@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/HttpApi/Api.d.ts

@@ -1,60 +1,68 @@
-import { Context, Effect, Layer, Redacted } from "effect";
+import { Context, Effect, Layer, Option, Redacted } from "effect";
 import type { Duration, Schema } from "effect";
-import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";
-import { ApiKeyId } from "../ApiKey.js";
+import { ApiKeyId, ApiKeyManagement } from "../ApiKey.js";
 import type { ApiKeyCreateForUserInput, ApiKeyManagementRevokeInput, ApiKeyManagementService } from "../ApiKey.js";
-import type { JwksDocument, JwksService, JwtAudience, JwtIssueInput, JwtIssuerService, JwtRevokeJwtIdInput, JwtRevocationService, JwtVerifyInput } from "../Jwt.js";
-import { Jwks } from "../Jwt.js";
 import { AuthFlow, AuthFlowState, AuthResult } from "../AuthFlow.js";
-import type { AuthFlowService, AuthFlowStateService, LoginApprovalFinalizeService } from "../AuthFlow.js";
+import type { AuthFlowService, AuthFlowFinalize, AuthFlowStateService, LoginApprovalFinalizeService } from "../AuthFlow.js";
+import { AuthRateLimit } from "../AuthRateLimit.js";
+import { EmailAuth } from "../EmailAuth.js";
+import type { EmailAuthService } from "../EmailAuth.js";
 import { EmailOtpLogin } from "../EmailOtp.js";
-import type { EmailOtpLoginService, EmailOtpStartInput, EmailOtpVerifyInput } from "../EmailOtp.js";
+import type { EmailOtpLoginService } from "../EmailOtp.js";
 import { EmailVerification, EmailVerificationFlow } from "../EmailVerification.js";
-import type { EmailVerificationFlowService, EmailVerificationService, EmailVerificationIssueInput, EmailVerificationVerifyInput } from "../EmailVerification.js";
-import type { Email, OAuthClientId, OAuthProviderId, SessionId, UnixMillis, UserId } from "../Identifiers.js";
+import type { EmailVerificationFlowService, EmailVerificationService, EmailVerificationVerifyInput } from "../EmailVerification.js";
+import type { OAuthClientId, OAuthProviderId, PermissionId, SessionId, UnixMillis, UserId } from "../Identifiers.js";
+import { ChallengeId, CredentialId } from "../Identifiers.js";
+import { IdentityManagement } from "../IdentityManagement.js";
+import type { IdentityManagementError, IdentityManagementService } from "../IdentityManagement.js";
+import type { JwksDocument, JwksService, JwtAudience, JwtIssueInput, JwtIssuerService, JwtRevokeJwtIdInput, JwtRevocationService, JwtVerifyInput } from "../Jwt.js";
+import { Jwks, JwtIssuer, JwtRevocation } from "../Jwt.js";
 import { LoginApproval } from "../LoginApproval.js";
 import type { LoginApprovalReviewService, LoginApprovalService, LoginApprovalVerifyInput } from "../LoginApproval.js";
-import type { LoginRequestContext } from "../LoginRisk.js";
 import type { LoginNotificationReportInput, LoginNotificationService } from "../LoginNotification.js";
 import { MagicLinkLogin } from "../MagicLink.js";
-import type { MagicLinkLoginService, MagicLinkStartInput, MagicLinkVerifyInput } from "../MagicLink.js";
-import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationCodeTokenGrantService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientCredentialsGrantService, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderAuthorizationService, OAuthProviderConfig, OAuthProvidersService, OAuthRefreshTokenGrantService, OAuthStateService, OAuthTokenIntrospectionService, OAuthTokenRevocationService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
-import { OAuthAuthorizationCodeTokenGrant, OAuthProviderAuthorization } from "../OAuth.js";
-import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset } from "../Password.js";
-import { PasskeyCredentialId } from "../Passkey.js";
+import type { MagicLinkLoginService } from "../MagicLink.js";
+import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderAuthorizationService, OAuthProviderConfig, OAuthProvidersService, OAuthStateService, OAuthTokenIntrospectionService, OAuthTokenRevocationService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
+import { OAuthAuthorizationCodeTokenGrant, OAuthAccountUnlinking, OAuthClientCredentialsGrant, OAuthProviderAuthorization, OAuthProviders, OAuthRefreshTokenGrant, OAuthTokenIntrospection, OAuthTokenRevocation, OAuthLinkConfirmation, OAuthState } from "../OAuth.js";
+import { OAuthDeviceCodeTokenGrant } from "../OAuthDeviceAuthorization.js";
+import { PasskeyCredentialId, PasskeyCredentialManagement, PasskeyOptions, PasskeyVerification } from "../Passkey.js";
 import type { FinishedPasskeyAuthentication, PasskeyAttestation, PasskeyAuthenticationFinishInput, PasskeyAuthenticationStartInput, PasskeyAuthenticatorSelection, PasskeyCredentialManagementService, PasskeyOptionsService, PasskeyPublicKeyCredentialParameters, PasskeyRelyingParty, PasskeyUserVerification, PasskeyVerificationService } from "../Passkey.js";
-import type { PasswordChangeInput, PasswordManagementService, PasswordLoginService, PasswordRegistrationService, PasswordResetService, PasswordResetStartInput, PasswordResetVerifyInput, PasswordSetInput, PasswordSignInInput, PasswordSignUpInput } from "../Password.js";
-import type { RecoveryCodeGenerateForUserInput, RecoveryCodeManagementRevokeInput, RecoveryCodeManagementService, RecoveryCodeVerifyForUserInput } from "../RecoveryCode.js";
+import { PasswordHasher } from "../Password.js";
+import type { PasswordHasherService } from "../Password.js";
+import { PermissionAdministration } from "../Permission.js";
+import type { PermissionDefinitionRecord } from "../Permission.js";
+import type { RecoveryCodeGenerateForUserInput, RecoveryCodeRegenerateForUserInput, RecoveryCodeManagementRevokeInput, RecoveryCodeManagementService, RecoveryCodeVerifyForUserInput, RecoveryCodeLoginCommitStoreService } from "../RecoveryCode.js";
+import { RecoveryCodeLoginCommitStore, RecoveryCodeManagement } from "../RecoveryCode.js";
 import type { RefreshTokenInfo, RefreshTokenManagementService, RefreshTokenRotateInput } from "../RefreshToken.js";
-import { SessionCookie, Sessions } from "../Sessions.js";
-import type { AuthMethodReference, CurrentSessionShape, SessionClaims, SessionCookieService, SessionCreateInput, SessionInfoShape, SessionsService, ValidatedSession } from "../Sessions.js";
+import { RefreshTokenManagement } from "../RefreshToken.js";
 import { SecurityTimelineStore } from "../SecurityTimeline.js";
 import type { SecurityTimelineEvent, SecurityTimelineStoreService } from "../SecurityTimeline.js";
-import { UserStore } from "../Storage.js";
-import type { UserStoreService } from "../Storage.js";
-import type { TotpAlgorithm, TotpEnrollmentConfirmInput, TotpEnrollmentStartInput, TotpFactorManagementService, TotpFactorManagementRevokeInput, TotpVerifyForUserInput } from "../Totp.js";
+import { SessionCookie, Sessions, RecoveryCodeSessionRotation, TotpSessionRotation } from "../Sessions.js";
+import type { CurrentActorShape, CurrentSessionShape, SessionClaims, SessionCookieService, SessionCreateInput, SessionInfoShape, SessionsService, RecoveryCodeSessionRotationService, TotpSessionRotationService, ValidatedSession } from "../Sessions.js";
+import { CredentialStore, IdentityStore, UserStore, VerificationStore } from "../Storage.js";
+import type { CredentialStoreService, IdentityStoreService, UserStoreService, VerificationStoreService } from "../Storage.js";
+import type { StrongFactorRemovalPolicyService } from "../StrongFactor.js";
+import type { TotpAlgorithm, TotpEnrollmentConfirmInput, TotpEnrollmentStartInput, TotpFactorManagementService, TotpFactorManagementRevokeInput, TotpVerifyForUserInput, TotpLoginCommitStoreService } from "../Totp.js";
+import { TotpFactorManagement, TotpLoginCommitStore } from "../Totp.js";
 import { TrustedDeviceStore } from "../TrustedDevice.js";
 import type { TrustedDeviceRecord, TrustedDeviceCookieService, TrustedDeviceService, TrustedDeviceStoreService } from "../TrustedDevice.js";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError } from "./Errors.js";
-import { OAuthProviderAuthorizationQuery } from "./Schemas.js";
-import type { AdminSecurityTimelineListQuery, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, ApiKeyCreateBody, ApiKeyRevokeBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtJwksBody, JwtRevokeBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasswordChangeBody, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
-import { AuthApiRateLimit, AuthOriginCheckMiddleware, AuthRateLimitMiddleware } from "./Security.js";
-import type { AuthApiRateLimitService } from "./Security.js";
+import { EmailAuthHttpApiGroup, EmailOtpHttpApiGroup, EmailVerificationHttpApiGroup, IdentityHttpApiGroup, LoginApprovalHttpApiGroup, MagicLinkHttpApiGroup, MfaHttpApiGroup, PasskeyHttpApiGroup, PasswordHttpApiGroup, RecoveryCodesHttpApiGroup, LoginNotificationHttpApiGroup, SessionHttpApiGroup, StepUpHttpApiGroup, TotpHttpApiGroup } from "./ClientApi.js";
+import type { EmailAuthStartGuardRequest, EmailOtpStartGuardRequest, EmailOtpVerifyGuardRequest, EmailVerificationStartGuardRequest, MagicLinkStartGuardRequest, MagicLinkVerifyGuardRequest } from "./EmailGuards.js";
+import { AuthBadRequestError, AuthConflictError, AuthIdentityAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthNotFoundError, AuthPolicyDeniedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError } from "./Errors.js";
+import type { IdentityAvailabilityGuardRequest } from "./IdentityGuards.js";
+import { AuthOriginCheckMiddleware, OAuthNoStoreMiddleware } from "./Middleware.js";
+import { AdminSecurityTimelineHttpOperations, AdminPermissionDefinitionHttpOperations, type AdminPermissionDefinitionHttpOperationRequirements, AdminSessionHttpOperations, AdminTrustedDeviceHttpOperations, ApiKeyHttpOperations, EmailAuthHttpOperations, EmailOtpHttpOperations, EmailVerificationHttpOperations, JwtDiscoveryHttpOperations, JwtHttpOperations, LoginApprovalHttpOperations, MagicLinkHttpOperations, MfaHttpOperations, OAuthHttpOperations, OAuthProviderAuthorizationHttpOperations, OAuthTokenHttpOperations, OAuthTokenIntrospectionHttpOperations, OAuthTokenRevocationHttpOperations, OidcDiscoveryHttpOperations, PasskeyHttpOperations, IdentityHttpOperations, RecoveryCodesHttpOperations, RefreshTokenHttpOperations, LoginNotificationHttpOperations, SecurityTimelineHttpOperations, SessionHttpOperations, StepUpHttpOperations, TotpHttpOperations, TrustedDeviceHttpOperations } from "./Operations/index.js";
+import type { AuthRateLimitGuardRequest } from "./RequestGuards.js";
+import { OAuthProviderAuthorizationQuery, OAuthTokenRequestBody } from "./Schemas.js";
+import type { AdminSecurityTimelineListQuery, AdminPermissionDefinitionCreateBody, AdminPermissionDefinitionGetQuery, AdminPermissionDefinitionListQuery, AdminPermissionDefinitionMutationBody, AdminPermissionDefinitionUpdateBody, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, ApiKeyCreateBody, ApiKeyRevokeBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtJwksBody, JwtRevokeBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OAuthTokenResponseBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, IdentityAddBody, IdentityPrimaryBody, IdentityReplaceBody, IdentityRevokeBody, SessionRevokeBody, RecoveryCodeGenerateBody, RecoveryCodeRegenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpPasswordVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
 import { AuthHttp } from "./Transport.js";
 import type { AuthHttpService, LoginApprovalPendingCookieService } from "./Transport.js";
-export declare const passwordSignInInput: (payload: Schema.Schema.Type<typeof PasswordSignInBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => PasswordSignInInput;
-export declare const passwordSignUpInput: (payload: Schema.Schema.Type<typeof PasswordSignUpBody>, request?: LoginRequestContext) => PasswordSignUpInput;
-export declare const passwordResetStartInput: (payload: Schema.Schema.Type<typeof PasswordResetStartBody>) => PasswordResetStartInput;
-export declare const passwordResetVerifyInput: (payload: Schema.Schema.Type<typeof PasswordResetVerifyBody>) => PasswordResetVerifyInput;
-export declare const passwordSetInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasswordSetBody>) => PasswordSetInput;
-export declare const passwordChangeInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasswordChangeBody>) => PasswordChangeInput;
-export declare const emailVerificationStartInput: (payload: Schema.Schema.Type<typeof EmailVerificationStartBody>) => EmailVerificationIssueInput;
+export { AuthClientProtocolApi, EmailAuthHttpApiGroup, EmailOtpHttpApiGroup, EmailVerificationHttpApiGroup, IdentityHttpApiGroup, LoginApprovalHttpApiGroup, MagicLinkHttpApiGroup, MfaHttpApiGroup, PasskeyHttpApiGroup, PasswordHttpApiGroup, RecoveryCodesHttpApiGroup, LoginNotificationHttpApiGroup, SessionHttpApiGroup, StepUpHttpApiGroup, TotpHttpApiGroup, } from "./ClientApi.js";
+export { makePasswordChangeHandler, makePasswordResetStartHandler, makePasswordResetVerifyHandler, makePasswordSetHandler, makePasswordSignInHandler, makePasswordSignUpHandler, passwordChangeInput, passwordSetInput, PasswordHttpApi, PasswordHttpApiGroupLive, PasswordHttpApiLive, PasswordHttpOperationsLive, } from "./Password.js";
+export type { PasswordChangeHandlerRequest, PasswordResetStartHandlerRequest, PasswordResetVerifyHandlerRequest, PasswordSetHandlerRequest, PasswordSignInHandlerRequest, PasswordSignUpHandlerRequest, } from "./Password.js";
 export declare const emailVerificationVerifyInput: (payload: Schema.Schema.Type<typeof EmailVerificationVerifyBody>) => EmailVerificationVerifyInput;
-export declare const emailOtpStartInput: (payload: Schema.Schema.Type<typeof EmailOtpStartBody>) => EmailOtpStartInput;
-export declare const emailOtpVerifyInput: (payload: Schema.Schema.Type<typeof EmailOtpVerifyBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => EmailOtpVerifyInput;
-export declare const magicLinkStartInput: (payload: Schema.Schema.Type<typeof MagicLinkStartBody>) => MagicLinkStartInput;
-export declare const magicLinkVerifyInput: (payload: Schema.Schema.Type<typeof MagicLinkVerifyBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => MagicLinkVerifyInput;
 export interface OAuthAuthorizationCodeVerifierStoreInput {
     readonly payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>;
     readonly started: StartedOAuthAuthorization;
@@ -79,7 +87,7 @@ export interface OAuthTokenClientAuthenticationInput {
 export interface OAuthTokenClientAuthenticationHttpOptions {
     readonly authenticateClient?: (input: OAuthTokenClientAuthenticationInput) => Effect.Effect<boolean, unknown>;
 }
-export interface OAuthAuthorizationCodeTokenHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
+export interface OAuthTokenHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
 }
 export interface OAuthTokenRevocationHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
 }
@@ -122,7 +130,7 @@ export declare const oauthAuthorizationStartedHttpBody: (started: StartedOAuthAu
     providerId: OAuthProviderId;
     authorizationUrl: string;
     state: import("../OAuth.js").OAuthStateToken;
-    challengeId: import("../Identifiers.js").ChallengeId;
+    challengeId: ChallengeId;
     expiresAt: UnixMillis;
     codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
     codeChallengeMethod: "S256";
@@ -138,6 +146,40 @@ export declare const oauthLinkConfirmationPendingHttpBody: (pending: PendingOAut
 export declare const oauthAuthorizationCallbackQueryPayload: (input: OAuthAuthorizationCallbackPayloadInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, AuthBadRequestError>;
 export declare const oauthAuthorizationCallbackFormPostPayload: (input: OAuthAuthorizationCallbackPayloadInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, AuthBadRequestError>;
 export declare const oauthAuthorizationCallbackInput: (payload: Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, options: OAuthAuthorizationCallbackHttpOptions) => Effect.Effect<OAuthCallbackInput, AuthBadRequestError>;
+export interface OAuthTokenGrantHandlerInput {
+    readonly payload: Schema.Schema.Type<typeof OAuthTokenRequestBody>;
+    readonly clientId?: OAuthClientId;
+    readonly clientAuthenticated: boolean;
+}
+export type OAuthTokenGrantHandler = (input: OAuthTokenGrantHandlerInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthTokenResponseBody>, OAuthTokenEndpointError | AuthInternalError>;
+export interface OAuthTokenGrantRegistration {
+    readonly grantType: string;
+    readonly exchange: OAuthTokenGrantHandler;
+}
+declare const OAuthTokenGrantRegistryDuplicateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenGrantRegistryDuplicateError";
+} & Readonly<A>;
+export declare class OAuthTokenGrantRegistryDuplicateError extends OAuthTokenGrantRegistryDuplicateError_base<{
+    readonly grantType: string;
+}> {
+}
+export interface OAuthTokenGrantRegistryService {
+    readonly get: (grantType: string) => Option.Option<OAuthTokenGrantRegistration>;
+}
+declare const OAuthTokenGrantRegistry_base: Context.ServiceClass<OAuthTokenGrantRegistry, "auth/HttpApi/OAuthTokenGrantRegistry", OAuthTokenGrantRegistryService>;
+export declare class OAuthTokenGrantRegistry extends OAuthTokenGrantRegistry_base {
+}
+export declare namespace OAuthTokenGrantRegistry {
+    const make: (registrations: readonly OAuthTokenGrantRegistration[]) => Effect.Effect<OAuthTokenGrantRegistryService, OAuthTokenGrantRegistryDuplicateError>;
+}
+type OAuthTokenRegistrationEffect = Effect.Effect<OAuthTokenGrantRegistration, unknown, unknown>;
+type OAuthTokenRegistrationError<T> = T extends Effect.Effect<unknown, infer E, unknown> ? E : never;
+type OAuthTokenRegistrationContext<T> = T extends Effect.Effect<unknown, unknown, infer R> ? R : never;
+export declare const OAuthTokenGrantRegistryLive: <const Registrations extends readonly OAuthTokenRegistrationEffect[]>(...registrations: Registrations) => Layer.Layer<OAuthTokenGrantRegistry, OAuthTokenGrantRegistryDuplicateError | OAuthTokenRegistrationError<Registrations[number]>, OAuthTokenRegistrationContext<Registrations[number]>>;
+export declare const oauthAuthorizationCodeTokenGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthAuthorizationCodeTokenGrant>;
+export declare const oauthRefreshTokenGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthRefreshTokenGrant>;
+export declare const oauthClientCredentialsGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthClientCredentialsGrant>;
+export declare const oauthDeviceCodeTokenGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthDeviceCodeTokenGrant>;
 export interface OAuthAccountUnlinkStepUpHttpInput {
     readonly payload: Schema.Schema.Type<typeof OAuthAccountUnlinkBody>;
     readonly session: ValidatedSession;
@@ -175,6 +217,17 @@ export interface PasskeyFinishHttpOptions {
     readonly expectedOrigin: string | readonly string[];
     readonly requireUserVerification?: boolean;
 }
+export interface PasskeyRegistrationUser {
+    readonly userName: string;
+    readonly userDisplayName: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface PasskeyRegistrationUserResolverInput {
+    readonly currentSession: CurrentSessionShape;
+    readonly actor?: CurrentActorShape;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}
+export type PasskeyRegistrationUserResolver = (input: PasskeyRegistrationUserResolverInput) => Effect.Effect<PasskeyRegistrationUser, AuthBadRequestError | AuthInternalError>;
 export interface TotpEnrollmentStartHttpOptions {
     readonly issuer: string;
     readonly secretBytes?: number;
@@ -190,18 +243,73 @@ export interface RecoveryCodeGenerateHttpOptions {
     readonly length?: number;
     readonly groupSize?: number;
 }
-export declare const passkeyRegistrationStartInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>, options: PasskeyRegistrationStartHttpOptions) => {
+export interface PasskeyHttpConfigValue {
+    readonly relyingParty: PasskeyRelyingParty;
+    readonly expectedOrigin: string | readonly string[];
+    readonly timeout?: number;
+    readonly pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[];
+    readonly authenticatorSelection?: PasskeyAuthenticatorSelection;
+    readonly attestation?: PasskeyAttestation;
+    readonly userVerification?: PasskeyUserVerification;
+    readonly requireUserVerification?: boolean;
+}
+declare const PasskeyHttpConfig_base: Context.ServiceClass<PasskeyHttpConfig, "auth/http/config/Passkey", PasskeyHttpConfigValue>;
+export declare class PasskeyHttpConfig extends PasskeyHttpConfig_base {
+}
+export declare namespace PasskeyHttpConfig {
+    const make: (config: PasskeyHttpConfigValue) => PasskeyHttpConfigValue;
+}
+export declare const PasskeyHttpConfigLive: (config: PasskeyHttpConfigValue) => Layer.Layer<PasskeyHttpConfig, never, never>;
+export interface TotpHttpConfigValue extends TotpEnrollmentStartHttpOptions, TotpCodeHttpOptions {
+}
+declare const TotpHttpConfig_base: Context.ServiceClass<TotpHttpConfig, "auth/http/config/Totp", TotpHttpConfigValue>;
+export declare class TotpHttpConfig extends TotpHttpConfig_base {
+}
+export declare namespace TotpHttpConfig {
+    const make: (config: TotpHttpConfigValue) => TotpHttpConfigValue;
+}
+export declare const TotpHttpConfigLive: (config: TotpHttpConfigValue) => Layer.Layer<TotpHttpConfig, never, never>;
+export declare const RecoveryCodeHttpConfig: Context.Reference<RecoveryCodeGenerateHttpOptions>;
+export declare const RecoveryCodeHttpConfigLive: (config?: RecoveryCodeGenerateHttpOptions) => Layer.Layer<never, never, never>;
+export interface OAuthHttpConfigValue extends OAuthAuthorizationStartHttpOptions, OAuthAccountUnlinkHttpOptions, OAuthLinkConfirmationStartHttpOptions, OAuthLinkConfirmationConfirmHttpOptions {
+}
+export declare const OAuthHttpConfig: Context.Reference<OAuthHttpConfigValue>;
+export declare const OAuthHttpConfigLive: (config?: OAuthHttpConfigValue) => Layer.Layer<never, never, never>;
+export declare const OAuthTokenHttpConfig: Context.Reference<OAuthTokenClientAuthenticationHttpOptions>;
+export declare const OAuthTokenHttpConfigLive: (config?: OAuthTokenClientAuthenticationHttpOptions) => Layer.Layer<never, never, never>;
+declare const RefreshTokenHttpConfig_base: Context.ServiceClass<RefreshTokenHttpConfig, "auth/http/config/RefreshToken", RefreshTokenRefreshHttpOptions>;
+export declare class RefreshTokenHttpConfig extends RefreshTokenHttpConfig_base {
+}
+export declare namespace RefreshTokenHttpConfig {
+    const make: (config: RefreshTokenRefreshHttpOptions) => RefreshTokenRefreshHttpOptions;
+}
+export declare const RefreshTokenHttpConfigLive: (config: RefreshTokenRefreshHttpOptions) => Layer.Layer<RefreshTokenHttpConfig, never, never>;
+export declare const JwtHttpConfig: Context.Reference<JwtIntrospectionHttpOptions>;
+export declare const JwtHttpConfigLive: (config?: JwtIntrospectionHttpOptions) => Layer.Layer<never, never, never>;
+export declare const passkeyRegistrationStartHttpOptions: (config: PasskeyHttpConfigValue) => PasskeyRegistrationStartHttpOptions;
+export declare const passkeyAuthenticationStartHttpOptions: (config: PasskeyHttpConfigValue) => PasskeyAuthenticationStartHttpOptions;
+export declare const passkeyFinishHttpOptions: (config: PasskeyHttpConfigValue) => PasskeyFinishHttpOptions;
+export declare const passkeyAuthenticationSessionInput: ({ finished, payload, }: PasskeyAuthenticationSessionContext) => SessionCreateInput;
+export declare const passkeyRegistrationStartInput: (userId: UserId, user: PasskeyRegistrationUser, options: PasskeyRegistrationStartHttpOptions) => {
+    metadata?: undefined;
     relyingParty: PasskeyRelyingParty;
-    userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    userId: UserId;
+    userName: string;
+    userDisplayName: string;
+    timeout?: number | undefined;
+    pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[] | undefined;
+    authenticatorSelection?: PasskeyAuthenticatorSelection | undefined;
+    attestation?: PasskeyAttestation | undefined;
+} | {
+    metadata: Readonly<Record<string, unknown>>;
+    relyingParty: PasskeyRelyingParty;
+    userId: UserId;
     userName: string;
     userDisplayName: string;
     timeout?: number | undefined;
     pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[] | undefined;
     authenticatorSelection?: PasskeyAuthenticatorSelection | undefined;
     attestation?: PasskeyAttestation | undefined;
-    metadata?: {
-        readonly [x: string]: unknown;
-    } | undefined;
 };
 export declare const passkeyAuthenticationStartInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>, options: PasskeyAuthenticationStartHttpOptions) => {
     relyingPartyId: string;
@@ -213,9 +321,29 @@ export declare const passkeyAuthenticationStartInput: (payload: Schema.Schema.Ty
     } | undefined;
 };
 export declare const passkeyMfaStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>, options: PasskeyAuthenticationStartHttpOptions) => PasskeyAuthenticationStartInput;
-export declare const passkeyRegistrationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>, options: PasskeyFinishHttpOptions) => {
+export declare const passkeyRegistrationFinishInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>, user: PasskeyRegistrationUser, options: PasskeyFinishHttpOptions) => {
+    metadata?: undefined;
     challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
-    userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    userId: UserId;
+    response: {
+        readonly id: string;
+        readonly rawId?: string | undefined;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    requireUserVerification?: boolean | undefined;
+} | {
+    metadata: Readonly<Record<string, unknown>>;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    userId: UserId;
     response: {
         readonly id: string;
         readonly rawId?: string | undefined;
@@ -231,9 +359,6 @@ export declare const passkeyRegistrationFinishInput: (payload: Schema.Schema.Typ
     relyingPartyId: string;
     expectedOrigin: string | readonly string[];
     requireUserVerification?: boolean | undefined;
-    metadata?: {
-        readonly [x: string]: unknown;
-    } | undefined;
 };
 export declare const passkeyAuthenticationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>, options: PasskeyFinishHttpOptions) => {
     challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
@@ -257,7 +382,7 @@ export declare const passkeyAuthenticationFinishInput: (payload: Schema.Schema.T
         readonly [x: string]: unknown;
     } | undefined;
 };
-export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>, options: PasskeyFinishHttpOptions) => {
+export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>, options: PasskeyFinishHttpOptions, expectedUserId?: UserId) => {
     challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
     response: {
         readonly id: string;
@@ -274,7 +399,10 @@ export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof
     userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
     relyingPartyId: string;
     expectedOrigin: string | readonly string[];
-    requireUserVerification?: boolean | undefined;
+    requireUserVerification: boolean;
+    expectedChallengeMetadata: {
+        flowId: string & import("effect/Brand").Brand<"auth/AuthFlowId">;
+    };
     metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
@@ -289,6 +417,7 @@ export declare const totpEnrollmentConfirmInput: (userId: UserId, payload: Schem
 export declare const totpVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
 export declare const totpFactorRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpFactorRevokeBody>) => TotpFactorManagementRevokeInput;
 export declare const recoveryCodeGenerateInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeGenerateBody>, options?: RecoveryCodeGenerateHttpOptions) => RecoveryCodeGenerateForUserInput;
+export declare const recoveryCodeRegenerateInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeRegenerateBody>, options?: RecoveryCodeGenerateHttpOptions) => RecoveryCodeRegenerateForUserInput;
 export declare const recoveryCodeVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeVerifyBody>) => RecoveryCodeVerifyForUserInput;
 export declare const recoveryCodeRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeRevokeBody>) => RecoveryCodeManagementRevokeInput;
 export declare const apiKeyCreateInput: (userId: UserId, payload: Schema.Schema.Type<typeof ApiKeyCreateBody>) => ApiKeyCreateForUserInput;
@@ -318,6 +447,12 @@ export declare const totpMfaVerifyForFlowInput: (userId: UserId, payload: Schema
 export declare const recoveryCodeMfaVerifyInput: (payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>) => RecoveryCodeVerifyForUserInput;
 export declare const recoveryCodeMfaVerifyForFlowInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyForFlowBody>) => RecoveryCodeVerifyForUserInput;
 export declare const stepUpTotpVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpTotpVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const stepUpPasswordVerifyInput: (payload: Schema.Schema.Type<typeof StepUpPasswordVerifyBody>) => {
+    password: Redacted.Redacted<string>;
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+};
 export declare const stepUpRecoveryCodeVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpRecoveryCodeVerifyBody>) => RecoveryCodeVerifyForUserInput;
 export declare const stepUpPasskeyStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpPasskeyStartBody>, options: PasskeyAuthenticationStartHttpOptions) => PasskeyAuthenticationStartInput;
 export declare const stepUpPasskeyVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpPasskeyVerifyBody>, options: PasskeyFinishHttpOptions) => PasskeyAuthenticationFinishInput;
@@ -346,8 +481,8 @@ export declare const adminSessionHttpBody: (session: SessionInfoShape) => {
     authTime: UnixMillis;
     lastSeenAt?: UnixMillis | undefined;
     expiresAt: UnixMillis;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
+    aal: import("../Assurance.js").AssuranceLevel;
+    amr: readonly import("../Assurance.js").AuthMethodReference[];
     mfaVerifiedAt?: UnixMillis | undefined;
     ip?: string | undefined;
     userAgent?: string | undefined;
@@ -360,39 +495,23 @@ export declare const adminSessionHttpBody: (session: SessionInfoShape) => {
 export declare const stepUpAuthenticatedHttpBody: (session: CurrentSessionShape) => {
     type: "authenticated";
     expiresAt: number;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
+    aal: import("../Assurance.js").AssuranceLevel;
+    amr: readonly import("../Assurance.js").AuthMethodReference[];
     mfaVerifiedAt?: UnixMillis | undefined;
 } | {
     type: "authenticated";
     expiresAt: number;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
+    aal: import("../Assurance.js").AssuranceLevel;
+    amr: readonly import("../Assurance.js").AuthMethodReference[];
     mfaVerifiedAt?: UnixMillis | undefined;
     claims: SessionClaims;
 };
-export type PasswordSignInHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof PasswordSignInBody>;
-    readonly request?: HttpServerRequest.HttpServerRequest;
-};
-export type PasswordSignUpHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof PasswordSignUpBody>;
-    readonly request?: HttpServerRequest.HttpServerRequest;
-};
-export type PasswordResetStartHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof PasswordResetStartBody>;
-};
-export type PasswordResetVerifyHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof PasswordResetVerifyBody>;
-};
-export type PasswordSetHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof PasswordSetBody>;
-    readonly request: HttpServerRequest.HttpServerRequest;
-};
-export type PasswordChangeHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof PasswordChangeBody>;
-    readonly request: HttpServerRequest.HttpServerRequest;
-};
+type AuthRateLimitHandlerRequestData = AuthRateLimitGuardRequest;
+export declare const makePasskeyRegistrationUserResolver: (dependencies: {
+    readonly users: UserStoreService;
+    readonly identities: IdentityStoreService;
+}) => PasskeyRegistrationUserResolver;
+export declare const identityHttpError: (error: IdentityManagementError) => AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError;
 export type SessionHandlerRequest = {
     readonly request: HttpServerRequest.HttpServerRequest;
 };
@@ -426,8 +545,39 @@ export interface AdminSessionAuthorizationService {
 declare const AdminSessionAuthorization_base: Context.ServiceClass<AdminSessionAuthorization, "auth/AdminSessionAuthorization", AdminSessionAuthorizationService>;
 export declare class AdminSessionAuthorization extends AdminSessionAuthorization_base {
 }
-export declare namespace AdminSessionAuthorization {
-    const make: (service: AdminSessionAuthorizationService) => AdminSessionAuthorizationService;
+export type AdminPermissionDefinitionCreateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof AdminPermissionDefinitionCreateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminPermissionDefinitionGetHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof AdminPermissionDefinitionGetQuery>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminPermissionDefinitionListHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof AdminPermissionDefinitionListQuery>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminPermissionDefinitionUpdateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof AdminPermissionDefinitionUpdateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminPermissionDefinitionMutationHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof AdminPermissionDefinitionMutationBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type AdminPermissionDefinitionAuthorizationAction = "create" | "get" | "list" | "update" | "disable" | "enable" | "delete";
+export interface AdminPermissionDefinitionAuthorizationInput {
+    readonly currentSession: CurrentSessionShape;
+    readonly action: AdminPermissionDefinitionAuthorizationAction;
+    readonly request: HttpServerRequest.HttpServerRequest;
+    readonly permissionId?: PermissionId;
+    readonly scopeType?: string | null;
+}
+export interface AdminPermissionDefinitionAuthorizationService {
+    readonly authorize: (input: AdminPermissionDefinitionAuthorizationInput) => Effect.Effect<void, AuthPolicyDeniedError | AuthInternalError>;
+}
+declare const AdminPermissionDefinitionAuthorization_base: Context.ServiceClass<AdminPermissionDefinitionAuthorization, "auth/AdminPermissionDefinitionAuthorization", AdminPermissionDefinitionAuthorizationService>;
+export declare class AdminPermissionDefinitionAuthorization extends AdminPermissionDefinitionAuthorization_base {
 }
 export type LoginNotificationReportHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof LoginNotificationReportBody>;
@@ -451,9 +601,6 @@ export interface AdminSecurityTimelineAuthorizationService {
 declare const AdminSecurityTimelineAuthorization_base: Context.ServiceClass<AdminSecurityTimelineAuthorization, "auth/AdminSecurityTimelineAuthorization", AdminSecurityTimelineAuthorizationService>;
 export declare class AdminSecurityTimelineAuthorization extends AdminSecurityTimelineAuthorization_base {
 }
-export declare namespace AdminSecurityTimelineAuthorization {
-    const make: (service: AdminSecurityTimelineAuthorizationService) => AdminSecurityTimelineAuthorizationService;
-}
 export type TrustedDeviceListHandlerRequest = {
     readonly request: HttpServerRequest.HttpServerRequest;
 };
@@ -483,30 +630,16 @@ export interface AdminTrustedDeviceAuthorizationService {
 declare const AdminTrustedDeviceAuthorization_base: Context.ServiceClass<AdminTrustedDeviceAuthorization, "auth/AdminTrustedDeviceAuthorization", AdminTrustedDeviceAuthorizationService>;
 export declare class AdminTrustedDeviceAuthorization extends AdminTrustedDeviceAuthorization_base {
 }
-export declare namespace AdminTrustedDeviceAuthorization {
-    const make: (service: AdminTrustedDeviceAuthorizationService) => AdminTrustedDeviceAuthorizationService;
-}
-export type EmailVerificationStartHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof EmailVerificationStartBody>;
-};
+export type EmailVerificationStartHandlerRequest = EmailVerificationStartGuardRequest;
 export type EmailVerificationVerifyHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof EmailVerificationVerifyBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
-export type EmailOtpStartHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof EmailOtpStartBody>;
-};
-export type EmailOtpVerifyHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof EmailOtpVerifyBody>;
-    readonly request?: HttpServerRequest.HttpServerRequest;
-};
-export type MagicLinkStartHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof MagicLinkStartBody>;
-};
-export type MagicLinkVerifyHandlerRequest = {
-    readonly payload: Schema.Schema.Type<typeof MagicLinkVerifyBody>;
-    readonly request?: HttpServerRequest.HttpServerRequest;
-};
+export type EmailOtpStartHandlerRequest = EmailOtpStartGuardRequest;
+export type EmailOtpVerifyHandlerRequest = EmailOtpVerifyGuardRequest;
+export type EmailAuthStartHandlerRequest = EmailAuthStartGuardRequest;
+export type MagicLinkStartHandlerRequest = MagicLinkStartGuardRequest;
+export type MagicLinkVerifyHandlerRequest = MagicLinkVerifyGuardRequest;
 export type OAuthAuthorizationStartHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>;
 };
@@ -537,16 +670,18 @@ export type OAuthLinkConfirmationConfirmHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof OAuthLinkConfirmationConfirmBody>;
     readonly request?: HttpServerRequest.HttpServerRequest;
 };
-export type PasskeyRegistrationStartHandlerRequest = {
+export type PasskeyRegistrationStartHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
 };
-export type PasskeyRegistrationFinishHandlerRequest = {
+export type PasskeyRegistrationFinishHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
 };
-export type PasskeyAuthenticationStartHandlerRequest = {
+export type PasskeyAuthenticationStartHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>;
 };
-export type PasskeyAuthenticationFinishHandlerRequest = {
+export type PasskeyAuthenticationFinishHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>;
     readonly request?: HttpServerRequest.HttpServerRequest;
 };
@@ -580,6 +715,10 @@ export type RecoveryCodeGenerateHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof RecoveryCodeGenerateBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type RecoveryCodeRegenerateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeRegenerateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
 export type RecoveryCodeVerifyHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof RecoveryCodeVerifyBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
@@ -620,29 +759,26 @@ export interface OidcDiscoveryMetadataService {
 declare const OidcDiscoveryMetadata_base: Context.ServiceClass<OidcDiscoveryMetadata, "auth/OidcDiscoveryMetadata", OidcDiscoveryMetadataService>;
 export declare class OidcDiscoveryMetadata extends OidcDiscoveryMetadata_base {
 }
-export declare namespace OidcDiscoveryMetadata {
-    const make: (service: OidcDiscoveryMetadataService) => OidcDiscoveryMetadataService;
-}
 export declare const OidcDiscoveryMetadataLive: (metadata: OidcDiscoveryMetadataShape) => Layer.Layer<OidcDiscoveryMetadata, never, never>;
-export type TotpMfaVerifyHandlerRequest = {
+export type TotpMfaVerifyHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>;
 };
-export type TotpMfaVerifyForFlowHandlerRequest = {
+export type TotpMfaVerifyForFlowHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyForFlowBody>;
 };
-export type MfaOptionsHandlerRequest = {
+export type MfaOptionsHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof MfaOptionsBody>;
 };
-export type RecoveryCodeMfaVerifyHandlerRequest = {
+export type RecoveryCodeMfaVerifyHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>;
 };
-export type RecoveryCodeMfaVerifyForFlowHandlerRequest = {
+export type RecoveryCodeMfaVerifyForFlowHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyForFlowBody>;
 };
-export type PasskeyMfaStartHandlerRequest = {
+export type PasskeyMfaStartHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>;
 };
-export type PasskeyMfaVerifyHandlerRequest = {
+export type PasskeyMfaVerifyHandlerRequest = AuthRateLimitHandlerRequestData & {
     readonly payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>;
 };
 export type StepUpOptionsHandlerRequest = {
@@ -652,6 +788,10 @@ export type StepUpTotpVerifyHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof StepUpTotpVerifyBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type StepUpPasswordVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof StepUpPasswordVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
 export type StepUpRecoveryCodeVerifyHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof StepUpRecoveryCodeVerifyBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
@@ -680,41 +820,11 @@ export type LoginApprovalFinalizeHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
-export declare const makePasswordSignInHandler: (dependencies: {
-    readonly password: PasswordLoginService;
-    readonly authHttp: AuthHttpService;
-    readonly emailVerificationFlow?: EmailVerificationFlowService;
-    readonly authApiRateLimit?: AuthApiRateLimitService;
-    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
-}) => (args_0: PasswordSignInHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | import("./Transport.js").PasswordSignInHttpError, never>;
-export declare const makePasswordSignUpHandler: (dependencies: {
-    readonly registration: PasswordRegistrationService;
-    readonly authHttp: AuthHttpService;
-    readonly emailVerificationFlow?: EmailVerificationFlowService;
-    readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: PasswordSignUpHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthEmailAlreadyRegisteredError | AuthRateLimitedError | import("./Transport.js").PasswordSignUpHttpError, never>;
-export declare const makePasswordResetStartHandler: (dependencies: {
-    readonly passwordReset: PasswordResetService;
-    readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: PasswordResetStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthRateLimitedError, never>;
-export declare const makePasswordResetVerifyHandler: (dependencies: {
-    readonly passwordReset: PasswordResetService;
-}) => (args_0: PasswordResetVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError, never>;
-export declare const makePasswordSetHandler: (dependencies: {
-    readonly passwordManagement: PasswordManagementService;
-    readonly sessions: SessionsService;
-    readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasswordSetHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
-export declare const makePasswordChangeHandler: (dependencies: {
-    readonly passwordManagement: PasswordManagementService;
-    readonly sessions: SessionsService;
-    readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasswordChangeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeCurrentSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRefreshSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
@@ -728,7 +838,7 @@ export declare const makeLogoutHandler: (dependencies: {
 export declare const makeListSessionsHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: SessionHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: SessionHandlerRequest) => Effect.Effect<{
     sessions: {
         sessionId: SessionId;
         userId: UserId;
@@ -736,8 +846,8 @@ export declare const makeListSessionsHandler: (dependencies: {
         authTime: UnixMillis;
         lastSeenAt?: UnixMillis | undefined;
         expiresAt: UnixMillis;
-        aal: import("../Sessions.js").AuthAssuranceLevel;
-        amr: readonly AuthMethodReference[];
+        aal: import("../Assurance.js").AssuranceLevel;
+        amr: readonly import("../Assurance.js").AuthMethodReference[];
         mfaVerifiedAt?: UnixMillis | undefined;
         current: boolean;
         claims?: SessionClaims | undefined;
@@ -755,16 +865,16 @@ export declare const makeRevokeSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: SessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: SessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRevokeOtherSessionsHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeAdminSessionListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authorization: AdminSessionAuthorizationService;
-}) => (args_0: AdminSessionListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: AdminSessionListHandlerRequest) => Effect.Effect<{
     sessions: {
         sessionId: SessionId;
         userId: UserId;
@@ -772,8 +882,8 @@ export declare const makeAdminSessionListHandler: (dependencies: {
         authTime: UnixMillis;
         lastSeenAt?: UnixMillis | undefined;
         expiresAt: UnixMillis;
-        aal: import("../Sessions.js").AuthAssuranceLevel;
-        amr: readonly AuthMethodReference[];
+        aal: import("../Assurance.js").AssuranceLevel;
+        amr: readonly import("../Assurance.js").AuthMethodReference[];
         mfaVerifiedAt?: UnixMillis | undefined;
         ip?: string | undefined;
         userAgent?: string | undefined;
@@ -788,18 +898,93 @@ export declare const makeAdminSessionRevokeHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authorization: AdminSessionAuthorizationService;
-}) => (args_0: AdminSessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: AdminSessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeAdminSessionRevokeAllHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly authorization: AdminSessionAuthorizationService;
-}) => (args_0: AdminSessionRevokeAllHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: AdminSessionRevokeAllHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
+export declare const adminPermissionDefinitionHttpBody: (definition: PermissionDefinitionRecord) => {
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+};
+export declare const adminPermissionDefinitionCreateOperation: (handlerRequest: AdminPermissionDefinitionCreateHandlerRequest) => Effect.Effect<{
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
+export declare const adminPermissionDefinitionGetOperation: (handlerRequest: AdminPermissionDefinitionGetHandlerRequest) => Effect.Effect<{
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
+export declare const adminPermissionDefinitionListOperation: (handlerRequest: AdminPermissionDefinitionListHandlerRequest) => Effect.Effect<{
+    definitions: {
+        id: PermissionId;
+        description?: string | undefined;
+        scopeType?: string | undefined;
+        createdAt: UnixMillis;
+        updatedAt: UnixMillis;
+        disabledAt?: UnixMillis | undefined;
+        deletedAt?: UnixMillis | undefined;
+    }[];
+    nextAfter?: PermissionId | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
+export declare const adminPermissionDefinitionUpdateOperation: (handlerRequest: AdminPermissionDefinitionUpdateHandlerRequest) => Effect.Effect<{
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
+export declare const adminPermissionDefinitionDisableOperation: (handlerRequest: AdminPermissionDefinitionMutationHandlerRequest) => Effect.Effect<{
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
+export declare const adminPermissionDefinitionEnableOperation: (handlerRequest: AdminPermissionDefinitionMutationHandlerRequest) => Effect.Effect<{
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
+export declare const adminPermissionDefinitionDeleteOperation: (handlerRequest: AdminPermissionDefinitionMutationHandlerRequest) => Effect.Effect<{
+    id: PermissionId;
+    description?: string | undefined;
+    scopeType?: string | undefined;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+    disabledAt?: UnixMillis | undefined;
+    deletedAt?: UnixMillis | undefined;
+}, AuthBadRequestError | AuthConflictError | AuthInternalError | AuthNotFoundError | AuthPolicyDeniedError | AuthUnauthenticatedError, AdminPermissionDefinitionAuthorization | PermissionAdministration | SessionCookie | Sessions>;
 export declare const makeLoginNotificationReportHandler: (dependencies: {
     readonly loginNotification?: LoginNotificationService;
 }) => (args_0: LoginNotificationReportHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError, never>;
 export declare const securityTimelineEventHttpBody: (event: SecurityTimelineEvent) => {
     eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-    type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.session.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
+    type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.identity.added" | "auth.identity.primary_changed" | "auth.identity.replaced" | "auth.identity.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.permission.granted" | "auth.permission.revoked" | "auth.permission_definition.created" | "auth.permission_definition.deleted" | "auth.permission_definition.disabled" | "auth.permission_definition.enabled" | "auth.permission_definition.updated" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.role.granted" | "auth.role.revoked" | "auth.role_definition.created" | "auth.role_definition.deleted" | "auth.role_definition.disabled" | "auth.role_definition.enabled" | "auth.role_definition.updated" | "auth.role_permission.assigned" | "auth.role_permission.removed" | "auth.session.assurance_changed" | "auth.session.primary_reauthenticated" | "auth.session.recovery_remediation.completed" | "auth.session.recovery_remediation.entered" | "auth.session.revoked" | "auth.session.step_up_completed" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
     category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
     severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
     occurredAt: UnixMillis;
@@ -820,10 +1005,10 @@ export declare const makeSecurityTimelineListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly securityTimeline: SecurityTimelineStoreService;
-}) => (args_0: SecurityTimelineListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: SecurityTimelineListHandlerRequest) => Effect.Effect<{
     events: {
         eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-        type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.session.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
+        type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.identity.added" | "auth.identity.primary_changed" | "auth.identity.replaced" | "auth.identity.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.permission.granted" | "auth.permission.revoked" | "auth.permission_definition.created" | "auth.permission_definition.deleted" | "auth.permission_definition.disabled" | "auth.permission_definition.enabled" | "auth.permission_definition.updated" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.role.granted" | "auth.role.revoked" | "auth.role_definition.created" | "auth.role_definition.deleted" | "auth.role_definition.disabled" | "auth.role_definition.enabled" | "auth.role_definition.updated" | "auth.role_permission.assigned" | "auth.role_permission.removed" | "auth.session.assurance_changed" | "auth.session.primary_reauthenticated" | "auth.session.recovery_remediation.completed" | "auth.session.recovery_remediation.entered" | "auth.session.revoked" | "auth.session.step_up_completed" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
         category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
         severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
         occurredAt: UnixMillis;
@@ -846,10 +1031,10 @@ export declare const makeAdminSecurityTimelineListHandler: (dependencies: {
     readonly sessionCookie: SessionCookieService;
     readonly securityTimeline: SecurityTimelineStoreService;
     readonly authorization: AdminSecurityTimelineAuthorizationService;
-}) => (args_0: AdminSecurityTimelineListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: AdminSecurityTimelineListHandlerRequest) => Effect.Effect<{
     events: {
         eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
-        type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.session.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
+        type: "auth.api_key.created" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.api_key.verified" | "auth.identity.added" | "auth.identity.primary_changed" | "auth.identity.replaced" | "auth.identity.revoked" | "auth.incident_action.executed" | "auth.jwt.introspected" | "auth.jwt.revoked" | "auth.login.failed" | "auth.login.succeeded" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.link_confirmation.started" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.permission.granted" | "auth.permission.revoked" | "auth.permission_definition.created" | "auth.permission_definition.deleted" | "auth.permission_definition.disabled" | "auth.permission_definition.enabled" | "auth.permission_definition.updated" | "auth.policy.denied" | "auth.recovery_code.generated" | "auth.recovery_code.revoked" | "auth.recovery_code.verified" | "auth.refresh_token.issued" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.refresh_token.rotated" | "auth.risk.assessed" | "auth.role.granted" | "auth.role.revoked" | "auth.role_definition.created" | "auth.role_definition.deleted" | "auth.role_definition.disabled" | "auth.role_definition.enabled" | "auth.role_definition.updated" | "auth.role_permission.assigned" | "auth.role_permission.removed" | "auth.session.assurance_changed" | "auth.session.primary_reauthenticated" | "auth.session.recovery_remediation.completed" | "auth.session.recovery_remediation.entered" | "auth.session.revoked" | "auth.session.step_up_completed" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.revoked" | "auth.totp.factor.verified";
         category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
         severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
         occurredAt: UnixMillis;
@@ -878,7 +1063,7 @@ export declare const makeTrustedDeviceListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
-}) => (args_0: TrustedDeviceListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: TrustedDeviceListHandlerRequest) => Effect.Effect<{
     devices: {
         deviceId: string;
         createdAt: UnixMillis;
@@ -891,13 +1076,13 @@ export declare const makeTrustedDeviceRevokeHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
-}) => (args_0: TrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: TrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeAdminTrustedDeviceListHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
     readonly authorization: AdminTrustedDeviceAuthorizationService;
-}) => (args_0: AdminTrustedDeviceListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: AdminTrustedDeviceListHandlerRequest) => Effect.Effect<{
     devices: {
         deviceId: string;
         createdAt: UnixMillis;
@@ -911,11 +1096,10 @@ export declare const makeAdminTrustedDeviceRevokeHandler: (dependencies: {
     readonly sessionCookie: SessionCookieService;
     readonly trustedDevices: TrustedDeviceStoreService;
     readonly authorization: AdminTrustedDeviceAuthorizationService;
-}) => (args_0: AdminTrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: AdminTrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
 export declare const makeEmailVerificationStartHandler: (dependencies: {
     readonly emailVerificationFlow: EmailVerificationFlowService;
-    readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: EmailVerificationStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthRateLimitedError, never>;
+}) => (handlerRequest: EmailVerificationStartGuardRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError, AuthRateLimit | IdentityStore>;
 export declare const makeEmailVerificationVerifyHandler: (dependencies: {
     readonly emailVerification: EmailVerificationService;
     readonly sessions: SessionsService;
@@ -923,25 +1107,64 @@ export declare const makeEmailVerificationVerifyHandler: (dependencies: {
 }) => (args_0: EmailVerificationVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
 export declare const makeEmailOtpStartHandler: (dependencies: {
     readonly emailOtp: EmailOtpLoginService;
-    readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: EmailOtpStartHandlerRequest) => Effect.Effect<import("../EmailOtp.js").EmailOtpStarted, AuthInternalError | AuthRateLimitedError, never>;
+}) => (handlerRequest: EmailOtpStartGuardRequest) => Effect.Effect<{
+    challengeId: ChallengeId;
+    identity: Schema.Struct.ReadonlySide<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }, "Type">;
+    expiresAt: UnixMillis;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError, AuthRateLimit>;
 export declare const makeEmailOtpVerifyHandler: (dependencies: {
     readonly emailOtp: EmailOtpLoginService;
     readonly authHttp: AuthHttpService;
-    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
-}) => (args_0: EmailOtpVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Transport.js").PasswordSignInHttpError, never>;
+}) => (handlerRequest: EmailOtpVerifyGuardRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError | import("./Transport.js").PasswordSignInHttpError, AuthRateLimit>;
+export declare const makeEmailAuthStartHandler: (dependencies: {
+    readonly emailAuth: EmailAuthService;
+}) => (handlerRequest: EmailAuthStartGuardRequest) => Effect.Effect<{
+    identity: Schema.Struct.ReadonlySide<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }, "Type">;
+    emailOtp: {
+        challengeId: ChallengeId;
+        expiresAt: UnixMillis;
+    };
+    magicLink: {
+        expiresAt: UnixMillis;
+    };
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError, AuthRateLimit>;
 export declare const makeMagicLinkStartHandler: (dependencies: {
     readonly magicLink: MagicLinkLoginService;
-    readonly authApiRateLimit?: AuthApiRateLimitService;
-}) => (args_0: MagicLinkStartHandlerRequest) => Effect.Effect<{
-    email: Email;
+}) => (handlerRequest: MagicLinkStartGuardRequest) => Effect.Effect<{
+    identity: Schema.Struct.ReadonlySide<{
+        readonly scope: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"global">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"tenant">;
+            readonly tenantId: Schema.String;
+        }>]>;
+        readonly kind: Schema.String;
+        readonly value: Schema.String;
+    }, "Type">;
     expiresAt: UnixMillis;
-}, AuthInternalError | AuthRateLimitedError, never>;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError, AuthRateLimit>;
 export declare const makeMagicLinkVerifyHandler: (dependencies: {
     readonly magicLink: MagicLinkLoginService;
     readonly authHttp: AuthHttpService;
-    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
-}) => (args_0: MagicLinkVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Transport.js").PasswordSignInHttpError, never>;
+}) => (handlerRequest: MagicLinkVerifyGuardRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError | import("./Transport.js").PasswordSignInHttpError, AuthRateLimit>;
 export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
     readonly oauthProviders: OAuthProvidersService;
     readonly oauthState: OAuthStateService;
@@ -949,7 +1172,7 @@ export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
     providerId: OAuthProviderId;
     authorizationUrl: string;
     state: import("../OAuth.js").OAuthStateToken;
-    challengeId: import("../Identifiers.js").ChallengeId;
+    challengeId: ChallengeId;
     expiresAt: UnixMillis;
     codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
     codeChallengeMethod: "S256";
@@ -960,11 +1183,9 @@ export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
 export declare const makeOAuthProviderAuthorizationHandler: (dependencies: {
     readonly authorization: OAuthProviderAuthorizationService;
 }) => (args_0: OAuthProviderAuthorizationHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | OAuthAuthorizationEndpointError, never>;
-export declare const makeOAuthAuthorizationCodeTokenHandler: (dependencies: {
-    readonly tokenGrant: OAuthAuthorizationCodeTokenGrantService;
-    readonly refreshTokenGrant?: OAuthRefreshTokenGrantService;
-    readonly clientCredentialsGrant?: OAuthClientCredentialsGrantService;
-} & OAuthAuthorizationCodeTokenHttpOptions) => (args_0: OAuthTokenHandlerRequest) => Effect.Effect<{
+export declare const makeOAuthTokenHandler: (dependencies: {
+    readonly registry: OAuthTokenGrantRegistryService;
+} & OAuthTokenHttpOptions) => (args_0: OAuthTokenHandlerRequest) => Effect.Effect<{
     readonly access_token: string;
     readonly token_type: string;
     readonly expires_in?: number | undefined;
@@ -1001,7 +1222,7 @@ export declare const makeOAuthAccountUnlinkHandler: (dependencies: {
     readonly oauthAccountUnlinking: OAuthAccountUnlinkingService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & OAuthAccountUnlinkHttpOptions) => (args_0: OAuthAccountUnlinkHandlerRequest) => Effect.Effect<Schema.Struct.ReadonlySide<{
+} & OAuthAccountUnlinkHttpOptions) => (handlerRequest: OAuthAccountUnlinkHandlerRequest) => Effect.Effect<Schema.Struct.ReadonlySide<{
     readonly type: Schema.Literal<"allow">;
     readonly reason: Schema.Literal<"owned-account">;
     readonly account: Schema.Struct<{
@@ -1096,26 +1317,111 @@ export declare const makeOAuthLinkConfirmationConfirmHandler: (dependencies: {
 }, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makePasskeyRegistrationStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
-} & PasskeyRegistrationStartHttpOptions) => (args_0: PasskeyRegistrationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyRegistration, AuthInternalError, never>;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly resolveUser: PasskeyRegistrationUserResolver;
+} & PasskeyRegistrationStartHttpOptions) => (handlerRequest: PasskeyRegistrationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyRegistration, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makePasskeyRegistrationFinishHandler: (dependencies: {
     readonly passkeyVerification: PasskeyVerificationService;
-} & PasskeyFinishHttpOptions) => (args_0: PasskeyRegistrationFinishHandlerRequest) => Effect.Effect<{
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly resolveUser: PasskeyRegistrationUserResolver;
+} & PasskeyFinishHttpOptions) => (handlerRequest: PasskeyRegistrationFinishHandlerRequest) => Effect.Effect<{
     credentialId: PasskeyCredentialId;
-}, AuthBadRequestError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makePasskeyAuthenticationStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
-} & PasskeyAuthenticationStartHttpOptions) => (args_0: PasskeyAuthenticationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthInternalError, never>;
+} & PasskeyAuthenticationStartHttpOptions) => (handlerRequest: PasskeyAuthenticationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthInternalError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makePasskeyAuthenticationFinishHandler: (dependencies: {
     readonly passkeyVerification: PasskeyVerificationService;
     readonly sessions: SessionsService;
     readonly authHttp: AuthHttpService;
     readonly makeSessionInput: (context: PasskeyAuthenticationSessionContext) => SessionCreateInput;
-} & PasskeyFinishHttpOptions) => (args_0: PasskeyAuthenticationFinishHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+} & PasskeyFinishHttpOptions) => (handlerRequest: PasskeyAuthenticationFinishHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
+type IdentityHandlerDependencies = {
+    readonly identityManagement: IdentityManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+};
+export declare const makeIdentityAvailabilityHandler: (dependencies: IdentityHandlerDependencies) => (handlerRequest: IdentityAvailabilityGuardRequest) => Effect.Effect<{
+    available: boolean;
+}, AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | import("./Errors.js").AuthRequestRejectedError | AuthUnauthenticatedError, AuthRateLimit | SessionCookie | Sessions>;
+export declare const makeIdentityListHandler: (dependencies: IdentityHandlerDependencies) => (handlerRequest: {
+    readonly request: HttpServerRequest.HttpServerRequest;
+}) => Effect.Effect<{
+    identities: {
+        id: import("../Identifiers.js").IdentityId;
+        scope: import("../Identity.js").IdentityScope;
+        kind: import("../Identity.js").IdentityKind;
+        value: string;
+        verified: boolean;
+        loginEligible: boolean;
+        isPrimaryLogin: boolean;
+        createdAt: UnixMillis;
+        updatedAt: UnixMillis;
+    }[];
+}, AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
+export declare const makeIdentityAddHandler: (dependencies: IdentityHandlerDependencies) => (request: {
+    readonly payload: Schema.Schema.Type<typeof IdentityAddBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}) => Effect.Effect<{
+    id: import("../Identifiers.js").IdentityId;
+    scope: import("../Identity.js").IdentityScope;
+    kind: import("../Identity.js").IdentityKind;
+    value: string;
+    verified: boolean;
+    loginEligible: boolean;
+    isPrimaryLogin: boolean;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+}, AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
+export declare const makeIdentityReplaceHandler: (dependencies: IdentityHandlerDependencies) => (request: {
+    readonly payload: Schema.Schema.Type<typeof IdentityReplaceBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}) => Effect.Effect<{
+    id: import("../Identifiers.js").IdentityId;
+    scope: import("../Identity.js").IdentityScope;
+    kind: import("../Identity.js").IdentityKind;
+    value: string;
+    verified: boolean;
+    loginEligible: boolean;
+    isPrimaryLogin: boolean;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+}, AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
+export declare const makeIdentityRevokeHandler: (dependencies: IdentityHandlerDependencies) => (request: {
+    readonly payload: Schema.Schema.Type<typeof IdentityRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}) => Effect.Effect<{
+    id: import("../Identifiers.js").IdentityId;
+    scope: import("../Identity.js").IdentityScope;
+    kind: import("../Identity.js").IdentityKind;
+    value: string;
+    verified: boolean;
+    loginEligible: boolean;
+    isPrimaryLogin: boolean;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+}, AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
+export declare const makeIdentityPrimaryHandler: (dependencies: IdentityHandlerDependencies) => (request: {
+    readonly payload: Schema.Schema.Type<typeof IdentityPrimaryBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}) => Effect.Effect<{
+    id: import("../Identifiers.js").IdentityId;
+    scope: import("../Identity.js").IdentityScope;
+    kind: import("../Identity.js").IdentityKind;
+    value: string;
+    verified: boolean;
+    loginEligible: boolean;
+    isPrimaryLogin: boolean;
+    createdAt: UnixMillis;
+    updatedAt: UnixMillis;
+}, AuthBadRequestError | AuthIdentityAlreadyRegisteredError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makePasskeyCredentialListHandler: (dependencies: {
     readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasskeyCredentialListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: PasskeyCredentialListHandlerRequest) => Effect.Effect<{
     credentials: {
         credentialId: PasskeyCredentialId;
         transports?: readonly import("../Passkey.js").PasskeyTransport[] | undefined;
@@ -1125,19 +1431,20 @@ export declare const makePasskeyCredentialListHandler: (dependencies: {
         revokedAt?: UnixMillis | undefined;
         metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makePasskeyCredentialRevokeHandler: (dependencies: {
     readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: PasskeyCredentialRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+    readonly strongFactorRemovalPolicy?: StrongFactorRemovalPolicyService;
+}) => (handlerRequest: PasskeyCredentialRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeTotpEnrollmentStartHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & TotpEnrollmentStartHttpOptions) => (args_0: TotpEnrollmentStartHandlerRequest) => Effect.Effect<{
+} & TotpEnrollmentStartHttpOptions) => (handlerRequest: TotpEnrollmentStartHandlerRequest) => Effect.Effect<{
     factor: {
-        factorId: import("../Identifiers.js").CredentialId;
+        factorId: CredentialId;
         algorithm: TotpAlgorithm;
         digits: number;
         period: number;
@@ -1149,13 +1456,13 @@ export declare const makeTotpEnrollmentStartHandler: (dependencies: {
     };
     secret: import("../Totp.js").TotpSecret;
     uri: string;
-}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeTotpEnrollmentConfirmHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & TotpCodeHttpOptions) => (args_0: TotpEnrollmentConfirmHandlerRequest) => Effect.Effect<{
-    factorId: import("../Identifiers.js").CredentialId;
+} & TotpCodeHttpOptions) => (handlerRequest: TotpEnrollmentConfirmHandlerRequest) => Effect.Effect<{
+    factorId: CredentialId;
     algorithm: TotpAlgorithm;
     digits: number;
     period: number;
@@ -1164,15 +1471,15 @@ export declare const makeTotpEnrollmentConfirmHandler: (dependencies: {
     lastUsedAt?: UnixMillis | undefined;
     revokedAt?: UnixMillis | undefined;
     metadata?: Readonly<Record<string, unknown>> | undefined;
-}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeTotpVerifyHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & TotpCodeHttpOptions) => (args_0: TotpVerifyHandlerRequest) => Effect.Effect<{
+} & TotpCodeHttpOptions) => (handlerRequest: TotpVerifyHandlerRequest) => Effect.Effect<{
     valid: boolean;
     factor?: {
-        factorId: import("../Identifiers.js").CredentialId;
+        factorId: CredentialId;
         algorithm: TotpAlgorithm;
         digits: number;
         period: number;
@@ -1183,14 +1490,15 @@ export declare const makeTotpVerifyHandler: (dependencies: {
         metadata?: Readonly<Record<string, unknown>> | undefined;
     } | undefined;
     delta?: number | undefined;
-}, AuthInternalError | AuthUnauthenticatedError, never>;
+    acceptedCounter?: number | undefined;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeTotpFactorListHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: TotpFactorListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: TotpFactorListHandlerRequest) => Effect.Effect<{
     factors: {
-        factorId: import("../Identifiers.js").CredentialId;
+        factorId: CredentialId;
         algorithm: TotpAlgorithm;
         digits: number;
         period: number;
@@ -1200,63 +1508,79 @@ export declare const makeTotpFactorListHandler: (dependencies: {
         revokedAt?: UnixMillis | undefined;
         metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeTotpFactorRevokeHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: TotpFactorRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+    readonly strongFactorRemovalPolicy?: StrongFactorRemovalPolicyService;
+}) => (handlerRequest: TotpFactorRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeRecoveryCodeGenerateHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & RecoveryCodeGenerateHttpOptions) => (args_0: RecoveryCodeGenerateHandlerRequest) => Effect.Effect<{
+} & RecoveryCodeGenerateHttpOptions) => (handlerRequest: RecoveryCodeGenerateHandlerRequest) => Effect.Effect<{
     codes: import("../RecoveryCode.js").RecoveryCode[];
     records: {
-        codeId: import("../Identifiers.js").CredentialId;
+        codeId: CredentialId;
         createdAt: UnixMillis;
         usedAt?: UnixMillis | undefined;
         revokedAt?: UnixMillis | undefined;
         metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
+export declare const makeRecoveryCodeRegenerateHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & RecoveryCodeGenerateHttpOptions) => (handlerRequest: RecoveryCodeRegenerateHandlerRequest) => Effect.Effect<{
+    codes: import("../RecoveryCode.js").RecoveryCode[];
+    records: {
+        codeId: CredentialId;
+        createdAt: UnixMillis;
+        usedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+    }[];
+}, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeRecoveryCodeVerifyHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: RecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: RecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
     valid: boolean;
     code?: {
-        codeId: import("../Identifiers.js").CredentialId;
+        codeId: CredentialId;
         createdAt: UnixMillis;
         usedAt?: UnixMillis | undefined;
         revokedAt?: UnixMillis | undefined;
         metadata?: Readonly<Record<string, unknown>> | undefined;
     } | undefined;
-}, AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeRecoveryCodeListHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: RecoveryCodeListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: RecoveryCodeListHandlerRequest) => Effect.Effect<{
     codes: {
-        codeId: import("../Identifiers.js").CredentialId;
+        codeId: CredentialId;
         createdAt: UnixMillis;
         usedAt?: UnixMillis | undefined;
         revokedAt?: UnixMillis | undefined;
         metadata?: Readonly<Record<string, unknown>> | undefined;
     }[];
-}, AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeRecoveryCodeRevokeHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: RecoveryCodeRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+    readonly strongFactorRemovalPolicy?: StrongFactorRemovalPolicyService;
+}) => (handlerRequest: RecoveryCodeRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeApiKeyCreateHandler: (dependencies: {
     readonly apiKeyManagement: ApiKeyManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: ApiKeyCreateHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: ApiKeyCreateHandlerRequest) => Effect.Effect<{
     secret: import("../ApiKey.js").ApiKeySecret;
     key: {
         keyId: ApiKeyId;
@@ -1273,7 +1597,7 @@ export declare const makeApiKeyListHandler: (dependencies: {
     readonly apiKeyManagement: ApiKeyManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: ApiKeyListHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: ApiKeyListHandlerRequest) => Effect.Effect<{
     keys: {
         keyId: ApiKeyId;
         prefix: import("../ApiKey.js").ApiKeyPrefix;
@@ -1289,7 +1613,7 @@ export declare const makeApiKeyRevokeHandler: (dependencies: {
     readonly apiKeyManagement: ApiKeyManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: ApiKeyRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: ApiKeyRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
 export declare const makeRefreshTokenRefreshHandler: (dependencies: {
     readonly refreshTokenManagement: RefreshTokenManagementService;
     readonly jwtIssuer: JwtIssuerService;
@@ -1357,6 +1681,7 @@ export declare const makeOidcDiscoveryMetadataHandler: (dependencies: {
     readonly issuer: string;
     readonly authorization_endpoint: string;
     readonly token_endpoint: string;
+    readonly device_authorization_endpoint?: string | undefined;
     readonly jwks_uri: string;
     readonly response_types_supported: readonly string[];
     readonly subject_types_supported: readonly string[];
@@ -1378,96 +1703,96 @@ export declare const makeMfaOptionsHandler: (dependencies: {
     readonly totpFactorManagement?: TotpFactorManagementService;
     readonly recoveryCodeManagement?: RecoveryCodeManagementService;
     readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
-}) => (args_0: MfaOptionsHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: MfaOptionsHandlerRequest) => Effect.Effect<{
     factors: {
         readonly type: "totp" | "backup-code" | "passkey";
     }[];
-}, AuthBadRequestError | AuthInternalError, never>;
+}, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makeTotpMfaVerifyHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
+    readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
+} & TotpCodeHttpOptions) => (handlerRequest: TotpMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makeTotpMfaVerifyForFlowHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
+    readonly verificationStore: VerificationStoreService;
+    readonly totpLoginCommitStore: TotpLoginCommitStoreService;
+    readonly users: UserStoreService;
+} & TotpCodeHttpOptions) => (handlerRequest: TotpMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makeRecoveryCodeMfaVerifyHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: RecoveryCodeMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
+}) => (handlerRequest: RecoveryCodeMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makeRecoveryCodeMfaVerifyForFlowHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-}) => (args_0: RecoveryCodeMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError, never>;
+    readonly verificationStore: VerificationStoreService;
+    readonly recoveryCodeLoginCommitStore: RecoveryCodeLoginCommitStoreService;
+    readonly users: UserStoreService;
+}) => (handlerRequest: RecoveryCodeMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthInvalidCredentialsError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makePasskeyMfaStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
     readonly authFlowState: AuthFlowStateService;
-} & PasskeyAuthenticationStartHttpOptions) => (args_0: PasskeyMfaStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError, never>;
+} & PasskeyAuthenticationStartHttpOptions) => (handlerRequest: PasskeyMfaStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makePasskeyMfaVerifyHandler: (dependencies: {
     readonly passkeyVerification: PasskeyVerificationService;
+    readonly authFlowState: AuthFlowStateService;
     readonly authFlow: AuthFlowService;
     readonly authHttp: AuthHttpService;
-} & PasskeyFinishHttpOptions) => (args_0: PasskeyMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError, never>;
+} & PasskeyFinishHttpOptions) => (handlerRequest: PasskeyMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
 export declare const makeStepUpOptionsHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
+    readonly credentials?: CredentialStoreService;
     readonly totpFactorManagement?: TotpFactorManagementService;
     readonly recoveryCodeManagement?: RecoveryCodeManagementService;
     readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
-}) => (args_0: StepUpOptionsHandlerRequest) => Effect.Effect<{
+}) => (handlerRequest: StepUpOptionsHandlerRequest) => Effect.Effect<{
     factors: {
-        readonly type: "totp" | "backup-code" | "passkey";
+        readonly type: "password" | "totp" | "backup-code" | "passkey";
     }[];
-}, AuthInternalError | AuthUnauthenticatedError, never>;
+}, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeStepUpTotpVerifyHandler: (dependencies: {
     readonly totpFactorManagement: TotpFactorManagementService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & TotpCodeHttpOptions) => (args_0: StepUpTotpVerifyHandlerRequest) => Effect.Effect<{
-    type: "authenticated";
-    expiresAt: number;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
-    mfaVerifiedAt?: UnixMillis | undefined;
-}, AuthInternalError | AuthInvalidCredentialsError | AuthUnauthenticatedError, never>;
+    readonly totpSessionRotation: TotpSessionRotationService;
+} & TotpCodeHttpOptions) => (handlerRequest: StepUpTotpVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthInvalidCredentialsError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
+export declare const makeStepUpPasswordVerifyHandler: (dependencies: {
+    readonly credentials: CredentialStoreService;
+    readonly hasher: PasswordHasherService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (handlerRequest: StepUpPasswordVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthInvalidCredentialsError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeStepUpRecoveryCodeVerifyHandler: (dependencies: {
     readonly recoveryCodeManagement: RecoveryCodeManagementService;
     readonly sessions: SessionsService;
+    readonly recoveryCodeSessionRotation: RecoveryCodeSessionRotationService;
     readonly sessionCookie: SessionCookieService;
-}) => (args_0: StepUpRecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
-    type: "authenticated";
-    expiresAt: number;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
-    mfaVerifiedAt?: UnixMillis | undefined;
-}, AuthInternalError | AuthInvalidCredentialsError | AuthUnauthenticatedError, never>;
+}) => (handlerRequest: StepUpRecoveryCodeVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthInvalidCredentialsError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeStepUpPasskeyStartHandler: (dependencies: {
     readonly passkeyOptions: PasskeyOptionsService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & PasskeyAuthenticationStartHttpOptions) => (args_0: StepUpPasskeyStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError | AuthUnauthenticatedError, never>;
+} & PasskeyAuthenticationStartHttpOptions) => (handlerRequest: StepUpPasskeyStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeStepUpPasskeyVerifyHandler: (dependencies: {
     readonly passkeyVerification: PasskeyVerificationService;
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
-} & PasskeyFinishHttpOptions) => (args_0: StepUpPasskeyVerifyHandlerRequest) => Effect.Effect<{
-    type: "authenticated";
-    expiresAt: number;
-    aal: import("../Sessions.js").AuthAssuranceLevel;
-    amr: readonly AuthMethodReference[];
-    mfaVerifiedAt?: UnixMillis | undefined;
-}, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | AuthUnauthenticatedError, never>;
+} & PasskeyFinishHttpOptions) => (handlerRequest: StepUpPasskeyVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError | AuthPolicyDeniedError | import("./Errors.js").AuthRateLimitedError | AuthUnauthenticatedError, AuthRateLimit>;
 export declare const makeLoginApprovalApproveHandler: (dependencies: {
     readonly loginApproval: LoginApprovalService;
     readonly authFlowState: AuthFlowStateService;
-    readonly authFlow: AuthFlowService;
-    readonly users: UserStoreService;
+    readonly finalizeAuthFlow: AuthFlowFinalize;
+    readonly identities: IdentityStoreService;
     readonly authHttp: AuthHttpService;
     readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
     readonly trustedDevice?: TrustedDeviceService;
@@ -1486,151 +1811,38 @@ export declare const makeLoginApprovalFinalizeHandler: (dependencies: {
     readonly trustedDevice?: TrustedDeviceService;
     readonly trustedDeviceCookie?: TrustedDeviceCookieService;
 }) => (args_0: LoginApprovalFinalizeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | AuthPolicyDeniedError, never>;
-declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"change", "POST", "/auth/password/change", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly currentPassword: Schema.String;
-    readonly newPassword: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"set", "POST", "/auth/password/set", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly password: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetStart", "POST", "/auth/password/reset/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly locale: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetVerify", "POST", "/auth/password/reset/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.String;
-    readonly password: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signIn", "POST", "/auth/password/sign-in", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly password: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_mfa">;
-    readonly flowId: Schema.String;
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_email_verification">;
-    readonly flowId: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_login_approval">;
-    readonly flowId: Schema.String;
-    readonly approvalChallengeId: Schema.String;
-    readonly channel: Schema.String;
-    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: Schema.Boolean;
-    readonly reason: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_passkey_enrollment">;
-    readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signUp", "POST", "/auth/password/sign-up", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly password: Schema.String;
-    readonly emailVerified: Schema.optional<Schema.Boolean>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_mfa">;
-    readonly flowId: Schema.String;
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_email_verification">;
-    readonly flowId: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_login_approval">;
-    readonly flowId: Schema.String;
-    readonly approvalChallengeId: Schema.String;
-    readonly channel: Schema.String;
-    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: Schema.Boolean;
-    readonly reason: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_passkey_enrollment">;
-    readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class PasswordApi extends PasswordApi_base {
-}
-declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"current", "GET", "/auth/session", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly userId: Schema.String;
-    readonly sessionId: Schema.String;
-    readonly authTime: Schema.Number;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/sessions", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly sessions: Schema.$Array<Schema.Struct<{
-        readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
-        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-        readonly authTime: Schema.brand<Schema.Number, "auth/UnixMillis">;
-        readonly lastSeenAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-        readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-        readonly amr: Schema.$Array<Schema.String>;
-        readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-        readonly current: Schema.Boolean;
-        readonly claims: Schema.optional<Schema.Struct<{
-            readonly emailVerified: Schema.optional<Schema.Boolean>;
-            readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-        }>>;
-        readonly ip: Schema.optional<Schema.String>;
-        readonly userAgent: Schema.optional<Schema.String>;
-        readonly country: Schema.optional<Schema.String>;
-        readonly region: Schema.optional<Schema.String>;
-        readonly city: Schema.optional<Schema.String>;
-        readonly latitude: Schema.optional<Schema.Number>;
-        readonly longitude: Schema.optional<Schema.Number>;
-        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"logout", "POST", "/auth/logout", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/session/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly userId: Schema.String;
-    readonly sessionId: Schema.String;
-    readonly authTime: Schema.Number;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeOthers", "POST", "/auth/sessions/revoke-others", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never>, false>;
-export declare class SessionApi extends SessionApi_base {
-}
-declare const AdminSessionApi_base: HttpApiGroup.HttpApiGroup<"adminSession", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/sessions/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+export declare const SessionHttpOperationsLive: Layer.Layer<SessionHttpOperations, never, AuthHttp | SessionCookie | Sessions>;
+export declare const EmailVerificationHttpOperationsLive: Layer.Layer<EmailVerificationHttpOperations, never, AuthRateLimit | EmailVerification | EmailVerificationFlow | IdentityStore | SessionCookie | Sessions>;
+export declare const EmailOtpHttpOperationsLive: Layer.Layer<EmailOtpHttpOperations, never, AuthHttp | AuthRateLimit | EmailOtpLogin>;
+export declare const EmailAuthHttpOperationsLive: Layer.Layer<EmailAuthHttpOperations, never, AuthRateLimit | EmailAuth>;
+export declare const MagicLinkHttpOperationsLive: Layer.Layer<MagicLinkHttpOperations, never, AuthHttp | AuthRateLimit | MagicLinkLogin>;
+export declare const PasskeyHttpOperationsLive: Layer.Layer<PasskeyHttpOperations, never, AuthHttp | AuthRateLimit | IdentityStore | PasskeyCredentialManagement | PasskeyHttpConfig | PasskeyOptions | PasskeyVerification | SessionCookie | Sessions | UserStore>;
+export declare const IdentityHttpOperationsLive: Layer.Layer<IdentityHttpOperations, never, AuthRateLimit | IdentityManagement | SessionCookie | Sessions>;
+export declare const TotpHttpOperationsLive: Layer.Layer<TotpHttpOperations, never, AuthRateLimit | SessionCookie | Sessions | TotpFactorManagement | TotpHttpConfig>;
+export declare const RecoveryCodesHttpOperationsLive: Layer.Layer<RecoveryCodesHttpOperations, never, AuthRateLimit | RecoveryCodeManagement | SessionCookie | Sessions>;
+export declare const MfaHttpOperationsLive: Layer.Layer<MfaHttpOperations, never, AuthFlow | AuthFlowState | AuthHttp | AuthRateLimit | PasskeyCredentialManagement | PasskeyHttpConfig | PasskeyOptions | PasskeyVerification | RecoveryCodeLoginCommitStore | RecoveryCodeManagement | TotpFactorManagement | TotpHttpConfig | TotpLoginCommitStore | UserStore | VerificationStore>;
+export declare const StepUpHttpOperationsLive: Layer.Layer<StepUpHttpOperations, never, AuthRateLimit | CredentialStore | PasskeyCredentialManagement | PasskeyHttpConfig | PasskeyOptions | PasskeyVerification | PasswordHasher | RecoveryCodeManagement | RecoveryCodeSessionRotation | SessionCookie | Sessions | TotpFactorManagement | TotpHttpConfig | TotpSessionRotation>;
+export declare const AdminSessionHttpOperationsLive: Layer.Layer<AdminSessionHttpOperations, never, AdminSessionAuthorization | SessionCookie | Sessions>;
+export declare const AdminPermissionDefinitionHttpOperationsLive: Layer.Layer<AdminPermissionDefinitionHttpOperations, never, never>;
+export declare const LoginNotificationHttpOperationsLive: Layer.Layer<LoginNotificationHttpOperations, never, never>;
+export declare const SecurityTimelineHttpOperationsLive: Layer.Layer<SecurityTimelineHttpOperations, never, SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const AdminSecurityTimelineHttpOperationsLive: Layer.Layer<AdminSecurityTimelineHttpOperations, never, AdminSecurityTimelineAuthorization | SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const TrustedDeviceHttpOperationsLive: Layer.Layer<TrustedDeviceHttpOperations, never, SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const AdminTrustedDeviceHttpOperationsLive: Layer.Layer<AdminTrustedDeviceHttpOperations, never, AdminTrustedDeviceAuthorization | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const OAuthHttpOperationsLive: Layer.Layer<OAuthHttpOperations, never, OAuthAccountUnlinking | OAuthLinkConfirmation | OAuthProviders | OAuthState | SessionCookie | Sessions>;
+export declare const OAuthProviderAuthorizationHttpOperationsLive: Layer.Layer<OAuthProviderAuthorizationHttpOperations, never, OAuthProviderAuthorization>;
+export declare const OAuthTokenHttpOperationsLive: Layer.Layer<OAuthTokenHttpOperations, never, OAuthTokenGrantRegistry>;
+export declare const OAuthTokenIntrospectionHttpOperationsLive: Layer.Layer<OAuthTokenIntrospectionHttpOperations, never, OAuthTokenIntrospection>;
+export declare const OAuthTokenRevocationHttpOperationsLive: Layer.Layer<OAuthTokenRevocationHttpOperations, never, OAuthTokenRevocation>;
+export declare const LoginApprovalHttpOperationsLive: Layer.Layer<LoginApprovalHttpOperations, never, AuthFlowState | AuthHttp | IdentityStore | LoginApproval | Sessions>;
+export declare const ApiKeyHttpOperationsLive: Layer.Layer<ApiKeyHttpOperations, never, ApiKeyManagement | SessionCookie | Sessions>;
+export declare const RefreshTokenHttpOperationsLive: Layer.Layer<RefreshTokenHttpOperations, never, JwtIssuer | RefreshTokenHttpConfig | RefreshTokenManagement>;
+export declare const JwtHttpOperationsLive: Layer.Layer<JwtHttpOperations, never, JwtRevocation>;
+export declare const JwtDiscoveryHttpOperationsLive: Layer.Layer<JwtDiscoveryHttpOperations, never, Jwks>;
+export declare const OidcDiscoveryHttpOperationsLive: Layer.Layer<OidcDiscoveryHttpOperations, never, OidcDiscoveryMetadata>;
+declare const AdminSessionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminSession", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/sessions/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly sessions: Schema.$Array<Schema.Struct<{
         readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
         readonly userId: Schema.brand<Schema.String, "auth/UserId">;
@@ -1649,118 +1861,158 @@ declare const AdminSessionApi_base: HttpApiGroup.HttpApiGroup<"adminSession", im
         readonly latitude: Schema.optional<Schema.Number>;
         readonly longitude: Schema.optional<Schema.Number>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class AdminSessionApi extends AdminSessionApi_base {
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class AdminSessionHttpApiGroup extends AdminSessionHttpApiGroup_base {
 }
-declare const AdminSessionHttpApi_base: HttpApi.HttpApi<"AdminSessionHttpApi", typeof AdminSessionApi>;
+declare const AdminSessionHttpApi_base: HttpApi.HttpApi<"AdminSessionHttpApi", typeof AdminSessionHttpApiGroup>;
 export declare class AdminSessionHttpApi extends AdminSessionHttpApi_base {
 }
-declare const EmailVerificationApi_base: HttpApiGroup.HttpApiGroup<"emailVerification", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-verification/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const AdminPermissionDefinitionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminPermissionDefinition", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"create", "POST", "/auth/admin/permission-definitions", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"delete", "POST", "/auth/admin/permission-definitions/delete", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"disable", "POST", "/auth/admin/permission-definitions/disable", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"enable", "POST", "/auth/admin/permission-definitions/enable", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"get", "GET", "/auth/admin/permission-definitions/get", never, Schema.toCodecStringTree<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/permission-definitions", never, Schema.toCodecStringTree<Schema.Struct<{
+    readonly includeDisabled: Schema.optional<Schema.Union<readonly [Schema.Boolean, Schema.decodeTo<Schema.Boolean, Schema.Literals<readonly ["true", "false"]>, never, never>]>>;
+    readonly includeDeleted: Schema.optional<Schema.Union<readonly [Schema.Boolean, Schema.decodeTo<Schema.Boolean, Schema.Literals<readonly ["true", "false"]>, never, never>]>>;
+    readonly after: Schema.optional<Schema.brand<Schema.String, "auth/PermissionId">>;
+    readonly limit: Schema.optional<Schema.Union<readonly [Schema.Number, Schema.NumberFromString]>>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly definitions: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+        readonly description: Schema.optional<Schema.String>;
+        readonly scopeType: Schema.optional<Schema.String>;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    }>>;
+    readonly nextAfter: Schema.optional<Schema.brand<Schema.String, "auth/PermissionId">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"update", "POST", "/auth/admin/permission-definitions/update", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly description: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly scopeType: Schema.optional<Schema.NullOr<Schema.String>>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class AdminPermissionDefinitionHttpApiGroup extends AdminPermissionDefinitionHttpApiGroup_base {
+}
+declare const AdminPermissionDefinitionHttpApi_base: HttpApi.HttpApi<"AdminPermissionDefinitionHttpApi", typeof AdminPermissionDefinitionHttpApiGroup>;
+export declare class AdminPermissionDefinitionHttpApi extends AdminPermissionDefinitionHttpApi_base {
+}
+declare const EmailAuthHttpApi_base: HttpApi.HttpApi<"EmailAuthHttpApi", typeof EmailAuthHttpApiGroup>;
+export declare class EmailAuthHttpApi extends EmailAuthHttpApi_base {
+}
+declare const PasskeyHttpApi_base: HttpApi.HttpApi<"PasskeyHttpApi", typeof PasskeyHttpApiGroup>;
+export declare class PasskeyHttpApi extends PasskeyHttpApi_base {
+}
+declare const IdentityHttpApi_base: HttpApi.HttpApi<"IdentityHttpApi", typeof IdentityHttpApiGroup>;
+export declare class IdentityHttpApi extends IdentityHttpApi_base {
+}
+declare const TotpHttpApi_base: HttpApi.HttpApi<"TotpHttpApi", typeof TotpHttpApiGroup>;
+export declare class TotpHttpApi extends TotpHttpApi_base {
+}
+declare const RecoveryCodesHttpApi_base: HttpApi.HttpApi<"RecoveryCodesHttpApi", typeof RecoveryCodesHttpApiGroup>;
+export declare class RecoveryCodesHttpApi extends RecoveryCodesHttpApi_base {
+}
+declare const OAuthHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-verification/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class EmailVerificationApi extends EmailVerificationApi_base {
-}
-declare const EmailOtpApi_base: HttpApiGroup.HttpApiGroup<"emailOtp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-otp/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly locale: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-otp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly expectedProviderId: Schema.optional<Schema.brand<Schema.String, "auth/OAuthProviderId">>;
+    readonly expectedProviderAccountId: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
         readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_mfa">;
-    readonly flowId: Schema.String;
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_email_verification">;
-    readonly flowId: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_login_approval">;
-    readonly flowId: Schema.String;
-    readonly approvalChallengeId: Schema.String;
-    readonly channel: Schema.String;
-    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: Schema.Boolean;
+    }>;
     readonly reason: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_passkey_enrollment">;
-    readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class EmailOtpApi extends EmailOtpApi_base {
-}
-declare const MagicLinkApi_base: HttpApiGroup.HttpApiGroup<"magicLink", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/magic-link/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly existingAccount: Schema.optional<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+    readonly linked: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
     readonly secret: Schema.optional<Schema.String>;
-    readonly locale: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly email: Schema.brand<Schema.String, "auth/Email">;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/magic-link/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
         readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_mfa">;
-    readonly flowId: Schema.String;
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.String;
-    }>>;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_email_verification">;
-    readonly flowId: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_login_approval">;
-    readonly flowId: Schema.String;
-    readonly approvalChallengeId: Schema.String;
-    readonly channel: Schema.String;
-    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
-    readonly sameDeviceRequired: Schema.Boolean;
+    }>;
     readonly reason: Schema.String;
-}>, Schema.Struct<{
-    readonly type: Schema.Literal<"requires_passkey_enrollment">;
-    readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class MagicLinkApi extends MagicLinkApi_base {
-}
-declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startAuthorization", "POST", "/auth/oauth/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startAuthorization", "POST", "/auth/oauth/start", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
     readonly redirectUri: Schema.optional<Schema.String>;
     readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
@@ -1769,7 +2021,7 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
     readonly includeNonce: Schema.optional<Schema.Boolean>;
     readonly nonce: Schema.optional<Schema.String>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
     readonly authorizationUrl: Schema.String;
     readonly state: Schema.String;
@@ -1780,11 +2032,34 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
     readonly nonce: Schema.optional<Schema.String>;
     readonly redirectUri: Schema.String;
     readonly scopes: Schema.$Array<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"unlinkAccount", "POST", "/auth/oauth/unlink", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
+    readonly identity: Schema.optional<Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+    readonly reason: Schema.optional<Schema.String>;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"unlinkAccount", "POST", "/auth/oauth/unlink", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
     readonly providerAccountId: Schema.String;
     readonly reason: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"allow">;
     readonly reason: Schema.Literal<"owned-account">;
     readonly account: Schema.Struct<{
@@ -1829,68 +2104,13 @@ declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/u
         readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
         readonly providerAccountId: Schema.String;
     }>;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly identity: Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-    }>;
-    readonly reason: Schema.String;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
-    readonly identity: Schema.optional<Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>>;
-    readonly reason: Schema.optional<Schema.String>;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly identity: Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-    }>;
-    readonly reason: Schema.String;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly expectedProviderId: Schema.optional<Schema.brand<Schema.String, "auth/OAuthProviderId">>;
-    readonly expectedProviderAccountId: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly identity: Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-    }>;
-    readonly reason: Schema.String;
-    readonly existingAccount: Schema.optional<Schema.Struct<{
-        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-    }>>;
-    readonly linked: Schema.Boolean;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class OAuthApi extends OAuthApi_base {
+}>]>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthHttpApiGroup extends OAuthHttpApiGroup_base {
 }
-declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"token", "POST", "/auth/oauth/token", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const OAuthHttpApi_base: HttpApi.HttpApi<"OAuthHttpApi", typeof OAuthHttpApiGroup>;
+export declare class OAuthHttpApi extends OAuthHttpApi_base {
+}
+declare const OAuthTokenHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"token", "POST", "/auth/oauth/token", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly access_token: Schema.String;
     readonly token_type: Schema.String;
     readonly expires_in: Schema.optional<Schema.Number>;
@@ -1898,7 +2118,13 @@ declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import
     readonly id_token: Schema.optional<Schema.String>;
     readonly scope: Schema.optional<Schema.String>;
     readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware | OAuthNoStoreMiddleware, never>, false>;
+export declare class OAuthTokenHttpApiGroup extends OAuthTokenHttpApiGroup_base {
+}
+declare const OAuthTokenHttpApi_base: HttpApi.HttpApi<"OAuthTokenHttpApi", typeof OAuthTokenHttpApiGroup>;
+export declare class OAuthTokenHttpApi extends OAuthTokenHttpApi_base {
+}
+declare const OAuthTokenIntrospectionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthTokenIntrospection", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly active: Schema.Boolean;
     readonly scope: Schema.optional<Schema.String>;
     readonly client_id: Schema.optional<Schema.String>;
@@ -1912,13 +2138,19 @@ declare const OAuthTokenApi_base: HttpApiGroup.HttpApiGroup<"oauthToken", import
     readonly iss: Schema.optional<Schema.String>;
     readonly jti: Schema.optional<Schema.String>;
     readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class OAuthTokenApi extends OAuthTokenApi_base {
+}>>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthTokenIntrospectionHttpApiGroup extends OAuthTokenIntrospectionHttpApiGroup_base {
 }
-declare const OAuthTokenHttpApi_base: HttpApi.HttpApi<"OAuthTokenHttpApi", typeof OAuthTokenApi>;
-export declare class OAuthTokenHttpApi extends OAuthTokenHttpApi_base {
+declare const OAuthTokenIntrospectionHttpApi_base: HttpApi.HttpApi<"OAuthTokenIntrospectionHttpApi", typeof OAuthTokenIntrospectionHttpApiGroup>;
+export declare class OAuthTokenIntrospectionHttpApi extends OAuthTokenIntrospectionHttpApi_base {
+}
+declare const OAuthTokenRevocationHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthTokenRevocation", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", never, never, never, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthTokenRevocationHttpApiGroup extends OAuthTokenRevocationHttpApiGroup_base {
+}
+declare const OAuthTokenRevocationHttpApi_base: HttpApi.HttpApi<"OAuthTokenRevocationHttpApi", typeof OAuthTokenRevocationHttpApiGroup>;
+export declare class OAuthTokenRevocationHttpApi extends OAuthTokenRevocationHttpApi_base {
 }
-declare const OAuthProviderAuthorizationApi_base: HttpApiGroup.HttpApiGroup<"oauthProviderAuthorization", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"authorize", "GET", "/auth/oauth/authorize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+declare const OAuthProviderAuthorizationHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthProviderAuthorization", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"authorize", "GET", "/auth/oauth/authorize", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly response_type: Schema.String;
     readonly client_id: Schema.optional<Schema.String>;
     readonly redirect_uri: Schema.optional<Schema.String>;
@@ -1926,229 +2158,25 @@ declare const OAuthProviderAuthorizationApi_base: HttpApiGroup.HttpApiGroup<"oau
     readonly state: Schema.optional<Schema.String>;
     readonly code_challenge: Schema.optional<Schema.String>;
     readonly code_challenge_method: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError | typeof OAuthAuthorizationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class OAuthProviderAuthorizationApi extends OAuthProviderAuthorizationApi_base {
+}>>, never, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthAuthorizationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthProviderAuthorizationHttpApiGroup extends OAuthProviderAuthorizationHttpApiGroup_base {
 }
-declare const OAuthProviderAuthorizationHttpApi_base: HttpApi.HttpApi<"OAuthProviderAuthorizationHttpApi", typeof OAuthProviderAuthorizationApi>;
+declare const OAuthProviderAuthorizationHttpApi_base: HttpApi.HttpApi<"OAuthProviderAuthorizationHttpApi", typeof OAuthProviderAuthorizationHttpApiGroup>;
 export declare class OAuthProviderAuthorizationHttpApi extends OAuthProviderAuthorizationHttpApi_base {
 }
-declare const LoginApprovalApi_base: HttpApiGroup.HttpApiGroup<"loginApproval", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"approve", "POST", "/auth/login-approval/approve", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly rememberDevice: Schema.optional<Schema.Boolean>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"finalize", "POST", "/auth/login-approval/finalize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly rememberDevice: Schema.optional<Schema.Boolean>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "POST", "/auth/login-approval/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly status: Schema.Literals<readonly ["pending", "approved", "denied", "expired"]>;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class LoginApprovalApi extends LoginApprovalApi_base {
+declare const MfaHttpApi_base: HttpApi.HttpApi<"MfaHttpApi", typeof MfaHttpApiGroup>;
+export declare class MfaHttpApi extends MfaHttpApi_base {
 }
-declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/mfa/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly publicKey: Schema.Struct<{
-        readonly challenge: Schema.String;
-        readonly rpId: Schema.String;
-        readonly timeout: Schema.optional<Schema.Number>;
-        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
-            readonly type: Schema.Literal<"public-key">;
-            readonly id: Schema.String;
-            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
-        }>>>;
-        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
-    }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "POST", "/auth/mfa/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/mfa/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly credential: Schema.Struct<{
-        readonly id: Schema.String;
-        readonly rawId: Schema.optional<Schema.String>;
-        readonly type: Schema.Literal<"public-key">;
-        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
-        readonly authenticatorAttachment: Schema.optional<Schema.String>;
-        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>;
-    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/mfa/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly code: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/auth/mfa/recovery-code/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly code: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/mfa/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly code: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotpForFlow", "POST", "/auth/mfa/totp/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
-    readonly code: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class MfaApi extends MfaApi_base {
+declare const StepUpHttpApi_base: HttpApi.HttpApi<"StepUpHttpApi", typeof StepUpHttpApiGroup>;
+export declare class StepUpHttpApi extends StepUpHttpApi_base {
 }
-declare const StepUpApi_base: HttpApiGroup.HttpApiGroup<"stepUp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "GET", "/auth/step-up/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly factors: Schema.$Array<Schema.Struct<{
-        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/step-up/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly publicKey: Schema.Struct<{
-        readonly challenge: Schema.String;
-        readonly rpId: Schema.String;
-        readonly timeout: Schema.optional<Schema.Number>;
-        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
-            readonly type: Schema.Literal<"public-key">;
-            readonly id: Schema.String;
-            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
-        }>>>;
-        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
-    }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/step-up/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly code: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/step-up/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly code: Schema.String;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/step-up/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly credential: Schema.Struct<{
-        readonly id: Schema.String;
-        readonly rawId: Schema.optional<Schema.String>;
-        readonly type: Schema.Literal<"public-key">;
-        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
-        readonly authenticatorAttachment: Schema.optional<Schema.String>;
-        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>;
+declare const ApiKeyHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly type: Schema.Literal<"authenticated">;
-    readonly expiresAt: Schema.Number;
-    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
-    readonly amr: Schema.$Array<Schema.String>;
-    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly claims: Schema.optional<Schema.Struct<{
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class StepUpApi extends StepUpApi_base {
-}
-declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listApiKeys", "GET", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly keys: Schema.$Array<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly secret: Schema.String;
+    readonly key: Schema.Struct<{
         readonly keyId: Schema.String;
         readonly prefix: Schema.String;
         readonly scopes: Schema.$Array<Schema.String>;
@@ -2157,17 +2185,9 @@ declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect
         readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly keyId: Schema.String;
-    readonly reason: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
-    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly secret: Schema.String;
-    readonly key: Schema.Struct<{
+    }>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listApiKeys", "GET", "/auth/api-keys/", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly keys: Schema.$Array<Schema.Struct<{
         readonly keyId: Schema.String;
         readonly prefix: Schema.String;
         readonly scopes: Schema.$Array<Schema.String>;
@@ -2176,14 +2196,20 @@ declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect
         readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class ApiKeyApi extends ApiKeyApi_base {
+    }>>;
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly keyId: Schema.String;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class ApiKeyHttpApiGroup extends ApiKeyHttpApiGroup_base {
+}
+declare const ApiKeyHttpApi_base: HttpApi.HttpApi<"ApiKeyHttpApi", typeof ApiKeyHttpApiGroup>;
+export declare class ApiKeyHttpApi extends ApiKeyHttpApi_base {
 }
-declare const RefreshTokenApi_base: HttpApiGroup.HttpApiGroup<"refreshToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/token/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const RefreshTokenHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"refreshToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/token/refresh", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly refreshToken: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly accessToken: Schema.String;
     readonly accessTokenExpiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly refreshToken: Schema.String;
@@ -2199,16 +2225,15 @@ declare const RefreshTokenApi_base: HttpApiGroup.HttpApiGroup<"refreshToken", im
         readonly reuseDetectedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class RefreshTokenApi extends RefreshTokenApi_base {
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class RefreshTokenHttpApiGroup extends RefreshTokenHttpApiGroup_base {
 }
-declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly jwtId: Schema.String;
-    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly reason: Schema.optional<Schema.String>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const RefreshTokenHttpApi_base: HttpApi.HttpApi<"RefreshTokenHttpApi", typeof RefreshTokenHttpApiGroup>;
+export declare class RefreshTokenHttpApi extends RefreshTokenHttpApi_base {
+}
+declare const JwtHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly token: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
     readonly active: Schema.Literal<true>;
     readonly header: Schema.Struct<{
         readonly typ: Schema.Literal<"JWT">;
@@ -2234,21 +2259,29 @@ declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unsta
     readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly revokedReason: Schema.optional<Schema.String>;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class JwtApi extends JwtApi_base {
+}>]>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class JwtHttpApiGroup extends JwtHttpApiGroup_base {
+}
+declare const JwtHttpApi_base: HttpApi.HttpApi<"JwtHttpApi", typeof JwtHttpApiGroup>;
+export declare class JwtHttpApi extends JwtHttpApi_base {
 }
-declare const JwtDiscoveryApi_base: HttpApiGroup.HttpApiGroup<"jwtDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"jwks", "GET", "/.well-known/jwks.json", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const JwtDiscoveryHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"jwtDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"jwks", "GET", "/.well-known/jwks.json", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly keys: Schema.$Array<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class JwtDiscoveryApi extends JwtDiscoveryApi_base {
+}>>, Schema.toCodecJson<typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class JwtDiscoveryHttpApiGroup extends JwtDiscoveryHttpApiGroup_base {
 }
-declare const JwtDiscoveryHttpApi_base: HttpApi.HttpApi<"JwtDiscoveryHttpApi", typeof JwtDiscoveryApi>;
+declare const JwtDiscoveryHttpApi_base: HttpApi.HttpApi<"JwtDiscoveryHttpApi", typeof JwtDiscoveryHttpApiGroup>;
 export declare class JwtDiscoveryHttpApi extends JwtDiscoveryHttpApi_base {
 }
-declare const OidcDiscoveryApi_base: HttpApiGroup.HttpApiGroup<"oidcDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"openidConfiguration", "GET", "/.well-known/openid-configuration", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const OidcDiscoveryHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oidcDiscovery", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"openidConfiguration", "GET", "/.well-known/openid-configuration", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly issuer: Schema.String;
     readonly authorization_endpoint: Schema.String;
     readonly token_endpoint: Schema.String;
+    readonly device_authorization_endpoint: Schema.optional<Schema.String>;
     readonly jwks_uri: Schema.String;
     readonly response_types_supported: Schema.$Array<Schema.String>;
     readonly subject_types_supported: Schema.$Array<Schema.String>;
@@ -2264,28 +2297,22 @@ declare const OidcDiscoveryApi_base: HttpApiGroup.HttpApiGroup<"oidcDiscovery",
     readonly introspection_endpoint: Schema.optional<Schema.String>;
     readonly revocation_endpoint: Schema.optional<Schema.String>;
     readonly revocation_endpoint_auth_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class OidcDiscoveryApi extends OidcDiscoveryApi_base {
+}>>, Schema.toCodecJson<typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OidcDiscoveryHttpApiGroup extends OidcDiscoveryHttpApiGroup_base {
 }
-declare const OidcDiscoveryHttpApi_base: HttpApi.HttpApi<"OidcDiscoveryHttpApi", typeof OidcDiscoveryApi>;
+declare const OidcDiscoveryHttpApi_base: HttpApi.HttpApi<"OidcDiscoveryHttpApi", typeof OidcDiscoveryHttpApiGroup>;
 export declare class OidcDiscoveryHttpApi extends OidcDiscoveryHttpApi_base {
 }
-declare const SecurityApi_base: HttpApiGroup.HttpApiGroup<"security", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"reportLogin", "POST", "/auth/security/login/report", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class SecurityApi extends SecurityApi_base {
-}
-declare const SecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"securityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/security/timeline", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+declare const SecurityTimelineHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"securityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/security/timeline", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly limit: Schema.optional<Schema.Number>;
     readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly events: Schema.$Array<Schema.Struct<{
         readonly eventId: Schema.String;
-        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-        readonly category: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+        readonly category: Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
         readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
         readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly summary: Schema.String;
@@ -2301,23 +2328,23 @@ declare const SecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"securityTimel
         }>>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class SecurityTimelineApi extends SecurityTimelineApi_base {
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class SecurityTimelineHttpApiGroup extends SecurityTimelineHttpApiGroup_base {
 }
-declare const SecurityTimelineHttpApi_base: HttpApi.HttpApi<"SecurityTimelineHttpApi", typeof SecurityTimelineApi>;
+declare const SecurityTimelineHttpApi_base: HttpApi.HttpApi<"SecurityTimelineHttpApi", typeof SecurityTimelineHttpApiGroup>;
 export declare class SecurityTimelineHttpApi extends SecurityTimelineHttpApi_base {
 }
-declare const AdminSecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"adminSecurityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/security/timeline", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+declare const AdminSecurityTimelineHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminSecurityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/security/timeline", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly limit: Schema.optional<Schema.Number>;
     readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
-    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>>>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly events: Schema.$Array<Schema.Struct<{
         readonly eventId: Schema.String;
-        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.risk.assessed", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked"]>;
-        readonly category: Schema.Literals<readonly ["api_key", "auth", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
+        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed", "auth.risk.assessed", "auth.policy.denied", "auth.identity.added", "auth.identity.replaced", "auth.identity.revoked", "auth.identity.primary_changed", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.incident_action.executed", "auth.jwt.introspected", "auth.jwt.revoked", "auth.permission_definition.created", "auth.permission_definition.updated", "auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted", "auth.role_definition.created", "auth.role_definition.updated", "auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted", "auth.permission.granted", "auth.permission.revoked", "auth.role.granted", "auth.role.revoked", "auth.role_permission.assigned", "auth.role_permission.removed"]>;
+        readonly category: Schema.Literals<readonly ["api_key", "auth", "authorization", "identity", "incident", "jwt", "mfa", "oauth", "policy", "refresh_token", "risk", "session"]>;
         readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
         readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly summary: Schema.String;
@@ -2333,13 +2360,13 @@ declare const AdminSecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"adminSec
         }>>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class AdminSecurityTimelineApi extends AdminSecurityTimelineApi_base {
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class AdminSecurityTimelineHttpApiGroup extends AdminSecurityTimelineHttpApiGroup_base {
 }
-declare const AdminSecurityTimelineHttpApi_base: HttpApi.HttpApi<"AdminSecurityTimelineHttpApi", typeof AdminSecurityTimelineApi>;
+declare const AdminSecurityTimelineHttpApi_base: HttpApi.HttpApi<"AdminSecurityTimelineHttpApi", typeof AdminSecurityTimelineHttpApiGroup>;
 export declare class AdminSecurityTimelineHttpApi extends AdminSecurityTimelineHttpApi_base {
 }
-declare const TrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"trustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/trusted-devices/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+declare const TrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"trustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/trusted-devices/", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly devices: Schema.$Array<Schema.Struct<{
         readonly deviceId: Schema.String;
         readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
@@ -2347,17 +2374,17 @@ declare const TrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"trustedDevice",
         readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly deviceId: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class TrustedDeviceApi extends TrustedDeviceApi_base {
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class TrustedDeviceHttpApiGroup extends TrustedDeviceHttpApiGroup_base {
 }
-declare const TrustedDeviceHttpApi_base: HttpApi.HttpApi<"TrustedDeviceHttpApi", typeof TrustedDeviceApi>;
+declare const TrustedDeviceHttpApi_base: HttpApi.HttpApi<"TrustedDeviceHttpApi", typeof TrustedDeviceHttpApiGroup>;
 export declare class TrustedDeviceHttpApi extends TrustedDeviceHttpApi_base {
 }
-declare const AdminTrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"adminTrustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/trusted-devices/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+declare const AdminTrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminTrustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/trusted-devices/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly devices: Schema.$Array<Schema.Struct<{
         readonly deviceId: Schema.String;
         readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
@@ -2365,44 +2392,72 @@ declare const AdminTrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"adminTruste
         readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
     readonly deviceId: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
-export declare class AdminTrustedDeviceApi extends AdminTrustedDeviceApi_base {
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+export declare class AdminTrustedDeviceHttpApiGroup extends AdminTrustedDeviceHttpApiGroup_base {
 }
-declare const AdminTrustedDeviceHttpApi_base: HttpApi.HttpApi<"AdminTrustedDeviceHttpApi", typeof AdminTrustedDeviceApi>;
+declare const AdminTrustedDeviceHttpApi_base: HttpApi.HttpApi<"AdminTrustedDeviceHttpApi", typeof AdminTrustedDeviceHttpApiGroup>;
 export declare class AdminTrustedDeviceHttpApi extends AdminTrustedDeviceHttpApi_base {
 }
-declare const AuthApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordApi | typeof SessionApi | typeof EmailVerificationApi | typeof EmailOtpApi | typeof MagicLinkApi | typeof LoginApprovalApi | typeof SecurityApi>;
-export declare class AuthApi extends AuthApi_base {
-}
-export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, AuthApiRateLimit | AuthHttp | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | EmailVerificationFlow | PasswordLogin | PasswordManagement | PasswordRegistration | PasswordReset | SessionCookie | Sessions>;
-export declare const SessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "session">, never, AuthHttp | AuthOriginCheckMiddleware | SessionCookie | Sessions>;
-export declare const AdminSessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSessionHttpApi", "adminSession">, never, AdminSessionAuthorization | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SessionCookie | Sessions>;
-export declare const AdminSessionHttpApiLive: Layer.Layer<never, never, AdminSessionAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SessionCookie | Sessions>;
-export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | EmailVerification | EmailVerificationFlow | SessionCookie | Sessions>;
-export declare const EmailOtpApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailOtp">, never, AuthApiRateLimit | AuthHttp | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | EmailOtpLogin>;
-export declare const MagicLinkApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "magicLink">, never, AuthApiRateLimit | AuthHttp | AuthOriginCheckMiddleware | AuthRateLimitMiddleware | AuthSchemaErrorMiddleware | MagicLinkLogin>;
-export declare const LoginApprovalApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "loginApproval">, never, AuthFlow | AuthFlowState | AuthHttp | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | LoginApproval | UserStore>;
-export declare const SecurityApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "security">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware>;
-export declare const SecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"SecurityTimelineHttpApi", "securityTimeline">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SecurityTimelineStore | SessionCookie | Sessions>;
-export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
-export declare const OAuthProviderAuthorizationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OAuthProviderAuthorizationHttpApi", "oauthProviderAuthorization">, never, AuthSchemaErrorMiddleware | OAuthProviderAuthorization>;
-export declare const OAuthProviderAuthorizationHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | OAuthProviderAuthorization | import("effect/Path").Path>;
-export declare const OAuthTokenApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OAuthTokenHttpApi", "oauthToken">, never, AuthSchemaErrorMiddleware | OAuthAuthorizationCodeTokenGrant>;
-export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | OAuthAuthorizationCodeTokenGrant | import("effect/Path").Path>;
-export declare const JwtDiscoveryApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"JwtDiscoveryHttpApi", "jwtDiscovery">, never, AuthSchemaErrorMiddleware | Jwks>;
-export declare const JwtDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | Jwks | import("effect/Path").Path>;
-export declare const OidcDiscoveryApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"OidcDiscoveryHttpApi", "oidcDiscovery">, never, AuthSchemaErrorMiddleware | OidcDiscoveryMetadata>;
-export declare const OidcDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | OidcDiscoveryMetadata | import("effect/Path").Path>;
-export declare const AdminSecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminSecurityTimelineHttpApi", "adminSecurityTimeline">, never, AdminSecurityTimelineAuthorization | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SecurityTimelineStore | SessionCookie | Sessions>;
-export declare const AdminSecurityTimelineHttpApiLive: Layer.Layer<never, never, AdminSecurityTimelineAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
-export declare const TrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"TrustedDeviceHttpApi", "trustedDevice">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SessionCookie | Sessions | TrustedDeviceStore>;
-export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TrustedDeviceStore>;
-export declare const AdminTrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AdminTrustedDeviceHttpApi", "adminTrustedDevice">, never, AdminTrustedDeviceAuthorization | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | SessionCookie | Sessions | TrustedDeviceStore>;
-export declare const AdminTrustedDeviceHttpApiLive: Layer.Layer<never, never, AdminTrustedDeviceAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TrustedDeviceStore>;
-export declare const AuthHttpApiBareLive: Layer.Layer<never, never, AuthFlow | AuthFlowState | AuthHttp | EmailOtpLogin | EmailVerification | EmailVerificationFlow | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | LoginApproval | MagicLinkLogin | PasswordLogin | PasswordManagement | PasswordRegistration | PasswordReset | import("effect/Path").Path | SessionCookie | Sessions | UserStore>;
-export declare const AuthHttpApiLive: Layer.Layer<never, never, AuthFlow | AuthFlowState | AuthHttp | EmailOtpLogin | EmailVerification | EmailVerificationFlow | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | LoginApproval | MagicLinkLogin | PasswordLogin | PasswordManagement | PasswordRegistration | PasswordReset | import("effect/Path").Path | import("../Privacy.js").Privacy | import("../RateLimiter.js").RateLimiter | SessionCookie | Sessions | UserStore>;
+declare const CoreAuthHttpApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordHttpApiGroup | typeof SessionHttpApiGroup | typeof EmailVerificationHttpApiGroup | typeof EmailOtpHttpApiGroup | typeof MagicLinkHttpApiGroup | typeof LoginApprovalHttpApiGroup | typeof LoginNotificationHttpApiGroup>;
+export declare class CoreAuthHttpApi extends CoreAuthHttpApi_base {
+}
+export declare const CoreAuthPasswordGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "password">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | import("./Password.js").PasswordHttpOperations>;
+export declare const CoreAuthSessionGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "session">, never, AuthOriginCheckMiddleware | SessionHttpOperations>;
+export declare const CoreAuthEmailVerificationGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "emailVerification">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | EmailVerificationHttpOperations>;
+export declare const CoreAuthEmailOtpGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "emailOtp">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | EmailOtpHttpOperations>;
+export declare const EmailAuthHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"EmailAuthHttpApi", "emailAuth">, never, EmailAuthHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const CoreAuthMagicLinkGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "magicLink">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | MagicLinkHttpOperations>;
+export declare const PasskeyHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"PasskeyHttpApi", "passkey">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | PasskeyHttpOperations>;
+export declare const IdentityHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"IdentityHttpApi", "identity">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | IdentityHttpOperations>;
+export declare const TotpHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"TotpHttpApi", "totp">, never, TotpHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const RecoveryCodesHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"RecoveryCodesHttpApi", "recoveryCodes">, never, RecoveryCodesHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const MfaHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"MfaHttpApi", "mfa">, never, MfaHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const StepUpHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"StepUpHttpApi", "stepUp">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | StepUpHttpOperations>;
+export declare const OAuthHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthHttpApi", "oauth">, never, OAuthHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const OAuthHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthAccountUnlinking | OAuthLinkConfirmation | OAuthProviders | OAuthState | import("effect/Path").Path | SessionCookie | Sessions>;
+export declare const ApiKeyHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"ApiKeyHttpApi", "apiKey">, never, ApiKeyHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const ApiKeyHttpApiLive: Layer.Layer<never, never, ApiKeyManagement | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SessionCookie | Sessions>;
+export declare const RefreshTokenHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"RefreshTokenHttpApi", "refreshToken">, never, AuthSchemaErrorMiddleware | RefreshTokenHttpOperations>;
+export declare const RefreshTokenHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | JwtIssuer | import("effect/Path").Path | RefreshTokenHttpConfig | RefreshTokenManagement>;
+export declare const JwtHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"JwtHttpApi", "jwt">, never, AuthSchemaErrorMiddleware | JwtHttpOperations>;
+export declare const JwtHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | JwtRevocation | import("effect/Path").Path>;
+export declare const AdminSessionHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"AdminSessionHttpApi", "adminSession">, never, AdminSessionHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const AdminSessionHttpApiLive: Layer.Layer<never, never, AdminSessionAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SessionCookie | Sessions>;
+export declare const AdminPermissionDefinitionHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"AdminPermissionDefinitionHttpApi", "adminPermissionDefinition">, never, AdminPermissionDefinitionHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const AdminPermissionDefinitionHttpRequirementsLive: Layer.Layer<HttpRouter.Request<"GlobalRequires", AdminPermissionDefinitionAuthorization> | HttpRouter.Request<"GlobalRequires", PermissionAdministration> | HttpRouter.Request<"GlobalRequires", SessionCookie> | HttpRouter.Request<"GlobalRequires", Sessions> | HttpRouter.Request<"Requires", AdminPermissionDefinitionAuthorization> | HttpRouter.Request<"Requires", PermissionAdministration> | HttpRouter.Request<"Requires", SessionCookie> | HttpRouter.Request<"Requires", Sessions>, never, HttpRouter.HttpRouter | AdminPermissionDefinitionHttpOperationRequirements>;
+export declare const AdminPermissionDefinitionHttpApiLive: Layer.Layer<HttpRouter.Request<"GlobalRequires", AdminPermissionDefinitionAuthorization> | HttpRouter.Request<"GlobalRequires", PermissionAdministration> | HttpRouter.Request<"GlobalRequires", SessionCookie> | HttpRouter.Request<"GlobalRequires", Sessions> | HttpRouter.Request<"Requires", AdminPermissionDefinitionAuthorization> | HttpRouter.Request<"Requires", PermissionAdministration> | HttpRouter.Request<"Requires", SessionCookie> | HttpRouter.Request<"Requires", Sessions>, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | AdminPermissionDefinitionHttpOperationRequirements>;
+export declare const EmailAuthHttpApiLive: Layer.Layer<never, never, AuthRateLimit | EmailAuth | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path>;
+export declare const PasskeyHttpApiLive: Layer.Layer<never, never, AuthHttp | AuthRateLimit | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | IdentityStore | PasskeyCredentialManagement | PasskeyHttpConfig | PasskeyOptions | PasskeyVerification | import("effect/Path").Path | SessionCookie | Sessions | UserStore>;
+export declare const IdentityHttpApiLive: Layer.Layer<never, never, AuthRateLimit | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | IdentityManagement | import("effect/Path").Path | SessionCookie | Sessions>;
+export declare const TotpHttpApiLive: Layer.Layer<never, never, AuthRateLimit | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TotpFactorManagement | TotpHttpConfig>;
+export declare const RecoveryCodesHttpApiLive: Layer.Layer<never, never, AuthRateLimit | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | RecoveryCodeManagement | SessionCookie | Sessions>;
+export declare const MfaHttpApiLive: Layer.Layer<never, never, AuthFlow | AuthFlowState | AuthHttp | AuthRateLimit | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | PasskeyCredentialManagement | PasskeyHttpConfig | PasskeyOptions | PasskeyVerification | import("effect/Path").Path | RecoveryCodeLoginCommitStore | RecoveryCodeManagement | TotpFactorManagement | TotpHttpConfig | TotpLoginCommitStore | UserStore | VerificationStore>;
+export declare const StepUpHttpApiLive: Layer.Layer<never, never, AuthRateLimit | CredentialStore | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | PasskeyCredentialManagement | PasskeyHttpConfig | PasskeyOptions | PasskeyVerification | PasswordHasher | import("effect/Path").Path | RecoveryCodeManagement | RecoveryCodeSessionRotation | SessionCookie | Sessions | TotpFactorManagement | TotpHttpConfig | TotpSessionRotation>;
+export declare const CoreAuthLoginApprovalGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "loginApproval">, never, LoginApprovalHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const CoreAuthLoginNotificationGroupLive: Layer.Layer<HttpApiGroup.Service<"AuthApi", "security">, never, LoginNotificationHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const SecurityTimelineHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"SecurityTimelineHttpApi", "securityTimeline">, never, SecurityTimelineHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const OAuthProviderAuthorizationHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthProviderAuthorizationHttpApi", "oauthProviderAuthorization">, never, AuthSchemaErrorMiddleware | OAuthProviderAuthorizationHttpOperations>;
+export declare const OAuthProviderAuthorizationHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthProviderAuthorization | import("effect/Path").Path>;
+export declare const OAuthTokenHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenHttpApi", "oauthToken">, never, OAuthTokenHttpOperations | (AuthSchemaErrorMiddleware | OAuthNoStoreMiddleware)>;
+export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthTokenGrantRegistry | import("effect/Path").Path>;
+export declare const OAuthTokenIntrospectionHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenIntrospectionHttpApi", "oauthTokenIntrospection">, never, AuthSchemaErrorMiddleware | OAuthTokenIntrospectionHttpOperations>;
+export declare const OAuthTokenIntrospectionHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthTokenIntrospection | import("effect/Path").Path>;
+export declare const OAuthTokenRevocationHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenRevocationHttpApi", "oauthTokenRevocation">, never, AuthSchemaErrorMiddleware | OAuthTokenRevocationHttpOperations>;
+export declare const OAuthTokenRevocationHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthTokenRevocation | import("effect/Path").Path>;
+export declare const JwtDiscoveryHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"JwtDiscoveryHttpApi", "jwtDiscovery">, never, AuthSchemaErrorMiddleware | JwtDiscoveryHttpOperations>;
+export declare const JwtDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | Jwks | import("effect/Path").Path>;
+export declare const OidcDiscoveryHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OidcDiscoveryHttpApi", "oidcDiscovery">, never, AuthSchemaErrorMiddleware | OidcDiscoveryHttpOperations>;
+export declare const OidcDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OidcDiscoveryMetadata | import("effect/Path").Path>;
+export declare const AdminSecurityTimelineHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"AdminSecurityTimelineHttpApi", "adminSecurityTimeline">, never, AdminSecurityTimelineHttpOperations | (AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware)>;
+export declare const AdminSecurityTimelineHttpApiLive: Layer.Layer<never, never, AdminSecurityTimelineAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
+export declare const TrustedDeviceHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"TrustedDeviceHttpApi", "trustedDevice">, never, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware | TrustedDeviceHttpOperations>;
+export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const AdminTrustedDeviceHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"AdminTrustedDeviceHttpApi", "adminTrustedDevice">, never, AdminTrustedDeviceHttpOperations | AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware>;
+export declare const AdminTrustedDeviceHttpApiLive: Layer.Layer<never, never, AdminTrustedDeviceAuthorization | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SessionCookie | Sessions | TrustedDeviceStore>;
+export declare const CoreAuthHttpApiLive: Layer.Layer<never, never, AuthFlowState | AuthHttp | AuthRateLimit | EmailOtpLogin | EmailVerification | EmailVerificationFlow | import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | IdentityStore | LoginApproval | MagicLinkLogin | import("../Password.js").PasswordLogin | import("../Password.js").PasswordManagement | import("../Password.js").PasswordRegistration | import("../Password.js").PasswordReset | import("effect/Path").Path | SessionCookie | Sessions>;
 export { AuthResult };
 //# sourceMappingURL=Api.d.ts.map