@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/Client.js

@@ -1,8 +1,27 @@
 import { Effect, Layer, ManagedRuntime, Schema } from "effect";
 import { FetchHttpClient, HttpClient } from "effect/unstable/http";
-import { HttpApiClient } from "effect/unstable/httpapi";
-import { AdminSecurityTimelineListQuery, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminSessionsHttpBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, AuthApi, AuthUnauthenticatedError, ActiveSessionsHttpBody, ApiKeyCreateBody, ApiKeyCreatedBody, ApiKeysBody, ApiKeyRevokeBody, AuthenticatedHttpBody, CurrentSessionHttpBody, EmailOtpStartedBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, LoginApprovalReviewStatusHttpBody, JwtIntrospectBody, JwtIntrospectionBody, JwtJwksBody, JwtRevokeBody, MagicLinkStartedBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaOptionsBody, MfaOptionsResultBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationStartedBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyAuthenticationStartedBody, PasskeyCredentialRevokeBody, PasskeyCredentialsBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegisteredBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasskeyRegistrationStartedBody, PasswordChangeBody, PasswordAuthSuccess, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RefreshTokenRefreshedBody, RecoveryCodeRevokeBody, RecoveryCodesBody, RecoveryCodesGeneratedBody, RecoveryCodeVerifyBody, RecoveryCodeVerifyResultBody, SecurityTimelineEventsBody, SecurityTimelineListQuery, StepUpOptionsResultBody, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TrustedDevicesBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartedBody, TotpEnrollmentStartBody, TotpFactorHttpBody, TotpFactorRevokeBody, TotpFactorsBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody, TotpVerifyResultBody, } from "./HttpApi.js";
+import { HttpApi, HttpApiClient, HttpApiGroup } from "effect/unstable/httpapi";
+import { AuthClientProtocolApi } from "./HttpApi/ClientApi.js";
+import { AuthHttpError, AuthUnauthenticatedError } from "./HttpApi/Errors.js";
+import { AdminSecurityTimelineListQuery, AdminPermissionDefinitionCreateBody, AdminPermissionDefinitionGetQuery, AdminPermissionDefinitionHttpBody, AdminPermissionDefinitionListQuery, AdminPermissionDefinitionMutationBody, AdminPermissionDefinitionsHttpBody, AdminPermissionDefinitionUpdateBody, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminSessionsHttpBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, ActiveSessionsHttpBody, ApiKeyCreateBody, ApiKeyCreatedBody, ApiKeysBody, ApiKeyRevokeBody, AuthenticatedHttpBody, CurrentSessionHttpBody, IdentitiesBody, IdentityAddBody, IdentityAvailabilityBody, IdentityAvailabilityResultBody, IdentityHttpBody, IdentityPrimaryBody, IdentityReplaceBody, IdentityRevokeBody, EmailAuthStartedBody, EmailAuthStartBody, EmailOtpStartedBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, LoginApprovalReviewStatusHttpBody, JwtIntrospectBody, JwtIntrospectionBody, JwtJwksBody, JwtRevokeBody, MagicLinkStartedBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaAuthSuccess, MfaOptionsBody, MfaOptionsResultBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationStartedBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyAuthenticationStartedBody, PasskeyCredentialRevokeBody, PasskeyCredentialsBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegisteredBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasskeyRegistrationStartedBody, PasswordChangeBody, PrimaryAuthSuccess, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeRegenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RefreshTokenRefreshedBody, RecoveryCodeRevokeBody, RecoveryCodesBody, RecoveryCodesGeneratedBody, RecoveryCodeVerifyBody, RecoveryCodeVerifyResultBody, SecurityTimelineEventsBody, SecurityTimelineListQuery, StepUpOptionsResultBody, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpPasswordVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TrustedDevicesBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartedBody, TotpEnrollmentStartBody, TotpFactorHttpBody, TotpFactorRevokeBody, TotpFactorsBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody, TotpVerifyResultBody, } from "./HttpApi/Schemas.js";
+import { createPasskeyCredential, getPasskeyCredential, isPasskeySupported, } from "./PasskeyBrowser.js";
+export const makeAuthHttpClient = (options = {}) => HttpApiClient.make(AuthClientProtocolApi, { baseUrl: options.baseUrl });
+const AuthHttpApiExtensionTypeId = Symbol.for("@effect-auth/core/Client/AuthHttpApiExtension");
+export const defineAuthHttpApiExtension = (api, make) => ({
+    [AuthHttpApiExtensionTypeId]: (runtime) => {
+        const clientEffect = HttpApiClient.make(api, {
+            baseUrl: runtime.baseUrl,
+        });
+        return make({
+            run: (use, options) => runtime.run(Effect.flatMap(clientEffect, use), options),
+        });
+    },
+});
 const defaultRequestInit = { credentials: "include" };
+const defaultEmailAuthPrefix = "/auth/email";
+const defaultEmailAuthClientPaths = {
+    start: "/start",
+};
 const defaultPasskeyPrefix = "/auth/passkey";
 const defaultPasskeyClientPaths = {
     registrationStart: "/register/start",
@@ -12,6 +31,15 @@ const defaultPasskeyClientPaths = {
     credentialList: "/credentials",
     credentialRevoke: "/credentials/revoke",
 };
+const defaultIdentityPrefix = "/auth/identities";
+const defaultIdentityClientPaths = {
+    availability: "/availability",
+    list: "/",
+    add: "/add",
+    replace: "/replace",
+    revoke: "/revoke",
+    primary: "/primary",
+};
 const defaultTotpPrefix = "/auth/totp";
 const defaultTotpClientPaths = {
     enrollmentStart: "/enroll/start",
@@ -23,6 +51,7 @@ const defaultTotpClientPaths = {
 const defaultRecoveryCodePrefix = "/auth/recovery-codes";
 const defaultRecoveryCodeClientPaths = {
     generate: "/generate",
+    regenerate: "/regenerate",
     verify: "/verify",
     list: "/codes",
     revoke: "/codes/revoke",
@@ -61,6 +90,7 @@ const defaultStepUpPrefix = "/auth/step-up";
 const defaultStepUpClientPaths = {
     options: "/options",
     totpVerify: "/totp/verify",
+    passwordVerify: "/password/verify",
     recoveryCodeVerify: "/recovery-code/verify",
     passkeyStart: "/passkey/start",
     passkeyVerify: "/passkey/verify",
@@ -79,6 +109,16 @@ const defaultAdminSessionClientPaths = {
     revoke: "/revoke",
     revokeAll: "/revoke-all",
 };
+const defaultAdminPermissionDefinitionPrefix = "/auth/admin/permission-definitions";
+const defaultAdminPermissionDefinitionClientPaths = {
+    create: "/",
+    get: "/get",
+    list: "/",
+    update: "/update",
+    disable: "/disable",
+    enable: "/enable",
+    delete: "/delete",
+};
 const defaultTrustedDevicePrefix = "/auth/trusted-devices";
 const defaultTrustedDeviceClientPaths = {
     list: "/",
@@ -110,7 +150,7 @@ const joinPath = (prefix, path) => {
         ? `/${normalizedPath}`
         : `${normalizedPrefix}/${normalizedPath}`;
 };
-const clientUrl = (baseUrl, path) => (baseUrl === undefined ? path : String(new URL(path, baseUrl)));
+const clientUrl = (baseUrl, path) => baseUrl === undefined ? path : String(new URL(path, baseUrl));
 const pathWithSearch = (path, searchParams) => {
     const search = searchParams.toString();
     if (search.length === 0) {
@@ -132,10 +172,10 @@ const responseJson = async (response) => {
 };
 const throwFailedResponse = async (response) => {
     const body = await responseJson(response);
-    throw body ?? {
+    throw (body ?? {
         code: `http_${response.status}`,
         message: response.statusText || "Request failed",
-    };
+    });
 };
 const requestHeaders = (requestInit, body) => {
     const headers = new Headers(requestInit.headers);
@@ -157,6 +197,110 @@ export const authClientErrorMessage = (error) => {
     }
     return error instanceof Error ? error.message : "Request failed";
 };
+export const isAuthApiError = Schema.is(AuthHttpError);
+export const authClientErrorStatus = (error) => {
+    if (!isAuthApiError(error)) {
+        return undefined;
+    }
+    switch (error.code) {
+        case "bad_request": {
+            return 400;
+        }
+        case "invalid_credentials":
+        case "unauthenticated": {
+            return 401;
+        }
+        case "policy_denied":
+        case "request_rejected":
+        case "step_up_required": {
+            return 403;
+        }
+        case "identity_already_registered":
+        case "conflict": {
+            return 409;
+        }
+        case "not_found": {
+            return 404;
+        }
+        case "rate_limited": {
+            return 429;
+        }
+        case "internal_error": {
+            return 500;
+        }
+    }
+};
+export const isAuthenticated = (response) => response.type === "authenticated";
+export const createEmailAuthClient = (options = {}) => {
+    const requestInit = {
+        ...defaultRequestInit,
+        ...options.requestInit,
+    };
+    const fetch = options.fetch ?? globalThis.fetch;
+    const prefix = options.prefix ?? defaultEmailAuthPrefix;
+    const paths = {
+        ...defaultEmailAuthClientPaths,
+        ...options.paths,
+    };
+    const url = (path) => clientUrl(options.baseUrl, joinPath(prefix, path));
+    const decodeEmailAuthStart = Schema.decodeUnknownEffect(EmailAuthStartBody);
+    const decodeEmailAuthStarted = Schema.decodeUnknownEffect(EmailAuthStartedBody);
+    const decode = (effect) => Effect.runPromise(effect);
+    const request = async (path, body, requestOptions, decodeResponse) => {
+        const response = await fetch(url(path), {
+            ...requestInit,
+            method: "POST",
+            headers: requestHeaders(requestInit, body),
+            body: JSON.stringify(body),
+            signal: requestOptions?.signal,
+        });
+        if (!response.ok) {
+            return throwFailedResponse(response);
+        }
+        return decode(decodeResponse(await responseJson(response)));
+    };
+    return {
+        start: async (input, requestOptions) => {
+            const payload = await decode(decodeEmailAuthStart(input));
+            return request(paths.start, payload, requestOptions, decodeEmailAuthStarted);
+        },
+    };
+};
+export const createIdentityClient = (options = {}) => {
+    const requestInit = {
+        ...defaultRequestInit,
+        ...options.requestInit,
+    };
+    const fetch = options.fetch ?? globalThis.fetch;
+    const prefix = options.prefix ?? defaultIdentityPrefix;
+    const paths = {
+        ...defaultIdentityClientPaths,
+        ...options.paths,
+    };
+    const url = (path) => clientUrl(options.baseUrl, joinPath(prefix, path));
+    const request = async (method, path, body, signal, schema) => {
+        const response = await fetch(url(path), {
+            ...requestInit,
+            method,
+            headers: requestHeaders(requestInit, body),
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal,
+        });
+        if (!response.ok) {
+            return throwFailedResponse(response);
+        }
+        return Effect.runPromise(Schema.decodeUnknownEffect(schema)(await responseJson(response)));
+    };
+    const post = async (path, input, requestOptions, inputSchema, outputSchema) => request("POST", path, await Effect.runPromise(Schema.decodeUnknownEffect(inputSchema)(input)), requestOptions?.signal, outputSchema);
+    return {
+        availability: (input, requestOptions) => post(paths.availability, input, requestOptions, IdentityAvailabilityBody, IdentityAvailabilityResultBody),
+        list: (requestOptions) => request("GET", paths.list, undefined, requestOptions?.signal, IdentitiesBody),
+        add: (input, requestOptions) => post(paths.add, input, requestOptions, IdentityAddBody, IdentityHttpBody),
+        replace: (input, requestOptions) => post(paths.replace, input, requestOptions, IdentityReplaceBody, IdentityHttpBody),
+        revoke: (input, requestOptions) => post(paths.revoke, input, requestOptions, IdentityRevokeBody, IdentityHttpBody),
+        primary: (input, requestOptions) => post(paths.primary, input, requestOptions, IdentityPrimaryBody, IdentityHttpBody),
+    };
+};
 export const createPasskeyClient = (options = {}) => {
     const requestInit = {
         ...defaultRequestInit,
@@ -207,7 +351,7 @@ export const createPasskeyClient = (options = {}) => {
     };
     return {
         registration: {
-            start: async (input, requestOptions) => request("POST", paths.registrationStart, await decode(decodePasskeyRegistrationStart(input)), requestOptions, decodePasskeyRegistrationStarted),
+            start: async (input, requestOptions) => request("POST", paths.registrationStart, await decode(decodePasskeyRegistrationStart(input ?? {})), requestOptions, decodePasskeyRegistrationStarted),
             finish: async (input, requestOptions) => request("POST", paths.registrationFinish, await decode(decodePasskeyRegistrationFinish(input)), requestOptions, decodePasskeyRegistered),
         },
         authentication: {
@@ -293,6 +437,7 @@ export const createRecoveryCodeClient = (options = {}) => {
     };
     const url = (path) => clientUrl(options.baseUrl, joinPath(prefix, path));
     const decodeRecoveryCodeGenerate = Schema.decodeUnknownEffect(RecoveryCodeGenerateBody);
+    const decodeRecoveryCodeRegenerate = Schema.decodeUnknownEffect(RecoveryCodeRegenerateBody);
     const decodeRecoveryCodeVerify = Schema.decodeUnknownEffect(RecoveryCodeVerifyBody);
     const decodeRecoveryCodeRevoke = Schema.decodeUnknownEffect(RecoveryCodeRevokeBody);
     const decodeRecoveryCodesGenerated = Schema.decodeUnknownEffect(RecoveryCodesGeneratedBody);
@@ -327,6 +472,7 @@ export const createRecoveryCodeClient = (options = {}) => {
     return {
         generation: {
             generate: async (input, requestOptions) => request("POST", paths.generate, await decode(decodeRecoveryCodeGenerate(input)), requestOptions, decodeRecoveryCodesGenerated),
+            regenerate: async (input, requestOptions) => request("POST", paths.regenerate, await decode(decodeRecoveryCodeRegenerate(input)), requestOptions, decodeRecoveryCodesGenerated),
         },
         verification: {
             verify: async (input, requestOptions) => request("POST", paths.verify, await decode(decodeRecoveryCodeVerify(input)), requestOptions, decodeRecoveryCodeVerifyResult),
@@ -526,7 +672,7 @@ export const createMfaClient = (options = {}) => {
     const decodePasskeyMfaVerify = Schema.decodeUnknownEffect(PasskeyMfaVerifyBody);
     const decodePasskeyAuthenticationStarted = Schema.decodeUnknownEffect(PasskeyAuthenticationStartedBody);
     const decodeMfaOptionsResult = Schema.decodeUnknownEffect(MfaOptionsResultBody);
-    const decodeAuthenticated = Schema.decodeUnknownEffect(AuthenticatedHttpBody);
+    const decodeMfaResult = Schema.decodeUnknownEffect(MfaAuthSuccess);
     const decode = (effect) => Effect.runPromise(effect);
     const request = async (path, body, requestOptions, decodeResponse) => {
         const response = await fetch(url(path), {
@@ -544,16 +690,16 @@ export const createMfaClient = (options = {}) => {
     return {
         options: async (input, requestOptions) => request(paths.options, await decode(decodeMfaOptions(input)), requestOptions, decodeMfaOptionsResult),
         totp: {
-            verify: async (input, requestOptions) => request(paths.totpVerify, await decode(decodeTotpMfaVerify(input)), requestOptions, decodeAuthenticated),
-            verifyForFlow: async (input, requestOptions) => request(paths.totpVerifyForFlow, await decode(decodeTotpMfaVerifyForFlow(input)), requestOptions, decodeAuthenticated),
+            verify: async (input, requestOptions) => request(paths.totpVerify, await decode(decodeTotpMfaVerify(input)), requestOptions, decodeMfaResult),
+            verifyForFlow: async (input, requestOptions) => request(paths.totpVerifyForFlow, await decode(decodeTotpMfaVerifyForFlow(input)), requestOptions, decodeMfaResult),
         },
         recoveryCode: {
-            verify: async (input, requestOptions) => request(paths.recoveryCodeVerify, await decode(decodeRecoveryCodeMfaVerify(input)), requestOptions, decodeAuthenticated),
-            verifyForFlow: async (input, requestOptions) => request(paths.recoveryCodeVerifyForFlow, await decode(decodeRecoveryCodeMfaVerifyForFlow(input)), requestOptions, decodeAuthenticated),
+            verify: async (input, requestOptions) => request(paths.recoveryCodeVerify, await decode(decodeRecoveryCodeMfaVerify(input)), requestOptions, decodeMfaResult),
+            verifyForFlow: async (input, requestOptions) => request(paths.recoveryCodeVerifyForFlow, await decode(decodeRecoveryCodeMfaVerifyForFlow(input)), requestOptions, decodeMfaResult),
         },
         passkey: {
             start: async (input, requestOptions) => request(paths.passkeyStart, await decode(decodePasskeyMfaStart(input)), requestOptions, decodePasskeyAuthenticationStarted),
-            verify: async (input, requestOptions) => request(paths.passkeyVerify, await decode(decodePasskeyMfaVerify(input)), requestOptions, decodeAuthenticated),
+            verify: async (input, requestOptions) => request(paths.passkeyVerify, await decode(decodePasskeyMfaVerify(input)), requestOptions, decodeMfaResult),
         },
     };
 };
@@ -570,6 +716,7 @@ export const createStepUpClient = (options = {}) => {
     };
     const url = (path) => clientUrl(options.baseUrl, joinPath(prefix, path));
     const decodeStepUpTotpVerify = Schema.decodeUnknownEffect(StepUpTotpVerifyBody);
+    const decodeStepUpPasswordVerify = Schema.decodeUnknownEffect(StepUpPasswordVerifyBody);
     const decodeStepUpRecoveryCodeVerify = Schema.decodeUnknownEffect(StepUpRecoveryCodeVerifyBody);
     const decodeStepUpPasskeyStart = Schema.decodeUnknownEffect(StepUpPasskeyStartBody);
     const decodeStepUpPasskeyVerify = Schema.decodeUnknownEffect(StepUpPasskeyVerifyBody);
@@ -595,6 +742,9 @@ export const createStepUpClient = (options = {}) => {
         totp: {
             verify: async (input, requestOptions) => request("POST", paths.totpVerify, await decode(decodeStepUpTotpVerify(input)), requestOptions, decodeAuthenticated),
         },
+        password: {
+            verify: async (input, requestOptions) => request("POST", paths.passwordVerify, await decode(decodeStepUpPasswordVerify(input)), requestOptions, decodeAuthenticated),
+        },
         recoveryCode: {
             verify: async (input, requestOptions) => request("POST", paths.recoveryCodeVerify, await decode(decodeStepUpRecoveryCodeVerify(input)), requestOptions, decodeAuthenticated),
         },
@@ -758,6 +908,72 @@ export const createAdminSessionClient = (options = {}) => {
         },
     };
 };
+export const createAdminPermissionDefinitionClient = (options = {}) => {
+    const requestInit = {
+        ...defaultRequestInit,
+        ...options.requestInit,
+    };
+    const fetch = options.fetch ?? globalThis.fetch;
+    const prefix = options.prefix ?? defaultAdminPermissionDefinitionPrefix;
+    const paths = {
+        ...defaultAdminPermissionDefinitionClientPaths,
+        ...options.paths,
+    };
+    const url = (path) => clientUrl(options.baseUrl, joinPath(prefix, path));
+    const decodeCreate = Schema.decodeUnknownEffect(AdminPermissionDefinitionCreateBody);
+    const decodeGet = Schema.decodeUnknownEffect(AdminPermissionDefinitionGetQuery);
+    const decodeList = Schema.decodeUnknownEffect(AdminPermissionDefinitionListQuery);
+    const decodeUpdate = Schema.decodeUnknownEffect(AdminPermissionDefinitionUpdateBody);
+    const decodeMutation = Schema.decodeUnknownEffect(AdminPermissionDefinitionMutationBody);
+    const decodeDefinition = Schema.decodeUnknownEffect(AdminPermissionDefinitionHttpBody);
+    const decodeDefinitions = Schema.decodeUnknownEffect(AdminPermissionDefinitionsHttpBody);
+    const decode = (effect) => Effect.runPromise(effect);
+    const getPath = (query) => {
+        const searchParams = new URLSearchParams();
+        searchParams.set("id", query.id);
+        return pathWithSearch(paths.get, searchParams);
+    };
+    const listPath = (query) => {
+        const searchParams = new URLSearchParams();
+        if (query.includeDisabled !== undefined) {
+            searchParams.set("includeDisabled", String(query.includeDisabled));
+        }
+        if (query.includeDeleted !== undefined) {
+            searchParams.set("includeDeleted", String(query.includeDeleted));
+        }
+        if (query.after !== undefined) {
+            searchParams.set("after", query.after);
+        }
+        if (query.limit !== undefined) {
+            searchParams.set("limit", String(query.limit));
+        }
+        return pathWithSearch(paths.list === "/" ? "" : paths.list, searchParams);
+    };
+    const request = async (method, path, body, requestOptions, decodeResponse) => {
+        const response = await fetch(url(path), {
+            ...requestInit,
+            method,
+            headers: requestHeaders(requestInit, body),
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: requestOptions?.signal,
+        });
+        if (!response.ok) {
+            return throwFailedResponse(response);
+        }
+        return decode(decodeResponse(await responseJson(response)));
+    };
+    return {
+        definitions: {
+            create: async (input, requestOptions) => request("POST", paths.create, await decode(decodeCreate(input)), requestOptions, decodeDefinition),
+            get: async (input, requestOptions) => request("GET", getPath(await decode(decodeGet(input))), undefined, requestOptions, decodeDefinition),
+            list: async (input, requestOptions) => request("GET", listPath(await decode(decodeList(input ?? {}))), undefined, requestOptions, decodeDefinitions),
+            update: async (input, requestOptions) => request("POST", paths.update, await decode(decodeUpdate(input)), requestOptions, decodeDefinition),
+            disable: async (input, requestOptions) => request("POST", paths.disable, await decode(decodeMutation(input)), requestOptions, decodeDefinition),
+            enable: async (input, requestOptions) => request("POST", paths.enable, await decode(decodeMutation(input)), requestOptions, decodeDefinition),
+            delete: async (input, requestOptions) => request("POST", paths.delete, await decode(decodeMutation(input)), requestOptions, decodeDefinition),
+        },
+    };
+};
 export const createTrustedDeviceClient = (options = {}) => {
     const requestInit = {
         ...defaultRequestInit,
@@ -908,6 +1124,32 @@ export const createOAuthClient = (options = {}) => {
         },
     };
 };
+const RemovedAuthProtocolNode = Symbol.for("@effect-auth/core/Client/RemovedAuthProtocolNode");
+const isObjectRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const mergeAuthProtocol = (standard, patch, runtime) => {
+    if (patch === null) {
+        return RemovedAuthProtocolNode;
+    }
+    if (isObjectRecord(patch) && AuthHttpApiExtensionTypeId in patch) {
+        return patch[AuthHttpApiExtensionTypeId](runtime);
+    }
+    if (!isObjectRecord(patch)) {
+        return patch;
+    }
+    const merged = isObjectRecord(standard)
+        ? { ...standard }
+        : {};
+    for (const key of Reflect.ownKeys(patch)) {
+        const value = mergeAuthProtocol(merged[key], patch[key], runtime);
+        if (value === RemovedAuthProtocolNode) {
+            Reflect.deleteProperty(merged, key);
+        }
+        else {
+            merged[key] = value;
+        }
+    }
+    return merged;
+};
 export const createAuthClient = (options = {}) => {
     const requestInit = {
         ...defaultRequestInit,
@@ -917,9 +1159,7 @@ export const createAuthClient = (options = {}) => {
         ? (layer) => layer
         : Layer.provide(Layer.succeed(FetchHttpClient.Fetch, options.fetch)));
     const runtime = ManagedRuntime.make(fetchLayer);
-    const clientEffect = HttpApiClient.make(AuthApi, {
-        baseUrl: options.baseUrl,
-    });
+    const clientEffect = makeAuthHttpClient({ baseUrl: options.baseUrl });
     const decodePasswordSignIn = Schema.decodeUnknownEffect(PasswordSignInBody);
     const decodePasswordSignUp = Schema.decodeUnknownEffect(PasswordSignUpBody);
     const decodePasswordResetStart = Schema.decodeUnknownEffect(PasswordResetStartBody);
@@ -937,9 +1177,38 @@ export const createAuthClient = (options = {}) => {
     const decodeLoginApprovalStatus = Schema.decodeUnknownEffect(LoginApprovalReviewStatusBody);
     const decodeLoginApprovalFinalize = Schema.decodeUnknownEffect(LoginApprovalFinalizeBody);
     const decodeLoginNotificationReport = Schema.decodeUnknownEffect(LoginNotificationReportBody);
+    const decodeEmailAuthStart = Schema.decodeUnknownEffect(EmailAuthStartBody);
+    const decodePasskeyRegistrationStart = Schema.decodeUnknownEffect(PasskeyRegistrationStartBody);
+    const decodePasskeyRegistrationFinish = Schema.decodeUnknownEffect(PasskeyRegistrationFinishBody);
+    const decodePasskeyAuthenticationStart = Schema.decodeUnknownEffect(PasskeyAuthenticationStartBody);
+    const decodePasskeyAuthenticationFinish = Schema.decodeUnknownEffect(PasskeyAuthenticationFinishBody);
+    const decodePasskeyCredentialRevoke = Schema.decodeUnknownEffect(PasskeyCredentialRevokeBody);
+    const decodeIdentityAvailability = Schema.decodeUnknownEffect(IdentityAvailabilityBody);
+    const decodeIdentityAdd = Schema.decodeUnknownEffect(IdentityAddBody);
+    const decodeIdentityReplace = Schema.decodeUnknownEffect(IdentityReplaceBody);
+    const decodeIdentityRevoke = Schema.decodeUnknownEffect(IdentityRevokeBody);
+    const decodeIdentityPrimary = Schema.decodeUnknownEffect(IdentityPrimaryBody);
+    const decodeTotpEnrollmentStart = Schema.decodeUnknownEffect(TotpEnrollmentStartBody);
+    const decodeTotpEnrollmentConfirm = Schema.decodeUnknownEffect(TotpEnrollmentConfirmBody);
+    const decodeTotpVerify = Schema.decodeUnknownEffect(TotpVerifyBody);
+    const decodeTotpFactorRevoke = Schema.decodeUnknownEffect(TotpFactorRevokeBody);
+    const decodeRecoveryCodeGenerate = Schema.decodeUnknownEffect(RecoveryCodeGenerateBody);
+    const decodeRecoveryCodeRegenerate = Schema.decodeUnknownEffect(RecoveryCodeRegenerateBody);
+    const decodeRecoveryCodeVerify = Schema.decodeUnknownEffect(RecoveryCodeVerifyBody);
+    const decodeRecoveryCodeRevoke = Schema.decodeUnknownEffect(RecoveryCodeRevokeBody);
+    const decodeMfaOptions = Schema.decodeUnknownEffect(MfaOptionsBody);
+    const decodeTotpMfaVerifyForFlow = Schema.decodeUnknownEffect(TotpMfaVerifyForFlowBody);
+    const decodeRecoveryCodeMfaVerifyForFlow = Schema.decodeUnknownEffect(RecoveryCodeMfaVerifyForFlowBody);
+    const decodePasskeyMfaStart = Schema.decodeUnknownEffect(PasskeyMfaStartBody);
+    const decodePasskeyMfaVerify = Schema.decodeUnknownEffect(PasskeyMfaVerifyBody);
+    const decodeStepUpTotpVerify = Schema.decodeUnknownEffect(StepUpTotpVerifyBody);
+    const decodeStepUpPasswordVerify = Schema.decodeUnknownEffect(StepUpPasswordVerifyBody);
+    const decodeStepUpRecoveryCodeVerify = Schema.decodeUnknownEffect(StepUpRecoveryCodeVerifyBody);
+    const decodeStepUpPasskeyStart = Schema.decodeUnknownEffect(StepUpPasskeyStartBody);
+    const decodeStepUpPasskeyVerify = Schema.decodeUnknownEffect(StepUpPasskeyVerifyBody);
     const run = (effect, requestOptions = {}) => runtime.runPromise(effect, requestOptions);
     const withClient = (effect, requestOptions) => run(Effect.flatMap(clientEffect, effect), requestOptions);
-    return {
+    const standard = {
         password: {
             signIn: (input, requestOptions) => withClient((client) => Effect.flatMap(decodePasswordSignIn(input), (payload) => client.password.signIn({ payload })), requestOptions),
             signUp: (input, requestOptions) => withClient((client) => Effect.flatMap(decodePasswordSignUp(input), (payload) => client.password.signUp({ payload })), requestOptions),
@@ -959,6 +1228,9 @@ export const createAuthClient = (options = {}) => {
             revoke: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeSessionRevoke(input), (payload) => client.session.revoke({ payload })), requestOptions),
             revokeOthers: (requestOptions) => withClient((client) => client.session.revokeOthers(), requestOptions),
         },
+        email: {
+            start: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeEmailAuthStart(input), (payload) => client.emailAuth.start({ payload })), requestOptions),
+        },
         emailVerification: {
             start: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeEmailVerificationStart(input), (payload) => client.emailVerification.start({ payload })), requestOptions),
             verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeEmailVerificationVerify(input), (payload) => client.emailVerification.verify({ payload })), requestOptions),
@@ -971,6 +1243,111 @@ export const createAuthClient = (options = {}) => {
             start: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeMagicLinkStart(input), (payload) => client.magicLink.start({ payload })), requestOptions),
             verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeMagicLinkVerify(input), (payload) => client.magicLink.verify({ payload })), requestOptions),
         },
+        passkey: {
+            isSupported: isPasskeySupported,
+            register: async (input, requestOptions) => {
+                const started = await withClient((client) => Effect.flatMap(decodePasskeyRegistrationStart(input ?? {}), (payload) => client.passkey.registerStart({ payload })), requestOptions);
+                const credential = await createPasskeyCredential(started.publicKey, options.browser?.passkey);
+                return withClient((client) => Effect.flatMap(decodePasskeyRegistrationFinish({
+                    challengeId: started.challengeId,
+                    credential,
+                }), (payload) => client.passkey.registerFinish({ payload })), requestOptions);
+            },
+            signIn: async (input, requestOptions) => {
+                const request = input ?? {};
+                const started = await withClient((client) => Effect.flatMap(decodePasskeyAuthenticationStart(request), (payload) => client.passkey.authenticateStart({ payload })), requestOptions);
+                const credential = await getPasskeyCredential(started.publicKey, options.browser?.passkey);
+                return withClient((client) => Effect.flatMap(decodePasskeyAuthenticationFinish({
+                    challengeId: started.challengeId,
+                    credential,
+                    ...(request.userId === undefined
+                        ? {}
+                        : { userId: request.userId }),
+                    ...(request.metadata === undefined
+                        ? {}
+                        : { metadata: request.metadata }),
+                }), (payload) => client.passkey.authenticateFinish({ payload })), requestOptions);
+            },
+            credentials: {
+                list: (requestOptions) => withClient((client) => client.passkey.listCredentials(), requestOptions),
+                revoke: (input, requestOptions) => withClient((client) => Effect.flatMap(decodePasskeyCredentialRevoke(input), (payload) => client.passkey.revokeCredential({ payload })), requestOptions),
+            },
+        },
+        identities: {
+            availability: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeIdentityAvailability(input), (payload) => client.identity.availability({ payload })), requestOptions),
+            list: (requestOptions) => withClient((client) => client.identity.list(), requestOptions),
+            add: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeIdentityAdd(input), (payload) => client.identity.add({ payload })), requestOptions),
+            replace: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeIdentityReplace(input), (payload) => client.identity.replace({ payload })), requestOptions),
+            revoke: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeIdentityRevoke(input), (payload) => client.identity.revoke({ payload })), requestOptions),
+            primary: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeIdentityPrimary(input), (payload) => client.identity.primary({ payload })), requestOptions),
+        },
+        totp: {
+            enrollment: {
+                start: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeTotpEnrollmentStart(input), (payload) => client.totp.startEnrollment({ payload })), requestOptions),
+                confirm: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeTotpEnrollmentConfirm(input), (payload) => client.totp.confirmEnrollment({ payload })), requestOptions),
+            },
+            verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeTotpVerify(input), (payload) => client.totp.verify({ payload })), requestOptions),
+            factors: {
+                list: (requestOptions) => withClient((client) => client.totp.listFactors(), requestOptions),
+                revoke: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeTotpFactorRevoke(input), (payload) => client.totp.revokeFactor({ payload })), requestOptions),
+            },
+        },
+        recoveryCodes: {
+            generate: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeRecoveryCodeGenerate(input ?? {}), (payload) => client.recoveryCodes.generateRecoveryCodes({ payload })), requestOptions),
+            regenerate: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeRecoveryCodeRegenerate(input ?? {}), (payload) => client.recoveryCodes.regenerateRecoveryCodes({ payload })), requestOptions),
+            verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeRecoveryCodeVerify(input), (payload) => client.recoveryCodes.verifyRecoveryCode({ payload })), requestOptions),
+            list: (requestOptions) => withClient((client) => client.recoveryCodes.listRecoveryCodes(), requestOptions),
+            revoke: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeRecoveryCodeRevoke(input), (payload) => client.recoveryCodes.revokeRecoveryCode({ payload })), requestOptions),
+        },
+        mfa: {
+            options: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeMfaOptions(input), (payload) => client.mfa.options({ payload })), requestOptions),
+            totp: {
+                verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeTotpMfaVerifyForFlow(input), (payload) => client.mfa.verifyTotpForFlow({ payload })), requestOptions),
+            },
+            recoveryCode: {
+                verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeRecoveryCodeMfaVerifyForFlow(input), (payload) => client.mfa.verifyRecoveryCodeForFlow({ payload })), requestOptions),
+            },
+            passkey: {
+                verify: async (input, requestOptions) => {
+                    const started = await withClient((client) => Effect.flatMap(decodePasskeyMfaStart(input), (payload) => client.mfa.startPasskey({ payload })), requestOptions);
+                    const credential = await getPasskeyCredential(started.publicKey, options.browser?.passkey);
+                    return withClient((client) => Effect.flatMap(decodePasskeyMfaVerify({
+                        flowId: input.flowId,
+                        challengeId: started.challengeId,
+                        credential,
+                        ...(input.metadata === undefined
+                            ? {}
+                            : { metadata: input.metadata }),
+                    }), (payload) => client.mfa.verifyPasskey({ payload })), requestOptions);
+                },
+            },
+        },
+        stepUp: {
+            options: (requestOptions) => withClient((client) => client.stepUp.options(), requestOptions),
+            totp: {
+                verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeStepUpTotpVerify(input), (payload) => client.stepUp.verifyTotp({ payload })), requestOptions),
+            },
+            password: {
+                verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeStepUpPasswordVerify(input), (payload) => client.stepUp.verifyPassword({ payload })), requestOptions),
+            },
+            recoveryCode: {
+                verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeStepUpRecoveryCodeVerify(input), (payload) => client.stepUp.verifyRecoveryCode({ payload })), requestOptions),
+            },
+            passkey: {
+                verify: async (input, requestOptions) => {
+                    const request = input ?? {};
+                    const started = await withClient((client) => Effect.flatMap(decodeStepUpPasskeyStart(request), (payload) => client.stepUp.startPasskey({ payload })), requestOptions);
+                    const credential = await getPasskeyCredential(started.publicKey, options.browser?.passkey);
+                    return withClient((client) => Effect.flatMap(decodeStepUpPasskeyVerify({
+                        challengeId: started.challengeId,
+                        credential,
+                        ...(request.metadata === undefined
+                            ? {}
+                            : { metadata: request.metadata }),
+                    }), (payload) => client.stepUp.verifyPasskey({ payload })), requestOptions);
+                },
+            },
+        },
         loginApproval: {
             approve: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeLoginApprovalApprove(input), (payload) => client.loginApproval.approve({ payload })), requestOptions),
             status: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeLoginApprovalStatus(input), (payload) => client.loginApproval.status({ payload })), requestOptions),
@@ -981,5 +1358,9 @@ export const createAuthClient = (options = {}) => {
         },
         dispose: () => runtime.dispose(),
     };
+    return mergeAuthProtocol(standard, options.protocol ?? {}, {
+        baseUrl: options.baseUrl,
+        run,
+    });
 };
 //# sourceMappingURL=Client.js.map