === undefined
+            ? {}
+            : { iss: introspection.issuer }),
         ...(introspection.jwtId === undefined ? {} : { jti: introspection.jwtId }),
-        ...(introspection.extra === undefined ? {} : { extra: introspection.extra }),
+        ...(introspection.extra === undefined
+            ? {}
+            : { extra: introspection.extra }),
     };
 };
 const oauthRefreshTokenResponse = (input) => Effect.gen(function* () {
@@ -505,7 +465,9 @@ const oauthAuthorizationCodeTokenResponse = (input) => Effect.gen(function* () {
         ...(redirectUri === undefined ? {} : { redirectUri }),
         ...(codeVerifier === undefined
             ? {}
-            : { codeVerifier: Redacted.make(makeOAuthCodeVerifier(codeVerifier)) }),
+            : {
+                codeVerifier: Redacted.make(makeOAuthCodeVerifier(codeVerifier)),
+            }),
         clientAuthenticated: input.clientAuthenticated,
     })
         .pipe(Effect.mapError(() => oauthInternalError("Failed to exchange OAuth token")));
@@ -526,7 +488,9 @@ export const oauthLinkConfirmationConfirmedHttpBody = (confirmed, options = {})
     reason: confirmed.reason,
     ...(confirmed.existingAccount === undefined
         ? {}
-        : { existingAccount: oauthLinkedAccountHttpBody(confirmed.existingAccount) }),
+        : {
+            existingAccount: oauthLinkedAccountHttpBody(confirmed.existingAccount),
+        }),
     linked: options.linked === true || confirmed.existingAccount !== undefined,
 });
 export const oauthAccountUnlinkResolutionHttpBody = (resolution, options = {}) => {
@@ -573,11 +537,87 @@ export const oauthAccountUnlinkResolutionHttpBody = (resolution, options = {}) =
         }
     }
 };
-export const passkeyRegistrationStartInput = (payload, options) => ({
+export class PasskeyHttpConfig extends Context.Service()("auth/http/config/Passkey") {
+}
+(function (PasskeyHttpConfig) {
+    PasskeyHttpConfig.make = (config) => PasskeyHttpConfig.of(config);
+})(PasskeyHttpConfig || (PasskeyHttpConfig = {}));
+export const PasskeyHttpConfigLive = (config) => Layer.succeed(PasskeyHttpConfig)(PasskeyHttpConfig.make(config));
+export class TotpHttpConfig extends Context.Service()("auth/http/config/Totp") {
+}
+(function (TotpHttpConfig) {
+    TotpHttpConfig.make = (config) => TotpHttpConfig.of(config);
+})(TotpHttpConfig || (TotpHttpConfig = {}));
+export const TotpHttpConfigLive = (config) => Layer.succeed(TotpHttpConfig)(TotpHttpConfig.make(config));
+export const RecoveryCodeHttpConfig = Context.Reference("auth/http/config/RecoveryCode", { defaultValue: () => ({}) });
+export const RecoveryCodeHttpConfigLive = (config = {}) => Layer.succeed(RecoveryCodeHttpConfig)(config);
+export const OAuthHttpConfig = Context.Reference("auth/http/config/OAuth", { defaultValue: () => ({}) });
+export const OAuthHttpConfigLive = (config = {}) => Layer.succeed(OAuthHttpConfig)(config);
+export const OAuthTokenHttpConfig = Context.Reference("auth/http/config/OAuthToken", { defaultValue: () => ({}) });
+export const OAuthTokenHttpConfigLive = (config = {}) => Layer.succeed(OAuthTokenHttpConfig)(config);
+export class RefreshTokenHttpConfig extends Context.Service()("auth/http/config/RefreshToken") {
+}
+(function (RefreshTokenHttpConfig) {
+    RefreshTokenHttpConfig.make = (config) => RefreshTokenHttpConfig.of(config);
+})(RefreshTokenHttpConfig || (RefreshTokenHttpConfig = {}));
+export const RefreshTokenHttpConfigLive = (config) => Layer.succeed(RefreshTokenHttpConfig)(RefreshTokenHttpConfig.make(config));
+export const JwtHttpConfig = Context.Reference("auth/http/config/Jwt", { defaultValue: () => ({}) });
+export const JwtHttpConfigLive = (config = {}) => Layer.succeed(JwtHttpConfig)(config);
+export const passkeyRegistrationStartHttpOptions = (config) => ({
+    relyingParty: config.relyingParty,
+    ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
+    ...(config.pubKeyCredParams === undefined
+        ? {}
+        : { pubKeyCredParams: config.pubKeyCredParams }),
+    ...(config.authenticatorSelection === undefined
+        ? {}
+        : { authenticatorSelection: config.authenticatorSelection }),
+    ...(config.attestation === undefined
+        ? {}
+        : { attestation: config.attestation }),
+});
+export const passkeyAuthenticationStartHttpOptions = (config) => ({
+    relyingPartyId: config.relyingParty.id,
+    ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
+    ...(config.userVerification === undefined
+        ? {}
+        : { userVerification: config.userVerification }),
+});
+export const passkeyFinishHttpOptions = (config) => ({
+    relyingPartyId: config.relyingParty.id,
+    expectedOrigin: config.expectedOrigin,
+    ...(config.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: config.requireUserVerification }),
+});
+export const passkeyAuthenticationSessionInput = ({ finished, payload, }) => ({
+    userId: finished.userId,
+    authenticationEvents: [
+        passkeyEvidence({
+            credentialId: CredentialId(finished.credential.id),
+            verifiedAt: finished.credential.lastUsedAt ?? finished.credential.createdAt,
+            userVerification: finished.userVerification,
+            ...(finished.authenticatorAttachment === undefined
+                ? {}
+                : { authenticatorAttachment: finished.authenticatorAttachment }),
+            ...(finished.backedUp === undefined
+                ? {}
+                : { backedUp: finished.backedUp }),
+            ...(finished.backupEligible === undefined
+                ? {}
+                : { backupEligible: finished.backupEligible }),
+            signCount: finished.signCount,
+            ...(finished.aaguid === undefined ? {} : { aaguid: finished.aaguid }),
+        }),
+    ],
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+const optionalHttpMetadata = (metadata) => (metadata === undefined ? {} : { metadata });
+export const passkeyRegistrationStartInput = (userId, user, options) => ({
     relyingParty: options.relyingParty,
-    userId: payload.userId,
-    userName: payload.userName,
-    userDisplayName: payload.userDisplayName,
+    userId,
+    userName: user.userName,
+    userDisplayName: user.userDisplayName,
     ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
     ...(options.pubKeyCredParams === undefined
         ? {}
@@ -585,8 +625,10 @@ export const passkeyRegistrationStartInput = (payload, options) => ({
     ...(options.authenticatorSelection === undefined
         ? {}
         : { authenticatorSelection: options.authenticatorSelection }),
-    ...(options.attestation === undefined ? {} : { attestation: options.attestation }),
-    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    ...(options.attestation === undefined
+        ? {}
+        : { attestation: options.attestation }),
+    ...optionalHttpMetadata(user.metadata),
 });
 export const passkeyAuthenticationStartInput = (payload, options) => ({
     relyingPartyId: options.relyingPartyId,
@@ -607,16 +649,16 @@ export const passkeyMfaStartInput = (userId, payload, options) => ({
         flowId: payload.flowId,
     },
 });
-export const passkeyRegistrationFinishInput = (payload, options) => ({
+export const passkeyRegistrationFinishInput = (userId, payload, user, options) => ({
     challengeId: payload.challengeId,
-    userId: payload.userId,
+    userId,
     response: payload.credential,
     relyingPartyId: options.relyingPartyId,
     expectedOrigin: options.expectedOrigin,
     ...(options.requireUserVerification === undefined
         ? {}
         : { requireUserVerification: options.requireUserVerification }),
-    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    ...optionalHttpMetadata(user.metadata),
 });
 export const passkeyAuthenticationFinishInput = (payload, options) => ({
     challengeId: payload.challengeId,
@@ -629,15 +671,18 @@ export const passkeyAuthenticationFinishInput = (payload, options) => ({
         : { requireUserVerification: options.requireUserVerification }),
     ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
 });
-export const passkeyMfaVerifyInput = (payload, options) => ({
+export const passkeyMfaVerifyInput = (payload, options, expectedUserId) => ({
     challengeId: payload.challengeId,
     response: payload.credential,
-    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    ...(expectedUserId === undefined
+        ? payload.userId === undefined
+            ? {}
+            : { userId: payload.userId }
+        : { userId: expectedUserId }),
     relyingPartyId: options.relyingPartyId,
     expectedOrigin: options.expectedOrigin,
-    ...(options.requireUserVerification === undefined
-        ? {}
-        : { requireUserVerification: options.requireUserVerification }),
+    requireUserVerification: true,
+    expectedChallengeMetadata: { flowId: payload.flowId },
     ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
 });
 export const passkeyCredentialRevokeInput = (userId, payload) => ({
@@ -650,7 +695,9 @@ const passkeyCredentialInfoHttpBody = (credential) => ({
     ...(credential.transports === undefined
         ? {}
         : { transports: credential.transports }),
-    ...(credential.backedUp === undefined ? {} : { backedUp: credential.backedUp }),
+    ...(credential.backedUp === undefined
+        ? {}
+        : { backedUp: credential.backedUp }),
     createdAt: credential.createdAt,
     ...(credential.lastUsedAt === undefined
         ? {}
@@ -658,13 +705,17 @@ const passkeyCredentialInfoHttpBody = (credential) => ({
     ...(credential.revokedAt === undefined
         ? {}
         : { revokedAt: credential.revokedAt }),
-    ...(credential.metadata === undefined ? {} : { metadata: credential.metadata }),
+    ...(credential.metadata === undefined
+        ? {}
+        : { metadata: credential.metadata }),
 });
 export const totpEnrollmentStartInput = (userId, payload, options) => ({
     userId,
     issuer: options.issuer,
     accountName: payload.accountName,
-    ...(options.secretBytes === undefined ? {} : { secretBytes: options.secretBytes }),
+    ...(options.secretBytes === undefined
+        ? {}
+        : { secretBytes: options.secretBytes }),
     ...(options.algorithm === undefined ? {} : { algorithm: options.algorithm }),
     ...(options.digits === undefined ? {} : { digits: options.digits }),
     ...(options.period === undefined ? {} : { period: options.period }),
@@ -694,7 +745,9 @@ const totpFactorInfoHttpBody = (factor) => ({
     digits: factor.digits,
     period: factor.period,
     createdAt: factor.createdAt,
-    ...(factor.confirmedAt === undefined ? {} : { confirmedAt: factor.confirmedAt }),
+    ...(factor.confirmedAt === undefined
+        ? {}
+        : { confirmedAt: factor.confirmedAt }),
     ...(factor.lastUsedAt === undefined ? {} : { lastUsedAt: factor.lastUsedAt }),
     ...(factor.revokedAt === undefined ? {} : { revokedAt: factor.revokedAt }),
     ...(factor.metadata === undefined ? {} : { metadata: factor.metadata }),
@@ -710,6 +763,9 @@ const totpVerifyResultHttpBody = (result) => ({
         ? {}
         : { factor: totpFactorInfoHttpBody(result.factor) }),
     ...(result.delta === undefined ? {} : { delta: result.delta }),
+    ...(result.acceptedCounter === undefined
+        ? {}
+        : { acceptedCounter: result.acceptedCounter }),
 });
 export const recoveryCodeGenerateInput = (userId, payload, options = {}) => ({
     userId,
@@ -718,6 +774,16 @@ export const recoveryCodeGenerateInput = (userId, payload, options = {}) => ({
     ...(options.groupSize === undefined ? {} : { groupSize: options.groupSize }),
     ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
 });
+export const recoveryCodeRegenerateInput = (userId, payload, options = {}) => ({
+    userId,
+    ...(options.count === undefined ? {} : { count: options.count }),
+    ...(options.length === undefined ? {} : { length: options.length }),
+    ...(options.groupSize === undefined ? {} : { groupSize: options.groupSize }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    ...(payload.revokeReason === undefined
+        ? {}
+        : { revokeReason: payload.revokeReason }),
+});
 export const recoveryCodeVerifyInput = (userId, payload) => ({
     userId,
     code: Redacted.make(payload.code),
@@ -796,7 +862,9 @@ const refreshTokenInfoHttpBody = (refreshToken) => ({
     ...(refreshToken.reuseDetectedAt === undefined
         ? {}
         : { reuseDetectedAt: refreshToken.reuseDetectedAt }),
-    ...(refreshToken.metadata === undefined ? {} : { metadata: refreshToken.metadata }),
+    ...(refreshToken.metadata === undefined
+        ? {}
+        : { metadata: refreshToken.metadata }),
 });
 const issuedJwtExpiresAt = (issued) => typeof issued.claims.exp === "number"
     ? (issued.claims.exp * 1000)
@@ -826,9 +894,15 @@ const jwtKeyInfoHttpBody = (result) => ({
     keyId: result.key.id,
     alg: result.key.alg,
     status: result.key.status,
-    ...(result.key.createdAt === undefined ? {} : { createdAt: result.key.createdAt }),
-    ...(result.key.expiresAt === undefined ? {} : { expiresAt: result.key.expiresAt }),
-    ...(result.key.metadata === undefined ? {} : { metadata: result.key.metadata }),
+    ...(result.key.createdAt === undefined
+        ? {}
+        : { createdAt: result.key.createdAt }),
+    ...(result.key.expiresAt === undefined
+        ? {}
+        : { expiresAt: result.key.expiresAt }),
+    ...(result.key.metadata === undefined
+        ? {}
+        : { metadata: result.key.metadata }),
 });
 const jwtIntrospectionHttpBody = (result) => result.active
     ? {
@@ -837,15 +911,21 @@ const jwtIntrospectionHttpBody = (result) => result.active
         claims: result.claims,
         key: jwtKeyInfoHttpBody(result),
         ...(result.jwtId === undefined ? {} : { jwtId: result.jwtId }),
-        ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
+        ...(result.expiresAt === undefined
+            ? {}
+            : { expiresAt: result.expiresAt }),
         revoked: false,
     }
     : {
         active: false,
         reason: result.reason,
         ...(result.jwtId === undefined ? {} : { jwtId: result.jwtId }),
-        ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
-        ...(result.revokedAt === undefined ? {} : { revokedAt: result.revokedAt }),
+        ...(result.expiresAt === undefined
+            ? {}
+            : { expiresAt: result.expiresAt }),
+        ...(result.revokedAt === undefined
+            ? {}
+            : { revokedAt: result.revokedAt }),
         ...(result.revokedReason === undefined
             ? {}
             : { revokedReason: result.revokedReason }),
@@ -881,6 +961,10 @@ export const stepUpTotpVerifyInput = (userId, payload, options = {}) => ({
     ...(options.window === undefined ? {} : { window: options.window }),
     ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
 });
+export const stepUpPasswordVerifyInput = (payload) => ({
+    password: Redacted.make(payload.password),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
 export const stepUpRecoveryCodeVerifyInput = (userId, payload) => ({
     userId,
     code: Redacted.make(payload.code),
@@ -899,9 +983,7 @@ export const stepUpPasskeyVerifyInput = (userId, payload, options) => ({
     userId,
     relyingPartyId: options.relyingPartyId,
     expectedOrigin: options.expectedOrigin,
-    ...(options.requireUserVerification === undefined
-        ? {}
-        : { requireUserVerification: options.requireUserVerification }),
+    requireUserVerification: true,
     ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
 });
 export const loginApprovalApproveInput = (payload) => ({
@@ -928,58 +1010,6 @@ export const loginNotificationReportInput = (payload) => ({
     secret: Redacted.make(payload.secret),
 });
 const webRequestFromHeaders = (headers) => new Request("http://localhost", { headers });
-const firstHeaderValue = (value) => {
-    const first = value?.split(",", 1)[0]?.trim();
-    return first === "" ? undefined : first;
-};
-const headerNumber = (value) => {
-    const parsed = Number(firstHeaderValue(value));
-    return Number.isFinite(parsed) ? parsed : undefined;
-};
-const authRequestMetadataOptions = Effect.gen(function* () {
-    const config = yield* Effect.serviceOption(AuthHttpApiConfig);
-    return Option.isSome(config) ? (config.value.requestMetadata ?? {}) : {};
-});
-const loginRequestContextFromRequest = (request, options) => {
-    if (request === undefined) {
-        return undefined;
-    }
-    const metadata = makeAuthRequestMetadata(request, options);
-    const trustProxyHeaders = options.trustProxyHeaders ?? false;
-    const { headers } = request;
-    const country = trustProxyHeaders
-        ? firstHeaderValue(headers["cf-ipcountry"])
-        : undefined;
-    const region = trustProxyHeaders
-        ? firstHeaderValue(headers["cf-region"])
-        : undefined;
-    const city = trustProxyHeaders
-        ? firstHeaderValue(headers["cf-ipcity"])
-        : undefined;
-    const latitude = trustProxyHeaders
-        ? headerNumber(headers["cf-iplatitude"])
-        : undefined;
-    const longitude = trustProxyHeaders
-        ? headerNumber(headers["cf-iplongitude"])
-        : undefined;
-    const context = {
-        ...(metadata.ipAddress === undefined
-            ? {}
-            : { ip: String(metadata.ipAddress) }),
-        ...(metadata.userAgent === undefined
-            ? {}
-            : { userAgent: metadata.userAgent }),
-        ...(country === undefined ? {} : { country }),
-        ...(region === undefined ? {} : { region }),
-        ...(city === undefined ? {} : { city }),
-        ...(latitude === undefined ? {} : { latitude }),
-        ...(longitude === undefined ? {} : { longitude }),
-    };
-    return Object.keys(context).length === 0 ? undefined : context;
-};
-const trustedDeviceTokenFromRequest = (trustedDeviceCookie, request) => trustedDeviceCookie === undefined || request === undefined
-    ? Effect.succeed(Option.none())
-    : trustedDeviceCookie.read(new Request("http://localhost", { headers: request.headers }));
 const metadataString = (metadata, key) => {
     const value = metadata?.[key];
     return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -988,14 +1018,18 @@ const emailVerifiedClaims = (claims) => {
     const requirements = claims?.requirements?.filter((requirement) => requirement !== "email_verification");
     return {
         ...claims,
-        emailVerified: true,
+        verifiedIdentityKinds: claims?.verifiedIdentityKinds?.includes("email")
+            ? claims.verifiedIdentityKinds
+            : [...(claims?.verifiedIdentityKinds ?? []), "email"],
         ...(requirements === undefined ? {} : { requirements }),
     };
 };
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const metadataNumber = (metadata, key) => {
     const value = metadata?.[key];
-    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+    return typeof value === "number" && Number.isFinite(value)
+        ? value
+        : undefined;
 };
 const sessionRequestMetadata = (metadata) => {
     const value = metadata?.[sessionRequestMetadataKey];
@@ -1078,40 +1112,37 @@ export const stepUpAuthenticatedHttpBody = (session) => {
             ? {}
             : { mfaVerifiedAt: session.mfaVerifiedAt }),
     };
-    return session.claims === undefined ? body : { ...body, claims: session.claims };
+    return session.claims === undefined
+        ? body
+        : { ...body, claims: session.claims };
 };
-const readOptionalSession = (dependencies, request) => Effect.gen(function* () {
-    const tokenOption = yield* dependencies.sessionCookie
-        .read(webRequestFromHeaders(request.headers))
-        .pipe(Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
-        ? Effect.succeed(Option.none())
-        : Effect.fail(new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to validate session",
-        }))));
-    if (Option.isNone(tokenOption)) {
-        return Option.none();
+const provideHandlerAuthRateLimit = (authRateLimit, handler) => ((...args) => handler(...args).pipe(Effect.provideService(AuthRateLimit, authRateLimit)));
+const provideRequestGuardServices = (dependencies, handler) => ((...args) => {
+    let effect = handler(...args).pipe(Effect.provideService(AuthRateLimit, dependencies.authRateLimit));
+    if (dependencies.botChallengeVerifier !== undefined) {
+        effect = effect.pipe(Effect.provideService(BotChallengeVerifier, dependencies.botChallengeVerifier));
     }
-    return yield* dependencies.sessions.validate(tokenOption.value).pipe(Effect.map(Option.some), Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
-        ? Effect.succeed(Option.none())
-        : Effect.fail(new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to validate session",
-        }))));
+    if (dependencies.trustedDeviceCookie !== undefined) {
+        effect = effect.pipe(Effect.provideService(TrustedDeviceCookie, dependencies.trustedDeviceCookie));
+    }
+    if (dependencies.identities !== undefined) {
+        effect = effect.pipe(Effect.provideService(IdentityStore, dependencies.identities));
+    }
+    if (dependencies.sessions !== undefined) {
+        effect = effect.pipe(Effect.provideService(Sessions, dependencies.sessions));
+    }
+    if (dependencies.sessionCookie !== undefined) {
+        effect = effect.pipe(Effect.provideService(SessionCookie, dependencies.sessionCookie));
+    }
+    return effect;
 });
-const readRequiredSession = (dependencies, request) => readOptionalSession(dependencies, request).pipe(Effect.flatMap((sessionOption) => Option.isSome(sessionOption)
-    ? Effect.succeed(sessionOption.value)
-    : Effect.fail(new AuthUnauthenticatedError({
-        code: "unauthenticated",
-        message: "Unauthenticated",
-    }))));
 const upgradeVerifiedEmailSession = (dependencies, request, verified) => Effect.gen(function* () {
     const sessionOption = yield* readOptionalSession(dependencies, request);
     if (Option.isNone(sessionOption)) {
         return;
     }
     const session = sessionOption.value.currentSession;
-    if (session.userId !== verified.user.id) {
+    if (session.userId !== verified.identity.userId) {
         return;
     }
     yield* dependencies.sessions
@@ -1127,27 +1158,6 @@ const upgradeVerifiedEmailSession = (dependencies, request, verified) => Effect.
             message: "Failed to update session claims",
         }))));
 });
-const startRequiredEmailVerification = (dependencies, result) => Effect.gen(function* () {
-    if (dependencies.emailVerificationFlow === undefined ||
-        !canStartRequiredEmailVerification(result)) {
-        return result;
-    }
-    const input = {
-        userId: result.userId,
-        email: result.email,
-    };
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.emailVerificationStart(input), "Failed to start email verification");
-    yield* dependencies.emailVerificationFlow
-        .start(input)
-        .pipe(Effect.catchTag("EmailVerificationFlowStartError", () => Effect.fail(passwordInternalError("Failed to start email verification"))));
-    return result;
-});
-const rateLimited = (retryAfter) => new AuthRateLimitedError({
-    code: "rate_limited",
-    message: "Too many authentication attempts",
-    retryAfter,
-});
 const passwordInternalError = (message) => new AuthInternalError({
     code: "internal_error",
     message,
@@ -1192,7 +1202,8 @@ const oauthInternalError = (message = "Failed to complete OAuth request") => new
     code: "internal_error",
     message,
 });
-const oauthHookHttpError = (error, internalMessage) => error instanceof AuthBadRequestError || error instanceof AuthUnauthenticatedError
+const oauthHookHttpError = (error, internalMessage) => error instanceof AuthBadRequestError ||
+    error instanceof AuthUnauthenticatedError
     ? error
     : oauthInternalError(internalMessage);
 const oauthLinkConfirmationHttpError = (error, internalMessage) => error.message === "OAuth provider account is already linked to this user" ||
@@ -1211,15 +1222,122 @@ const passkeyBadRequest = (message = "Invalid passkey request") => new AuthBadRe
     code: "bad_request",
     message,
 });
+const userMetadataString = (user, key) => {
+    const value = user.metadata?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+export const makePasskeyRegistrationUserResolver = (dependencies) => Effect.fn("auth.http.passkey.registration_user.resolve")(function* (input) {
+    const userOption = yield* dependencies.users
+        .findById(input.currentSession.userId)
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to load passkey registration user")));
+    if (Option.isNone(userOption)) {
+        return yield* passkeyBadRequest("Passkey registration user not found");
+    }
+    const user = userOption.value;
+    const identities = yield* dependencies.identities
+        .listByUser({ userId: user.id })
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to load passkey registration identity")));
+    const loginIdentity = identities.find((identity) => identity.isPrimaryLogin) ?? identities[0];
+    if (loginIdentity === undefined) {
+        return yield* passkeyBadRequest("Passkey registration identity not found");
+    }
+    const displayName = userMetadataString(user, "displayName") ??
+        userMetadataString(user, "name") ??
+        loginIdentity.value;
+    return {
+        userName: loginIdentity.value,
+        userDisplayName: displayName,
+    };
+});
 const passkeyVerificationHttpError = (error) => error.message === "Failed to load passkey credential" ||
     error.message === "Failed to store passkey credential" ||
     error.message === "Failed to update passkey credential" ||
     error.message === "Failed to generate passkey credential record id"
     ? passkeyInternalError()
     : passkeyBadRequest();
+export const identityHttpError = (error) => {
+    if (error instanceof IdentityMutationDeniedError) {
+        return new AuthPolicyDeniedError({
+            code: "policy_denied",
+            message: "Identity mutation denied",
+        });
+    }
+    if (error instanceof LastLoginIdentityError) {
+        return new AuthPolicyDeniedError({
+            code: "policy_denied",
+            message: "Cannot remove the last login identity",
+        });
+    }
+    if (error instanceof IdentityAlreadyExistsError) {
+        return new AuthIdentityAlreadyRegisteredError({
+            code: "identity_already_registered",
+            message: "Identity is unavailable",
+        });
+    }
+    if (error instanceof IdentityNotFoundError ||
+        error instanceof IdentityOwnershipError ||
+        error instanceof IdentityInactiveError) {
+        return new AuthBadRequestError({
+            code: "bad_request",
+            message: "Invalid identity request",
+        });
+    }
+    if (error instanceof IdentityConcurrentModificationError ||
+        error instanceof IdentityNotLoginEligibleError ||
+        error instanceof IdentityUserNotActiveError) {
+        return new AuthBadRequestError({
+            code: "bad_request",
+            message: "Identity could not be updated",
+        });
+    }
+    if (error instanceof IdentityManagementStorageError ||
+        error instanceof IdentityIdGenerationError) {
+        return new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to complete identity request",
+        });
+    }
+    if (error instanceof EmailRiskProviderUnavailableError) {
+        return new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to complete identity request",
+        });
+    }
+    return new AuthBadRequestError({
+        code: "bad_request",
+        message: "Invalid identity request",
+    });
+};
 const passkeyCredentialManagementHttpError = (error) => error.message === "Passkey credential not found"
     ? passkeyBadRequest("Invalid passkey credential")
     : passkeyInternalError("Failed to update passkey credentials");
+const strongFactorRemovalPolicyHttpError = (error) => {
+    switch (error.reason) {
+        case "factor_not_found": {
+            return new AuthBadRequestError({
+                code: "bad_request",
+                message: "Invalid strong factor removal request",
+            });
+        }
+        case "last_strong_factor": {
+            return new AuthPolicyDeniedError({
+                code: "policy_denied",
+                message: "Cannot remove the last active strong factor",
+            });
+        }
+        case "inventory_unavailable": {
+            return new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to check strong factor removal policy",
+            });
+        }
+    }
+};
+const requireCanRemoveStrongFactor = (policy, input) => policy === undefined
+    ? Effect.void
+    : policy
+        .requireCanRemove(input)
+        .pipe(Effect.mapError(strongFactorRemovalPolicyHttpError));
 const totpInternalError = (message = "Failed to complete TOTP request") => new AuthInternalError({
     code: "internal_error",
     message,
@@ -1293,7 +1411,9 @@ const jwtBadRequest = (message = "Invalid JWT request") => new AuthBadRequestErr
     code: "bad_request",
     message,
 });
-const jwtRevocationHttpError = (error) => error.message === "JWT ID must not be empty" ? jwtBadRequest() : jwtInternalError();
+const jwtRevocationHttpError = (error) => error.message === "JWT ID must not be empty"
+    ? jwtBadRequest()
+    : jwtInternalError();
 const mfaInternalError = (message = "Failed to complete MFA request") => new AuthInternalError({
     code: "internal_error",
     message,
@@ -1306,11 +1426,8 @@ const mfaInvalidCredentials = () => new AuthInvalidCredentialsError({
     code: "invalid_credentials",
     message: "Invalid MFA code",
 });
-const mfaPolicyDenied = (reason) => new AuthPolicyDeniedError({
-    code: "policy_denied",
-    message: reason ?? "MFA policy denied the request",
-});
-const authFlowMfaHttpError = (error) => error._tag === "AuthFlowStateError" ? mfaBadRequest() : mfaInternalError();
+const authFlowMfaHttpFailure = (error) => customEvidencePolicyHttpFailure(error, "Failed to complete MFA request") ??
+    Effect.fail(error._tag === "AuthFlowStateError" ? mfaBadRequest() : mfaInternalError());
 const stepUpInternalError = (message = "Failed to complete step-up request") => new AuthInternalError({
     code: "internal_error",
     message,
@@ -1327,6 +1444,10 @@ const stepUpPolicyDenied = (message = "Step-up policy denied the request") => ne
     code: "policy_denied",
     message,
 });
+const stepUpRotationHttpFailure = (error) => {
+    const policyFailure = customEvidencePolicyHttpFailure(error, "Failed to upgrade current session");
+    return policyFailure ?? Effect.fail(stepUpInvalidCredentials());
+};
 const trustedDeviceSetCookies = (dependencies) => Effect.gen(function* () {
     if (!dependencies.rememberDevice ||
         dependencies.trustedDevice === undefined ||
@@ -1341,144 +1462,37 @@ const trustedDeviceSetCookies = (dependencies) => Effect.gen(function* () {
         .pipe(Effect.mapError(() => passwordInternalError("Failed to remember trusted device")));
     return [cookie];
 });
-const catchAuthApiRateLimit = (effect, internalMessage) => effect.pipe(Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(rateLimited(error.retryAfter))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(passwordInternalError(internalMessage))), Effect.catchTag("PrivacyError", () => Effect.fail(passwordInternalError(internalMessage))));
 export class AdminSessionAuthorization extends Context.Service()("auth/AdminSessionAuthorization") {
 }
-(function (AdminSessionAuthorization) {
-    AdminSessionAuthorization.make = (service) => AdminSessionAuthorization.of(service);
-})(AdminSessionAuthorization || (AdminSessionAuthorization = {}));
+export class AdminPermissionDefinitionAuthorization extends Context.Service()("auth/AdminPermissionDefinitionAuthorization") {
+}
 export class AdminSecurityTimelineAuthorization extends Context.Service()("auth/AdminSecurityTimelineAuthorization") {
 }
-(function (AdminSecurityTimelineAuthorization) {
-    AdminSecurityTimelineAuthorization.make = (service) => AdminSecurityTimelineAuthorization.of(service);
-})(AdminSecurityTimelineAuthorization || (AdminSecurityTimelineAuthorization = {}));
 export class AdminTrustedDeviceAuthorization extends Context.Service()("auth/AdminTrustedDeviceAuthorization") {
 }
-(function (AdminTrustedDeviceAuthorization) {
-    AdminTrustedDeviceAuthorization.make = (service) => AdminTrustedDeviceAuthorization.of(service);
-})(AdminTrustedDeviceAuthorization || (AdminTrustedDeviceAuthorization = {}));
 export class OidcDiscoveryMetadata extends Context.Service()("auth/OidcDiscoveryMetadata") {
 }
-(function (OidcDiscoveryMetadata) {
-    OidcDiscoveryMetadata.make = (service) => OidcDiscoveryMetadata.of(service);
-})(OidcDiscoveryMetadata || (OidcDiscoveryMetadata = {}));
-export const OidcDiscoveryMetadataLive = (metadata) => Layer.succeed(OidcDiscoveryMetadata, OidcDiscoveryMetadata.make({ load: () => Effect.succeed(metadata) }));
-export const makePasswordSignInHandler = (dependencies) => Effect.fn("auth.http.password.sign_in")(function* ({ payload, request, }) {
-    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_in");
-    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
-    const requestMetadataOptions = yield* authRequestMetadataOptions;
-    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
-    const input = passwordSignInInput(payload, Option.isSome(trustedDeviceToken) ? trustedDeviceToken.value : undefined, requestContext);
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.passwordSignIn(input), "Failed to sign in with password");
-    const result = yield* dependencies.password.signIn(input).pipe(Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("TrustedDeviceError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginRiskError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("AuthFlowStateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginApprovalReviewError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginApprovalFlowStartError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))));
-    yield* startRequiredEmailVerification(dependencies, result);
-    return yield* dependencies.authHttp.commitPasswordSignInResult(result);
-});
-export const makePasswordSignUpHandler = (dependencies) => Effect.fn("auth.http.password.sign_up")(function* ({ payload, request, }) {
-    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_up");
-    const requestMetadataOptions = yield* authRequestMetadataOptions;
-    const input = passwordSignUpInput(payload, loginRequestContextFromRequest(request, requestMetadataOptions));
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.passwordSignUp(input), "Failed to sign up with password");
-    const result = yield* dependencies.registration.signUp(input).pipe(Effect.catchTag("EmailAlreadyRegisteredError", () => Effect.fail(new AuthEmailAlreadyRegisteredError({
-        code: "email_already_registered",
-        message: "Email is already registered",
-    }))), Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("CryptoError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("TrustedDeviceError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginRiskError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("AuthFlowStateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginApprovalReviewError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginApprovalFlowStartError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))));
-    yield* startRequiredEmailVerification(dependencies, result);
-    return yield* dependencies.authHttp.commitPasswordSignUpResult(result);
-});
-export const makePasswordResetStartHandler = (dependencies) => Effect.fn("auth.http.password.reset_start")(function* ({ payload, }) {
-    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.reset_start");
-    const input = passwordResetStartInput(payload);
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.passwordResetStart(input), "Failed to start password reset");
-    yield* dependencies.passwordReset.start(input).pipe(Effect.mapError(() => new AuthInternalError({
-        code: "internal_error",
-        message: "Failed to start password reset",
-    })));
-    return HttpServerResponse.empty({ status: 204 });
-});
-export const makePasswordResetVerifyHandler = (dependencies) => Effect.fn("auth.http.password.reset_verify")(function* ({ payload, }) {
-    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.reset_verify");
-    yield* dependencies.passwordReset
-        .verify(passwordResetVerifyInput(payload))
-        .pipe(Effect.mapError(() => new AuthBadRequestError({
-        code: "bad_request",
-        message: "Invalid password reset request",
-    })));
-    return HttpServerResponse.empty({ status: 204 });
-});
-const passwordManagementError = (error) => error.reason === "internal"
-    ? new AuthInternalError({
-        code: "internal_error",
-        message: "Failed to update password",
-    })
-    : new AuthBadRequestError({
-        code: "bad_request",
-        message: "Invalid password update request",
-    });
-export const makePasswordSetHandler = (dependencies) => Effect.fn("auth.http.password.set")(function* ({ payload, request, }) {
-    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.set");
-    const current = yield* readRequiredSession(dependencies, request);
-    yield* dependencies.passwordManagement
-        .set(passwordSetInput(current.currentSession.userId, payload))
-        .pipe(Effect.mapError(passwordManagementError));
-    return HttpServerResponse.empty({ status: 204 });
-});
-export const makePasswordChangeHandler = (dependencies) => Effect.fn("auth.http.password.change")(function* ({ payload, request, }) {
-    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.change");
-    const current = yield* readRequiredSession(dependencies, request);
-    yield* dependencies.passwordManagement
-        .change(passwordChangeInput(current.currentSession.userId, payload))
-        .pipe(Effect.mapError(passwordManagementError));
-    return HttpServerResponse.empty({ status: 204 });
-});
-export const makeCurrentSessionHandler = (dependencies) => Effect.fn("auth.http.session.current")(function* ({ request, }) {
+export const OidcDiscoveryMetadataLive = (metadata) => Layer.succeed(OidcDiscoveryMetadata, OidcDiscoveryMetadata.of({ load: () => Effect.succeed(metadata) }));
+export const makeCurrentSessionHandler = (dependencies) => Effect.fn("auth.http.session.current")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.current");
-    const tokenOption = yield* dependencies.sessionCookie
-        .read(webRequestFromHeaders(request.headers))
-        .pipe(Effect.mapError((error) => error.cause === undefined
-        ? new AuthUnauthenticatedError({
-            code: "unauthenticated",
-            message: "Unauthenticated",
-        })
-        : new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to validate session",
-        })));
-    if (Option.isNone(tokenOption)) {
-        return yield* new AuthUnauthenticatedError({
-            code: "unauthenticated",
-            message: "Unauthenticated",
-        });
-    }
-    const session = yield* dependencies.sessions
-        .validate(tokenOption.value)
-        .pipe(Effect.mapError((error) => error.cause === undefined
-        ? new AuthUnauthenticatedError({
-            code: "unauthenticated",
-            message: "Unauthenticated",
-        })
-        : new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to validate session",
-        })));
+    const session = yield* readRequiredSession(dependencies, request);
     return yield* dependencies.authHttp.commitCurrentSession(session);
 });
 export const makeRefreshSessionHandler = (dependencies) => Effect.fn("auth.http.session.refresh")(function* ({ request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.refresh");
     const tokenOption = yield* dependencies.sessionCookie
         .read(webRequestFromHeaders(request.headers))
-        .pipe(Effect.mapError((error) => error.cause === undefined
-        ? new AuthUnauthenticatedError({
-            code: "unauthenticated",
-            message: "Unauthenticated",
-        })
-        : new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to validate session",
-        })));
+        .pipe(Effect.catch((error) => customEvidencePolicyHttpFailure(error, "Failed to validate session") ??
+        Effect.fail(error.cause === undefined
+            ? new AuthUnauthenticatedError({
+                code: "unauthenticated",
+                message: "Unauthenticated",
+            })
+            : new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to validate session",
+            }))));
     if (Option.isNone(tokenOption)) {
         return yield* new AuthUnauthenticatedError({
             code: "unauthenticated",
@@ -1487,51 +1501,36 @@ export const makeRefreshSessionHandler = (dependencies) => Effect.fn("auth.http.
     }
     const session = yield* dependencies.sessions
         .refresh(tokenOption.value)
-        .pipe(Effect.mapError((error) => error.cause === undefined
-        ? new AuthUnauthenticatedError({
-            code: "unauthenticated",
-            message: "Unauthenticated",
-        })
-        : new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to refresh session",
-        })));
+        .pipe(Effect.catch((error) => customEvidencePolicyHttpFailure(error, "Failed to refresh session") ??
+        Effect.fail(error.cause === undefined
+            ? new AuthUnauthenticatedError({
+                code: "unauthenticated",
+                message: "Unauthenticated",
+            })
+            : new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to refresh session",
+            }))));
     return yield* dependencies.authHttp.commitSessionRefreshed(session);
 });
 export const makeLogoutHandler = (dependencies) => Effect.fn("auth.http.session.logout")(function* ({ request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.logout");
-    const tokenOption = yield* dependencies.sessionCookie
-        .read(webRequestFromHeaders(request.headers))
-        .pipe(Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
-        ? Effect.succeed(Option.none())
-        : Effect.fail(new AuthInternalError({
+    const sessionOption = yield* readOptionalSession(dependencies, request);
+    if (Option.isSome(sessionOption)) {
+        yield* dependencies.sessions
+            .revoke({
+            sessionId: sessionOption.value.currentSession.sessionId,
+            reason: "logout",
+        })
+            .pipe(Effect.mapError(() => new AuthInternalError({
             code: "internal_error",
-            message: "Failed to validate session",
-        }))));
-    if (Option.isSome(tokenOption)) {
-        const sessionOption = yield* dependencies.sessions
-            .validate(tokenOption.value)
-            .pipe(Effect.map(Option.some), Effect.catchTag("SessionValidateError", (error) => error.cause === undefined
-            ? Effect.succeed(Option.none())
-            : Effect.fail(new AuthInternalError({
-                code: "internal_error",
-                message: "Failed to validate session",
-            }))));
-        if (Option.isSome(sessionOption)) {
-            yield* dependencies.sessions
-                .revoke({
-                sessionId: sessionOption.value.currentSession.sessionId,
-                reason: "logout",
-            })
-                .pipe(Effect.mapError(() => new AuthInternalError({
-                code: "internal_error",
-                message: "Failed to revoke session",
-            })));
-        }
+            message: "Failed to revoke session",
+        })));
     }
     return yield* dependencies.authHttp.commitSessionCleared();
 });
-export const makeListSessionsHandler = (dependencies) => Effect.fn("auth.http.session.list")(function* ({ request, }) {
+export const makeListSessionsHandler = (dependencies) => Effect.fn("auth.http.session.list")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.list");
     const current = yield* readRequiredSession(dependencies, request);
     const sessions = yield* dependencies.sessions
@@ -1544,7 +1543,8 @@ export const makeListSessionsHandler = (dependencies) => Effect.fn("auth.http.se
         sessions: sessions.map((session) => activeSessionBody(session, current.currentSession.sessionId)),
     };
 });
-export const makeRevokeSessionHandler = (dependencies) => Effect.fn("auth.http.session.revoke")(function* ({ payload, request, }) {
+export const makeRevokeSessionHandler = (dependencies) => Effect.fn("auth.http.session.revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.revoke");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.sessions
@@ -1561,7 +1561,8 @@ export const makeRevokeSessionHandler = (dependencies) => Effect.fn("auth.http.s
         ? yield* dependencies.authHttp.commitSessionCleared()
         : HttpServerResponse.empty({ status: 204 });
 });
-export const makeRevokeOtherSessionsHandler = (dependencies) => Effect.fn("auth.http.session.revoke_others")(function* ({ request, }) {
+export const makeRevokeOtherSessionsHandler = (dependencies) => Effect.fn("auth.http.session.revoke_others")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.revoke_others");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.sessions
@@ -1576,7 +1577,8 @@ export const makeRevokeOtherSessionsHandler = (dependencies) => Effect.fn("auth.
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeAdminSessionListHandler = (dependencies) => Effect.fn("auth.http.admin_session.list")(function* ({ query, request, }) {
+export const makeAdminSessionListHandler = (dependencies) => Effect.fn("auth.http.admin_session.list")(function* (handlerRequest) {
+    const { query, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.list");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.authorization.authorize({
@@ -1593,7 +1595,8 @@ export const makeAdminSessionListHandler = (dependencies) => Effect.fn("auth.htt
     })));
     return { sessions: sessions.map(adminSessionHttpBody) };
 });
-export const makeAdminSessionRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke")(function* ({ payload, request, }) {
+export const makeAdminSessionRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.revoke");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.authorization.authorize({
@@ -1615,7 +1618,8 @@ export const makeAdminSessionRevokeHandler = (dependencies) => Effect.fn("auth.h
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeAdminSessionRevokeAllHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke_all")(function* ({ payload, request, }) {
+export const makeAdminSessionRevokeAllHandler = (dependencies) => Effect.fn("auth.http.admin_session.revoke_all")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_session.revoke_all");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.authorization.authorize({
@@ -1630,6 +1634,213 @@ export const makeAdminSessionRevokeAllHandler = (dependencies) => Effect.fn("aut
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
+export const adminPermissionDefinitionHttpBody = (definition) => ({
+    id: definition.id,
+    ...(definition.description === undefined
+        ? {}
+        : { description: definition.description }),
+    ...(definition.scopeType === undefined
+        ? {}
+        : { scopeType: definition.scopeType }),
+    createdAt: definition.createdAt,
+    updatedAt: definition.updatedAt,
+    ...(definition.disabledAt === undefined
+        ? {}
+        : { disabledAt: definition.disabledAt }),
+    ...(definition.deletedAt === undefined
+        ? {}
+        : { deletedAt: definition.deletedAt }),
+});
+const adminPermissionDefinitionHttpError = (error) => {
+    switch (error.reason) {
+        case "storage": {
+            return new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to complete permission definition request",
+            });
+        }
+        case "not_found": {
+            return new AuthNotFoundError({
+                code: "not_found",
+                message: "Permission definition not found",
+            });
+        }
+        case "already_exists":
+        case "concurrent_modification":
+        case "deleted":
+        case "inactive": {
+            return new AuthConflictError({
+                code: "conflict",
+                message: "Permission definition conflicts with its current state",
+            });
+        }
+        case "invalid_input": {
+            return new AuthBadRequestError({
+                code: "bad_request",
+                message: "Invalid permission definition request",
+            });
+        }
+    }
+};
+export const adminPermissionDefinitionCreateOperation = Effect.fn("auth.http.admin_permission_definition.create")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
+    const administration = yield* PermissionAdministration;
+    const authorization = yield* AdminPermissionDefinitionAuthorization;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_permission_definition.create");
+    const current = yield* requireSession(request);
+    yield* authorization.authorize({
+        currentSession: current.currentSession,
+        action: "create",
+        request,
+        permissionId: payload.id,
+        ...(payload.scopeType === undefined
+            ? {}
+            : { scopeType: payload.scopeType }),
+    });
+    const definition = yield* administration
+        .createPermissionDefinition(payload)
+        .pipe(Effect.mapError(adminPermissionDefinitionHttpError));
+    yield* Audit.emit({
+        type: "auth.permission_definition.created",
+        actor: Audit.AuditActor.user({
+            userId: current.currentSession.userId,
+            sessionId: current.currentSession.sessionId,
+        }),
+        permissionId: definition.id,
+        ...(definition.scopeType === undefined
+            ? {}
+            : { scopeType: definition.scopeType }),
+        occurredAt: definition.updatedAt,
+    });
+    return adminPermissionDefinitionHttpBody(definition);
+});
+export const adminPermissionDefinitionGetOperation = Effect.fn("auth.http.admin_permission_definition.get")(function* (handlerRequest) {
+    const { query, request } = handlerRequest;
+    const administration = yield* PermissionAdministration;
+    const authorization = yield* AdminPermissionDefinitionAuthorization;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_permission_definition.get");
+    const current = yield* requireSession(request);
+    yield* authorization.authorize({
+        currentSession: current.currentSession,
+        action: "get",
+        request,
+        permissionId: query.id,
+    });
+    const definition = yield* administration
+        .getPermissionDefinition(query.id)
+        .pipe(Effect.mapError(adminPermissionDefinitionHttpError));
+    if (Option.isNone(definition)) {
+        return yield* new AuthNotFoundError({
+            code: "not_found",
+            message: "Permission definition not found",
+        });
+    }
+    return adminPermissionDefinitionHttpBody(definition.value);
+});
+export const adminPermissionDefinitionListOperation = Effect.fn("auth.http.admin_permission_definition.list")(function* (handlerRequest) {
+    const { query, request } = handlerRequest;
+    const administration = yield* PermissionAdministration;
+    const authorization = yield* AdminPermissionDefinitionAuthorization;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_permission_definition.list");
+    const current = yield* requireSession(request);
+    yield* authorization.authorize({
+        currentSession: current.currentSession,
+        action: "list",
+        request,
+    });
+    const limit = normalizePermissionDefinitionListLimit(query.limit);
+    const definitions = yield* administration
+        .listPermissionDefinitions({ ...query, limit })
+        .pipe(Effect.mapError(adminPermissionDefinitionHttpError));
+    const nextAfter = definitions.length === limit ? definitions.at(-1)?.id : undefined;
+    return {
+        definitions: definitions.map(adminPermissionDefinitionHttpBody),
+        ...(nextAfter === undefined ? {} : { nextAfter }),
+    };
+});
+export const adminPermissionDefinitionUpdateOperation = Effect.fn("auth.http.admin_permission_definition.update")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
+    const administration = yield* PermissionAdministration;
+    const authorization = yield* AdminPermissionDefinitionAuthorization;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_permission_definition.update");
+    const current = yield* requireSession(request);
+    yield* authorization.authorize({
+        currentSession: current.currentSession,
+        action: "update",
+        request,
+        permissionId: payload.id,
+        ...(payload.scopeType === undefined
+            ? {}
+            : { scopeType: payload.scopeType }),
+    });
+    const definition = yield* administration
+        .updatePermissionDefinition(payload)
+        .pipe(Effect.mapError(adminPermissionDefinitionHttpError));
+    yield* Audit.emit({
+        type: "auth.permission_definition.updated",
+        actor: Audit.AuditActor.user({
+            userId: current.currentSession.userId,
+            sessionId: current.currentSession.sessionId,
+        }),
+        permissionId: definition.id,
+        ...(definition.scopeType === undefined
+            ? {}
+            : { scopeType: definition.scopeType }),
+        changedFields: [
+            ...(payload.description === undefined ? [] : ["description"]),
+            ...(payload.scopeType === undefined ? [] : ["scopeType"]),
+        ],
+        occurredAt: definition.updatedAt,
+    });
+    return adminPermissionDefinitionHttpBody(definition);
+});
+const runAdminPermissionDefinitionMutation = Effect.fn("auth.http.admin_permission_definition.mutate")(function* (action, handlerRequest) {
+    const { payload, request } = handlerRequest;
+    const administration = yield* PermissionAdministration;
+    const authorization = yield* AdminPermissionDefinitionAuthorization;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", `admin_permission_definition.${action}`);
+    const current = yield* requireSession(request);
+    yield* authorization.authorize({
+        currentSession: current.currentSession,
+        action,
+        request,
+        permissionId: payload.id,
+    });
+    const mutation = action === "disable"
+        ? administration.disablePermissionDefinition(payload)
+        : action === "enable"
+            ? administration.enablePermissionDefinition(payload)
+            : administration.deletePermissionDefinition(payload);
+    const definition = yield* mutation.pipe(Effect.mapError(adminPermissionDefinitionHttpError));
+    const actor = Audit.AuditActor.user({
+        userId: current.currentSession.userId,
+        sessionId: current.currentSession.sessionId,
+    });
+    const common = {
+        actor,
+        permissionId: definition.id,
+        ...(definition.scopeType === undefined
+            ? {}
+            : { scopeType: definition.scopeType }),
+        occurredAt: definition.updatedAt,
+    };
+    const event = action === "disable"
+        ? { type: "auth.permission_definition.disabled", ...common }
+        : action === "enable"
+            ? { type: "auth.permission_definition.enabled", ...common }
+            : { type: "auth.permission_definition.deleted", ...common };
+    yield* Audit.emit(event);
+    return adminPermissionDefinitionHttpBody(definition);
+});
+export const adminPermissionDefinitionDisableOperation = Effect.fn("auth.http.admin_permission_definition.disable")(function* (handlerRequest) {
+    return yield* runAdminPermissionDefinitionMutation("disable", handlerRequest);
+});
+export const adminPermissionDefinitionEnableOperation = Effect.fn("auth.http.admin_permission_definition.enable")(function* (handlerRequest) {
+    return yield* runAdminPermissionDefinitionMutation("enable", handlerRequest);
+});
+export const adminPermissionDefinitionDeleteOperation = Effect.fn("auth.http.admin_permission_definition.delete")(function* (handlerRequest) {
+    return yield* runAdminPermissionDefinitionMutation("delete", handlerRequest);
+});
 export const makeLoginNotificationReportHandler = (dependencies) => Effect.fn("auth.http.security.login_notification.report")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security.login_notification.report");
     if (dependencies.loginNotification === undefined) {
@@ -1645,33 +1856,48 @@ export const makeLoginNotificationReportHandler = (dependencies) => Effect.fn("a
         })));
     return HttpServerResponse.empty({ status: 204 });
 });
-const securityTimelineActorHttpBody = (actor) => actor.type === "anonymous"
-    ? { type: "anonymous" }
-    : {
-        type: "user",
-        ...(actor.sessionId === undefined ? {} : { sessionId: actor.sessionId }),
-    };
+const securityTimelineActorHttpBody = (actor) => {
+    switch (actor.type) {
+        case "anonymous": {
+            return { type: "anonymous" };
+        }
+        case "user": {
+            return {
+                type: "user",
+                ...(actor.sessionId === undefined
+                    ? {}
+                    : { sessionId: actor.sessionId }),
+            };
+        }
+        case "custom": {
+            return undefined;
+        }
+    }
+};
 const securityTimelineRequestHttpBody = (request) => ({
     ...(request.ipHash === undefined ? {} : { ipHash: request.ipHash }),
     ...(request.userAgentHash === undefined
         ? {}
         : { userAgentHash: request.userAgentHash }),
 });
-export const securityTimelineEventHttpBody = (event) => ({
-    eventId: event.id,
-    type: event.type,
-    category: event.category,
-    severity: event.severity,
-    occurredAt: event.occurredAt,
-    summary: event.summary,
-    ...(event.actor === undefined
-        ? {}
-        : { actor: securityTimelineActorHttpBody(event.actor) }),
-    ...(event.request === undefined
-        ? {}
-        : { request: securityTimelineRequestHttpBody(event.request) }),
-    ...(event.metadata === undefined ? {} : { metadata: event.metadata }),
-});
+export const securityTimelineEventHttpBody = (event) => {
+    const actor = event.actor === undefined
+        ? undefined
+        : securityTimelineActorHttpBody(event.actor);
+    return {
+        eventId: event.id,
+        type: event.type,
+        category: event.category,
+        severity: event.severity,
+        occurredAt: event.occurredAt,
+        summary: event.summary,
+        ...(actor === undefined ? {} : { actor }),
+        ...(event.request === undefined
+            ? {}
+            : { request: securityTimelineRequestHttpBody(event.request) }),
+        ...(event.metadata === undefined ? {} : { metadata: event.metadata }),
+    };
+};
 const securityTimelineListInput = (query, userId) => ({
     userId,
     ...(query.limit === undefined ? {} : { limit: query.limit }),
@@ -1682,7 +1908,8 @@ const securityTimelineListInput = (query, userId) => ({
     ...(query.categories === undefined ? {} : { categories: query.categories }),
 });
 const adminSecurityTimelineListInput = (query) => securityTimelineListInput(query, query.userId);
-export const makeSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.security_timeline.list")(function* ({ query, request, }) {
+export const makeSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.security_timeline.list")(function* (handlerRequest) {
+    const { query, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security_timeline.list");
     const current = yield* readRequiredSession(dependencies, request);
     const events = yield* dependencies.securityTimeline
@@ -1693,7 +1920,8 @@ export const makeSecurityTimelineListHandler = (dependencies) => Effect.fn("auth
     })));
     return { events: events.map(securityTimelineEventHttpBody) };
 });
-export const makeAdminSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.admin_security_timeline.list")(function* ({ query, request, }) {
+export const makeAdminSecurityTimelineListHandler = (dependencies) => Effect.fn("auth.http.admin_security_timeline.list")(function* (handlerRequest) {
+    const { query, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_security_timeline.list");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.authorization.authorize({
@@ -1716,7 +1944,8 @@ export const trustedDeviceHttpBody = (device) => ({
     expiresAt: device.expiresAt,
     ...(device.metadata === undefined ? {} : { metadata: device.metadata }),
 });
-export const makeTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.trusted_device.list")(function* ({ request, }) {
+export const makeTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.trusted_device.list")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "trusted_device.list");
     const current = yield* readRequiredSession(dependencies, request);
     const now = yield* currentUnixMillis;
@@ -1728,7 +1957,8 @@ export const makeTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.ht
     })));
     return { devices: devices.map(trustedDeviceHttpBody) };
 });
-export const makeTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.trusted_device.revoke")(function* ({ payload, request, }) {
+export const makeTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.trusted_device.revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "trusted_device.revoke");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.trustedDevices
@@ -1742,7 +1972,8 @@ export const makeTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeAdminTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.list")(function* ({ query, request, }) {
+export const makeAdminTrustedDeviceListHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.list")(function* (handlerRequest) {
+    const { query, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_trusted_device.list");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.authorization.authorize({
@@ -1760,7 +1991,8 @@ export const makeAdminTrustedDeviceListHandler = (dependencies) => Effect.fn("au
     })));
     return { devices: devices.map(trustedDeviceHttpBody) };
 });
-export const makeAdminTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.revoke")(function* ({ payload, request, }) {
+export const makeAdminTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("auth.http.admin_trusted_device.revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "admin_trusted_device.revoke");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.authorization.authorize({
@@ -1781,12 +2013,10 @@ export const makeAdminTrustedDeviceRevokeHandler = (dependencies) => Effect.fn("
     })));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeEmailVerificationStartHandler = (dependencies) => Effect.fn("auth.http.email_verification.start")(function* ({ payload, }) {
+export const makeEmailVerificationStartHandler = (dependencies) => Effect.fn("auth.http.email_verification.start")(function* (handlerRequest) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_verification.start");
-    const input = emailVerificationStartInput(payload);
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.emailVerificationStart(input), "Failed to start email verification");
-    yield* dependencies.emailVerificationFlow.start(input).pipe(Effect.catchTag("EmailVerificationFlowStartError", (error) => Effect.fail(error.cause instanceof EmailVerificationIssueError
+    const guarded = yield* EmailGuards.emailVerification.start(handlerRequest);
+    yield* dependencies.emailVerificationFlow.start(guarded.input).pipe(Effect.catchTag("EmailVerificationFlowStartError", (error) => Effect.fail(error.cause instanceof EmailVerificationIssueError
         ? new AuthBadRequestError({
             code: "bad_request",
             message: "Invalid email verification request",
@@ -1813,55 +2043,65 @@ export const makeEmailVerificationVerifyHandler = (dependencies) => Effect.fn("a
     yield* upgradeVerifiedEmailSession(dependencies, request, verified);
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeEmailOtpStartHandler = (dependencies) => Effect.fn("auth.http.email_otp.start")(function* ({ payload, }) {
+export const makeEmailOtpStartHandler = (dependencies) => Effect.fn("auth.http.email_otp.start")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_otp.start");
-    const input = emailOtpStartInput(payload);
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.emailOtpStart(input), "Failed to start email OTP");
-    return yield* dependencies.emailOtp.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+    const guarded = yield* EmailGuards.emailOtp.start(handlerRequest);
+    const started = yield* dependencies.emailOtp.start(guarded.input).pipe(Effect.mapError(() => new AuthInternalError({
         code: "internal_error",
         message: "Failed to start email OTP",
     })));
+    return {
+        challengeId: started.challengeId,
+        identity: payload.identity,
+        expiresAt: started.expiresAt,
+    };
 });
-export const makeEmailOtpVerifyHandler = (dependencies) => Effect.fn("auth.http.email_otp.verify")(function* ({ payload, request, }) {
+export const makeEmailOtpVerifyHandler = (dependencies) => Effect.fn("auth.http.email_otp.verify")(function* (handlerRequest) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_otp.verify");
-    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
-    const requestMetadataOptions = yield* authRequestMetadataOptions;
-    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
-    const result = yield* dependencies.emailOtp
-        .verify(emailOtpVerifyInput(payload, Option.isSome(trustedDeviceToken)
-        ? trustedDeviceToken.value
-        : undefined, requestContext))
-        .pipe(Effect.mapError(() => new AuthInternalError({
+    const guarded = yield* EmailGuards.emailOtp.verify(handlerRequest);
+    const result = yield* dependencies.emailOtp.verify(guarded.input).pipe(Effect.mapError(() => new AuthInternalError({
         code: "internal_error",
         message: "Failed to verify email OTP",
     })));
     return yield* dependencies.authHttp.commitEmailOtpVerifyResult(result);
 });
-export const makeMagicLinkStartHandler = (dependencies) => Effect.fn("auth.http.magic_link.start")(function* ({ payload, }) {
+export const makeEmailAuthStartHandler = (dependencies) => Effect.fn("auth.http.email.start")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email.start");
+    const guarded = yield* EmailGuards.emailAuth.start(handlerRequest);
+    const started = yield* dependencies.emailAuth.start(guarded.input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start email authentication",
+    })));
+    return {
+        identity: payload.identity,
+        emailOtp: {
+            challengeId: started.emailOtp.challengeId,
+            expiresAt: started.emailOtp.expiresAt,
+        },
+        magicLink: {
+            expiresAt: started.magicLink.expiresAt,
+        },
+    };
+});
+export const makeMagicLinkStartHandler = (dependencies) => Effect.fn("auth.http.magic_link.start")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "magic_link.start");
-    const input = magicLinkStartInput(payload);
-    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
-    yield* catchAuthApiRateLimit(authApiRateLimit.magicLinkStart(input), "Failed to start magic link");
-    const started = yield* dependencies.magicLink.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+    const guarded = yield* EmailGuards.magicLink.start(handlerRequest);
+    const started = yield* dependencies.magicLink.start(guarded.input).pipe(Effect.mapError(() => new AuthInternalError({
         code: "internal_error",
         message: "Failed to start magic link",
     })));
     return {
-        email: started.email,
+        identity: payload.identity,
         expiresAt: started.expiresAt,
     };
 });
-export const makeMagicLinkVerifyHandler = (dependencies) => Effect.fn("auth.http.magic_link.verify")(function* ({ payload, request, }) {
+export const makeMagicLinkVerifyHandler = (dependencies) => Effect.fn("auth.http.magic_link.verify")(function* (handlerRequest) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "magic_link.verify");
-    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
-    const requestMetadataOptions = yield* authRequestMetadataOptions;
-    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
-    const result = yield* dependencies.magicLink
-        .verify(magicLinkVerifyInput(payload, Option.isSome(trustedDeviceToken)
-        ? trustedDeviceToken.value
-        : undefined, requestContext))
-        .pipe(Effect.mapError(() => new AuthInternalError({
+    const guarded = yield* EmailGuards.magicLink.verify(handlerRequest);
+    const result = yield* dependencies.magicLink.verify(guarded.input).pipe(Effect.mapError(() => new AuthInternalError({
         code: "internal_error",
         message: "Failed to verify magic link",
     })));
@@ -1869,7 +2109,9 @@ export const makeMagicLinkVerifyHandler = (dependencies) => Effect.fn("auth.http
 });
 export const makeOAuthAuthorizationStartHandler = (dependencies) => Effect.fn("auth.http.oauth.authorization_start")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.authorization_start");
-    const provider = yield* dependencies.oauthProviders.get(payload.providerId).pipe(Effect.mapError(() => oauthInternalError("Failed to load OAuth provider")));
+    const provider = yield* dependencies.oauthProviders
+        .get(payload.providerId)
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to load OAuth provider")));
     if (Option.isNone(provider)) {
         return yield* oauthBadRequest("Unknown OAuth provider");
     }
@@ -1877,7 +2119,9 @@ export const makeOAuthAuthorizationStartHandler = (dependencies) => Effect.fn("a
         .start(oauthAuthorizationStartInput(payload, provider.value, dependencies))
         .pipe(Effect.mapError(() => oauthInternalError("Failed to start OAuth authorization")));
     if (dependencies.storeCodeVerifier !== undefined) {
-        yield* dependencies.storeCodeVerifier({ payload, started }).pipe(Effect.mapError(() => oauthInternalError("Failed to store OAuth verifier")));
+        yield* dependencies
+            .storeCodeVerifier({ payload, started })
+            .pipe(Effect.mapError(() => oauthInternalError("Failed to store OAuth verifier")));
     }
     return oauthAuthorizationStartedHttpBody(started);
 });
@@ -2008,12 +2252,15 @@ const makeOAuthTokenIntrospectionNotConfiguredHandler = () => Effect.fn("auth.ht
     yield* oauthTokenIntrospectionRequestBody(request);
     return yield* oauthTokenIntrospectionEndpointError("invalid_request");
 });
-export const makeOAuthAccountUnlinkHandler = (dependencies) => Effect.fn("auth.http.oauth.account_unlink")(function* ({ payload, request, }) {
+export const makeOAuthAccountUnlinkHandler = (dependencies) => Effect.fn("auth.http.oauth.account_unlink")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.account_unlink");
     const session = yield* readRequiredSession(dependencies, request);
     const stepUpSatisfied = dependencies.stepUpSatisfied === undefined
         ? undefined
-        : yield* dependencies.stepUpSatisfied({ payload, request, session }).pipe(Effect.mapError(() => oauthInternalError("Failed to evaluate OAuth unlink step-up")));
+        : yield* dependencies
+            .stepUpSatisfied({ payload, request, session })
+            .pipe(Effect.mapError(() => oauthInternalError("Failed to evaluate OAuth unlink step-up")));
     const decision = yield* dependencies.oauthAccountUnlinking
         .resolve({
         userId: session.currentSession.userId,
@@ -2038,16 +2285,22 @@ export const makeOAuthLinkConfirmationStartHandler = (dependencies) => Effect.fn
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.link_confirmation_start");
     const baseInput = dependencies.startInput === undefined
         ? yield* oauthLinkConfirmationStartInput(payload, dependencies)
-        : yield* dependencies.startInput({ payload, request }).pipe(Effect.mapError((error) => oauthHookHttpError(error, "Failed to resolve OAuth link confirmation input")));
+        : yield* dependencies
+            .startInput({ payload, request })
+            .pipe(Effect.mapError((error) => oauthHookHttpError(error, "Failed to resolve OAuth link confirmation input")));
     const input = {
         ...baseInput,
         ...(baseInput.ttl === undefined && dependencies.ttl !== undefined
             ? { ttl: dependencies.ttl }
             : {}),
     };
-    const started = yield* dependencies.oauthLinkConfirmation.start(input).pipe(Effect.mapError((error) => oauthLinkConfirmationHttpError(error, "Failed to start OAuth link confirmation")));
+    const started = yield* dependencies.oauthLinkConfirmation
+        .start(input)
+        .pipe(Effect.mapError((error) => oauthLinkConfirmationHttpError(error, "Failed to start OAuth link confirmation")));
     if (dependencies.onStarted !== undefined) {
-        yield* dependencies.onStarted({ payload, request, started }).pipe(Effect.mapError(() => oauthInternalError("Failed to deliver OAuth link confirmation")));
+        yield* dependencies
+            .onStarted({ payload, request, started })
+            .pipe(Effect.mapError(() => oauthInternalError("Failed to deliver OAuth link confirmation")));
     }
     return oauthLinkConfirmationStartedHttpBody(started);
 });
@@ -2062,38 +2315,62 @@ export const makeOAuthLinkConfirmationConfirmHandler = (dependencies) => Effect.
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.link_confirmation_confirm");
     const currentUserId = dependencies.currentUserId === undefined
         ? undefined
-        : yield* dependencies.currentUserId({ payload, request }).pipe(Effect.mapError((error) => oauthHookHttpError(error, "Failed to resolve current OAuth user")));
+        : yield* dependencies
+            .currentUserId({ payload, request })
+            .pipe(Effect.mapError((error) => oauthHookHttpError(error, "Failed to resolve current OAuth user")));
     const confirmed = yield* dependencies.oauthLinkConfirmation
         .confirm(oauthLinkConfirmationConfirmInput(payload, currentUserId))
         .pipe(Effect.mapError((error) => oauthLinkConfirmationHttpError(error, "Failed to confirm OAuth link confirmation")));
     if (dependencies.linkAfterConfirm !== undefined) {
-        yield* dependencies.linkAfterConfirm({ payload, request, confirmed }).pipe(Effect.mapError(() => oauthInternalError("Failed to link OAuth account")));
+        yield* dependencies
+            .linkAfterConfirm({ payload, request, confirmed })
+            .pipe(Effect.mapError(() => oauthInternalError("Failed to link OAuth account")));
     }
     return oauthLinkConfirmationConfirmedHttpBody(confirmed, {
         linked: dependencies.linkAfterConfirm !== undefined,
     });
 });
-export const makePasskeyRegistrationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_start")(function* ({ payload, }) {
+export const makePasskeyRegistrationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_start")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.registration_start");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.passkey.registration_start", handlerRequest, current.currentSession.userId);
+    const user = yield* dependencies.resolveUser({
+        currentSession: current.currentSession,
+        actor: current.actor,
+        request,
+    });
     return yield* dependencies.passkeyOptions
-        .startRegistration(passkeyRegistrationStartInput(payload, dependencies))
+        .startRegistration(passkeyRegistrationStartInput(current.currentSession.userId, user, dependencies))
         .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey registration")));
 });
-export const makePasskeyRegistrationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_finish")(function* ({ payload, }) {
+export const makePasskeyRegistrationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_finish")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.registration_finish");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.passkey.registration_finish", handlerRequest, current.currentSession.userId);
+    const user = yield* dependencies.resolveUser({
+        currentSession: current.currentSession,
+        actor: current.actor,
+        request,
+    });
     const finished = yield* dependencies.passkeyVerification
-        .finishRegistration(passkeyRegistrationFinishInput(payload, dependencies))
+        .finishRegistration(passkeyRegistrationFinishInput(current.currentSession.userId, payload, user, dependencies))
         .pipe(Effect.mapError(passkeyVerificationHttpError));
     return { credentialId: finished.credential.credentialId };
 });
-export const makePasskeyAuthenticationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_start")(function* ({ payload, }) {
+export const makePasskeyAuthenticationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_start")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.authentication_start");
+    yield* requireAuthRateLimit("auth.passkey.authentication_start", handlerRequest);
     return yield* dependencies.passkeyOptions
         .startAuthentication(passkeyAuthenticationStartInput(payload, dependencies))
         .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey authentication")));
 });
-export const makePasskeyAuthenticationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_finish")(function* ({ payload, request, }) {
+export const makePasskeyAuthenticationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_finish")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.authentication_finish");
+    yield* requireAuthRateLimit("auth.passkey.authentication_finish", handlerRequest);
     const finished = yield* dependencies.passkeyVerification
         .finishAuthentication(passkeyAuthenticationFinishInput(payload, dependencies))
         .pipe(Effect.mapError(passkeyVerificationHttpError));
@@ -2106,9 +2383,58 @@ export const makePasskeyAuthenticationFinishHandler = (dependencies) => Effect.f
         .pipe(Effect.mapError(() => passkeyInternalError("Failed to create passkey session")));
     return yield* dependencies.authHttp.commitAuthenticatedSession(session);
 });
-export const makePasskeyCredentialListHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_list")(function* ({ request, }) {
+const identityInfoHttpBody = (identity) => ({ ...identity });
+const withIdentitySession = (dependencies, request, operation, handlerRequest, run) => Effect.gen(function* () {
+    const session = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit(operation, handlerRequest, session.currentSession.userId);
+    return yield* run(session).pipe(Effect.mapError(identityHttpError));
+});
+export const makeIdentityAvailabilityHandler = (dependencies) => (handlerRequest) => Effect.gen(function* () {
+    const guarded = yield* IdentityGuards.availability(handlerRequest);
+    const available = yield* dependencies.identityManagement
+        .availability(guarded.input)
+        .pipe(Effect.mapError(identityHttpError));
+    return { available };
+});
+export const makeIdentityListHandler = (dependencies) => (handlerRequest) => withIdentitySession(dependencies, handlerRequest.request, "auth.identity.list", handlerRequest, (session) => dependencies.identityManagement
+    .list(session.currentSession.userId)
+    .pipe(Effect.map((identities) => ({
+    identities: identities.map(identityInfoHttpBody),
+}))));
+const identityMutationHandler = (dependencies, operation, handlerRequest, run) => withIdentitySession(dependencies, handlerRequest.request, operation, handlerRequest, (session) => run(session, handlerRequest.payload));
+export const makeIdentityAddHandler = (dependencies) => (request) => identityMutationHandler(dependencies, "auth.identity.add", request, (session, payload) => dependencies.identityManagement
+    .add({
+    ...payload,
+    userId: session.currentSession.userId,
+    currentSession: session,
+})
+    .pipe(Effect.map(identityInfoHttpBody)));
+export const makeIdentityReplaceHandler = (dependencies) => (request) => identityMutationHandler(dependencies, "auth.identity.replace", request, (session, payload) => dependencies.identityManagement
+    .replace({
+    ...payload,
+    userId: session.currentSession.userId,
+    currentSession: session,
+})
+    .pipe(Effect.map(identityInfoHttpBody)));
+export const makeIdentityRevokeHandler = (dependencies) => (request) => identityMutationHandler(dependencies, "auth.identity.revoke", request, (session, payload) => dependencies.identityManagement
+    .revoke({
+    ...payload,
+    userId: session.currentSession.userId,
+    currentSession: session,
+})
+    .pipe(Effect.map(identityInfoHttpBody)));
+export const makeIdentityPrimaryHandler = (dependencies) => (request) => identityMutationHandler(dependencies, "auth.identity.set_primary", request, (session, payload) => dependencies.identityManagement
+    .setPrimary({
+    ...payload,
+    userId: session.currentSession.userId,
+    currentSession: session,
+})
+    .pipe(Effect.map(identityInfoHttpBody)));
+export const makePasskeyCredentialListHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_list")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.credential_list");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.passkey.credentials.list", handlerRequest, current.currentSession.userId);
     const credentials = yield* dependencies.passkeyCredentialManagement
         .listForUser({ userId: current.currentSession.userId })
         .pipe(Effect.mapError(() => passkeyInternalError("Failed to list passkey credentials")));
@@ -2116,87 +2442,130 @@ export const makePasskeyCredentialListHandler = (dependencies) => Effect.fn("aut
         credentials: credentials.map(passkeyCredentialInfoHttpBody),
     };
 });
-export const makePasskeyCredentialRevokeHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_revoke")(function* ({ payload, request, }) {
+export const makePasskeyCredentialRevokeHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.credential_revoke");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.passkey.credentials.revoke", handlerRequest, current.currentSession.userId);
+    yield* requireCanRemoveStrongFactor(dependencies.strongFactorRemovalPolicy, {
+        userId: current.currentSession.userId,
+        factor: strongFactor("passkey", PasskeyCredentialId(payload.credentialId)),
+    });
     yield* dependencies.passkeyCredentialManagement
         .revokeForUser(passkeyCredentialRevokeInput(current.currentSession.userId, payload))
         .pipe(Effect.mapError(passkeyCredentialManagementHttpError));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeTotpEnrollmentStartHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_start")(function* ({ payload, request, }) {
+export const makeTotpEnrollmentStartHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_start")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.enrollment_start");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.totp.enrollment_start", handlerRequest, current.currentSession.userId);
     const started = yield* dependencies.totpFactorManagement
         .startEnrollment(totpEnrollmentStartInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError(totpFactorManagementHttpError));
     return totpEnrollmentStartedHttpBody(started);
 });
-export const makeTotpEnrollmentConfirmHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_confirm")(function* ({ payload, request, }) {
+export const makeTotpEnrollmentConfirmHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_confirm")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.enrollment_confirm");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.totp.enrollment_confirm", handlerRequest, current.currentSession.userId);
     const confirmed = yield* dependencies.totpFactorManagement
         .confirmEnrollment(totpEnrollmentConfirmInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError(totpFactorManagementHttpError));
     return totpFactorInfoHttpBody(confirmed);
 });
-export const makeTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.totp.verify")(function* ({ payload, request, }) {
+export const makeTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.totp.verify")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.verify");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.totp.verify", handlerRequest, current.currentSession.userId);
     const result = yield* dependencies.totpFactorManagement
         .verifyForUser(totpVerifyInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError(() => totpInternalError("Failed to verify TOTP factor")));
     return totpVerifyResultHttpBody(result);
 });
-export const makeTotpFactorListHandler = (dependencies) => Effect.fn("auth.http.totp.factor_list")(function* ({ request, }) {
+export const makeTotpFactorListHandler = (dependencies) => Effect.fn("auth.http.totp.factor_list")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.factor_list");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.totp.factors.list", handlerRequest, current.currentSession.userId);
     const factors = yield* dependencies.totpFactorManagement
         .listForUser({ userId: current.currentSession.userId })
         .pipe(Effect.mapError(() => totpInternalError("Failed to list TOTP factors")));
     return { factors: factors.map(totpFactorInfoHttpBody) };
 });
-export const makeTotpFactorRevokeHandler = (dependencies) => Effect.fn("auth.http.totp.factor_revoke")(function* ({ payload, request, }) {
+export const makeTotpFactorRevokeHandler = (dependencies) => Effect.fn("auth.http.totp.factor_revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.factor_revoke");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.totp.factors.revoke", handlerRequest, current.currentSession.userId);
+    yield* requireCanRemoveStrongFactor(dependencies.strongFactorRemovalPolicy, {
+        userId: current.currentSession.userId,
+        factor: strongFactor("totp", payload.factorId),
+    });
     yield* dependencies.totpFactorManagement
         .revokeForUser(totpFactorRevokeInput(current.currentSession.userId, payload))
         .pipe(Effect.mapError(totpFactorManagementHttpError));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeRecoveryCodeGenerateHandler = (dependencies) => Effect.fn("auth.http.recovery_code.generate")(function* ({ payload, request, }) {
+export const makeRecoveryCodeGenerateHandler = (dependencies) => Effect.fn("auth.http.recovery_code.generate")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.generate");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.recovery_code.generate", handlerRequest, current.currentSession.userId);
     const generated = yield* dependencies.recoveryCodeManagement
         .generateForUser(recoveryCodeGenerateInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError(recoveryCodeManagementHttpError));
     return recoveryCodesGeneratedHttpBody(generated);
 });
-export const makeRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.recovery_code.verify")(function* ({ payload, request, }) {
+export const makeRecoveryCodeRegenerateHandler = (dependencies) => Effect.fn("auth.http.recovery_code.regenerate")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.regenerate");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.recovery_code.regenerate", handlerRequest, current.currentSession.userId);
+    const generated = yield* dependencies.recoveryCodeManagement
+        .regenerateForUser(recoveryCodeRegenerateInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(recoveryCodeManagementHttpError));
+    return recoveryCodesGeneratedHttpBody(generated);
+});
+export const makeRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.recovery_code.verify")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.verify");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.recovery_code.verify", handlerRequest, current.currentSession.userId);
     const result = yield* dependencies.recoveryCodeManagement
         .verifyForUser(recoveryCodeVerifyInput(current.currentSession.userId, payload))
         .pipe(Effect.mapError(() => recoveryCodeInternalError("Failed to verify recovery code")));
     return recoveryCodeVerifyResultHttpBody(result);
 });
-export const makeRecoveryCodeListHandler = (dependencies) => Effect.fn("auth.http.recovery_code.list")(function* ({ request, }) {
+export const makeRecoveryCodeListHandler = (dependencies) => Effect.fn("auth.http.recovery_code.list")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.list");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.recovery_code.list", handlerRequest, current.currentSession.userId);
     const codes = yield* dependencies.recoveryCodeManagement
         .listForUser({ userId: current.currentSession.userId })
         .pipe(Effect.mapError(() => recoveryCodeInternalError("Failed to list recovery codes")));
     return { codes: codes.map(recoveryCodeInfoHttpBody) };
 });
-export const makeRecoveryCodeRevokeHandler = (dependencies) => Effect.fn("auth.http.recovery_code.revoke")(function* ({ payload, request, }) {
+export const makeRecoveryCodeRevokeHandler = (dependencies) => Effect.fn("auth.http.recovery_code.revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.revoke");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.recovery_code.revoke", handlerRequest, current.currentSession.userId);
+    yield* requireCanRemoveStrongFactor(dependencies.strongFactorRemovalPolicy, {
+        userId: current.currentSession.userId,
+        factor: strongFactor("recovery-code", payload.codeId),
+    });
     yield* dependencies.recoveryCodeManagement
         .revokeForUser(recoveryCodeRevokeInput(current.currentSession.userId, payload))
         .pipe(Effect.mapError(recoveryCodeManagementHttpError));
     return HttpServerResponse.empty({ status: 204 });
 });
-export const makeApiKeyCreateHandler = (dependencies) => Effect.fn("auth.http.api_key.create")(function* ({ payload, request, }) {
+export const makeApiKeyCreateHandler = (dependencies) => Effect.fn("auth.http.api_key.create")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.create");
     const current = yield* readRequiredSession(dependencies, request);
     const created = yield* dependencies.apiKeyManagement
@@ -2204,7 +2573,8 @@ export const makeApiKeyCreateHandler = (dependencies) => Effect.fn("auth.http.ap
         .pipe(Effect.mapError(apiKeyManagementHttpError));
     return apiKeyCreatedHttpBody(created);
 });
-export const makeApiKeyListHandler = (dependencies) => Effect.fn("auth.http.api_key.list")(function* ({ request, }) {
+export const makeApiKeyListHandler = (dependencies) => Effect.fn("auth.http.api_key.list")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.list");
     const current = yield* readRequiredSession(dependencies, request);
     const keys = yield* dependencies.apiKeyManagement
@@ -2212,7 +2582,8 @@ export const makeApiKeyListHandler = (dependencies) => Effect.fn("auth.http.api_
         .pipe(Effect.mapError(() => apiKeyInternalError("Failed to list API keys")));
     return { keys: keys.map(apiKeyInfoHttpBody) };
 });
-export const makeApiKeyRevokeHandler = (dependencies) => Effect.fn("auth.http.api_key.revoke")(function* ({ payload, request, }) {
+export const makeApiKeyRevokeHandler = (dependencies) => Effect.fn("auth.http.api_key.revoke")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.revoke");
     const current = yield* readRequiredSession(dependencies, request);
     yield* dependencies.apiKeyManagement
@@ -2257,7 +2628,7 @@ export const makeJwtIntrospectHandler = (dependencies) => Effect.fn("auth.http.j
         .pipe(Effect.mapError(() => jwtInternalError("Failed to introspect JWT access token")));
     return jwtIntrospectionHttpBody(result);
 });
-export const makeJwtRevokeHandler = (dependencies) => Effect.fn("auth.http.jwt.revoke")(function* ({ payload }) {
+export const makeJwtRevokeHandler = (dependencies) => Effect.fn("auth.http.jwt.revoke")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.revoke");
     yield* dependencies.jwtRevocation
         .revokeJwtId(jwtRevokeInput(payload))
@@ -2266,20 +2637,28 @@ export const makeJwtRevokeHandler = (dependencies) => Effect.fn("auth.http.jwt.r
 });
 export const makeJwtJwksHandler = (dependencies) => Effect.fn("auth.http.jwt.jwks")(function* (_) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.jwks");
-    const document = yield* dependencies.jwks.document().pipe(Effect.mapError(() => jwtInternalError("Failed to load JWT JWKS document")));
+    const document = yield* dependencies.jwks
+        .document()
+        .pipe(Effect.mapError(() => jwtInternalError("Failed to load JWT JWKS document")));
     return jwtJwksHttpBody(document);
 });
 export const makeOidcDiscoveryMetadataHandler = (dependencies) => Effect.fn("auth.http.oidc.discovery_metadata")(function* (_) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oidc.discovery_metadata");
-    return yield* dependencies.metadata.load().pipe(Effect.mapError(() => jwtInternalError("Failed to load OIDC discovery metadata")));
+    return yield* dependencies.metadata
+        .load()
+        .pipe(Effect.mapError(() => jwtInternalError("Failed to load OIDC discovery metadata")));
 });
-export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.options")(function* ({ payload, }) {
+export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.options")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.options");
+    yield* requireAuthRateLimit("auth.mfa.options", handlerRequest);
     const pending = yield* dependencies.authFlowState
         .inspect(payload.flowId)
         .pipe(Effect.mapError(() => mfaBadRequest()));
+    const allowed = new Set(pending.factors?.map((factor) => factor.type));
     const factors = [];
-    if (dependencies.totpFactorManagement !== undefined) {
+    if (allowed.has("totp") &&
+        dependencies.totpFactorManagement !== undefined) {
         const totpFactors = yield* dependencies.totpFactorManagement
             .listForUser({ userId: pending.userId })
             .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
@@ -2287,7 +2666,8 @@ export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.
             factors.push({ type: "totp" });
         }
     }
-    if (dependencies.recoveryCodeManagement !== undefined) {
+    if (allowed.has("backup-code") &&
+        dependencies.recoveryCodeManagement !== undefined) {
         const recoveryCodes = yield* dependencies.recoveryCodeManagement
             .listForUser({ userId: pending.userId })
             .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
@@ -2295,7 +2675,8 @@ export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.
             factors.push({ type: "backup-code" });
         }
     }
-    if (dependencies.passkeyCredentialManagement !== undefined) {
+    if (allowed.has("passkey") &&
+        dependencies.passkeyCredentialManagement !== undefined) {
         const credentials = yield* dependencies.passkeyCredentialManagement
             .listForUser({ userId: pending.userId })
             .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
@@ -2305,12 +2686,29 @@ export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.
     }
     return { factors };
 });
-export const makeTotpMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify")(function* ({ payload, }) {
+const inspectMfaFlowForFactor = (authFlowState, flowId, factorType) => Effect.gen(function* () {
+    const pending = yield* authFlowState
+        .inspect(flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    if (pending.factors?.some((factor) => factor.type === factorType) !== true) {
+        return yield* mfaBadRequest();
+    }
+    return pending;
+});
+export const makeTotpMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.totp_verify");
+    yield* requireAuthRateLimit("auth.mfa.totp_verify", handlerRequest);
+    const pending = yield* inspectMfaFlowForFactor(dependencies.authFlowState, payload.flowId, "totp");
+    if (pending.userId !== payload.userId) {
+        return yield* mfaInvalidCredentials();
+    }
     const verified = yield* dependencies.totpFactorManagement
         .verifyForUser(totpMfaVerifyInput(payload, dependencies))
         .pipe(Effect.mapError(() => mfaInternalError("Failed to verify TOTP MFA factor")));
-    if (!verified.valid) {
+    if (!verified.valid ||
+        verified.factor === undefined ||
+        verified.acceptedCounter === undefined) {
         return yield* mfaInvalidCredentials();
     }
     const result = yield* dependencies.authFlow
@@ -2318,44 +2716,98 @@ export const makeTotpMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.m
         flowId: payload.flowId,
         userId: payload.userId,
         method: "totp",
-        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+        evidence: totpEvidence({
+            factorId: verified.factor.id,
+            acceptedCounter: verified.acceptedCounter,
+            verifiedAt: yield* currentUnixMillis,
+        }),
     })
-        .pipe(Effect.mapError(authFlowMfaHttpError));
-    if (result._tag === "PolicyDenied") {
-        return yield* mfaPolicyDenied(result.reason);
-    }
-    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+        .pipe(Effect.catch(authFlowMfaHttpFailure));
+    return yield* dependencies.authHttp.commitMfaResult(result);
 });
-export const makeTotpMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify_for_flow")(function* ({ payload, }) {
+export const makeTotpMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify_for_flow")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.totp_verify_for_flow");
-    const pending = yield* dependencies.authFlowState
-        .inspect(payload.flowId)
-        .pipe(Effect.mapError(() => mfaBadRequest()));
+    yield* requireAuthRateLimit("auth.mfa.totp_verify_for_flow", handlerRequest);
+    const pending = yield* inspectMfaFlowForFactor(dependencies.authFlowState, payload.flowId, "totp");
+    const user = yield* dependencies.users
+        .findById(pending.userId)
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to load pending MFA user")));
+    if (Option.isNone(user) || user.value.disabledAt !== undefined) {
+        return yield* mfaInvalidCredentials();
+    }
+    const verification = yield* dependencies.verificationStore
+        .findById(ChallengeId(payload.flowId))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to load pending MFA flow")));
+    if (Option.isNone(verification)) {
+        return yield* mfaBadRequest();
+    }
     const verified = yield* dependencies.totpFactorManagement
-        .verifyForUser(totpMfaVerifyForFlowInput(pending.userId, payload, dependencies))
+        .identifyForUser(totpMfaVerifyForFlowInput(pending.userId, payload, dependencies))
         .pipe(Effect.mapError(() => mfaInternalError("Failed to verify TOTP MFA factor")));
-    if (!verified.valid) {
+    if (!verified.valid ||
+        verified.factor === undefined ||
+        verified.acceptedCounter === undefined) {
         return yield* mfaInvalidCredentials();
     }
+    if (dependencies.authFlow.prepareMfa === undefined) {
+        return yield* mfaInternalError("Atomic TOTP login is not configured");
+    }
+    const verifiedAt = yield* currentUnixMillis;
     const result = yield* dependencies.authFlow
-        .completeMfa({
+        .prepareMfa({
         flowId: payload.flowId,
         userId: pending.userId,
         method: "totp",
-        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+        evidence: totpEvidence({
+            factorId: verified.factor.id,
+            acceptedCounter: verified.acceptedCounter,
+            verifiedAt,
+        }),
     })
-        .pipe(Effect.mapError(authFlowMfaHttpError));
+        .pipe(Effect.catch(authFlowMfaHttpFailure));
     if (result._tag === "PolicyDenied") {
-        return yield* mfaPolicyDenied(result.reason);
+        return yield* dependencies.authHttp.commitMfaResult(result);
+    }
+    const committedAt = yield* currentUnixMillis;
+    const committed = yield* dependencies.totpLoginCommitStore
+        .commit({
+        verification: verification.value,
+        factorId: verified.factor.id,
+        userId: pending.userId,
+        counter: verified.acceptedCounter,
+        consumedAt: committedAt,
+        lastUsedAt: committedAt,
+        ...(payload.metadata === undefined
+            ? {}
+            : { factorMetadata: payload.metadata }),
+        ...(result._tag === "PreparedAuthenticated"
+            ? { session: result.prepared.row }
+            : { continuation: "login-approval" }),
+    })
+        .pipe(Effect.catch(() => Effect.succeed(false)));
+    if (!committed) {
+        return yield* mfaInvalidCredentials();
+    }
+    if (result._tag === "PreparedLoginApproval") {
+        const approval = yield* result.complete.pipe(Effect.catch(authFlowMfaHttpFailure));
+        return yield* dependencies.authHttp.commitMfaResult(approval);
     }
-    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+    yield* result.notify;
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.prepared.session);
 });
-export const makeRecoveryCodeMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify")(function* ({ payload, }) {
+export const makeRecoveryCodeMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.recovery_code_verify");
+    yield* requireAuthRateLimit("auth.mfa.recovery_code_verify", handlerRequest);
+    const pending = yield* inspectMfaFlowForFactor(dependencies.authFlowState, payload.flowId, "backup-code");
+    if (pending.userId !== payload.userId) {
+        return yield* mfaInvalidCredentials();
+    }
     const verified = yield* dependencies.recoveryCodeManagement
         .verifyForUser(recoveryCodeMfaVerifyInput(payload))
         .pipe(Effect.mapError(() => mfaInternalError("Failed to verify recovery code MFA factor")));
-    if (!verified.valid) {
+    if (!verified.valid || verified.code === undefined) {
         return yield* mfaInvalidCredentials();
     }
     const result = yield* dependencies.authFlow
@@ -2363,71 +2815,159 @@ export const makeRecoveryCodeMfaVerifyHandler = (dependencies) => Effect.fn("aut
         flowId: payload.flowId,
         userId: payload.userId,
         method: "backup-code",
-        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+        evidence: recoveryCodeEvidence({
+            codeId: verified.code.id,
+            verifiedAt: yield* currentUnixMillis,
+        }),
     })
-        .pipe(Effect.mapError(authFlowMfaHttpError));
-    if (result._tag === "PolicyDenied") {
-        return yield* mfaPolicyDenied(result.reason);
-    }
-    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+        .pipe(Effect.catch(authFlowMfaHttpFailure));
+    return yield* dependencies.authHttp.commitMfaResult(result);
 });
-export const makeRecoveryCodeMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify_for_flow")(function* ({ payload, }) {
+export const makeRecoveryCodeMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify_for_flow")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.recovery_code_verify_for_flow");
-    const pending = yield* dependencies.authFlowState
-        .inspect(payload.flowId)
-        .pipe(Effect.mapError(() => mfaBadRequest()));
+    yield* requireAuthRateLimit("auth.mfa.recovery_code_verify_for_flow", handlerRequest);
+    const pending = yield* inspectMfaFlowForFactor(dependencies.authFlowState, payload.flowId, "backup-code");
+    const user = yield* dependencies.users
+        .findById(pending.userId)
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to load pending MFA user")));
+    if (Option.isNone(user) || user.value.disabledAt !== undefined) {
+        return yield* mfaInvalidCredentials();
+    }
+    const verification = yield* dependencies.verificationStore
+        .findById(ChallengeId(payload.flowId))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to load pending MFA flow")));
+    if (Option.isNone(verification)) {
+        return yield* mfaBadRequest();
+    }
     const verified = yield* dependencies.recoveryCodeManagement
-        .verifyForUser(recoveryCodeMfaVerifyForFlowInput(pending.userId, payload))
+        .identifyForUser(recoveryCodeMfaVerifyForFlowInput(pending.userId, payload))
         .pipe(Effect.mapError(() => mfaInternalError("Failed to verify recovery code MFA factor")));
-    if (!verified.valid) {
+    if (!verified.valid || verified.code === undefined) {
         return yield* mfaInvalidCredentials();
     }
+    if (dependencies.authFlow.prepareMfa === undefined) {
+        return yield* mfaInternalError("Atomic recovery-code login is not configured");
+    }
+    const verifiedAt = yield* currentUnixMillis;
     const result = yield* dependencies.authFlow
-        .completeMfa({
+        .prepareMfa({
         flowId: payload.flowId,
         userId: pending.userId,
         method: "backup-code",
-        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+        evidence: recoveryCodeEvidence({
+            codeId: verified.code.id,
+            verifiedAt,
+        }),
     })
-        .pipe(Effect.mapError(authFlowMfaHttpError));
+        .pipe(Effect.catch(authFlowMfaHttpFailure));
     if (result._tag === "PolicyDenied") {
-        return yield* mfaPolicyDenied(result.reason);
+        return yield* dependencies.authHttp.commitMfaResult(result);
+    }
+    const committedAt = yield* currentUnixMillis;
+    const committed = yield* dependencies.recoveryCodeLoginCommitStore
+        .commit({
+        verification: verification.value,
+        codeId: verified.code.id,
+        userId: pending.userId,
+        consumedAt: committedAt,
+        usedAt: committedAt,
+        ...(payload.metadata === undefined
+            ? {}
+            : { codeMetadata: payload.metadata }),
+        ...(result._tag === "PreparedAuthenticated"
+            ? { session: result.prepared.row }
+            : { continuation: "login-approval" }),
+    })
+        .pipe(Effect.catch(() => Effect.succeed(false)));
+    if (!committed) {
+        return yield* mfaInvalidCredentials();
+    }
+    if (result._tag === "PreparedLoginApproval") {
+        const approval = yield* result.complete.pipe(Effect.catch(authFlowMfaHttpFailure));
+        return yield* dependencies.authHttp.commitMfaResult(approval);
     }
-    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+    yield* result.notify;
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.prepared.session);
 });
-export const makePasskeyMfaStartHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_start")(function* ({ payload, }) {
+export const makePasskeyMfaStartHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_start")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.passkey_start");
+    yield* requireAuthRateLimit("auth.mfa.passkey_start", handlerRequest);
     const pending = yield* dependencies.authFlowState
         .inspect(payload.flowId)
         .pipe(Effect.mapError(() => mfaBadRequest()));
+    if (pending.factors?.some((factor) => factor.type === "passkey") !== true) {
+        return yield* mfaBadRequest();
+    }
     return yield* dependencies.passkeyOptions
         .startAuthentication(passkeyMfaStartInput(pending.userId, payload, dependencies))
         .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey MFA authentication")));
 });
-export const makePasskeyMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_verify")(function* ({ payload, }) {
+export const makePasskeyMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_verify")(function* (handlerRequest) {
+    const { payload } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.passkey_verify");
+    yield* requireAuthRateLimit("auth.mfa.passkey_verify", handlerRequest);
+    const pending = yield* inspectMfaFlowForFactor(dependencies.authFlowState, payload.flowId, "passkey");
     const finished = yield* dependencies.passkeyVerification
-        .finishAuthentication(passkeyMfaVerifyInput(payload, dependencies))
+        .finishAuthentication(passkeyMfaVerifyInput(payload, dependencies, pending.userId))
         .pipe(Effect.mapError(passkeyVerificationHttpError));
+    if (finished.userVerification !== "verified") {
+        return yield* mfaBadRequest();
+    }
     const result = yield* dependencies.authFlow
         .completeMfa({
         flowId: payload.flowId,
         userId: finished.userId,
         method: "passkey",
-        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+        evidence: passkeyEvidence({
+            credentialId: CredentialId(finished.credential.id),
+            verifiedAt: yield* currentUnixMillis,
+            userVerification: finished.userVerification,
+            ...(finished.authenticatorAttachment === undefined
+                ? {}
+                : { authenticatorAttachment: finished.authenticatorAttachment }),
+            ...(finished.backedUp === undefined
+                ? {}
+                : { backedUp: finished.backedUp }),
+            ...(finished.backupEligible === undefined
+                ? {}
+                : { backupEligible: finished.backupEligible }),
+            signCount: finished.signCount,
+            ...(finished.aaguid === undefined ? {} : { aaguid: finished.aaguid }),
+        }),
     })
-        .pipe(Effect.mapError(authFlowMfaHttpError));
-    if (result._tag === "PolicyDenied") {
-        return yield* mfaPolicyDenied(result.reason);
-    }
-    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
-});
-const upgradeStepUpSession = (dependencies, current, method) => upgradeCurrentSession({ method, reason: "step_up" }).pipe(Effect.provideService(CurrentSession, CurrentSession.make(current.currentSession)), Effect.provideService(Sessions, dependencies.sessions), Effect.map(stepUpAuthenticatedHttpBody), Effect.mapError(() => stepUpInternalError("Failed to upgrade current session")));
-export const makeStepUpOptionsHandler = (dependencies) => Effect.fn("auth.http.step_up.options")(function* ({ request, }) {
+        .pipe(Effect.catch(authFlowMfaHttpFailure));
+    return yield* dependencies.authHttp.commitMfaResult(result);
+});
+const upgradeStepUpSession = (dependencies, current, evidence, claims) => dependencies.sessions
+    .assureAndRotate({
+    token: current.issued.token,
+    evidence,
+    claims,
+    reason: "step_up",
+})
+    .pipe(Effect.flatMap((issued) => dependencies.sessionCookie.commit(issued).pipe(Effect.flatMap((cookie) => HttpServerResponse.json(stepUpAuthenticatedHttpBody(issued), {
+    status: 200,
+    headers: { "set-cookie": cookie },
+})))), Effect.mapError(() => stepUpInternalError("Failed to upgrade current session")));
+const reauthenticateStepUpSession = (dependencies, current, evidence) => upgradeStepUpSession(dependencies, current, evidence);
+export const makeStepUpOptionsHandler = (dependencies) => Effect.fn("auth.http.step_up.options")(function* (handlerRequest) {
+    const { request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.options");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.step_up.options", handlerRequest, current.currentSession.userId);
     const { userId } = current.currentSession;
     const factors = [];
+    if (dependencies.credentials !== undefined) {
+        const passwordCredential = yield* dependencies.credentials
+            .findPasswordByUserId(userId)
+            .pipe(Effect.mapError(() => stepUpInternalError("Failed to list step-up options")));
+        if (Option.isSome(passwordCredential) &&
+            passwordCredential.value.revokedAt === undefined) {
+            factors.push({ type: "password" });
+        }
+    }
     if (dependencies.totpFactorManagement !== undefined) {
         const totpFactors = yield* dependencies.totpFactorManagement
             .listForUser({ userId })
@@ -2454,90 +2994,234 @@ export const makeStepUpOptionsHandler = (dependencies) => Effect.fn("auth.http.s
     }
     return { factors };
 });
-export const makeStepUpTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.totp_verify")(function* ({ payload, request, }) {
+export const makeStepUpTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.totp_verify")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.totp_verify");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.step_up.totp_verify", handlerRequest, current.currentSession.userId);
     const verified = yield* dependencies.totpFactorManagement
-        .verifyForUser(stepUpTotpVerifyInput(current.currentSession.userId, payload, dependencies))
+        .identifyForUser(stepUpTotpVerifyInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError(() => stepUpInternalError("Failed to verify TOTP step-up factor")));
     if (!verified.valid) {
         return yield* stepUpInvalidCredentials();
     }
-    return yield* upgradeStepUpSession(dependencies, current, "totp");
+    if (verified.factor === undefined ||
+        verified.acceptedCounter === undefined) {
+        return yield* stepUpInvalidCredentials();
+    }
+    const issued = yield* dependencies.totpSessionRotation
+        .acceptAndRotate({
+        token: current.issued.token,
+        factorId: verified.factor.id,
+        userId: current.currentSession.userId,
+        acceptedCounter: verified.acceptedCounter,
+        expectedAuthenticationEvents: current.currentSession.authenticationEvents,
+        ...(payload.metadata === undefined
+            ? {}
+            : { factorMetadata: payload.metadata }),
+        evidence: totpEvidence({
+            factorId: verified.factor.id,
+            acceptedCounter: verified.acceptedCounter,
+            verifiedAt: yield* currentUnixMillis,
+        }),
+        reason: "step_up",
+    })
+        .pipe(Effect.catch(stepUpRotationHttpFailure));
+    const cookie = yield* dependencies.sessionCookie
+        .commit(issued)
+        .pipe(Effect.mapError(() => stepUpInternalError("Failed to commit upgraded session")));
+    return yield* HttpServerResponse.json(stepUpAuthenticatedHttpBody(issued), {
+        status: 200,
+        headers: { "set-cookie": cookie },
+    }).pipe(Effect.mapError(() => stepUpInternalError("Failed to encode upgraded session")));
+});
+export const makeStepUpPasswordVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.password_verify")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.password_verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.step_up.password_verify", handlerRequest, current.currentSession.userId);
+    const input = stepUpPasswordVerifyInput(payload);
+    const credential = yield* dependencies.credentials
+        .findPasswordByUserId(current.currentSession.userId)
+        .pipe(Effect.mapError(() => stepUpInternalError("Failed to verify password step-up factor")));
+    if (Option.isNone(credential) || credential.value.revokedAt !== undefined) {
+        return yield* stepUpInvalidCredentials();
+    }
+    const verified = yield* dependencies.hasher
+        .verify({ hash: credential.value.passwordHash, password: input.password })
+        .pipe(Effect.mapError(() => stepUpInternalError("Failed to verify password step-up factor")));
+    if (!verified) {
+        return yield* stepUpInvalidCredentials();
+    }
+    return yield* reauthenticateStepUpSession(dependencies, current, passwordEvidence({
+        credentialId: credential.value.id,
+        verifiedAt: yield* currentUnixMillis,
+    }));
 });
-export const makeStepUpRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.recovery_code_verify")(function* ({ payload, request, }) {
+export const makeStepUpRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.recovery_code_verify")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.recovery_code_verify");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.step_up.recovery_code_verify", handlerRequest, current.currentSession.userId);
     const verified = yield* dependencies.recoveryCodeManagement
-        .verifyForUser(stepUpRecoveryCodeVerifyInput(current.currentSession.userId, payload))
+        .identifyForUser(stepUpRecoveryCodeVerifyInput(current.currentSession.userId, payload))
         .pipe(Effect.mapError(() => stepUpInternalError("Failed to verify recovery-code step-up factor")));
     if (!verified.valid) {
         return yield* stepUpInvalidCredentials();
     }
-    return yield* upgradeStepUpSession(dependencies, current, "backup_code");
-});
-export const makeStepUpPasskeyStartHandler = (dependencies) => Effect.fn("auth.http.step_up.passkey_start")(function* ({ payload, request, }) {
+    if (verified.code === undefined) {
+        return yield* stepUpInvalidCredentials();
+    }
+    const evidence = recoveryCodeEvidence({
+        codeId: verified.code.id,
+        verifiedAt: yield* currentUnixMillis,
+    });
+    const issued = yield* dependencies.recoveryCodeSessionRotation
+        .consumeAndRotate({
+        token: current.issued.token,
+        codeId: verified.code.id,
+        userId: current.currentSession.userId,
+        expectedAuthenticationEvents: current.currentSession.authenticationEvents,
+        evidence,
+        claims: withRecoveryRemediationRequirement(current.currentSession.claims, defaultRecoveryRemediationCapabilities),
+        reason: "recovery_code_step_up",
+    })
+        .pipe(Effect.catch(stepUpRotationHttpFailure));
+    const cookie = yield* dependencies.sessionCookie
+        .commit(issued)
+        .pipe(Effect.mapError(() => stepUpInternalError("Failed to commit recovery session")));
+    return yield* HttpServerResponse.json(stepUpAuthenticatedHttpBody(issued), {
+        status: 200,
+        headers: { "set-cookie": cookie },
+    }).pipe(Effect.mapError(() => stepUpInternalError("Failed to encode recovery session")));
+});
+export const makeStepUpPasskeyStartHandler = (dependencies) => Effect.fn("auth.http.step_up.passkey_start")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.passkey_start");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.step_up.passkey_start", handlerRequest, current.currentSession.userId);
     return yield* dependencies.passkeyOptions
         .startAuthentication(stepUpPasskeyStartInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError((error) => error.cause === undefined
         ? stepUpBadRequest()
         : stepUpInternalError("Failed to start passkey step-up")));
 });
-export const makeStepUpPasskeyVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.passkey_verify")(function* ({ payload, request, }) {
+export const makeStepUpPasskeyVerifyHandler = (dependencies) => Effect.fn("auth.http.step_up.passkey_verify")(function* (handlerRequest) {
+    const { payload, request } = handlerRequest;
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "step_up.passkey_verify");
     const current = yield* readRequiredSession(dependencies, request);
+    yield* requireAuthRateLimit("auth.step_up.passkey_verify", handlerRequest, current.currentSession.userId);
     const finished = yield* dependencies.passkeyVerification
         .finishAuthentication(stepUpPasskeyVerifyInput(current.currentSession.userId, payload, dependencies))
         .pipe(Effect.mapError(passkeyVerificationHttpError));
+    if (finished.userVerification !== "verified") {
+        return yield* stepUpPolicyDenied("Passkey user verification was not confirmed");
+    }
     if (finished.userId !== current.currentSession.userId) {
         return yield* stepUpPolicyDenied("Passkey belongs to a different user");
     }
-    return yield* upgradeStepUpSession(dependencies, current, "passkey");
+    return yield* upgradeStepUpSession(dependencies, current, passkeyEvidence({
+        credentialId: CredentialId(finished.credential.id),
+        verifiedAt: yield* currentUnixMillis,
+        userVerification: finished.userVerification,
+        ...(finished.authenticatorAttachment === undefined
+            ? {}
+            : { authenticatorAttachment: finished.authenticatorAttachment }),
+        ...(finished.backedUp === undefined
+            ? {}
+            : { backedUp: finished.backedUp }),
+        ...(finished.backupEligible === undefined
+            ? {}
+            : { backupEligible: finished.backupEligible }),
+        signCount: finished.signCount,
+        ...(finished.aaguid === undefined ? {} : { aaguid: finished.aaguid }),
+    }));
 });
-export const makeLoginApprovalApproveHandler = (dependencies) => Effect.fn("auth.http.login_approval.approve")(function* ({ payload, request, }) {
+export const makeLoginApprovalApproveHandler = (dependencies) => 
+// oxlint-disable-next-line eslint/complexity -- approval preflight intentionally validates every binding before either one-time state is consumed.
+Effect.fn("auth.http.login_approval.approve")(function* ({ payload, request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.approve");
     const input = loginApprovalApproveInput(payload);
-    const approval = yield* dependencies.loginApproval
-        .verify(input.approval)
+    const inspectedApproval = yield* dependencies.loginApproval
+        .inspect(input.approval)
         .pipe(Effect.mapError(() => loginApprovalBadRequest()));
-    const approvedFlowId = metadataString(approval.metadata, "flowId");
+    const approvedFlowId = metadataString(inspectedApproval.metadata, "flowId");
     if (approvedFlowId !== input.flowId) {
         return yield* loginApprovalBadRequest();
     }
-    if (approval.sessionBinding === "none") {
+    if (inspectedApproval.sessionBinding === "none") {
         return yield* loginApprovalNoSessionBindingDenied();
     }
-    const sameDeviceSecret = approval.sameDeviceRequired
+    const sameDeviceSecret = inspectedApproval.sameDeviceRequired
         ? yield* dependencies.loginApprovalPendingCookie
             .read(new Request("http://localhost", { headers: request.headers }))
             .pipe(Effect.flatMap((secret) => Option.isSome(secret)
             ? Effect.succeed(secret.value)
             : Effect.fail(loginApprovalSameDeviceDenied())))
         : undefined;
+    const inspectedFlow = yield* dependencies.authFlowState
+        .inspect(input.flowId, sameDeviceSecret)
+        .pipe(Effect.mapError(() => inspectedApproval.sameDeviceRequired
+        ? loginApprovalSameDeviceDenied()
+        : loginApprovalBadRequest()));
+    if (inspectedFlow.userId !== inspectedApproval.userId) {
+        return yield* loginApprovalBadRequest();
+    }
+    const identity = inspectedApproval.markIdentityVerified === true
+        ? inspectedApproval.identityId === undefined
+            ? Option.none()
+            : yield* dependencies.identities
+                .findById(inspectedApproval.identityId)
+                .pipe(Effect.mapError(() => passwordInternalError("Failed to load identity for verification")))
+        : Option.none();
+    if (inspectedApproval.markIdentityVerified === true &&
+        (Option.isNone(identity) ||
+            identity.value.userId !== inspectedApproval.userId)) {
+        return yield* loginApprovalBadRequest();
+    }
+    const approval = yield* dependencies.loginApproval
+        .verify(input.approval)
+        .pipe(Effect.mapError(() => loginApprovalBadRequest()));
+    if (metadataString(approval.metadata, "flowId") !== input.flowId ||
+        approval.userId !== inspectedApproval.userId ||
+        approval.sessionBinding !== inspectedApproval.sessionBinding ||
+        approval.sameDeviceRequired !== inspectedApproval.sameDeviceRequired ||
+        approval.markIdentityVerified !==
+            inspectedApproval.markIdentityVerified ||
+        approval.identityId !== inspectedApproval.identityId) {
+        return yield* loginApprovalBadRequest();
+    }
     const consumed = yield* dependencies.authFlowState
         .consume(input.flowId, sameDeviceSecret)
         .pipe(Effect.mapError(() => approval.sameDeviceRequired
         ? loginApprovalSameDeviceDenied()
         : loginApprovalBadRequest()));
-    if (consumed.userId !== approval.userId) {
+    if (consumed.userId !== approval.userId ||
+        consumed.userId !== inspectedFlow.userId) {
         return yield* loginApprovalBadRequest();
     }
-    if (approval.markEmailVerified === true) {
-        const updated = yield* dependencies.users
-            .markEmailVerified({
-            userId: approval.userId,
-            updatedAt: yield* currentUnixMillis,
+    if (approval.markIdentityVerified === true) {
+        if (approval.identityId === undefined || Option.isNone(identity)) {
+            return yield* loginApprovalBadRequest();
+        }
+        const updated = yield* dependencies.identities
+            .markVerified({
+            id: approval.identityId,
+            expectedNormalizedValue: identity.value.normalizedValue,
+            verifiedAt: yield* currentUnixMillis,
         })
-            .pipe(Effect.mapError(() => passwordInternalError("Failed to mark email verified")));
+            .pipe(Effect.mapError(() => passwordInternalError("Failed to mark identity verified")));
         if (Option.isNone(updated)) {
             return yield* loginApprovalBadRequest();
         }
     }
-    const result = yield* dependencies.authFlow
-        .complete(consumed)
-        .pipe(Effect.mapError(() => passwordInternalError("Failed to complete login approval")));
+    const result = yield* dependencies
+        .finalizeAuthFlow(consumed)
+        .pipe(Effect.catch((error) => customEvidencePolicyHttpFailure(error, "Failed to complete login approval") ??
+        Effect.fail(passwordInternalError("Failed to complete login approval"))));
+    if (result._tag === "PolicyDenied") {
+        return yield* loginApprovalPolicyDenied();
+    }
     const setCookies = yield* trustedDeviceSetCookies({
         trustedDevice: dependencies.trustedDevice,
         trustedDeviceCookie: dependencies.trustedDeviceCookie,
@@ -2586,9 +3270,10 @@ export const makeLoginApprovalFinalizeHandler = (dependencies) => Effect.fn("aut
             ? { sameDeviceSecret: sameDeviceSecret.value }
             : {}),
     })
-        .pipe(Effect.mapError((error) => error._tag === "AuthFlowStateError"
-        ? loginApprovalSameDeviceDenied()
-        : passwordInternalError("Failed to finalize login approval")));
+        .pipe(Effect.catch((error) => customEvidencePolicyHttpFailure(error, "Failed to finalize login approval") ??
+        Effect.fail(error._tag === "AuthFlowStateError"
+            ? loginApprovalSameDeviceDenied()
+            : passwordInternalError("Failed to finalize login approval"))));
     if (result._tag === "PolicyDenied") {
         return yield* loginApprovalPolicyDenied(result.reason);
     }
@@ -2600,427 +3285,1006 @@ export const makeLoginApprovalFinalizeHandler = (dependencies) => Effect.fn("aut
     });
     return yield* dependencies.authHttp.commitAuthenticatedSession(result.session, { setCookies });
 });
-export class PasswordApi extends HttpApiGroup.make("password")
-    .add(passwordSignInEndpoint.middleware(AuthRateLimitMiddleware), passwordSignUpEndpoint.middleware(AuthRateLimitMiddleware), passwordResetStartEndpoint.middleware(AuthRateLimitMiddleware), passwordResetVerifyEndpoint.middleware(AuthRateLimitMiddleware), passwordSetEndpoint.middleware(AuthOriginCheckMiddleware), passwordChangeEndpoint.middleware(AuthOriginCheckMiddleware))
-    .prefix("/auth/password")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
-}
-export class SessionApi extends HttpApiGroup.make("session")
-    .add(currentSessionEndpoint, refreshSessionEndpoint.middleware(AuthOriginCheckMiddleware), logoutEndpoint.middleware(AuthOriginCheckMiddleware), listSessionsEndpoint, revokeSessionEndpoint.middleware(AuthOriginCheckMiddleware), revokeOtherSessionsEndpoint.middleware(AuthOriginCheckMiddleware))
-    .prefix("/auth") {
-}
-export class AdminSessionApi extends HttpApiGroup.make("adminSession")
+export const SessionHttpOperationsLive = Layer.effect(SessionHttpOperations, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authHttp = yield* AuthHttp;
+    return SessionHttpOperations.of({
+        current: makeCurrentSessionHandler({ sessions, sessionCookie, authHttp }),
+        refresh: makeRefreshSessionHandler({ sessions, sessionCookie, authHttp }),
+        logout: makeLogoutHandler({ sessions, sessionCookie, authHttp }),
+        list: makeListSessionsHandler({ sessions, sessionCookie }),
+        revoke: makeRevokeSessionHandler({ sessions, sessionCookie, authHttp }),
+        revokeOthers: makeRevokeOtherSessionsHandler({ sessions, sessionCookie }),
+    });
+}));
+export const EmailVerificationHttpOperationsLive = Layer.effect(EmailVerificationHttpOperations, Effect.gen(function* () {
+    const emailVerificationFlow = yield* EmailVerificationFlow;
+    const emailVerification = yield* EmailVerification;
+    const identities = yield* IdentityStore;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authRateLimit = yield* AuthRateLimit;
+    const botChallengeVerifier = yield* Effect.serviceOption(BotChallengeVerifier);
+    const guardServices = {
+        authRateLimit,
+        identities,
+        ...(Option.isSome(botChallengeVerifier)
+            ? { botChallengeVerifier: botChallengeVerifier.value }
+            : {}),
+    };
+    return EmailVerificationHttpOperations.of({
+        start: provideRequestGuardServices(guardServices, makeEmailVerificationStartHandler({
+            emailVerificationFlow,
+        })),
+        verify: makeEmailVerificationVerifyHandler({
+            emailVerification,
+            sessions,
+            sessionCookie,
+        }),
+    });
+}));
+export const EmailOtpHttpOperationsLive = Layer.effect(EmailOtpHttpOperations, Effect.gen(function* () {
+    const emailOtp = yield* EmailOtpLogin;
+    const authHttp = yield* AuthHttp;
+    const authRateLimit = yield* AuthRateLimit;
+    const botChallengeVerifier = yield* Effect.serviceOption(BotChallengeVerifier);
+    const cookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    const guardServices = {
+        authRateLimit,
+        ...(Option.isSome(botChallengeVerifier)
+            ? { botChallengeVerifier: botChallengeVerifier.value }
+            : {}),
+        ...(Option.isSome(cookie) ? { trustedDeviceCookie: cookie.value } : {}),
+    };
+    return EmailOtpHttpOperations.of({
+        start: provideRequestGuardServices(guardServices, makeEmailOtpStartHandler({ emailOtp })),
+        verify: provideRequestGuardServices(guardServices, makeEmailOtpVerifyHandler({
+            emailOtp,
+            authHttp,
+        })),
+    });
+}));
+export const EmailAuthHttpOperationsLive = Layer.effect(EmailAuthHttpOperations, Effect.gen(function* () {
+    const emailAuth = yield* EmailAuth;
+    const authRateLimit = yield* AuthRateLimit;
+    const botChallengeVerifier = yield* Effect.serviceOption(BotChallengeVerifier);
+    const guardServices = {
+        authRateLimit,
+        ...(Option.isSome(botChallengeVerifier)
+            ? { botChallengeVerifier: botChallengeVerifier.value }
+            : {}),
+    };
+    return EmailAuthHttpOperations.of({
+        start: provideRequestGuardServices(guardServices, makeEmailAuthStartHandler({ emailAuth })),
+    });
+}));
+export const MagicLinkHttpOperationsLive = Layer.effect(MagicLinkHttpOperations, Effect.gen(function* () {
+    const magicLink = yield* MagicLinkLogin;
+    const authHttp = yield* AuthHttp;
+    const authRateLimit = yield* AuthRateLimit;
+    const botChallengeVerifier = yield* Effect.serviceOption(BotChallengeVerifier);
+    const cookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    const guardServices = {
+        authRateLimit,
+        ...(Option.isSome(botChallengeVerifier)
+            ? { botChallengeVerifier: botChallengeVerifier.value }
+            : {}),
+        ...(Option.isSome(cookie) ? { trustedDeviceCookie: cookie.value } : {}),
+    };
+    return MagicLinkHttpOperations.of({
+        start: provideRequestGuardServices(guardServices, makeMagicLinkStartHandler({ magicLink })),
+        verify: provideRequestGuardServices(guardServices, makeMagicLinkVerifyHandler({
+            magicLink,
+            authHttp,
+        })),
+    });
+}));
+export const PasskeyHttpOperationsLive = Layer.effect(PasskeyHttpOperations, Effect.gen(function* () {
+    const authRateLimit = yield* AuthRateLimit;
+    const config = yield* PasskeyHttpConfig;
+    const passkeyOptions = yield* PasskeyOptions;
+    const passkeyVerification = yield* PasskeyVerification;
+    const passkeyCredentialManagement = yield* PasskeyCredentialManagement;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authHttp = yield* AuthHttp;
+    const users = yield* UserStore;
+    const identities = yield* IdentityStore;
+    const policy = yield* Effect.serviceOption(StrongFactorRemovalPolicy);
+    const resolveUser = makePasskeyRegistrationUserResolver({
+        users,
+        identities,
+    });
+    return PasskeyHttpOperations.of({
+        registerStart: provideHandlerAuthRateLimit(authRateLimit, makePasskeyRegistrationStartHandler({
+            passkeyOptions,
+            sessions,
+            sessionCookie,
+            resolveUser,
+            ...passkeyRegistrationStartHttpOptions(config),
+        })),
+        registerFinish: provideHandlerAuthRateLimit(authRateLimit, makePasskeyRegistrationFinishHandler({
+            passkeyVerification,
+            sessions,
+            sessionCookie,
+            resolveUser,
+            ...passkeyFinishHttpOptions(config),
+        })),
+        authenticateStart: provideHandlerAuthRateLimit(authRateLimit, makePasskeyAuthenticationStartHandler({
+            passkeyOptions,
+            ...passkeyAuthenticationStartHttpOptions(config),
+        })),
+        authenticateFinish: provideHandlerAuthRateLimit(authRateLimit, makePasskeyAuthenticationFinishHandler({
+            passkeyVerification,
+            sessions,
+            authHttp,
+            makeSessionInput: passkeyAuthenticationSessionInput,
+            ...passkeyFinishHttpOptions(config),
+        })),
+        listCredentials: provideHandlerAuthRateLimit(authRateLimit, makePasskeyCredentialListHandler({
+            passkeyCredentialManagement,
+            sessions,
+            sessionCookie,
+        })),
+        revokeCredential: provideHandlerAuthRateLimit(authRateLimit, makePasskeyCredentialRevokeHandler({
+            passkeyCredentialManagement,
+            sessions,
+            sessionCookie,
+            ...(Option.isSome(policy)
+                ? { strongFactorRemovalPolicy: policy.value }
+                : {}),
+        })),
+    });
+}));
+export const IdentityHttpOperationsLive = Layer.effect(IdentityHttpOperations, Effect.gen(function* () {
+    const authRateLimit = yield* AuthRateLimit;
+    const botChallengeVerifier = yield* Effect.serviceOption(BotChallengeVerifier);
+    const identityManagement = yield* IdentityManagement;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const dependencies = {
+        identityManagement,
+        sessions,
+        sessionCookie,
+    };
+    const availabilityGuardServices = {
+        authRateLimit,
+        sessions,
+        sessionCookie,
+        ...(Option.isSome(botChallengeVerifier)
+            ? { botChallengeVerifier: botChallengeVerifier.value }
+            : {}),
+    };
+    return IdentityHttpOperations.of({
+        availability: provideRequestGuardServices(availabilityGuardServices, makeIdentityAvailabilityHandler(dependencies)),
+        list: provideHandlerAuthRateLimit(authRateLimit, makeIdentityListHandler(dependencies)),
+        add: provideHandlerAuthRateLimit(authRateLimit, makeIdentityAddHandler(dependencies)),
+        replace: provideHandlerAuthRateLimit(authRateLimit, makeIdentityReplaceHandler(dependencies)),
+        revoke: provideHandlerAuthRateLimit(authRateLimit, makeIdentityRevokeHandler(dependencies)),
+        primary: provideHandlerAuthRateLimit(authRateLimit, makeIdentityPrimaryHandler(dependencies)),
+    });
+}));
+export const TotpHttpOperationsLive = Layer.effect(TotpHttpOperations, Effect.gen(function* () {
+    const authRateLimit = yield* AuthRateLimit;
+    const config = yield* TotpHttpConfig;
+    const totpFactorManagement = yield* TotpFactorManagement;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const policy = yield* Effect.serviceOption(StrongFactorRemovalPolicy);
+    return TotpHttpOperations.of({
+        startEnrollment: provideHandlerAuthRateLimit(authRateLimit, makeTotpEnrollmentStartHandler({
+            totpFactorManagement,
+            sessions,
+            sessionCookie,
+            ...config,
+        })),
+        confirmEnrollment: provideHandlerAuthRateLimit(authRateLimit, makeTotpEnrollmentConfirmHandler({
+            totpFactorManagement,
+            sessions,
+            sessionCookie,
+            ...config,
+        })),
+        verify: provideHandlerAuthRateLimit(authRateLimit, makeTotpVerifyHandler({
+            totpFactorManagement,
+            sessions,
+            sessionCookie,
+            ...config,
+        })),
+        listFactors: provideHandlerAuthRateLimit(authRateLimit, makeTotpFactorListHandler({
+            totpFactorManagement,
+            sessions,
+            sessionCookie,
+        })),
+        revokeFactor: provideHandlerAuthRateLimit(authRateLimit, makeTotpFactorRevokeHandler({
+            totpFactorManagement,
+            sessions,
+            sessionCookie,
+            ...(Option.isSome(policy)
+                ? { strongFactorRemovalPolicy: policy.value }
+                : {}),
+        })),
+    });
+}));
+export const RecoveryCodesHttpOperationsLive = Layer.effect(RecoveryCodesHttpOperations, Effect.gen(function* () {
+    const authRateLimit = yield* AuthRateLimit;
+    const config = yield* RecoveryCodeHttpConfig;
+    const recoveryCodeManagement = yield* RecoveryCodeManagement;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const policy = yield* Effect.serviceOption(StrongFactorRemovalPolicy);
+    return RecoveryCodesHttpOperations.of({
+        generate: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeGenerateHandler({
+            recoveryCodeManagement,
+            sessions,
+            sessionCookie,
+            ...config,
+        })),
+        regenerate: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeRegenerateHandler({
+            recoveryCodeManagement,
+            sessions,
+            sessionCookie,
+            ...config,
+        })),
+        verify: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeVerifyHandler({
+            recoveryCodeManagement,
+            sessions,
+            sessionCookie,
+        })),
+        list: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeListHandler({
+            recoveryCodeManagement,
+            sessions,
+            sessionCookie,
+        })),
+        revoke: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeRevokeHandler({
+            recoveryCodeManagement,
+            sessions,
+            sessionCookie,
+            ...(Option.isSome(policy)
+                ? { strongFactorRemovalPolicy: policy.value }
+                : {}),
+        })),
+    });
+}));
+export const MfaHttpOperationsLive = Layer.effect(MfaHttpOperations, Effect.gen(function* () {
+    const authRateLimit = yield* AuthRateLimit;
+    const passkeyConfig = yield* PasskeyHttpConfig;
+    const totpConfig = yield* TotpHttpConfig;
+    const authFlowState = yield* AuthFlowState;
+    const authFlow = yield* AuthFlow;
+    const authHttp = yield* AuthHttp;
+    const totpFactorManagement = yield* TotpFactorManagement;
+    const recoveryCodeManagement = yield* RecoveryCodeManagement;
+    const verificationStore = yield* VerificationStore;
+    const recoveryCodeLoginCommitStore = yield* RecoveryCodeLoginCommitStore;
+    const totpLoginCommitStore = yield* TotpLoginCommitStore;
+    const users = yield* UserStore;
+    const passkeyCredentialManagement = yield* PasskeyCredentialManagement;
+    const passkeyOptions = yield* PasskeyOptions;
+    const passkeyVerification = yield* PasskeyVerification;
+    return MfaHttpOperations.of({
+        options: provideHandlerAuthRateLimit(authRateLimit, makeMfaOptionsHandler({
+            authFlowState,
+            totpFactorManagement,
+            recoveryCodeManagement,
+            passkeyCredentialManagement,
+        })),
+        verifyTotp: provideHandlerAuthRateLimit(authRateLimit, makeTotpMfaVerifyHandler({
+            totpFactorManagement,
+            authFlowState,
+            authFlow,
+            authHttp,
+            ...totpConfig,
+        })),
+        verifyTotpForFlow: provideHandlerAuthRateLimit(authRateLimit, makeTotpMfaVerifyForFlowHandler({
+            totpFactorManagement,
+            authFlowState,
+            authFlow,
+            authHttp,
+            verificationStore,
+            totpLoginCommitStore,
+            users,
+            ...totpConfig,
+        })),
+        verifyRecoveryCode: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeMfaVerifyHandler({
+            recoveryCodeManagement,
+            authFlowState,
+            authFlow,
+            authHttp,
+        })),
+        verifyRecoveryCodeForFlow: provideHandlerAuthRateLimit(authRateLimit, makeRecoveryCodeMfaVerifyForFlowHandler({
+            recoveryCodeManagement,
+            authFlowState,
+            authFlow,
+            authHttp,
+            verificationStore,
+            recoveryCodeLoginCommitStore,
+            users,
+        })),
+        startPasskey: provideHandlerAuthRateLimit(authRateLimit, makePasskeyMfaStartHandler({
+            passkeyOptions,
+            authFlowState,
+            ...passkeyAuthenticationStartHttpOptions(passkeyConfig),
+        })),
+        verifyPasskey: provideHandlerAuthRateLimit(authRateLimit, makePasskeyMfaVerifyHandler({
+            passkeyVerification,
+            authFlowState,
+            authFlow,
+            authHttp,
+            ...passkeyFinishHttpOptions(passkeyConfig),
+        })),
+    });
+}));
+export const StepUpHttpOperationsLive = Layer.effect(StepUpHttpOperations, Effect.gen(function* () {
+    const authRateLimit = yield* AuthRateLimit;
+    const passkeyConfig = yield* PasskeyHttpConfig;
+    const totpConfig = yield* TotpHttpConfig;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const totpFactorManagement = yield* TotpFactorManagement;
+    const recoveryCodeManagement = yield* RecoveryCodeManagement;
+    const recoveryCodeSessionRotation = yield* RecoveryCodeSessionRotation;
+    const totpSessionRotation = yield* TotpSessionRotation;
+    const passkeyCredentialManagement = yield* PasskeyCredentialManagement;
+    const passkeyOptions = yield* PasskeyOptions;
+    const passkeyVerification = yield* PasskeyVerification;
+    return StepUpHttpOperations.of({
+        options: provideHandlerAuthRateLimit(authRateLimit, makeStepUpOptionsHandler({
+            sessions,
+            sessionCookie,
+            credentials,
+            totpFactorManagement,
+            recoveryCodeManagement,
+            passkeyCredentialManagement,
+        })),
+        verifyTotp: provideHandlerAuthRateLimit(authRateLimit, makeStepUpTotpVerifyHandler({
+            totpFactorManagement,
+            sessions,
+            sessionCookie,
+            totpSessionRotation,
+            ...totpConfig,
+        })),
+        verifyPassword: provideHandlerAuthRateLimit(authRateLimit, makeStepUpPasswordVerifyHandler({
+            credentials,
+            hasher,
+            sessions,
+            sessionCookie,
+        })),
+        verifyRecoveryCode: provideHandlerAuthRateLimit(authRateLimit, makeStepUpRecoveryCodeVerifyHandler({
+            recoveryCodeManagement,
+            recoveryCodeSessionRotation,
+            sessions,
+            sessionCookie,
+        })),
+        startPasskey: provideHandlerAuthRateLimit(authRateLimit, makeStepUpPasskeyStartHandler({
+            passkeyOptions,
+            sessions,
+            sessionCookie,
+            ...passkeyAuthenticationStartHttpOptions(passkeyConfig),
+        })),
+        verifyPasskey: provideHandlerAuthRateLimit(authRateLimit, makeStepUpPasskeyVerifyHandler({
+            passkeyVerification,
+            sessions,
+            sessionCookie,
+            ...passkeyFinishHttpOptions(passkeyConfig),
+        })),
+    });
+}));
+export const AdminSessionHttpOperationsLive = Layer.effect(AdminSessionHttpOperations, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const authorization = yield* AdminSessionAuthorization;
+    return AdminSessionHttpOperations.of({
+        list: makeAdminSessionListHandler({
+            sessions,
+            sessionCookie,
+            authorization,
+        }),
+        revoke: makeAdminSessionRevokeHandler({
+            sessions,
+            sessionCookie,
+            authorization,
+        }),
+        revokeAll: makeAdminSessionRevokeAllHandler({
+            sessions,
+            sessionCookie,
+            authorization,
+        }),
+    });
+}));
+export const AdminPermissionDefinitionHttpOperationsLive = Layer.succeed(AdminPermissionDefinitionHttpOperations, AdminPermissionDefinitionHttpOperations.of({
+    create: adminPermissionDefinitionCreateOperation,
+    get: adminPermissionDefinitionGetOperation,
+    list: adminPermissionDefinitionListOperation,
+    update: adminPermissionDefinitionUpdateOperation,
+    disable: adminPermissionDefinitionDisableOperation,
+    enable: adminPermissionDefinitionEnableOperation,
+    delete: adminPermissionDefinitionDeleteOperation,
+}));
+export const LoginNotificationHttpOperationsLive = Layer.effect(LoginNotificationHttpOperations, Effect.gen(function* () {
+    const loginNotification = yield* Effect.serviceOption(LoginNotification);
+    return LoginNotificationHttpOperations.of({
+        reportLogin: makeLoginNotificationReportHandler(Option.isSome(loginNotification)
+            ? { loginNotification: loginNotification.value }
+            : {}),
+    });
+}));
+export const SecurityTimelineHttpOperationsLive = Layer.effect(SecurityTimelineHttpOperations, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const securityTimeline = yield* SecurityTimelineStore;
+    return SecurityTimelineHttpOperations.of({
+        list: makeSecurityTimelineListHandler({
+            sessions,
+            sessionCookie,
+            securityTimeline,
+        }),
+    });
+}));
+export const AdminSecurityTimelineHttpOperationsLive = Layer.effect(AdminSecurityTimelineHttpOperations, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const securityTimeline = yield* SecurityTimelineStore;
+    const authorization = yield* AdminSecurityTimelineAuthorization;
+    return AdminSecurityTimelineHttpOperations.of({
+        list: makeAdminSecurityTimelineListHandler({
+            sessions,
+            sessionCookie,
+            securityTimeline,
+            authorization,
+        }),
+    });
+}));
+export const TrustedDeviceHttpOperationsLive = Layer.effect(TrustedDeviceHttpOperations, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const trustedDevices = yield* TrustedDeviceStore;
+    return TrustedDeviceHttpOperations.of({
+        list: makeTrustedDeviceListHandler({
+            sessions,
+            sessionCookie,
+            trustedDevices,
+        }),
+        revoke: makeTrustedDeviceRevokeHandler({
+            sessions,
+            sessionCookie,
+            trustedDevices,
+        }),
+    });
+}));
+export const AdminTrustedDeviceHttpOperationsLive = Layer.effect(AdminTrustedDeviceHttpOperations, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const trustedDevices = yield* TrustedDeviceStore;
+    const authorization = yield* AdminTrustedDeviceAuthorization;
+    return AdminTrustedDeviceHttpOperations.of({
+        list: makeAdminTrustedDeviceListHandler({
+            sessions,
+            sessionCookie,
+            trustedDevices,
+            authorization,
+        }),
+        revoke: makeAdminTrustedDeviceRevokeHandler({
+            sessions,
+            sessionCookie,
+            trustedDevices,
+            authorization,
+        }),
+    });
+}));
+export const OAuthHttpOperationsLive = Layer.effect(OAuthHttpOperations, Effect.gen(function* () {
+    const oauthProviders = yield* OAuthProviders;
+    const oauthState = yield* OAuthState;
+    const oauthAccountUnlinking = yield* OAuthAccountUnlinking;
+    const oauthLinkConfirmation = yield* OAuthLinkConfirmation;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const config = yield* OAuthHttpConfig;
+    return OAuthHttpOperations.of({
+        authorizationStart: makeOAuthAuthorizationStartHandler({
+            oauthProviders,
+            oauthState,
+            ...config,
+        }),
+        accountUnlink: makeOAuthAccountUnlinkHandler({
+            oauthAccountUnlinking,
+            sessions,
+            sessionCookie,
+            ...config,
+        }),
+        linkConfirmationStart: makeOAuthLinkConfirmationStartHandler({
+            oauthLinkConfirmation,
+            ...config,
+        }),
+        linkConfirmationInspect: makeOAuthLinkConfirmationInspectHandler({
+            oauthLinkConfirmation,
+        }),
+        linkConfirmationConfirm: makeOAuthLinkConfirmationConfirmHandler({
+            oauthLinkConfirmation,
+            ...config,
+        }),
+    });
+}));
+export const OAuthProviderAuthorizationHttpOperationsLive = Layer.effect(OAuthProviderAuthorizationHttpOperations, Effect.gen(function* () {
+    const authorization = yield* OAuthProviderAuthorization;
+    return OAuthProviderAuthorizationHttpOperations.of({
+        authorize: makeOAuthProviderAuthorizationHandler({ authorization }),
+    });
+}));
+export const OAuthTokenHttpOperationsLive = Layer.effect(OAuthTokenHttpOperations, Effect.gen(function* () {
+    const tokenGrant = yield* OAuthAuthorizationCodeTokenGrant;
+    const refreshTokenGrant = yield* Effect.serviceOption(OAuthRefreshTokenGrant);
+    const clientCredentialsGrant = yield* Effect.serviceOption(OAuthClientCredentialsGrant);
+    const tokenIntrospection = yield* Effect.serviceOption(OAuthTokenIntrospection);
+    const tokenRevocation = yield* Effect.serviceOption(OAuthTokenRevocation);
+    const config = yield* OAuthTokenHttpConfig;
+    return OAuthTokenHttpOperations.of({
+        token: makeOAuthAuthorizationCodeTokenHandler({
+            tokenGrant,
+            ...config,
+            ...(Option.isSome(refreshTokenGrant)
+                ? { refreshTokenGrant: refreshTokenGrant.value }
+                : {}),
+            ...(Option.isSome(clientCredentialsGrant)
+                ? { clientCredentialsGrant: clientCredentialsGrant.value }
+                : {}),
+        }),
+        introspect: Option.isNone(tokenIntrospection)
+            ? makeOAuthTokenIntrospectionNotConfiguredHandler()
+            : makeOAuthTokenIntrospectionHandler({
+                tokenIntrospection: tokenIntrospection.value,
+                ...config,
+            }),
+        revoke: Option.isNone(tokenRevocation)
+            ? makeOAuthTokenRevocationNotConfiguredHandler()
+            : makeOAuthTokenRevocationHandler({
+                tokenRevocation: tokenRevocation.value,
+                ...config,
+            }),
+    });
+}));
+export const LoginApprovalHttpOperationsLive = Layer.effect(LoginApprovalHttpOperations, Effect.gen(function* () {
+    const loginApproval = yield* LoginApproval;
+    const authFlowState = yield* AuthFlowState;
+    const authFlowFinalizer = yield* AuthFlowFinalizer;
+    const identities = yield* IdentityStore;
+    const authHttp = yield* AuthHttp;
+    const loginApprovalReview = yield* Effect.serviceOption(LoginApprovalReview);
+    const loginApprovalFinalize = yield* Effect.serviceOption(LoginApprovalFinalize);
+    const pendingCookie = yield* Effect.serviceOption(LoginApprovalPendingCookie);
+    const trustedDevice = yield* Effect.serviceOption(TrustedDevice);
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    const loginApprovalPendingCookie = Option.isSome(pendingCookie)
+        ? pendingCookie.value
+        : makeLoginApprovalPendingCookie();
+    return LoginApprovalHttpOperations.of({
+        approve: makeLoginApprovalApproveHandler({
+            loginApproval,
+            authFlowState,
+            finalizeAuthFlow: authFlowFinalizer.complete,
+            identities,
+            authHttp,
+            loginApprovalPendingCookie,
+            ...(Option.isSome(trustedDevice)
+                ? { trustedDevice: trustedDevice.value }
+                : {}),
+            ...(Option.isSome(trustedDeviceCookie)
+                ? { trustedDeviceCookie: trustedDeviceCookie.value }
+                : {}),
+        }),
+        status: makeLoginApprovalStatusHandler(Option.isSome(loginApprovalReview)
+            ? { loginApprovalReview: loginApprovalReview.value }
+            : {}),
+        finalize: makeLoginApprovalFinalizeHandler({
+            authHttp,
+            loginApprovalPendingCookie,
+            ...(Option.isSome(loginApprovalFinalize)
+                ? { loginApprovalFinalize: loginApprovalFinalize.value }
+                : {}),
+            ...(Option.isSome(trustedDevice)
+                ? { trustedDevice: trustedDevice.value }
+                : {}),
+            ...(Option.isSome(trustedDeviceCookie)
+                ? { trustedDeviceCookie: trustedDeviceCookie.value }
+                : {}),
+        }),
+    });
+})).pipe(Layer.provide(AuthFlowFinalizerLive));
+export const ApiKeyHttpOperationsLive = Layer.effect(ApiKeyHttpOperations, Effect.gen(function* () {
+    const apiKeyManagement = yield* ApiKeyManagement;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
+    const dependencies = { apiKeyManagement, sessions, sessionCookie };
+    return ApiKeyHttpOperations.of({
+        create: makeApiKeyCreateHandler(dependencies),
+        list: makeApiKeyListHandler(dependencies),
+        revoke: makeApiKeyRevokeHandler(dependencies),
+    });
+}));
+export const RefreshTokenHttpOperationsLive = Layer.effect(RefreshTokenHttpOperations, Effect.gen(function* () {
+    const refreshTokenManagement = yield* RefreshTokenManagement;
+    const jwtIssuer = yield* JwtIssuer;
+    const config = yield* RefreshTokenHttpConfig;
+    return RefreshTokenHttpOperations.of({
+        refresh: makeRefreshTokenRefreshHandler({
+            refreshTokenManagement,
+            jwtIssuer,
+            ...config,
+        }),
+    });
+}));
+export const JwtHttpOperationsLive = Layer.effect(JwtHttpOperations, Effect.gen(function* () {
+    const jwtRevocation = yield* JwtRevocation;
+    const config = yield* JwtHttpConfig;
+    return JwtHttpOperations.of({
+        introspect: makeJwtIntrospectHandler({ jwtRevocation, ...config }),
+        revoke: makeJwtRevokeHandler({ jwtRevocation }),
+    });
+}));
+export const JwtDiscoveryHttpOperationsLive = Layer.effect(JwtDiscoveryHttpOperations, Effect.gen(function* () {
+    const jwks = yield* Jwks;
+    return JwtDiscoveryHttpOperations.of({
+        jwks: makeJwtJwksHandler({ jwks }),
+    });
+}));
+export const OidcDiscoveryHttpOperationsLive = Layer.effect(OidcDiscoveryHttpOperations, Effect.gen(function* () {
+    const metadata = yield* OidcDiscoveryMetadata;
+    return OidcDiscoveryHttpOperations.of({
+        openidConfiguration: makeOidcDiscoveryMetadataHandler({ metadata }),
+    });
+}));
+export class AdminSessionHttpApiGroup extends HttpApiGroup.make("adminSession")
     .add(adminSessionListEndpoint, adminSessionRevokeEndpoint, adminSessionRevokeAllEndpoint)
     .prefix("/auth/admin/sessions")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class AdminSessionHttpApi extends HttpApi.make("AdminSessionHttpApi").add(AdminSessionApi) {
+export class AdminSessionHttpApi extends HttpApi.make("AdminSessionHttpApi").add(AdminSessionHttpApiGroup) {
 }
-export class EmailVerificationApi extends HttpApiGroup.make("emailVerification")
-    .add(emailVerificationStartEndpoint.middleware(AuthRateLimitMiddleware), emailVerificationVerifyEndpoint)
-    .prefix("/auth/email-verification")
+export class AdminPermissionDefinitionHttpApiGroup extends HttpApiGroup.make("adminPermissionDefinition")
+    .add(adminPermissionDefinitionCreateEndpoint, adminPermissionDefinitionGetEndpoint, adminPermissionDefinitionListEndpoint, adminPermissionDefinitionUpdateEndpoint, adminPermissionDefinitionDisableEndpoint, adminPermissionDefinitionEnableEndpoint, adminPermissionDefinitionDeleteEndpoint)
+    .prefix("/auth/admin")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class EmailOtpApi extends HttpApiGroup.make("emailOtp")
-    .add(emailOtpStartEndpoint.middleware(AuthRateLimitMiddleware), emailOtpVerifyEndpoint.middleware(AuthRateLimitMiddleware))
-    .prefix("/auth/email-otp")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
+export class AdminPermissionDefinitionHttpApi extends HttpApi.make("AdminPermissionDefinitionHttpApi").add(AdminPermissionDefinitionHttpApiGroup) {
 }
-export class MagicLinkApi extends HttpApiGroup.make("magicLink")
-    .add(magicLinkStartEndpoint.middleware(AuthRateLimitMiddleware), magicLinkVerifyEndpoint.middleware(AuthRateLimitMiddleware))
-    .prefix("/auth/magic-link")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
+export class EmailAuthHttpApi extends HttpApi.make("EmailAuthHttpApi").add(EmailAuthHttpApiGroup) {
+}
+export class PasskeyHttpApi extends HttpApi.make("PasskeyHttpApi").add(PasskeyHttpApiGroup) {
+}
+export class IdentityHttpApi extends HttpApi.make("IdentityHttpApi").add(IdentityHttpApiGroup) {
+}
+export class TotpHttpApi extends HttpApi.make("TotpHttpApi").add(TotpHttpApiGroup) {
 }
-export class OAuthApi extends HttpApiGroup.make("oauth")
+export class RecoveryCodesHttpApi extends HttpApi.make("RecoveryCodesHttpApi").add(RecoveryCodesHttpApiGroup) {
+}
+export class OAuthHttpApiGroup extends HttpApiGroup.make("oauth")
     .add(oauthAuthorizationStartEndpoint, oauthAccountUnlinkEndpoint, oauthLinkConfirmationStartEndpoint, oauthLinkConfirmationInspectEndpoint, oauthLinkConfirmationConfirmEndpoint)
     .prefix("/auth/oauth")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class OAuthTokenApi extends HttpApiGroup.make("oauthToken")
+export class OAuthHttpApi extends HttpApi.make("OAuthHttpApi").add(OAuthHttpApiGroup) {
+}
+export class OAuthTokenHttpApiGroup extends HttpApiGroup.make("oauthToken")
     .add(oauthTokenEndpoint, oauthTokenIntrospectionEndpoint, oauthTokenRevocationEndpoint)
     .prefix("/auth/oauth")
     .middleware(AuthSchemaErrorMiddleware) {
 }
-export class OAuthTokenHttpApi extends HttpApi.make("OAuthTokenHttpApi").add(OAuthTokenApi) {
+export class OAuthTokenHttpApi extends HttpApi.make("OAuthTokenHttpApi").add(OAuthTokenHttpApiGroup) {
 }
-export class OAuthProviderAuthorizationApi extends HttpApiGroup.make("oauthProviderAuthorization")
+export class OAuthProviderAuthorizationHttpApiGroup extends HttpApiGroup.make("oauthProviderAuthorization")
     .add(oauthProviderAuthorizeEndpoint)
     .prefix("/auth/oauth")
     .middleware(AuthSchemaErrorMiddleware) {
 }
-export class OAuthProviderAuthorizationHttpApi extends HttpApi.make("OAuthProviderAuthorizationHttpApi").add(OAuthProviderAuthorizationApi) {
+export class OAuthProviderAuthorizationHttpApi extends HttpApi.make("OAuthProviderAuthorizationHttpApi").add(OAuthProviderAuthorizationHttpApiGroup) {
 }
-export class LoginApprovalApi extends HttpApiGroup.make("loginApproval")
-    .add(loginApprovalApproveEndpoint, loginApprovalStatusEndpoint, loginApprovalFinalizeEndpoint)
-    .prefix("/auth/login-approval")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
+export class MfaHttpApi extends HttpApi.make("MfaHttpApi").add(MfaHttpApiGroup) {
 }
-export class MfaApi extends HttpApiGroup.make("mfa")
-    .add(mfaOptionsEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint)
-    .prefix("/auth/mfa")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
+export class StepUpHttpApi extends HttpApi.make("StepUpHttpApi").add(StepUpHttpApiGroup) {
 }
-export class StepUpApi extends HttpApiGroup.make("stepUp")
-    .add(stepUpOptionsEndpoint, stepUpTotpVerifyEndpoint, stepUpRecoveryCodeVerifyEndpoint, stepUpPasskeyStartEndpoint, stepUpPasskeyVerifyEndpoint)
-    .prefix("/auth/step-up")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
-}
-export class ApiKeyApi extends HttpApiGroup.make("apiKey")
+export class ApiKeyHttpApiGroup extends HttpApiGroup.make("apiKey")
     .add(apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint)
     .prefix("/auth/api-keys")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class RefreshTokenApi extends HttpApiGroup.make("refreshToken")
+export class ApiKeyHttpApi extends HttpApi.make("ApiKeyHttpApi").add(ApiKeyHttpApiGroup) {
+}
+export class RefreshTokenHttpApiGroup extends HttpApiGroup.make("refreshToken")
     .add(refreshTokenRefreshEndpoint)
     .prefix("/auth/token")
     .middleware(AuthSchemaErrorMiddleware) {
 }
-export class JwtApi extends HttpApiGroup.make("jwt")
+export class RefreshTokenHttpApi extends HttpApi.make("RefreshTokenHttpApi").add(RefreshTokenHttpApiGroup) {
+}
+export class JwtHttpApiGroup extends HttpApiGroup.make("jwt")
     .add(jwtIntrospectEndpoint, jwtRevokeEndpoint)
     .prefix("/auth/jwt")
     .middleware(AuthSchemaErrorMiddleware) {
 }
-export class JwtDiscoveryApi extends HttpApiGroup.make("jwtDiscovery")
+export class JwtHttpApi extends HttpApi.make("JwtHttpApi").add(JwtHttpApiGroup) {
+}
+export class JwtDiscoveryHttpApiGroup extends HttpApiGroup.make("jwtDiscovery")
     .add(jwtJwksEndpoint)
     .prefix("/.well-known")
     .middleware(AuthSchemaErrorMiddleware) {
 }
-export class JwtDiscoveryHttpApi extends HttpApi.make("JwtDiscoveryHttpApi").add(JwtDiscoveryApi) {
+export class JwtDiscoveryHttpApi extends HttpApi.make("JwtDiscoveryHttpApi").add(JwtDiscoveryHttpApiGroup) {
 }
-export class OidcDiscoveryApi extends HttpApiGroup.make("oidcDiscovery")
+export class OidcDiscoveryHttpApiGroup extends HttpApiGroup.make("oidcDiscovery")
     .add(oidcDiscoveryMetadataEndpoint)
     .prefix("/.well-known")
     .middleware(AuthSchemaErrorMiddleware) {
 }
-export class OidcDiscoveryHttpApi extends HttpApi.make("OidcDiscoveryHttpApi").add(OidcDiscoveryApi) {
-}
-export class SecurityApi extends HttpApiGroup.make("security")
-    .add(loginNotificationReportEndpoint)
-    .prefix("/auth/security")
-    .middleware(AuthSchemaErrorMiddleware)
-    .middleware(AuthOriginCheckMiddleware) {
+export class OidcDiscoveryHttpApi extends HttpApi.make("OidcDiscoveryHttpApi").add(OidcDiscoveryHttpApiGroup) {
 }
-export class SecurityTimelineApi extends HttpApiGroup.make("securityTimeline")
+export class SecurityTimelineHttpApiGroup extends HttpApiGroup.make("securityTimeline")
     .add(securityTimelineListEndpoint)
     .prefix("/auth/security")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class SecurityTimelineHttpApi extends HttpApi.make("SecurityTimelineHttpApi")
-    .add(SecurityTimelineApi) {
+export class SecurityTimelineHttpApi extends HttpApi.make("SecurityTimelineHttpApi").add(SecurityTimelineHttpApiGroup) {
 }
-export class AdminSecurityTimelineApi extends HttpApiGroup.make("adminSecurityTimeline")
+export class AdminSecurityTimelineHttpApiGroup extends HttpApiGroup.make("adminSecurityTimeline")
     .add(adminSecurityTimelineListEndpoint)
     .prefix("/auth/admin/security")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class AdminSecurityTimelineHttpApi extends HttpApi.make("AdminSecurityTimelineHttpApi").add(AdminSecurityTimelineApi) {
+export class AdminSecurityTimelineHttpApi extends HttpApi.make("AdminSecurityTimelineHttpApi").add(AdminSecurityTimelineHttpApiGroup) {
 }
-export class TrustedDeviceApi extends HttpApiGroup.make("trustedDevice")
+export class TrustedDeviceHttpApiGroup extends HttpApiGroup.make("trustedDevice")
     .add(trustedDeviceListEndpoint, trustedDeviceRevokeEndpoint)
     .prefix("/auth/trusted-devices")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class TrustedDeviceHttpApi extends HttpApi.make("TrustedDeviceHttpApi")
-    .add(TrustedDeviceApi) {
+export class TrustedDeviceHttpApi extends HttpApi.make("TrustedDeviceHttpApi").add(TrustedDeviceHttpApiGroup) {
 }
-export class AdminTrustedDeviceApi extends HttpApiGroup.make("adminTrustedDevice")
+export class AdminTrustedDeviceHttpApiGroup extends HttpApiGroup.make("adminTrustedDevice")
     .add(adminTrustedDeviceListEndpoint, adminTrustedDeviceRevokeEndpoint)
     .prefix("/auth/admin/trusted-devices")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
-export class AdminTrustedDeviceHttpApi extends HttpApi.make("AdminTrustedDeviceHttpApi").add(AdminTrustedDeviceApi) {
+export class AdminTrustedDeviceHttpApi extends HttpApi.make("AdminTrustedDeviceHttpApi").add(AdminTrustedDeviceHttpApiGroup) {
 }
-export class AuthApi extends HttpApi.make("AuthApi")
-    .add(PasswordApi)
-    .add(SessionApi)
-    .add(EmailVerificationApi)
-    .add(EmailOtpApi)
-    .add(MagicLinkApi)
-    .add(LoginApprovalApi)
-    .add(SecurityApi) {
+export class CoreAuthHttpApi extends HttpApi.make("AuthApi")
+    .add(PasswordHttpApiGroup)
+    .add(SessionHttpApiGroup)
+    .add(EmailVerificationHttpApiGroup)
+    .add(EmailOtpHttpApiGroup)
+    .add(MagicLinkHttpApiGroup)
+    .add(LoginApprovalHttpApiGroup)
+    .add(LoginNotificationHttpApiGroup) {
 }
-export const PasswordApiLive = HttpApiBuilder.group(AuthApi, "password", Effect.fn("auth.http.password.group")(function* (handlers) {
-    const password = yield* PasswordLogin;
-    const registration = yield* PasswordRegistration;
-    const passwordReset = yield* PasswordReset;
-    const passwordManagement = yield* PasswordManagement;
-    const authHttp = yield* AuthHttp;
-    const emailVerificationFlow = yield* EmailVerificationFlow;
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const authApiRateLimit = yield* AuthApiRateLimit;
-    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+export const CoreAuthPasswordGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "password", passwordGroupHandlers);
+export const CoreAuthSessionGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "session", Effect.fn("auth.http.session.group")(function* (handlers) {
+    const operations = yield* SessionHttpOperations;
     return handlers
-        .handle("signIn", makePasswordSignInHandler({
-        password,
-        authHttp,
-        emailVerificationFlow,
-        authApiRateLimit,
-        ...(Option.isSome(trustedDeviceCookie)
-            ? { trustedDeviceCookie: trustedDeviceCookie.value }
-            : {}),
-    }))
-        .handle("signUp", makePasswordSignUpHandler({
-        registration,
-        authHttp,
-        emailVerificationFlow,
-        authApiRateLimit,
-    }))
-        .handle("resetStart", makePasswordResetStartHandler({
-        passwordReset,
-        authApiRateLimit,
-    }))
-        .handle("resetVerify", makePasswordResetVerifyHandler({
-        passwordReset,
-    }))
-        .handle("set", makePasswordSetHandler({
-        passwordManagement,
-        sessions,
-        sessionCookie,
-    }))
-        .handle("change", makePasswordChangeHandler({
-        passwordManagement,
-        sessions,
-        sessionCookie,
-    }));
+        .handle("current", operations.current)
+        .handle("refresh", operations.refresh)
+        .handle("logout", operations.logout)
+        .handle("list", operations.list)
+        .handle("revoke", operations.revoke)
+        .handle("revokeOthers", operations.revokeOthers);
 }));
-export const SessionApiLive = HttpApiBuilder.group(AuthApi, "session", Effect.fn("auth.http.session.group")(function* (handlers) {
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const authHttp = yield* AuthHttp;
+export const CoreAuthEmailVerificationGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "emailVerification", Effect.fn("auth.http.email_verification.group")(function* (handlers) {
+    const operations = yield* EmailVerificationHttpOperations;
     return handlers
-        .handle("current", makeCurrentSessionHandler({ sessions, sessionCookie, authHttp }))
-        .handle("refresh", makeRefreshSessionHandler({ sessions, sessionCookie, authHttp }))
-        .handle("logout", makeLogoutHandler({ sessions, sessionCookie, authHttp }))
-        .handle("list", makeListSessionsHandler({ sessions, sessionCookie }))
-        .handle("revoke", makeRevokeSessionHandler({ sessions, sessionCookie, authHttp }))
-        .handle("revokeOthers", makeRevokeOtherSessionsHandler({ sessions, sessionCookie }));
+        .handle("start", operations.start)
+        .handle("verify", operations.verify);
 }));
-export const AdminSessionApiLive = HttpApiBuilder.group(AdminSessionHttpApi, "adminSession", Effect.fn("auth.http.admin_session.group")(function* (handlers) {
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const authorization = yield* AdminSessionAuthorization;
+export const CoreAuthEmailOtpGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "emailOtp", Effect.fn("auth.http.email_otp.group")(function* (handlers) {
+    const operations = yield* EmailOtpHttpOperations;
     return handlers
-        .handle("list", makeAdminSessionListHandler({ sessions, sessionCookie, authorization }))
-        .handle("revoke", makeAdminSessionRevokeHandler({ sessions, sessionCookie, authorization }))
-        .handle("revokeAll", makeAdminSessionRevokeAllHandler({
-        sessions,
-        sessionCookie,
-        authorization,
-    }));
+        .handle("start", operations.start)
+        .handle("verify", operations.verify);
 }));
-export const AdminSessionHttpApiLive = HttpApiBuilder.layer(AdminSessionHttpApi).pipe(Layer.provide(AdminSessionApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const EmailVerificationApiLive = HttpApiBuilder.group(AuthApi, "emailVerification", Effect.fn("auth.http.email_verification.group")(function* (handlers) {
-    const emailVerificationFlow = yield* EmailVerificationFlow;
-    const emailVerification = yield* EmailVerification;
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const authApiRateLimit = yield* AuthApiRateLimit;
+export const EmailAuthHttpApiGroupLive = HttpApiBuilder.group(EmailAuthHttpApi, "emailAuth", Effect.fn("auth.http.email.group")(function* (handlers) {
+    const operations = yield* EmailAuthHttpOperations;
+    return handlers.handle("start", operations.start);
+}));
+export const CoreAuthMagicLinkGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "magicLink", Effect.fn("auth.http.magic_link.group")(function* (handlers) {
+    const operations = yield* MagicLinkHttpOperations;
     return handlers
-        .handle("start", makeEmailVerificationStartHandler({
-        emailVerificationFlow,
-        authApiRateLimit,
-    }))
-        .handle("verify", makeEmailVerificationVerifyHandler({
-        emailVerification,
-        sessions,
-        sessionCookie,
-    }));
+        .handle("start", operations.start)
+        .handle("verify", operations.verify);
 }));
-export const EmailOtpApiLive = HttpApiBuilder.group(AuthApi, "emailOtp", Effect.fn("auth.http.email_otp.group")(function* (handlers) {
-    const emailOtp = yield* EmailOtpLogin;
-    const authHttp = yield* AuthHttp;
-    const authApiRateLimit = yield* AuthApiRateLimit;
-    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+export const PasskeyHttpApiGroupLive = HttpApiBuilder.group(PasskeyHttpApi, "passkey", Effect.fn("auth.http.passkey.group")(function* (handlers) {
+    const operations = yield* PasskeyHttpOperations;
     return handlers
-        .handle("start", makeEmailOtpStartHandler({ emailOtp, authApiRateLimit }))
-        .handle("verify", makeEmailOtpVerifyHandler({
-        emailOtp,
-        authHttp,
-        ...(Option.isSome(trustedDeviceCookie)
-            ? { trustedDeviceCookie: trustedDeviceCookie.value }
-            : {}),
-    }));
+        .handle("registerStart", operations.registerStart)
+        .handle("registerFinish", operations.registerFinish)
+        .handle("authenticateStart", operations.authenticateStart)
+        .handle("authenticateFinish", operations.authenticateFinish)
+        .handle("listCredentials", operations.listCredentials)
+        .handle("revokeCredential", operations.revokeCredential);
 }));
-export const MagicLinkApiLive = HttpApiBuilder.group(AuthApi, "magicLink", Effect.fn("auth.http.magic_link.group")(function* (handlers) {
-    const magicLink = yield* MagicLinkLogin;
-    const authHttp = yield* AuthHttp;
-    const authApiRateLimit = yield* AuthApiRateLimit;
-    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+export const IdentityHttpApiGroupLive = HttpApiBuilder.group(IdentityHttpApi, "identity", Effect.fn("auth.http.identity.group")(function* (handlers) {
+    const operations = yield* IdentityHttpOperations;
     return handlers
-        .handle("start", makeMagicLinkStartHandler({ magicLink, authApiRateLimit }))
-        .handle("verify", makeMagicLinkVerifyHandler({
-        magicLink,
-        authHttp,
-        ...(Option.isSome(trustedDeviceCookie)
-            ? { trustedDeviceCookie: trustedDeviceCookie.value }
-            : {}),
-    }));
+        .handle("availability", operations.availability)
+        .handle("list", operations.list)
+        .handle("add", operations.add)
+        .handle("replace", operations.replace)
+        .handle("revoke", operations.revoke)
+        .handle("primary", operations.primary);
 }));
-export const LoginApprovalApiLive = HttpApiBuilder.group(AuthApi, "loginApproval", Effect.fn("auth.http.login_approval.group")(function* (handlers) {
-    const loginApproval = yield* LoginApproval;
-    const authFlowState = yield* AuthFlowState;
-    const authFlow = yield* AuthFlow;
-    const users = yield* UserStore;
-    const authHttp = yield* AuthHttp;
-    const loginApprovalReview = yield* Effect.serviceOption(LoginApprovalReview);
-    const loginApprovalFinalize = yield* Effect.serviceOption(LoginApprovalFinalize);
-    const pendingCookieOption = yield* Effect.serviceOption(LoginApprovalPendingCookie);
-    const trustedDevice = yield* Effect.serviceOption(TrustedDevice);
-    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
-    const loginApprovalPendingCookie = Option.isSome(pendingCookieOption)
-        ? pendingCookieOption.value
-        : makeLoginApprovalPendingCookie();
+export const TotpHttpApiGroupLive = HttpApiBuilder.group(TotpHttpApi, "totp", Effect.fn("auth.http.totp.group")(function* (handlers) {
+    const operations = yield* TotpHttpOperations;
     return handlers
-        .handle("approve", makeLoginApprovalApproveHandler({
-        loginApproval,
-        authFlowState,
-        authFlow,
-        users,
-        authHttp,
-        loginApprovalPendingCookie,
-        ...(Option.isSome(trustedDevice)
-            ? { trustedDevice: trustedDevice.value }
-            : {}),
-        ...(Option.isSome(trustedDeviceCookie)
-            ? { trustedDeviceCookie: trustedDeviceCookie.value }
-            : {}),
-    }))
-        .handle("status", makeLoginApprovalStatusHandler(Option.isSome(loginApprovalReview)
-        ? { loginApprovalReview: loginApprovalReview.value }
-        : {}))
-        .handle("finalize", makeLoginApprovalFinalizeHandler({
-        authHttp,
-        loginApprovalPendingCookie,
-        ...(Option.isSome(loginApprovalFinalize)
-            ? { loginApprovalFinalize: loginApprovalFinalize.value }
-            : {}),
-        ...(Option.isSome(trustedDevice)
-            ? { trustedDevice: trustedDevice.value }
-            : {}),
-        ...(Option.isSome(trustedDeviceCookie)
-            ? { trustedDeviceCookie: trustedDeviceCookie.value }
-            : {}),
-    }));
+        .handle("startEnrollment", operations.startEnrollment)
+        .handle("confirmEnrollment", operations.confirmEnrollment)
+        .handle("verify", operations.verify)
+        .handle("listFactors", operations.listFactors)
+        .handle("revokeFactor", operations.revokeFactor);
 }));
-export const SecurityApiLive = HttpApiBuilder.group(AuthApi, "security", Effect.fn("auth.http.security.group")(function* (handlers) {
-    const loginNotification = yield* Effect.serviceOption(LoginNotification);
-    return handlers.handle("reportLogin", makeLoginNotificationReportHandler(Option.isSome(loginNotification)
-        ? { loginNotification: loginNotification.value }
-        : {}));
+export const RecoveryCodesHttpApiGroupLive = HttpApiBuilder.group(RecoveryCodesHttpApi, "recoveryCodes", Effect.fn("auth.http.recovery_codes.group")(function* (handlers) {
+    const operations = yield* RecoveryCodesHttpOperations;
+    return handlers
+        .handle("generateRecoveryCodes", operations.generate)
+        .handle("regenerateRecoveryCodes", operations.regenerate)
+        .handle("verifyRecoveryCode", operations.verify)
+        .handle("listRecoveryCodes", operations.list)
+        .handle("revokeRecoveryCode", operations.revoke);
 }));
-export const SecurityTimelineApiLive = HttpApiBuilder.group(SecurityTimelineHttpApi, "securityTimeline", Effect.fn("auth.http.security_timeline.group")(function* (handlers) {
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const securityTimeline = yield* SecurityTimelineStore;
-    return handlers.handle("list", makeSecurityTimelineListHandler({
-        sessions,
-        sessionCookie,
-        securityTimeline,
-    }));
+export const MfaHttpApiGroupLive = HttpApiBuilder.group(MfaHttpApi, "mfa", Effect.fn("auth.http.mfa.group")(function* (handlers) {
+    const operations = yield* MfaHttpOperations;
+    return handlers
+        .handle("options", operations.options)
+        .handle("verifyTotp", operations.verifyTotp)
+        .handle("verifyTotpForFlow", operations.verifyTotpForFlow)
+        .handle("verifyRecoveryCode", operations.verifyRecoveryCode)
+        .handle("verifyRecoveryCodeForFlow", operations.verifyRecoveryCodeForFlow)
+        .handle("startPasskey", operations.startPasskey)
+        .handle("verifyPasskey", operations.verifyPasskey);
 }));
-export const SecurityTimelineHttpApiLive = HttpApiBuilder.layer(SecurityTimelineHttpApi).pipe(Layer.provide(SecurityTimelineApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const OAuthProviderAuthorizationApiLive = HttpApiBuilder.group(OAuthProviderAuthorizationHttpApi, "oauthProviderAuthorization", Effect.fn("auth.http.oauth_provider_authorization.group")(function* (handlers) {
-    const authorization = yield* OAuthProviderAuthorization;
-    return handlers.handle("authorize", makeOAuthProviderAuthorizationHandler({ authorization }));
+export const StepUpHttpApiGroupLive = HttpApiBuilder.group(StepUpHttpApi, "stepUp", Effect.fn("auth.http.step_up.group")(function* (handlers) {
+    const operations = yield* StepUpHttpOperations;
+    return handlers
+        .handle("options", operations.options)
+        .handle("verifyTotp", operations.verifyTotp)
+        .handle("verifyPassword", operations.verifyPassword)
+        .handle("verifyRecoveryCode", operations.verifyRecoveryCode)
+        .handle("startPasskey", operations.startPasskey)
+        .handle("verifyPasskey", operations.verifyPasskey);
 }));
-export const OAuthProviderAuthorizationHttpApiLive = HttpApiBuilder.layer(OAuthProviderAuthorizationHttpApi).pipe(Layer.provide(OAuthProviderAuthorizationApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const OAuthTokenApiLive = HttpApiBuilder.group(OAuthTokenHttpApi, "oauthToken", Effect.fn("auth.http.oauth_token.group")(function* (handlers) {
-    const tokenGrant = yield* OAuthAuthorizationCodeTokenGrant;
-    const refreshTokenGrant = yield* Effect.serviceOption(OAuthRefreshTokenGrant);
-    const clientCredentialsGrant = yield* Effect.serviceOption(OAuthClientCredentialsGrant);
-    const tokenIntrospection = yield* Effect.serviceOption(OAuthTokenIntrospection);
-    const tokenRevocation = yield* Effect.serviceOption(OAuthTokenRevocation);
+export const OAuthHttpApiGroupLive = HttpApiBuilder.group(OAuthHttpApi, "oauth", Effect.fn("auth.http.oauth.group")(function* (handlers) {
+    const operations = yield* OAuthHttpOperations;
     return handlers
-        .handle("token", makeOAuthAuthorizationCodeTokenHandler({
-        tokenGrant,
-        ...(Option.isNone(refreshTokenGrant)
-            ? {}
-            : { refreshTokenGrant: refreshTokenGrant.value }),
-        ...(Option.isNone(clientCredentialsGrant)
-            ? {}
-            : { clientCredentialsGrant: clientCredentialsGrant.value }),
-    }))
-        .handle("introspect", Option.isNone(tokenIntrospection)
-        ? makeOAuthTokenIntrospectionNotConfiguredHandler()
-        : makeOAuthTokenIntrospectionHandler({
-            tokenIntrospection: tokenIntrospection.value,
-        }))
-        .handle("revoke", Option.isNone(tokenRevocation)
-        ? makeOAuthTokenRevocationNotConfiguredHandler()
-        : makeOAuthTokenRevocationHandler({
-            tokenRevocation: tokenRevocation.value,
-        }));
+        .handle("startAuthorization", operations.authorizationStart)
+        .handle("unlinkAccount", operations.accountUnlink)
+        .handle("startLinkConfirmation", operations.linkConfirmationStart)
+        .handle("inspectLinkConfirmation", operations.linkConfirmationInspect)
+        .handle("confirmLinkConfirmation", operations.linkConfirmationConfirm);
 }));
-export const OAuthTokenHttpApiLive = HttpApiBuilder.layer(OAuthTokenHttpApi).pipe(Layer.provide(OAuthTokenApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const JwtDiscoveryApiLive = HttpApiBuilder.group(JwtDiscoveryHttpApi, "jwtDiscovery", Effect.fn("auth.http.jwt_discovery.group")(function* (handlers) {
-    const jwks = yield* Jwks;
-    return handlers.handle("jwks", makeJwtJwksHandler({ jwks }));
+export const OAuthHttpApiLive = HttpApiBuilder.layer(OAuthHttpApi).pipe(Layer.provide(OAuthHttpApiGroupLive), Layer.provide(OAuthHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const ApiKeyHttpApiGroupLive = HttpApiBuilder.group(ApiKeyHttpApi, "apiKey", Effect.fn("auth.http.api_key.group")(function* (handlers) {
+    const operations = yield* ApiKeyHttpOperations;
+    return handlers
+        .handle("createApiKey", operations.create)
+        .handle("listApiKeys", operations.list)
+        .handle("revokeApiKey", operations.revoke);
 }));
-export const JwtDiscoveryHttpApiLive = HttpApiBuilder.layer(JwtDiscoveryHttpApi).pipe(Layer.provide(JwtDiscoveryApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const OidcDiscoveryApiLive = HttpApiBuilder.group(OidcDiscoveryHttpApi, "oidcDiscovery", Effect.fn("auth.http.oidc_discovery.group")(function* (handlers) {
-    const metadata = yield* OidcDiscoveryMetadata;
-    return handlers.handle("openidConfiguration", makeOidcDiscoveryMetadataHandler({ metadata }));
+export const ApiKeyHttpApiLive = HttpApiBuilder.layer(ApiKeyHttpApi).pipe(Layer.provide(ApiKeyHttpApiGroupLive), Layer.provide(ApiKeyHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const RefreshTokenHttpApiGroupLive = HttpApiBuilder.group(RefreshTokenHttpApi, "refreshToken", Effect.fn("auth.http.refresh_token.group")(function* (handlers) {
+    const operations = yield* RefreshTokenHttpOperations;
+    return handlers.handle("refresh", operations.refresh);
 }));
-export const OidcDiscoveryHttpApiLive = HttpApiBuilder.layer(OidcDiscoveryHttpApi).pipe(Layer.provide(OidcDiscoveryApiLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const AdminSecurityTimelineApiLive = HttpApiBuilder.group(AdminSecurityTimelineHttpApi, "adminSecurityTimeline", Effect.fn("auth.http.admin_security_timeline.group")(function* (handlers) {
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const securityTimeline = yield* SecurityTimelineStore;
-    const authorization = yield* AdminSecurityTimelineAuthorization;
-    return handlers.handle("list", makeAdminSecurityTimelineListHandler({
-        sessions,
-        sessionCookie,
-        securityTimeline,
-        authorization,
-    }));
+export const RefreshTokenHttpApiLive = HttpApiBuilder.layer(RefreshTokenHttpApi).pipe(Layer.provide(RefreshTokenHttpApiGroupLive), Layer.provide(RefreshTokenHttpOperationsLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const JwtHttpApiGroupLive = HttpApiBuilder.group(JwtHttpApi, "jwt", Effect.fn("auth.http.jwt.group")(function* (handlers) {
+    const operations = yield* JwtHttpOperations;
+    return handlers
+        .handle("introspect", operations.introspect)
+        .handle("revoke", operations.revoke);
 }));
-export const AdminSecurityTimelineHttpApiLive = HttpApiBuilder.layer(AdminSecurityTimelineHttpApi).pipe(Layer.provide(AdminSecurityTimelineApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const TrustedDeviceApiLive = HttpApiBuilder.group(TrustedDeviceHttpApi, "trustedDevice", Effect.fn("auth.http.trusted_device.group")(function* (handlers) {
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const trustedDevices = yield* TrustedDeviceStore;
+export const JwtHttpApiLive = HttpApiBuilder.layer(JwtHttpApi).pipe(Layer.provide(JwtHttpApiGroupLive), Layer.provide(JwtHttpOperationsLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminSessionHttpApiGroupLive = HttpApiBuilder.group(AdminSessionHttpApi, "adminSession", Effect.fn("auth.http.admin_session.group")(function* (handlers) {
+    const operations = yield* AdminSessionHttpOperations;
     return handlers
-        .handle("list", makeTrustedDeviceListHandler({ sessions, sessionCookie, trustedDevices }))
-        .handle("revoke", makeTrustedDeviceRevokeHandler({ sessions, sessionCookie, trustedDevices }));
+        .handle("list", operations.list)
+        .handle("revoke", operations.revoke)
+        .handle("revokeAll", operations.revokeAll);
 }));
-export const TrustedDeviceHttpApiLive = HttpApiBuilder.layer(TrustedDeviceHttpApi).pipe(Layer.provide(TrustedDeviceApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const AdminTrustedDeviceApiLive = HttpApiBuilder.group(AdminTrustedDeviceHttpApi, "adminTrustedDevice", Effect.fn("auth.http.admin_trusted_device.group")(function* (handlers) {
-    const sessions = yield* Sessions;
-    const sessionCookie = yield* SessionCookie;
-    const trustedDevices = yield* TrustedDeviceStore;
-    const authorization = yield* AdminTrustedDeviceAuthorization;
+export const AdminSessionHttpApiLive = HttpApiBuilder.layer(AdminSessionHttpApi).pipe(Layer.provide(AdminSessionHttpApiGroupLive), Layer.provide(AdminSessionHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminPermissionDefinitionHttpApiGroupLive = HttpApiBuilder.group(AdminPermissionDefinitionHttpApi, "adminPermissionDefinition", Effect.fn("auth.http.admin_permission_definition.group")(function* (handlers) {
+    const operations = yield* AdminPermissionDefinitionHttpOperations;
+    // The standalone API installs a router middleware that provides these
+    // operation requirements for every request.
+    const create = operations.create;
+    const get = operations.get;
+    const list = operations.list;
+    const update = operations.update;
+    const disable = operations.disable;
+    const enable = operations.enable;
+    const remove = operations.delete;
     return handlers
-        .handle("list", makeAdminTrustedDeviceListHandler({
-        sessions,
-        sessionCookie,
-        trustedDevices,
-        authorization,
-    }))
-        .handle("revoke", makeAdminTrustedDeviceRevokeHandler({
-        sessions,
-        sessionCookie,
-        trustedDevices,
-        authorization,
-    }));
+        .handle("create", create)
+        .handle("get", get)
+        .handle("list", list)
+        .handle("update", update)
+        .handle("disable", disable)
+        .handle("enable", enable)
+        .handle("delete", remove);
+}));
+export const AdminPermissionDefinitionHttpRequirementsLive = HttpRouter.middleware()(Effect.gen(function* () {
+    const context = yield* Effect.context();
+    return (httpEffect) => httpEffect.pipe(Effect.provide(context));
+}), { global: true });
+export const AdminPermissionDefinitionHttpApiLive = Layer.merge(HttpApiBuilder.layer(AdminPermissionDefinitionHttpApi).pipe(Layer.provide(AdminPermissionDefinitionHttpApiGroupLive), Layer.provide(AdminPermissionDefinitionHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive)), AdminPermissionDefinitionHttpRequirementsLive);
+export const EmailAuthHttpApiLive = HttpApiBuilder.layer(EmailAuthHttpApi).pipe(Layer.provide(EmailAuthHttpApiGroupLive), Layer.provide(EmailAuthHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const PasskeyHttpApiLive = HttpApiBuilder.layer(PasskeyHttpApi).pipe(Layer.provide(PasskeyHttpApiGroupLive), Layer.provide(PasskeyHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const IdentityHttpApiLive = HttpApiBuilder.layer(IdentityHttpApi).pipe(Layer.provide(IdentityHttpApiGroupLive), Layer.provide(IdentityHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const TotpHttpApiLive = HttpApiBuilder.layer(TotpHttpApi).pipe(Layer.provide(TotpHttpApiGroupLive), Layer.provide(TotpHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const RecoveryCodesHttpApiLive = HttpApiBuilder.layer(RecoveryCodesHttpApi).pipe(Layer.provide(RecoveryCodesHttpApiGroupLive), Layer.provide(RecoveryCodesHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const MfaHttpApiLive = HttpApiBuilder.layer(MfaHttpApi).pipe(Layer.provide(MfaHttpApiGroupLive), Layer.provide(MfaHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const StepUpHttpApiLive = HttpApiBuilder.layer(StepUpHttpApi).pipe(Layer.provide(StepUpHttpApiGroupLive), Layer.provide(StepUpHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const CoreAuthLoginApprovalGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "loginApproval", Effect.fn("auth.http.login_approval.group")(function* (handlers) {
+    const operations = yield* LoginApprovalHttpOperations;
+    return handlers
+        .handle("approve", operations.approve)
+        .handle("status", operations.status)
+        .handle("finalize", operations.finalize);
+}));
+export const CoreAuthLoginNotificationGroupLive = HttpApiBuilder.group(CoreAuthHttpApi, "security", Effect.fn("auth.http.security.group")(function* (handlers) {
+    const operations = yield* LoginNotificationHttpOperations;
+    return handlers.handle("reportLogin", operations.reportLogin);
+}));
+export const SecurityTimelineHttpApiGroupLive = HttpApiBuilder.group(SecurityTimelineHttpApi, "securityTimeline", Effect.fn("auth.http.security_timeline.group")(function* (handlers) {
+    const operations = yield* SecurityTimelineHttpOperations;
+    return handlers.handle("list", operations.list);
+}));
+export const SecurityTimelineHttpApiLive = HttpApiBuilder.layer(SecurityTimelineHttpApi).pipe(Layer.provide(SecurityTimelineHttpApiGroupLive), Layer.provide(SecurityTimelineHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OAuthProviderAuthorizationHttpApiGroupLive = HttpApiBuilder.group(OAuthProviderAuthorizationHttpApi, "oauthProviderAuthorization", Effect.fn("auth.http.oauth_provider_authorization.group")(function* (handlers) {
+    const operations = yield* OAuthProviderAuthorizationHttpOperations;
+    return handlers.handle("authorize", operations.authorize);
+}));
+export const OAuthProviderAuthorizationHttpApiLive = HttpApiBuilder.layer(OAuthProviderAuthorizationHttpApi).pipe(Layer.provide(OAuthProviderAuthorizationHttpApiGroupLive), Layer.provide(OAuthProviderAuthorizationHttpOperationsLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OAuthTokenHttpApiGroupLive = HttpApiBuilder.group(OAuthTokenHttpApi, "oauthToken", Effect.fn("auth.http.oauth_token.group")(function* (handlers) {
+    const operations = yield* OAuthTokenHttpOperations;
+    return handlers
+        .handle("token", operations.token)
+        .handle("introspect", operations.introspect)
+        .handle("revoke", operations.revoke);
+}));
+export const OAuthTokenHttpApiLive = HttpApiBuilder.layer(OAuthTokenHttpApi).pipe(Layer.provide(OAuthTokenHttpApiGroupLive), Layer.provide(OAuthTokenHttpOperationsLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const JwtDiscoveryHttpApiGroupLive = HttpApiBuilder.group(JwtDiscoveryHttpApi, "jwtDiscovery", Effect.fn("auth.http.jwt_discovery.group")(function* (handlers) {
+    const operations = yield* JwtDiscoveryHttpOperations;
+    return handlers.handle("jwks", operations.jwks);
+}));
+export const JwtDiscoveryHttpApiLive = HttpApiBuilder.layer(JwtDiscoveryHttpApi).pipe(Layer.provide(JwtDiscoveryHttpApiGroupLive), Layer.provide(JwtDiscoveryHttpOperationsLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const OidcDiscoveryHttpApiGroupLive = HttpApiBuilder.group(OidcDiscoveryHttpApi, "oidcDiscovery", Effect.fn("auth.http.oidc_discovery.group")(function* (handlers) {
+    const operations = yield* OidcDiscoveryHttpOperations;
+    return handlers.handle("openidConfiguration", operations.openidConfiguration);
+}));
+export const OidcDiscoveryHttpApiLive = HttpApiBuilder.layer(OidcDiscoveryHttpApi).pipe(Layer.provide(OidcDiscoveryHttpApiGroupLive), Layer.provide(OidcDiscoveryHttpOperationsLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminSecurityTimelineHttpApiGroupLive = HttpApiBuilder.group(AdminSecurityTimelineHttpApi, "adminSecurityTimeline", Effect.fn("auth.http.admin_security_timeline.group")(function* (handlers) {
+    const operations = yield* AdminSecurityTimelineHttpOperations;
+    return handlers.handle("list", operations.list);
+}));
+export const AdminSecurityTimelineHttpApiLive = HttpApiBuilder.layer(AdminSecurityTimelineHttpApi).pipe(Layer.provide(AdminSecurityTimelineHttpApiGroupLive), Layer.provide(AdminSecurityTimelineHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const TrustedDeviceHttpApiGroupLive = HttpApiBuilder.group(TrustedDeviceHttpApi, "trustedDevice", Effect.fn("auth.http.trusted_device.group")(function* (handlers) {
+    const operations = yield* TrustedDeviceHttpOperations;
+    return handlers
+        .handle("list", operations.list)
+        .handle("revoke", operations.revoke);
+}));
+export const TrustedDeviceHttpApiLive = HttpApiBuilder.layer(TrustedDeviceHttpApi).pipe(Layer.provide(TrustedDeviceHttpApiGroupLive), Layer.provide(TrustedDeviceHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const AdminTrustedDeviceHttpApiGroupLive = HttpApiBuilder.group(AdminTrustedDeviceHttpApi, "adminTrustedDevice", Effect.fn("auth.http.admin_trusted_device.group")(function* (handlers) {
+    const operations = yield* AdminTrustedDeviceHttpOperations;
+    return handlers
+        .handle("list", operations.list)
+        .handle("revoke", operations.revoke);
 }));
-export const AdminTrustedDeviceHttpApiLive = HttpApiBuilder.layer(AdminTrustedDeviceHttpApi).pipe(Layer.provide(AdminTrustedDeviceApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-const AuthHttpApiBaseLive = HttpApiBuilder.layer(AuthApi).pipe(Layer.provide(PasswordApiLive), Layer.provide(SessionApiLive), Layer.provide(EmailVerificationApiLive), Layer.provide(EmailOtpApiLive), Layer.provide(MagicLinkApiLive), Layer.provide(LoginApprovalApiLive), Layer.provide(SecurityApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
-export const AuthHttpApiBareLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitNoopLive));
-export const AuthHttpApiLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitLive));
+export const AdminTrustedDeviceHttpApiLive = HttpApiBuilder.layer(AdminTrustedDeviceHttpApi).pipe(Layer.provide(AdminTrustedDeviceHttpApiGroupLive), Layer.provide(AdminTrustedDeviceHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+const CoreAuthHttpApiBaseLive = HttpApiBuilder.layer(CoreAuthHttpApi).pipe(Layer.provide(CoreAuthPasswordGroupLive), Layer.provide(CoreAuthSessionGroupLive), Layer.provide(CoreAuthEmailVerificationGroupLive), Layer.provide(CoreAuthEmailOtpGroupLive), Layer.provide(CoreAuthMagicLinkGroupLive), Layer.provide(CoreAuthLoginApprovalGroupLive), Layer.provide(CoreAuthLoginNotificationGroupLive), Layer.provide(PasswordHttpOperationsLive), Layer.provide(SessionHttpOperationsLive), Layer.provide(EmailVerificationHttpOperationsLive), Layer.provide(EmailOtpHttpOperationsLive), Layer.provide(MagicLinkHttpOperationsLive), Layer.provide(LoginApprovalHttpOperationsLive), Layer.provide(LoginNotificationHttpOperationsLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const CoreAuthHttpApiLive = CoreAuthHttpApiBaseLive.pipe(Layer.provide(BotProtectionNoopLive));
 export { AuthResult };
 //# sourceMappingURL=Api.js.map