@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/HttpApi/Schemas.d.ts

@@ -1,24 +1,186 @@
 import { Schema } from "effect";
+export declare const IdentityScopeHttpBody: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"global">;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"tenant">;
+    readonly tenantId: Schema.String;
+}>]>;
+export declare const LoginIdentityHttpBody: Schema.Struct<{
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly kind: Schema.String;
+    readonly value: Schema.String;
+}>;
+export declare const BotChallengeHttpBody: Schema.Struct<{
+    readonly token: Schema.String;
+}>;
+export declare const IdentityAvailabilityBody: Schema.Struct<{
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly kind: Schema.String;
+    readonly value: Schema.String;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
+}>;
+export declare const IdentityAvailabilityResultBody: Schema.Struct<{
+    readonly available: Schema.Boolean;
+}>;
+export declare const IdentityHttpBody: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly kind: Schema.String;
+    readonly value: Schema.String;
+    readonly verified: Schema.Boolean;
+    readonly loginEligible: Schema.Boolean;
+    readonly isPrimaryLogin: Schema.Boolean;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>;
+export declare const IdentitiesBody: Schema.Struct<{
+    readonly identities: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.brand<Schema.String, "auth/IdentityId">;
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+        readonly verified: Schema.Boolean;
+        readonly loginEligible: Schema.Boolean;
+        readonly isPrimaryLogin: Schema.Boolean;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    }>>;
+}>;
+export declare const IdentityAddBody: Schema.Struct<{
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly kind: Schema.String;
+    readonly value: Schema.String;
+}>;
+export declare const IdentityReplaceBody: Schema.Struct<{
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly kind: Schema.String;
+    readonly value: Schema.String;
+}>;
+export declare const IdentityRevokeBody: Schema.Struct<{
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly reason: Schema.optional<Schema.String>;
+}>;
+export declare const IdentityPrimaryBody: Schema.Struct<{
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>;
+export declare const LoginRiskDeviceFingerprintBody: Schema.Struct<{
+    readonly userAgentFamily: Schema.optional<Schema.String>;
+    readonly platform: Schema.optional<Schema.String>;
+    readonly timezone: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly screenClass: Schema.optional<Schema.Literals<readonly ["small", "medium", "large"]>>;
+    readonly appDeviceId: Schema.optional<Schema.String>;
+}>;
 export declare const PasswordSignInBody: Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly password: Schema.String;
+    readonly deviceFingerprint: Schema.optional<Schema.Struct<{
+        readonly userAgentFamily: Schema.optional<Schema.String>;
+        readonly platform: Schema.optional<Schema.String>;
+        readonly timezone: Schema.optional<Schema.String>;
+        readonly locale: Schema.optional<Schema.String>;
+        readonly screenClass: Schema.optional<Schema.Literals<readonly ["small", "medium", "large"]>>;
+        readonly appDeviceId: Schema.optional<Schema.String>;
+    }>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const PasswordSignUpBody: Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly password: Schema.String;
-    readonly emailVerified: Schema.optional<Schema.Boolean>;
+    readonly deviceFingerprint: Schema.optional<Schema.Struct<{
+        readonly userAgentFamily: Schema.optional<Schema.String>;
+        readonly platform: Schema.optional<Schema.String>;
+        readonly timezone: Schema.optional<Schema.String>;
+        readonly locale: Schema.optional<Schema.String>;
+        readonly screenClass: Schema.optional<Schema.Literals<readonly ["small", "medium", "large"]>>;
+        readonly appDeviceId: Schema.optional<Schema.String>;
+    }>>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const PasswordResetStartBody: Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly secret: Schema.optional<Schema.String>;
     readonly locale: Schema.optional<Schema.String>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const PasswordResetVerifyBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
     readonly password: Schema.String;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const PasswordSetBody: Schema.Struct<{
     readonly password: Schema.String;
@@ -29,43 +191,131 @@ export declare const PasswordChangeBody: Schema.Struct<{
     readonly newPassword: Schema.String;
 }>;
 export declare const EmailVerificationStartBody: Schema.Struct<{
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
     readonly secret: Schema.optional<Schema.String>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const EmailVerificationVerifyBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
 }>;
 export declare const EmailOtpStartBody: Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly secret: Schema.optional<Schema.String>;
     readonly locale: Schema.optional<Schema.String>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const EmailOtpStartedBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
 }>;
 export declare const EmailOtpVerifyBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
+}>;
+export declare const EmailAuthStartBody: Schema.Struct<{
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
+    readonly emailOtpSecret: Schema.optional<Schema.String>;
+    readonly magicLinkSecret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
+}>;
+export declare const EmailAuthStartedBody: Schema.Struct<{
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
+    readonly emailOtp: Schema.Struct<{
+        readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    }>;
+    readonly magicLink: Schema.Struct<{
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    }>;
 }>;
 export declare const MagicLinkStartBody: Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly secret: Schema.optional<Schema.String>;
     readonly locale: Schema.optional<Schema.String>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const MagicLinkStartedBody: Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly identity: Schema.Struct<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }>;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
 }>;
 export declare const MagicLinkVerifyBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
+    readonly botChallenge: Schema.optional<Schema.Struct<{
+        readonly token: Schema.String;
+    }>>;
 }>;
 export declare const OAuthAuthorizationStartBody: Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
@@ -344,15 +594,9 @@ export declare const PasskeyClientCredentialBody: Schema.Struct<{
     readonly authenticatorAttachment: Schema.optional<Schema.String>;
     readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>;
-export declare const PasskeyRegistrationStartBody: Schema.Struct<{
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly userName: Schema.String;
-    readonly userDisplayName: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>;
+export declare const PasskeyRegistrationStartBody: Schema.Struct<{}>;
 export declare const PasskeyRegistrationFinishBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly credential: Schema.Struct<{
         readonly id: Schema.String;
         readonly rawId: Schema.optional<Schema.String>;
@@ -361,7 +605,6 @@ export declare const PasskeyRegistrationFinishBody: Schema.Struct<{
         readonly authenticatorAttachment: Schema.optional<Schema.String>;
         readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>;
 export declare const PasskeyAuthenticationStartBody: Schema.Struct<{
     readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
@@ -586,6 +829,7 @@ export declare const TotpVerifyResultBody: Schema.Struct<{
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
     readonly delta: Schema.optional<Schema.Number>;
+    readonly acceptedCounter: Schema.optional<Schema.Number>;
 }>;
 export declare const TotpFactorsBody: Schema.Struct<{
     readonly factors: Schema.$Array<Schema.Struct<{
@@ -603,6 +847,10 @@ export declare const TotpFactorsBody: Schema.Struct<{
 export declare const RecoveryCodeGenerateBody: Schema.Struct<{
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>;
+export declare const RecoveryCodeRegenerateBody: Schema.Struct<{
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly revokeReason: Schema.optional<Schema.String>;
+}>;
 export declare const RecoveryCodeVerifyBody: Schema.Struct<{
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
@@ -837,17 +1085,21 @@ export declare const MfaOptionsResultBody: Schema.Struct<{
     }>>;
 }>;
 export declare const StepUpFactorOptionBody: Schema.Struct<{
-    readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
+    readonly type: Schema.Literals<readonly ["password", "totp", "backup-code", "passkey"]>;
 }>;
 export declare const StepUpOptionsResultBody: Schema.Struct<{
     readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
+        readonly type: Schema.Literals<readonly ["password", "totp", "backup-code", "passkey"]>;
     }>>;
 }>;
 export declare const StepUpTotpVerifyBody: Schema.Struct<{
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>;
+export declare const StepUpPasswordVerifyBody: Schema.Struct<{
+    readonly password: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>;
 export declare const StepUpRecoveryCodeVerifyBody: Schema.Struct<{
     readonly code: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
@@ -905,8 +1157,11 @@ export declare const LoginApprovalFinalizeBody: Schema.Struct<{
     readonly rememberDevice: Schema.optional<Schema.Boolean>;
 }>;
 export declare const SessionClaimsHttpBody: Schema.Struct<{
-    readonly emailVerified: Schema.optional<Schema.Boolean>;
+    readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
     readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+        readonly allowed: Schema.$Array<Schema.String>;
+    }>>;
 }>;
 export declare const AuthenticatedHttpBody: Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
@@ -915,8 +1170,11 @@ export declare const AuthenticatedHttpBody: Schema.Struct<{
     readonly amr: Schema.$Array<Schema.String>;
     readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+            readonly allowed: Schema.$Array<Schema.String>;
+        }>>;
     }>>;
 }>;
 export declare const CurrentSessionHttpBody: Schema.Struct<{
@@ -929,8 +1187,11 @@ export declare const CurrentSessionHttpBody: Schema.Struct<{
     readonly amr: Schema.$Array<Schema.String>;
     readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+            readonly allowed: Schema.$Array<Schema.String>;
+        }>>;
     }>>;
 }>;
 export declare const ActiveSessionHttpBody: Schema.Struct<{
@@ -945,8 +1206,11 @@ export declare const ActiveSessionHttpBody: Schema.Struct<{
     readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly current: Schema.Boolean;
     readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+            readonly allowed: Schema.$Array<Schema.String>;
+        }>>;
     }>>;
     readonly ip: Schema.optional<Schema.String>;
     readonly userAgent: Schema.optional<Schema.String>;
@@ -970,8 +1234,11 @@ export declare const ActiveSessionsHttpBody: Schema.Struct<{
         readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly current: Schema.Boolean;
         readonly claims: Schema.optional<Schema.Struct<{
-            readonly emailVerified: Schema.optional<Schema.Boolean>;
+            readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
             readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+            readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+                readonly allowed: Schema.$Array<Schema.String>;
+            }>>;
         }>>;
         readonly ip: Schema.optional<Schema.String>;
         readonly userAgent: Schema.optional<Schema.String>;
@@ -1034,12 +1301,57 @@ export declare const AdminSessionRevokeBody: Schema.Struct<{
 export declare const AdminSessionRevokeAllBody: Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
 }>;
+export declare const AdminPermissionDefinitionHttpBody: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>;
+export declare const AdminPermissionDefinitionsHttpBody: Schema.Struct<{
+    readonly definitions: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+        readonly description: Schema.optional<Schema.String>;
+        readonly scopeType: Schema.optional<Schema.String>;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    }>>;
+    readonly nextAfter: Schema.optional<Schema.brand<Schema.String, "auth/PermissionId">>;
+}>;
+export declare const AdminPermissionDefinitionCreateBody: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>;
+export declare const AdminPermissionDefinitionGetQuery: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+}>;
+export declare const AdminPermissionDefinitionListQuery: Schema.Struct<{
+    readonly includeDisabled: Schema.optional<Schema.Union<readonly [Schema.Boolean, Schema.decodeTo<Schema.Boolean, Schema.Literals<readonly ["true", "false"]>, never, never>]>>;
+    readonly includeDeleted: Schema.optional<Schema.Union<readonly [Schema.Boolean, Schema.decodeTo<Schema.Boolean, Schema.Literals<readonly ["true", "false"]>, never, never>]>>;
+    readonly after: Schema.optional<Schema.brand<Schema.String, "auth/PermissionId">>;
+    readonly limit: Schema.optional<Schema.Union<readonly [Schema.Number, Schema.NumberFromString]>>;
+}>;
+export declare const AdminPermissionDefinitionUpdateBody: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly description: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly scopeType: Schema.optional<Schema.NullOr<Schema.String>>;
+}>;
+export declare const AdminPermissionDefinitionMutationBody: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>;
 export declare const LoginNotificationReportBody: Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.String;
 }>;
-export declare const SecurityTimelineEventTypeBody: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-export declare const SecurityTimelineEventCategoryBody: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+export declare const SecurityTimelineEventTypeBody: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+export declare const SecurityTimelineEventCategoryBody: Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
 export declare const SecurityTimelineEventSeverityBody: Schema.Literals<readonly ["info", "warning", "critical"]>;
 export declare const SecurityTimelineActorBody: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"anonymous">;
@@ -1053,8 +1365,8 @@ export declare const SecurityTimelineRequestBody: Schema.Struct<{
 }>;
 export declare const SecurityTimelineEventBody: Schema.Struct<{
     readonly eventId: Schema.String;
-    readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-    readonly category: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+    readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+    readonly category: Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
     readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
     readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
     readonly summary: Schema.String;
@@ -1073,8 +1385,8 @@ export declare const SecurityTimelineEventBody: Schema.Struct<{
 export declare const SecurityTimelineEventsBody: Schema.Struct<{
     readonly events: Schema.$Array<Schema.Struct<{
         readonly eventId: Schema.String;
-        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-        readonly category: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+        readonly category: Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
         readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
         readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly summary: Schema.String;
@@ -1094,15 +1406,15 @@ export declare const SecurityTimelineEventsBody: Schema.Struct<{
 export declare const SecurityTimelineListQuery: Schema.Struct<{
     readonly limit: Schema.optional<Schema.Number>;
     readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
 }>;
 export declare const AdminSecurityTimelineListQuery: Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly limit: Schema.optional<Schema.Number>;
     readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
 }>;
 export declare const TrustedDeviceHttpBody: Schema.Struct<{
     readonly deviceId: Schema.String;
@@ -1134,12 +1446,13 @@ export declare const RequiresMfaHttpBody: Schema.Struct<{
     readonly type: Schema.Literal<"requires_mfa">;
     readonly flowId: Schema.String;
     readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
+        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
 }>;
 export declare const RequiresEmailVerificationHttpBody: Schema.Struct<{
     readonly type: Schema.Literal<"requires_email_verification">;
     readonly flowId: Schema.String;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
 }>;
 export declare const RequiresLoginApprovalHttpBody: Schema.Struct<{
     readonly type: Schema.Literal<"requires_login_approval">;
@@ -1158,56 +1471,19 @@ export declare const RequiresPasskeyEnrollmentHttpBody: Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
 }>;
-export declare const PasswordAuthSuccess: Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_mfa">;
-    readonly flowId: Schema.String;
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_email_verification">;
-    readonly flowId: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_login_approval">;
-    readonly flowId: Schema.String;
-    readonly approvalChallengeId: Schema.String;
-    readonly channel: Schema.String;
-    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: Schema.Boolean;
-    readonly reason: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_passkey_enrollment">;
-    readonly flowId: Schema.String;
-}>]>;
-export declare const EmailOtpAuthSuccess: Schema.Union<readonly [Schema.Struct<{
+export declare const MfaAuthSuccess: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
     readonly expiresAt: Schema.Number;
     readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: Schema.$Array<Schema.String>;
     readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+            readonly allowed: Schema.$Array<Schema.String>;
+        }>>;
     }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_mfa">;
-    readonly flowId: Schema.String;
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_email_verification">;
-    readonly flowId: Schema.String;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_login_approval">;
     readonly flowId: Schema.String;
@@ -1216,29 +1492,30 @@ export declare const EmailOtpAuthSuccess: Schema.Union<readonly [Schema.Struct<{
     readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
     readonly sameDeviceRequired: Schema.Boolean;
     readonly reason: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_passkey_enrollment">;
-    readonly flowId: Schema.String;
 }>]>;
-export declare const MagicLinkAuthSuccess: Schema.Union<readonly [Schema.Struct<{
+export declare const PrimaryAuthSuccess: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
     readonly expiresAt: Schema.Number;
     readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: Schema.$Array<Schema.String>;
     readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly verifiedIdentityKinds: Schema.optional<Schema.$Array<Schema.String>>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly recoveryEnrollment: Schema.optional<Schema.Struct<{
+            readonly allowed: Schema.$Array<Schema.String>;
+        }>>;
     }>>;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_mfa">;
     readonly flowId: Schema.String;
     readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
+        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_email_verification">;
     readonly flowId: Schema.String;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_login_approval">;
     readonly flowId: Schema.String;