@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/HttpApi/Endpoints.d.ts

@@ -1,95 +1,131 @@
 import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError } from "./Errors.js";
-export declare const passwordSignInEndpoint: HttpApiEndpoint.HttpApiEndpoint<"signIn", "POST", "/sign-in", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
-    readonly password: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"authenticated">;
-    readonly expiresAt: import("effect/Schema").Number;
-    readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
-    readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
-    readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
-        readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
-    }>>;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_mfa">;
-    readonly flowId: import("effect/Schema").String;
-    readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly type: import("effect/Schema").String;
-    }>>;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_email_verification">;
-    readonly flowId: import("effect/Schema").String;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
-    readonly flowId: import("effect/Schema").String;
-    readonly approvalChallengeId: import("effect/Schema").String;
-    readonly channel: import("effect/Schema").String;
-    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: import("effect/Schema").Boolean;
-    readonly reason: import("effect/Schema").String;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_passkey_enrollment">;
-    readonly flowId: import("effect/Schema").String;
-}>]>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const passwordSignUpEndpoint: HttpApiEndpoint.HttpApiEndpoint<"signUp", "POST", "/sign-up", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
-    readonly password: import("effect/Schema").String;
-    readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
-    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"authenticated">;
-    readonly expiresAt: import("effect/Schema").Number;
-    readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
-    readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
-    readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
-        readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+import { AuthBadRequestError, AuthConflictError, AuthIdentityAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthNotFoundError, AuthPolicyDeniedError, AuthRateLimitedError, AuthRequestRejectedError, AuthStepUpRequiredError, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError } from "./Errors.js";
+export declare const identityAvailabilityEndpoint: HttpApiEndpoint.HttpApiEndpoint<"availability", "POST", "/availability", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
     }>>;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_mfa">;
-    readonly flowId: import("effect/Schema").String;
-    readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly type: import("effect/Schema").String;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly available: import("effect/Schema").Boolean;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthIdentityAlreadyRegisteredError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const identityListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identities: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+        readonly verified: import("effect/Schema").Boolean;
+        readonly loginEligible: import("effect/Schema").Boolean;
+        readonly isPrimaryLogin: import("effect/Schema").Boolean;
+        readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+        readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
     }>>;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_email_verification">;
-    readonly flowId: import("effect/Schema").String;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
-    readonly flowId: import("effect/Schema").String;
-    readonly approvalChallengeId: import("effect/Schema").String;
-    readonly channel: import("effect/Schema").String;
-    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: import("effect/Schema").Boolean;
-    readonly reason: import("effect/Schema").String;
-}>, import("effect/Schema").Struct<{
-    readonly type: import("effect/Schema").Literal<"requires_passkey_enrollment">;
-    readonly flowId: import("effect/Schema").String;
-}>]>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, never, never>;
-export declare const passwordResetStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"resetStart", "POST", "/reset/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
-    readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly locale: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const passwordResetVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"resetVerify", "POST", "/reset/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
-    readonly secret: import("effect/Schema").String;
-    readonly password: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const passwordSetEndpoint: HttpApiEndpoint.HttpApiEndpoint<"set", "POST", "/set", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly password: import("effect/Schema").String;
-    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const passwordChangeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"change", "POST", "/change", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly currentPassword: import("effect/Schema").String;
-    readonly newPassword: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const currentSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"current", "GET", "/session", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthIdentityAlreadyRegisteredError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const identityAddEndpoint: HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/add", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+    readonly verified: import("effect/Schema").Boolean;
+    readonly loginEligible: import("effect/Schema").Boolean;
+    readonly isPrimaryLogin: import("effect/Schema").Boolean;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthIdentityAlreadyRegisteredError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const identityReplaceEndpoint: HttpApiEndpoint.HttpApiEndpoint<"replace", "POST", "/replace", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identityId: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+    readonly verified: import("effect/Schema").Boolean;
+    readonly loginEligible: import("effect/Schema").Boolean;
+    readonly isPrimaryLogin: import("effect/Schema").Boolean;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthIdentityAlreadyRegisteredError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const identityRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identityId: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+    readonly verified: import("effect/Schema").Boolean;
+    readonly loginEligible: import("effect/Schema").Boolean;
+    readonly isPrimaryLogin: import("effect/Schema").Boolean;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthIdentityAlreadyRegisteredError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const identityPrimaryEndpoint: HttpApiEndpoint.HttpApiEndpoint<"primary", "POST", "/primary", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identityId: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"global">;
+    }>, import("effect/Schema").Struct<{
+        readonly type: import("effect/Schema").Literal<"tenant">;
+        readonly tenantId: import("effect/Schema").String;
+    }>]>;
+    readonly kind: import("effect/Schema").String;
+    readonly value: import("effect/Schema").String;
+    readonly verified: import("effect/Schema").Boolean;
+    readonly loginEligible: import("effect/Schema").Boolean;
+    readonly isPrimaryLogin: import("effect/Schema").Boolean;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthIdentityAlreadyRegisteredError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export { passwordChangeEndpoint, passwordResetStartEndpoint, passwordResetVerifyEndpoint, passwordSetEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, } from "./PasswordContract.js";
+export declare const currentSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"current", "GET", "/session", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly userId: import("effect/Schema").String;
     readonly sessionId: import("effect/Schema").String;
@@ -99,11 +135,14 @@ export declare const currentSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"cu
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const refreshSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"refresh", "POST", "/session/refresh", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const refreshSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"refresh", "POST", "/session/refresh", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly userId: import("effect/Schema").String;
     readonly sessionId: import("effect/Schema").String;
@@ -113,12 +152,15 @@ export declare const refreshSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"re
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const logoutEndpoint: HttpApiEndpoint.HttpApiEndpoint<"logout", "POST", "/logout", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthInternalError>, never, never>;
-export declare const listSessionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/sessions", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
+export declare const logoutEndpoint: HttpApiEndpoint.HttpApiEndpoint<"logout", "POST", "/logout", never, never, never, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthInternalError>, never, never>;
+export declare const listSessionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/sessions", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly sessions: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly sessionId: import("effect/Schema").brand<import("effect/Schema").String, "auth/SessionId">;
         readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
@@ -131,8 +173,11 @@ export declare const listSessionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list
         readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly current: import("effect/Schema").Boolean;
         readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-            readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+            readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
             readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+            readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+            }>>;
         }>>;
         readonly ip: import("effect/Schema").optional<import("effect/Schema").String>;
         readonly userAgent: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -143,14 +188,14 @@ export declare const listSessionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list
         readonly longitude: import("effect/Schema").optional<import("effect/Schema").Number>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const revokeSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/sessions/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const revokeSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/sessions/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly sessionId: import("effect/Schema").brand<import("effect/Schema").String, "auth/SessionId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const revokeOtherSessionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeOthers", "POST", "/sessions/revoke-others", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const adminSessionListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const revokeOtherSessionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeOthers", "POST", "/sessions/revoke-others", never, never, never, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminSessionListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly sessions: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly sessionId: import("effect/Schema").brand<import("effect/Schema").String, "auth/SessionId">;
         readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
@@ -169,28 +214,119 @@ export declare const adminSessionListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"
         readonly latitude: import("effect/Schema").optional<import("effect/Schema").Number>;
         readonly longitude: import("effect/Schema").optional<import("effect/Schema").Number>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const adminSessionRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminSessionRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly sessionId: import("effect/Schema").brand<import("effect/Schema").String, "auth/SessionId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const adminSessionRevokeAllEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeAll", "POST", "/revoke-all", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminSessionRevokeAllEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeAll", "POST", "/revoke-all", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const loginNotificationReportEndpoint: HttpApiEndpoint.HttpApiEndpoint<"reportLogin", "POST", "/login/report", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionCreateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/permission-definitions", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionGetEndpoint: HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/permission-definitions/get", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/permission-definitions", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    readonly includeDisabled: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Boolean, import("effect/Schema").decodeTo<import("effect/Schema").Boolean, import("effect/Schema").Literals<readonly ["true", "false"]>, never, never>]>>;
+    readonly includeDeleted: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Boolean, import("effect/Schema").decodeTo<import("effect/Schema").Boolean, import("effect/Schema").Literals<readonly ["true", "false"]>, never, never>]>>;
+    readonly after: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">>;
+    readonly limit: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Number, import("effect/Schema").NumberFromString]>>;
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly definitions: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+        readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+        readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+        readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+        readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+        readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+        readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    }>>;
+    readonly nextAfter: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionUpdateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"update", "POST", "/permission-definitions/update", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionDisableEndpoint: HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/permission-definitions/disable", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionEnableEndpoint: HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/permission-definitions/enable", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminPermissionDefinitionDeleteEndpoint: HttpApiEndpoint.HttpApiEndpoint<"delete", "POST", "/permission-definitions/delete", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").brand<import("effect/Schema").String, "auth/PermissionId">;
+    readonly description: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly scopeType: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly updatedAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    readonly disabledAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly deletedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const loginNotificationReportEndpoint: HttpApiEndpoint.HttpApiEndpoint<"reportLogin", "POST", "/login/report", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const securityTimelineListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/timeline", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
+export declare const securityTimelineListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/timeline", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly limit: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly beforeOccurredAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
-    readonly types: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+    readonly types: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>>>;
+    readonly categories: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly events: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly eventId: import("effect/Schema").String;
-        readonly type: import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-        readonly category: import("effect/Schema").Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+        readonly type: import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+        readonly category: import("effect/Schema").Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
         readonly severity: import("effect/Schema").Literals<readonly ["info", "warning", "critical"]>;
         readonly occurredAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
         readonly summary: import("effect/Schema").String;
@@ -206,18 +342,18 @@ export declare const securityTimelineListEndpoint: HttpApiEndpoint.HttpApiEndpoi
         }>>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const adminSecurityTimelineListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/timeline", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminSecurityTimelineListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/timeline", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly limit: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly beforeOccurredAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
-    readonly types: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+    readonly types: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>>>;
+    readonly categories: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly events: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly eventId: import("effect/Schema").String;
-        readonly type: import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-        readonly category: import("effect/Schema").Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+        readonly type: import("effect/Schema").Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+        readonly category: import("effect/Schema").Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
         readonly severity: import("effect/Schema").Literals<readonly ["info", "warning", "critical"]>;
         readonly occurredAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
         readonly summary: import("effect/Schema").String;
@@ -233,8 +369,8 @@ export declare const adminSecurityTimelineListEndpoint: HttpApiEndpoint.HttpApiE
         }>>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const trustedDeviceListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const trustedDeviceListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly devices: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly deviceId: import("effect/Schema").String;
         readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
@@ -242,13 +378,13 @@ export declare const trustedDeviceListEndpoint: HttpApiEndpoint.HttpApiEndpoint<
         readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const trustedDeviceRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const trustedDeviceRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly deviceId: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const adminTrustedDeviceListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminTrustedDeviceListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly devices: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly deviceId: import("effect/Schema").String;
         readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
@@ -256,53 +392,83 @@ export declare const adminTrustedDeviceListEndpoint: HttpApiEndpoint.HttpApiEndp
         readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const adminTrustedDeviceRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const adminTrustedDeviceRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly deviceId: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const emailVerificationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const emailVerificationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identityId: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const emailVerificationVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
+    }>>;
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const emailVerificationVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const emailOtpStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
+export declare const emailOtpStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identity: import("effect/Schema").Struct<{
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+    }>;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly locale: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
+    }>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
+    readonly identity: import("effect/Schema").Struct<{
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+    }>;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const emailOtpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const emailOtpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
+    }>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_mfa">;
     readonly flowId: import("effect/Schema").String;
     readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly type: import("effect/Schema").String;
+        readonly type: import("effect/Schema").Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_email_verification">;
     readonly flowId: import("effect/Schema").String;
+    readonly identityId: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_login_approval">;
     readonly flowId: import("effect/Schema").String;
@@ -314,38 +480,103 @@ export declare const emailOtpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"ve
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_passkey_enrollment">;
     readonly flowId: import("effect/Schema").String;
-}>]>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const magicLinkStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const emailAuthStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identity: import("effect/Schema").Struct<{
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+    }>;
+    readonly emailOtpSecret: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly magicLinkSecret: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly locale: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
+    }>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identity: import("effect/Schema").Struct<{
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+    }>;
+    readonly emailOtp: import("effect/Schema").Struct<{
+        readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
+        readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    }>;
+    readonly magicLink: import("effect/Schema").Struct<{
+        readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+    }>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const magicLinkStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identity: import("effect/Schema").Struct<{
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+    }>;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly locale: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly email: import("effect/Schema").brand<import("effect/Schema").String, "auth/Email">;
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
+    }>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly identity: import("effect/Schema").Struct<{
+        readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"global">;
+        }>, import("effect/Schema").Struct<{
+            readonly type: import("effect/Schema").Literal<"tenant">;
+            readonly tenantId: import("effect/Schema").String;
+        }>]>;
+        readonly kind: import("effect/Schema").String;
+        readonly value: import("effect/Schema").String;
+    }>;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const magicLinkVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const magicLinkVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+    readonly botChallenge: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly token: import("effect/Schema").String;
+    }>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_mfa">;
     readonly flowId: import("effect/Schema").String;
     readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly type: import("effect/Schema").String;
+        readonly type: import("effect/Schema").Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_email_verification">;
     readonly flowId: import("effect/Schema").String;
+    readonly identityId: import("effect/Schema").brand<import("effect/Schema").String, "auth/IdentityId">;
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_login_approval">;
     readonly flowId: import("effect/Schema").String;
@@ -357,8 +588,8 @@ export declare const magicLinkVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"v
 }>, import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"requires_passkey_enrollment">;
     readonly flowId: import("effect/Schema").String;
-}>]>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, never, never>;
-export declare const oauthAuthorizationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startAuthorization", "POST", "/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const oauthAuthorizationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startAuthorization", "POST", "/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly providerId: import("effect/Schema").brand<import("effect/Schema").String, "auth/OAuthProviderId">;
     readonly redirectUri: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly scopes: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
@@ -367,7 +598,7 @@ export declare const oauthAuthorizationStartEndpoint: HttpApiEndpoint.HttpApiEnd
     readonly includeNonce: import("effect/Schema").optional<import("effect/Schema").Boolean>;
     readonly nonce: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly providerId: import("effect/Schema").brand<import("effect/Schema").String, "auth/OAuthProviderId">;
     readonly authorizationUrl: import("effect/Schema").String;
     readonly state: import("effect/Schema").String;
@@ -378,8 +609,8 @@ export declare const oauthAuthorizationStartEndpoint: HttpApiEndpoint.HttpApiEnd
     readonly nonce: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly redirectUri: import("effect/Schema").String;
     readonly scopes: import("effect/Schema").$Array<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const oauthProviderAuthorizeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"authorize", "GET", "/authorize", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
+export declare const oauthProviderAuthorizeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"authorize", "GET", "/authorize", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly response_type: import("effect/Schema").String;
     readonly client_id: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly redirect_uri: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -387,8 +618,8 @@ export declare const oauthProviderAuthorizeEndpoint: HttpApiEndpoint.HttpApiEndp
     readonly state: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly code_challenge: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly code_challenge_method: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthInternalError | typeof OAuthAuthorizationEndpointError>, never, never>;
-export declare const oauthTokenEndpoint: HttpApiEndpoint.HttpApiEndpoint<"token", "POST", "/token", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthInternalError | typeof OAuthAuthorizationEndpointError>, never, never>;
+export declare const oauthTokenEndpoint: HttpApiEndpoint.HttpApiEndpoint<"token", "POST", "/token", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly access_token: import("effect/Schema").String;
     readonly token_type: import("effect/Schema").String;
     readonly expires_in: import("effect/Schema").optional<import("effect/Schema").Number>;
@@ -396,8 +627,8 @@ export declare const oauthTokenEndpoint: HttpApiEndpoint.HttpApiEndpoint<"token"
     readonly id_token: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly scope: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly extra: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.Json<typeof AuthInternalError | typeof OAuthTokenEndpointError>, never, never>;
-export declare const oauthTokenIntrospectionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"introspect", "POST", "/introspect", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthInternalError | typeof OAuthTokenEndpointError>, never, never>;
+export declare const oauthTokenIntrospectionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"introspect", "POST", "/introspect", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly active: import("effect/Schema").Boolean;
     readonly scope: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly client_id: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -411,13 +642,13 @@ export declare const oauthTokenIntrospectionEndpoint: HttpApiEndpoint.HttpApiEnd
     readonly iss: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly jti: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly extra: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.Json<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, never, never>;
-export declare const oauthTokenRevocationEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, never, never>;
-export declare const oauthAccountUnlinkEndpoint: HttpApiEndpoint.HttpApiEndpoint<"unlinkAccount", "POST", "/unlink", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, never, never>;
+export declare const oauthTokenRevocationEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", never, never, never, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, never, never>;
+export declare const oauthAccountUnlinkEndpoint: HttpApiEndpoint.HttpApiEndpoint<"unlinkAccount", "POST", "/unlink", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly providerId: import("effect/Schema").brand<import("effect/Schema").String, "auth/OAuthProviderId">;
     readonly providerAccountId: import("effect/Schema").String;
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"allow">;
     readonly reason: import("effect/Schema").Literal<"owned-account">;
     readonly account: import("effect/Schema").Struct<{
@@ -462,8 +693,8 @@ export declare const oauthAccountUnlinkEndpoint: HttpApiEndpoint.HttpApiEndpoint
         readonly providerId: import("effect/Schema").brand<import("effect/Schema").String, "auth/OAuthProviderId">;
         readonly providerAccountId: import("effect/Schema").String;
     }>;
-}>]>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const oauthLinkConfirmationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startLinkConfirmation", "POST", "/link-confirmation/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const oauthLinkConfirmationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startLinkConfirmation", "POST", "/link-confirmation/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">>;
     readonly identity: import("effect/Schema").optional<import("effect/Schema").Struct<{
         readonly providerId: import("effect/Schema").brand<import("effect/Schema").String, "auth/OAuthProviderId">;
@@ -475,7 +706,7 @@ export declare const oauthLinkConfirmationStartEndpoint: HttpApiEndpoint.HttpApi
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly identity: import("effect/Schema").Struct<{
@@ -486,11 +717,11 @@ export declare const oauthLinkConfirmationStartEndpoint: HttpApiEndpoint.HttpApi
     }>;
     readonly reason: import("effect/Schema").String;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const oauthLinkConfirmationInspectEndpoint: HttpApiEndpoint.HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/link-confirmation/inspect", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
+export declare const oauthLinkConfirmationInspectEndpoint: HttpApiEndpoint.HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/link-confirmation/inspect", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly identity: import("effect/Schema").Struct<{
@@ -501,13 +732,13 @@ export declare const oauthLinkConfirmationInspectEndpoint: HttpApiEndpoint.HttpA
     }>;
     readonly reason: import("effect/Schema").String;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const oauthLinkConfirmationConfirmEndpoint: HttpApiEndpoint.HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/link-confirmation/confirm", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
+export declare const oauthLinkConfirmationConfirmEndpoint: HttpApiEndpoint.HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/link-confirmation/confirm", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly expectedProviderId: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/OAuthProviderId">>;
     readonly expectedProviderAccountId: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly identity: import("effect/Schema").Struct<{
@@ -523,13 +754,8 @@ export declare const oauthLinkConfirmationConfirmEndpoint: HttpApiEndpoint.HttpA
         readonly providerAccountId: import("effect/Schema").String;
     }>>;
     readonly linked: import("effect/Schema").Boolean;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const passkeyRegistrationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"registerStart", "POST", "/register/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
-    readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
-    readonly userName: import("effect/Schema").String;
-    readonly userDisplayName: import("effect/Schema").String;
-    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyRegistrationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"registerStart", "POST", "/register/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
     readonly publicKey: import("effect/Schema").Struct<{
@@ -561,10 +787,9 @@ export declare const passkeyRegistrationStartEndpoint: HttpApiEndpoint.HttpApiEn
         }>>;
         readonly attestation: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["none", "indirect", "direct", "enterprise"]>>;
     }>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const passkeyRegistrationFinishEndpoint: HttpApiEndpoint.HttpApiEndpoint<"registerFinish", "POST", "/register/finish", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyRegistrationFinishEndpoint: HttpApiEndpoint.HttpApiEndpoint<"registerFinish", "POST", "/register/finish", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
-    readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly credential: import("effect/Schema").Struct<{
         readonly id: import("effect/Schema").String;
         readonly rawId: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -573,14 +798,13 @@ export declare const passkeyRegistrationFinishEndpoint: HttpApiEndpoint.HttpApiE
         readonly authenticatorAttachment: import("effect/Schema").optional<import("effect/Schema").String>;
         readonly clientExtensionResults: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>;
-    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly credentialId: import("effect/Schema").String;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const passkeyAuthenticationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"authenticateStart", "POST", "/authenticate/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyAuthenticationStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"authenticateStart", "POST", "/authenticate/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly userId: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
     readonly publicKey: import("effect/Schema").Struct<{
@@ -594,8 +818,8 @@ export declare const passkeyAuthenticationStartEndpoint: HttpApiEndpoint.HttpApi
         }>>>;
         readonly userVerification: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["required", "preferred", "discouraged"]>>;
     }>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const passkeyAuthenticationFinishEndpoint: HttpApiEndpoint.HttpApiEndpoint<"authenticateFinish", "POST", "/authenticate/finish", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyAuthenticationFinishEndpoint: HttpApiEndpoint.HttpApiEndpoint<"authenticateFinish", "POST", "/authenticate/finish", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly credential: import("effect/Schema").Struct<{
         readonly id: import("effect/Schema").String;
@@ -607,18 +831,21 @@ export declare const passkeyAuthenticationFinishEndpoint: HttpApiEndpoint.HttpAp
     }>;
     readonly userId: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const passkeyCredentialListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listCredentials", "GET", "/credentials", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyCredentialListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listCredentials", "GET", "/credentials", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly credentials: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly credentialId: import("effect/Schema").String;
         readonly transports: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
@@ -628,15 +855,15 @@ export declare const passkeyCredentialListEndpoint: HttpApiEndpoint.HttpApiEndpo
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const passkeyCredentialRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeCredential", "POST", "/credentials/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyCredentialRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeCredential", "POST", "/credentials/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly credentialId: import("effect/Schema").String;
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const totpEnrollmentStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startEnrollment", "POST", "/enroll/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpEnrollmentStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startEnrollment", "POST", "/enroll/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly accountName: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factor: import("effect/Schema").Struct<{
         readonly factorId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
         readonly algorithm: import("effect/Schema").Literals<readonly ["SHA1", "SHA256", "SHA512"]>;
@@ -650,12 +877,12 @@ export declare const totpEnrollmentStartEndpoint: HttpApiEndpoint.HttpApiEndpoin
     }>;
     readonly secret: import("effect/Schema").String;
     readonly uri: import("effect/Schema").String;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const totpEnrollmentConfirmEndpoint: HttpApiEndpoint.HttpApiEndpoint<"confirmEnrollment", "POST", "/enroll/confirm", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpEnrollmentConfirmEndpoint: HttpApiEndpoint.HttpApiEndpoint<"confirmEnrollment", "POST", "/enroll/confirm", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factorId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factorId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
     readonly algorithm: import("effect/Schema").Literals<readonly ["SHA1", "SHA256", "SHA512"]>;
     readonly digits: import("effect/Schema").Number;
@@ -665,11 +892,11 @@ export declare const totpEnrollmentConfirmEndpoint: HttpApiEndpoint.HttpApiEndpo
     readonly lastUsedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const totpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify", "POST", "/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly valid: import("effect/Schema").Boolean;
     readonly factor: import("effect/Schema").optional<import("effect/Schema").Struct<{
         readonly factorId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
@@ -683,8 +910,9 @@ export declare const totpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verify
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
     readonly delta: import("effect/Schema").optional<import("effect/Schema").Number>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const totpFactorListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listFactors", "GET", "/factors", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+    readonly acceptedCounter: import("effect/Schema").optional<import("effect/Schema").Number>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpFactorListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listFactors", "GET", "/factors", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly factorId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
         readonly algorithm: import("effect/Schema").Literals<readonly ["SHA1", "SHA256", "SHA512"]>;
@@ -696,14 +924,27 @@ export declare const totpFactorListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"li
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const totpFactorRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeFactor", "POST", "/factors/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpFactorRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeFactor", "POST", "/factors/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factorId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const recoveryCodeGenerateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"generateRecoveryCodes", "POST", "/generate", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeGenerateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"generateRecoveryCodes", "POST", "/generate", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly codes: import("effect/Schema").$Array<import("effect/Schema").String>;
+    readonly records: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly codeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
+        readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
+        readonly usedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+        readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+        readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    }>>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeRegenerateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"regenerateRecoveryCodes", "POST", "/regenerate", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+    readonly revokeReason: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly codes: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly records: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly codeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
@@ -712,11 +953,11 @@ export declare const recoveryCodeGenerateEndpoint: HttpApiEndpoint.HttpApiEndpoi
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const recoveryCodeVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCode", "POST", "/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCode", "POST", "/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly valid: import("effect/Schema").Boolean;
     readonly code: import("effect/Schema").optional<import("effect/Schema").Struct<{
         readonly codeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
@@ -725,8 +966,8 @@ export declare const recoveryCodeVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const recoveryCodeListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listRecoveryCodes", "GET", "/codes", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listRecoveryCodes", "GET", "/codes", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly codes: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly codeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
         readonly createdAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
@@ -734,16 +975,16 @@ export declare const recoveryCodeListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const recoveryCodeRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeRecoveryCode", "POST", "/codes/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeRecoveryCode", "POST", "/codes/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly codeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/CredentialId">;
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const apiKeyCreateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"createApiKey", "POST", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const apiKeyCreateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"createApiKey", "POST", "/", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly scopes: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
     readonly expiresAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly secret: import("effect/Schema").String;
     readonly key: import("effect/Schema").Struct<{
         readonly keyId: import("effect/Schema").String;
@@ -755,8 +996,8 @@ export declare const apiKeyCreateEndpoint: HttpApiEndpoint.HttpApiEndpoint<"crea
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const apiKeyListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listApiKeys", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const apiKeyListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listApiKeys", "GET", "/", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly keys: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly keyId: import("effect/Schema").String;
         readonly prefix: import("effect/Schema").String;
@@ -767,15 +1008,15 @@ export declare const apiKeyListEndpoint: HttpApiEndpoint.HttpApiEndpoint<"listAp
         readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const apiKeyRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeApiKey", "POST", "/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const apiKeyRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revokeApiKey", "POST", "/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly keyId: import("effect/Schema").String;
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const refreshTokenRefreshEndpoint: HttpApiEndpoint.HttpApiEndpoint<"refresh", "POST", "/refresh", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const refreshTokenRefreshEndpoint: HttpApiEndpoint.HttpApiEndpoint<"refresh", "POST", "/refresh", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly refreshToken: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly accessToken: import("effect/Schema").String;
     readonly accessTokenExpiresAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly refreshToken: import("effect/Schema").String;
@@ -791,10 +1032,10 @@ export declare const refreshTokenRefreshEndpoint: HttpApiEndpoint.HttpApiEndpoin
         readonly reuseDetectedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, never, never>;
-export declare const jwtIntrospectEndpoint: HttpApiEndpoint.HttpApiEndpoint<"introspect", "POST", "/introspect", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, never, never>;
+export declare const jwtIntrospectEndpoint: HttpApiEndpoint.HttpApiEndpoint<"introspect", "POST", "/introspect", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly token: import("effect/Schema").String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly active: import("effect/Schema").Literal<true>;
     readonly header: import("effect/Schema").Struct<{
         readonly typ: import("effect/Schema").Literal<"JWT">;
@@ -820,11 +1061,11 @@ export declare const jwtIntrospectEndpoint: HttpApiEndpoint.HttpApiEndpoint<"int
     readonly expiresAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly revokedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly revokedReason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>]>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const jwtJwksEndpoint: HttpApiEndpoint.HttpApiEndpoint<"jwks", "GET", "/jwks.json", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
+export declare const jwtJwksEndpoint: HttpApiEndpoint.HttpApiEndpoint<"jwks", "GET", "/jwks.json", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly keys: import("effect/Schema").$Array<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.Json<typeof AuthInternalError>, never, never>;
-export declare const oidcDiscoveryMetadataEndpoint: HttpApiEndpoint.HttpApiEndpoint<"openidConfiguration", "GET", "/openid-configuration", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthInternalError>, never, never>;
+export declare const oidcDiscoveryMetadataEndpoint: HttpApiEndpoint.HttpApiEndpoint<"openidConfiguration", "GET", "/openid-configuration", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly issuer: import("effect/Schema").String;
     readonly authorization_endpoint: import("effect/Schema").String;
     readonly token_endpoint: import("effect/Schema").String;
@@ -843,85 +1084,129 @@ export declare const oidcDiscoveryMetadataEndpoint: HttpApiEndpoint.HttpApiEndpo
     readonly introspection_endpoint: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly revocation_endpoint: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly revocation_endpoint_auth_methods_supported: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
-}>>, HttpApiEndpoint.Json<typeof AuthInternalError>, never, never>;
-export declare const jwtRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthInternalError>, never, never>;
+export declare const jwtRevokeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"revoke", "POST", "/revoke", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly jwtId: import("effect/Schema").String;
     readonly expiresAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<HttpApiSchema.NoContent>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const mfaOptionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"options", "POST", "/options", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
+export declare const mfaOptionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"options", "POST", "/options", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly type: import("effect/Schema").Literals<readonly ["totp", "backup-code", "passkey"]>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const totpMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyTotp", "POST", "/totp/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyTotp", "POST", "/totp/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const totpMfaVerifyForFlowEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyTotpForFlow", "POST", "/totp/verify-flow", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>, import("effect/Schema").Struct<{
+    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
+    readonly flowId: import("effect/Schema").String;
+    readonly approvalChallengeId: import("effect/Schema").String;
+    readonly channel: import("effect/Schema").String;
+    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: import("effect/Schema").Boolean;
+    readonly reason: import("effect/Schema").String;
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const totpMfaVerifyForFlowEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyTotpForFlow", "POST", "/totp/verify-flow", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const recoveryCodeMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCode", "POST", "/recovery-code/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>, import("effect/Schema").Struct<{
+    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
+    readonly flowId: import("effect/Schema").String;
+    readonly approvalChallengeId: import("effect/Schema").String;
+    readonly channel: import("effect/Schema").String;
+    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: import("effect/Schema").Boolean;
+    readonly reason: import("effect/Schema").String;
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCode", "POST", "/recovery-code/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly userId: import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">;
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const recoveryCodeMfaVerifyForFlowEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/recovery-code/verify-flow", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>, import("effect/Schema").Struct<{
+    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
+    readonly flowId: import("effect/Schema").String;
+    readonly approvalChallengeId: import("effect/Schema").String;
+    readonly channel: import("effect/Schema").String;
+    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: import("effect/Schema").Boolean;
+    readonly reason: import("effect/Schema").String;
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const recoveryCodeMfaVerifyForFlowEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/recovery-code/verify-flow", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const passkeyMfaStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startPasskey", "POST", "/passkey/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>, import("effect/Schema").Struct<{
+    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
+    readonly flowId: import("effect/Schema").String;
+    readonly approvalChallengeId: import("effect/Schema").String;
+    readonly channel: import("effect/Schema").String;
+    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: import("effect/Schema").Boolean;
+    readonly reason: import("effect/Schema").String;
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyMfaStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startPasskey", "POST", "/passkey/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
     readonly publicKey: import("effect/Schema").Struct<{
@@ -935,8 +1220,8 @@ export declare const passkeyMfaStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"s
         }>>>;
         readonly userVerification: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["required", "preferred", "discouraged"]>>;
     }>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthInternalError>, never, never>;
-export declare const passkeyMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyPasskey", "POST", "/passkey/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const passkeyMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyPasskey", "POST", "/passkey/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly credential: import("effect/Schema").Struct<{
@@ -949,53 +1234,87 @@ export declare const passkeyMfaVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"
     }>;
     readonly userId: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").String, "auth/UserId">>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const stepUpOptionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"options", "GET", "/options", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>, import("effect/Schema").Struct<{
+    readonly type: import("effect/Schema").Literal<"requires_login_approval">;
+    readonly flowId: import("effect/Schema").String;
+    readonly approvalChallengeId: import("effect/Schema").String;
+    readonly channel: import("effect/Schema").String;
+    readonly sessionBinding: import("effect/Schema").Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: import("effect/Schema").Boolean;
+    readonly reason: import("effect/Schema").String;
+}>]>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const stepUpOptionsEndpoint: HttpApiEndpoint.HttpApiEndpoint<"options", "GET", "/options", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly factors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly type: import("effect/Schema").Literals<readonly ["totp", "backup-code", "passkey"]>;
+        readonly type: import("effect/Schema").Literals<readonly ["password", "totp", "backup-code", "passkey"]>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const stepUpTotpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyTotp", "POST", "/totp/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const stepUpTotpVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyTotp", "POST", "/totp/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
+    }>>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const stepUpPasswordVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyPassword", "POST", "/password/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly password: import("effect/Schema").String;
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly type: import("effect/Schema").Literal<"authenticated">;
+    readonly expiresAt: import("effect/Schema").Number;
+    readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
+    readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
+    readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, never, never>;
-export declare const stepUpRecoveryCodeVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCode", "POST", "/recovery-code/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const stepUpRecoveryCodeVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyRecoveryCode", "POST", "/recovery-code/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly code: import("effect/Schema").String;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, never, never>;
-export declare const stepUpPasskeyStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startPasskey", "POST", "/passkey/start", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const stepUpPasskeyStartEndpoint: HttpApiEndpoint.HttpApiEndpoint<"startPasskey", "POST", "/passkey/start", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
     readonly publicKey: import("effect/Schema").Struct<{
@@ -1009,8 +1328,8 @@ export declare const stepUpPasskeyStartEndpoint: HttpApiEndpoint.HttpApiEndpoint
         }>>>;
         readonly userVerification: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["required", "preferred", "discouraged"]>>;
     }>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never>;
-export declare const stepUpPasskeyVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyPasskey", "POST", "/passkey/verify", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const stepUpPasskeyVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyPasskey", "POST", "/passkey/verify", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly challengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly credential: import("effect/Schema").Struct<{
         readonly id: import("effect/Schema").String;
@@ -1021,53 +1340,62 @@ export declare const stepUpPasskeyVerifyEndpoint: HttpApiEndpoint.HttpApiEndpoin
         readonly clientExtensionResults: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
     }>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const loginApprovalApproveEndpoint: HttpApiEndpoint.HttpApiEndpoint<"approve", "POST", "/approve", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthStepUpRequiredError | typeof AuthRateLimitedError | typeof AuthRequestRejectedError | typeof AuthInternalError>, never, never>;
+export declare const loginApprovalApproveEndpoint: HttpApiEndpoint.HttpApiEndpoint<"approve", "POST", "/approve", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly approvalChallengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly secret: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly rememberDevice: import("effect/Schema").optional<import("effect/Schema").Boolean>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const loginApprovalStatusEndpoint: HttpApiEndpoint.HttpApiEndpoint<"status", "POST", "/status", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
+export declare const loginApprovalStatusEndpoint: HttpApiEndpoint.HttpApiEndpoint<"status", "POST", "/status", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly approvalChallengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly status: import("effect/Schema").Literals<readonly ["pending", "approved", "denied", "expired"]>;
     readonly expiresAt: import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
-export declare const loginApprovalFinalizeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"finalize", "POST", "/finalize", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
+export declare const loginApprovalFinalizeEndpoint: HttpApiEndpoint.HttpApiEndpoint<"finalize", "POST", "/finalize", never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly flowId: import("effect/Schema").brand<import("effect/Schema").String, "auth/AuthFlowId">;
     readonly approvalChallengeId: import("effect/Schema").brand<import("effect/Schema").String, "auth/ChallengeId">;
     readonly rememberDevice: import("effect/Schema").optional<import("effect/Schema").Boolean>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<import("effect/Schema").Struct<{
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
     readonly type: import("effect/Schema").Literal<"authenticated">;
     readonly expiresAt: import("effect/Schema").Number;
     readonly aal: import("effect/Schema").Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: import("effect/Schema").$Array<import("effect/Schema").String>;
     readonly mfaVerifiedAt: import("effect/Schema").optional<import("effect/Schema").brand<import("effect/Schema").Number, "auth/UnixMillis">>;
     readonly claims: import("effect/Schema").optional<import("effect/Schema").Struct<{
-        readonly emailVerified: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly verifiedIdentityKinds: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
         readonly requirements: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").String>>;
+        readonly recoveryEnrollment: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            readonly allowed: import("effect/Schema").$Array<import("effect/Schema").String>;
+        }>>;
     }>>;
-}>>, HttpApiEndpoint.Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
+}>>, import("effect/Schema").toCodecJson<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, never, never>;
 //# sourceMappingURL=Endpoints.d.ts.map