@effect-auth/core 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/HttpApi/Api.d.ts

@@ -1,4 +1,4 @@
-import { Context, Effect, Layer, Redacted } from "effect";
+import { Context, Effect, Layer, Option, Redacted } from "effect";
 import type { Duration, Schema } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";
@@ -24,8 +24,9 @@ import type { LoginApprovalReviewService, LoginApprovalService, LoginApprovalVer
 import type { LoginNotificationReportInput, LoginNotificationService } from "../LoginNotification.js";
 import { MagicLinkLogin } from "../MagicLink.js";
 import type { MagicLinkLoginService } from "../MagicLink.js";
-import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationCodeTokenGrantService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientCredentialsGrantService, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderAuthorizationService, OAuthProviderConfig, OAuthProvidersService, OAuthRefreshTokenGrantService, OAuthStateService, OAuthTokenIntrospectionService, OAuthTokenRevocationService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
-import { OAuthAuthorizationCodeTokenGrant, OAuthAccountUnlinking, OAuthProviderAuthorization, OAuthProviders, OAuthLinkConfirmation, OAuthState } from "../OAuth.js";
+import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderAuthorizationService, OAuthProviderConfig, OAuthProvidersService, OAuthStateService, OAuthTokenIntrospectionService, OAuthTokenRevocationService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
+import { OAuthAuthorizationCodeTokenGrant, OAuthAccountUnlinking, OAuthClientCredentialsGrant, OAuthProviderAuthorization, OAuthProviders, OAuthRefreshTokenGrant, OAuthTokenIntrospection, OAuthTokenRevocation, OAuthLinkConfirmation, OAuthState } from "../OAuth.js";
+import { OAuthDeviceCodeTokenGrant } from "../OAuthDeviceAuthorization.js";
 import { PasskeyCredentialId, PasskeyCredentialManagement, PasskeyOptions, PasskeyVerification } from "../Passkey.js";
 import type { FinishedPasskeyAuthentication, PasskeyAttestation, PasskeyAuthenticationFinishInput, PasskeyAuthenticationStartInput, PasskeyAuthenticatorSelection, PasskeyCredentialManagementService, PasskeyOptionsService, PasskeyPublicKeyCredentialParameters, PasskeyRelyingParty, PasskeyUserVerification, PasskeyVerificationService } from "../Passkey.js";
 import { PasswordHasher } from "../Password.js";
@@ -51,11 +52,11 @@ import { EmailAuthHttpApiGroup, EmailOtpHttpApiGroup, EmailVerificationHttpApiGr
 import type { EmailAuthStartGuardRequest, EmailOtpStartGuardRequest, EmailOtpVerifyGuardRequest, EmailVerificationStartGuardRequest, MagicLinkStartGuardRequest, MagicLinkVerifyGuardRequest } from "./EmailGuards.js";
 import { AuthBadRequestError, AuthConflictError, AuthIdentityAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthNotFoundError, AuthPolicyDeniedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError, OAuthAuthorizationEndpointError, OAuthTokenEndpointError, OAuthTokenIntrospectionEndpointError, OAuthTokenRevocationEndpointError } from "./Errors.js";
 import type { IdentityAvailabilityGuardRequest } from "./IdentityGuards.js";
-import { AuthOriginCheckMiddleware } from "./Middleware.js";
-import { AdminSecurityTimelineHttpOperations, AdminPermissionDefinitionHttpOperations, type AdminPermissionDefinitionHttpOperationRequirements, AdminSessionHttpOperations, AdminTrustedDeviceHttpOperations, ApiKeyHttpOperations, EmailAuthHttpOperations, EmailOtpHttpOperations, EmailVerificationHttpOperations, JwtDiscoveryHttpOperations, JwtHttpOperations, LoginApprovalHttpOperations, MagicLinkHttpOperations, MfaHttpOperations, OAuthHttpOperations, OAuthProviderAuthorizationHttpOperations, OAuthTokenHttpOperations, OidcDiscoveryHttpOperations, PasskeyHttpOperations, IdentityHttpOperations, RecoveryCodesHttpOperations, RefreshTokenHttpOperations, LoginNotificationHttpOperations, SecurityTimelineHttpOperations, SessionHttpOperations, StepUpHttpOperations, TotpHttpOperations, TrustedDeviceHttpOperations } from "./Operations/index.js";
+import { AuthOriginCheckMiddleware, OAuthNoStoreMiddleware } from "./Middleware.js";
+import { AdminSecurityTimelineHttpOperations, AdminPermissionDefinitionHttpOperations, type AdminPermissionDefinitionHttpOperationRequirements, AdminSessionHttpOperations, AdminTrustedDeviceHttpOperations, ApiKeyHttpOperations, EmailAuthHttpOperations, EmailOtpHttpOperations, EmailVerificationHttpOperations, JwtDiscoveryHttpOperations, JwtHttpOperations, LoginApprovalHttpOperations, MagicLinkHttpOperations, MfaHttpOperations, OAuthHttpOperations, OAuthProviderAuthorizationHttpOperations, OAuthTokenHttpOperations, OAuthTokenIntrospectionHttpOperations, OAuthTokenRevocationHttpOperations, OidcDiscoveryHttpOperations, PasskeyHttpOperations, IdentityHttpOperations, RecoveryCodesHttpOperations, RefreshTokenHttpOperations, LoginNotificationHttpOperations, SecurityTimelineHttpOperations, SessionHttpOperations, StepUpHttpOperations, TotpHttpOperations, TrustedDeviceHttpOperations } from "./Operations/index.js";
 import type { AuthRateLimitGuardRequest } from "./RequestGuards.js";
-import { OAuthProviderAuthorizationQuery } from "./Schemas.js";
-import type { AdminSecurityTimelineListQuery, AdminPermissionDefinitionCreateBody, AdminPermissionDefinitionGetQuery, AdminPermissionDefinitionListQuery, AdminPermissionDefinitionMutationBody, AdminPermissionDefinitionUpdateBody, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, ApiKeyCreateBody, ApiKeyRevokeBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtJwksBody, JwtRevokeBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, IdentityAddBody, IdentityPrimaryBody, IdentityReplaceBody, IdentityRevokeBody, SessionRevokeBody, RecoveryCodeGenerateBody, RecoveryCodeRegenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpPasswordVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
+import { OAuthProviderAuthorizationQuery, OAuthTokenRequestBody } from "./Schemas.js";
+import type { AdminSecurityTimelineListQuery, AdminPermissionDefinitionCreateBody, AdminPermissionDefinitionGetQuery, AdminPermissionDefinitionListQuery, AdminPermissionDefinitionMutationBody, AdminPermissionDefinitionUpdateBody, AdminSessionListQuery, AdminSessionRevokeAllBody, AdminSessionRevokeBody, AdminTrustedDeviceListQuery, AdminTrustedDeviceRevokeBody, ApiKeyCreateBody, ApiKeyRevokeBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtJwksBody, JwtRevokeBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, OAuthTokenResponseBody, OidcDiscoveryMetadataBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, IdentityAddBody, IdentityPrimaryBody, IdentityReplaceBody, IdentityRevokeBody, SessionRevokeBody, RecoveryCodeGenerateBody, RecoveryCodeRegenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpPasswordVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
 import { AuthHttp } from "./Transport.js";
 import type { AuthHttpService, LoginApprovalPendingCookieService } from "./Transport.js";
 export { AuthClientProtocolApi, EmailAuthHttpApiGroup, EmailOtpHttpApiGroup, EmailVerificationHttpApiGroup, IdentityHttpApiGroup, LoginApprovalHttpApiGroup, MagicLinkHttpApiGroup, MfaHttpApiGroup, PasskeyHttpApiGroup, PasswordHttpApiGroup, RecoveryCodesHttpApiGroup, LoginNotificationHttpApiGroup, SessionHttpApiGroup, StepUpHttpApiGroup, TotpHttpApiGroup, } from "./ClientApi.js";
@@ -86,7 +87,7 @@ export interface OAuthTokenClientAuthenticationInput {
 export interface OAuthTokenClientAuthenticationHttpOptions {
     readonly authenticateClient?: (input: OAuthTokenClientAuthenticationInput) => Effect.Effect<boolean, unknown>;
 }
-export interface OAuthAuthorizationCodeTokenHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
+export interface OAuthTokenHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
 }
 export interface OAuthTokenRevocationHttpOptions extends OAuthTokenClientAuthenticationHttpOptions {
 }
@@ -145,6 +146,40 @@ export declare const oauthLinkConfirmationPendingHttpBody: (pending: PendingOAut
 export declare const oauthAuthorizationCallbackQueryPayload: (input: OAuthAuthorizationCallbackPayloadInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, AuthBadRequestError>;
 export declare const oauthAuthorizationCallbackFormPostPayload: (input: OAuthAuthorizationCallbackPayloadInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, AuthBadRequestError>;
 export declare const oauthAuthorizationCallbackInput: (payload: Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, options: OAuthAuthorizationCallbackHttpOptions) => Effect.Effect<OAuthCallbackInput, AuthBadRequestError>;
+export interface OAuthTokenGrantHandlerInput {
+    readonly payload: Schema.Schema.Type<typeof OAuthTokenRequestBody>;
+    readonly clientId?: OAuthClientId;
+    readonly clientAuthenticated: boolean;
+}
+export type OAuthTokenGrantHandler = (input: OAuthTokenGrantHandlerInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthTokenResponseBody>, OAuthTokenEndpointError | AuthInternalError>;
+export interface OAuthTokenGrantRegistration {
+    readonly grantType: string;
+    readonly exchange: OAuthTokenGrantHandler;
+}
+declare const OAuthTokenGrantRegistryDuplicateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenGrantRegistryDuplicateError";
+} & Readonly<A>;
+export declare class OAuthTokenGrantRegistryDuplicateError extends OAuthTokenGrantRegistryDuplicateError_base<{
+    readonly grantType: string;
+}> {
+}
+export interface OAuthTokenGrantRegistryService {
+    readonly get: (grantType: string) => Option.Option<OAuthTokenGrantRegistration>;
+}
+declare const OAuthTokenGrantRegistry_base: Context.ServiceClass<OAuthTokenGrantRegistry, "auth/HttpApi/OAuthTokenGrantRegistry", OAuthTokenGrantRegistryService>;
+export declare class OAuthTokenGrantRegistry extends OAuthTokenGrantRegistry_base {
+}
+export declare namespace OAuthTokenGrantRegistry {
+    const make: (registrations: readonly OAuthTokenGrantRegistration[]) => Effect.Effect<OAuthTokenGrantRegistryService, OAuthTokenGrantRegistryDuplicateError>;
+}
+type OAuthTokenRegistrationEffect = Effect.Effect<OAuthTokenGrantRegistration, unknown, unknown>;
+type OAuthTokenRegistrationError<T> = T extends Effect.Effect<unknown, infer E, unknown> ? E : never;
+type OAuthTokenRegistrationContext<T> = T extends Effect.Effect<unknown, unknown, infer R> ? R : never;
+export declare const OAuthTokenGrantRegistryLive: <const Registrations extends readonly OAuthTokenRegistrationEffect[]>(...registrations: Registrations) => Layer.Layer<OAuthTokenGrantRegistry, OAuthTokenGrantRegistryDuplicateError | OAuthTokenRegistrationError<Registrations[number]>, OAuthTokenRegistrationContext<Registrations[number]>>;
+export declare const oauthAuthorizationCodeTokenGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthAuthorizationCodeTokenGrant>;
+export declare const oauthRefreshTokenGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthRefreshTokenGrant>;
+export declare const oauthClientCredentialsGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthClientCredentialsGrant>;
+export declare const oauthDeviceCodeTokenGrantRegistration: Effect.Effect<OAuthTokenGrantRegistration, never, OAuthDeviceCodeTokenGrant>;
 export interface OAuthAccountUnlinkStepUpHttpInput {
     readonly payload: Schema.Schema.Type<typeof OAuthAccountUnlinkBody>;
     readonly session: ValidatedSession;
@@ -1148,11 +1183,9 @@ export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
 export declare const makeOAuthProviderAuthorizationHandler: (dependencies: {
     readonly authorization: OAuthProviderAuthorizationService;
 }) => (args_0: OAuthProviderAuthorizationHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError | OAuthAuthorizationEndpointError, never>;
-export declare const makeOAuthAuthorizationCodeTokenHandler: (dependencies: {
-    readonly tokenGrant: OAuthAuthorizationCodeTokenGrantService;
-    readonly refreshTokenGrant?: OAuthRefreshTokenGrantService;
-    readonly clientCredentialsGrant?: OAuthClientCredentialsGrantService;
-} & OAuthAuthorizationCodeTokenHttpOptions) => (args_0: OAuthTokenHandlerRequest) => Effect.Effect<{
+export declare const makeOAuthTokenHandler: (dependencies: {
+    readonly registry: OAuthTokenGrantRegistryService;
+} & OAuthTokenHttpOptions) => (args_0: OAuthTokenHandlerRequest) => Effect.Effect<{
     readonly access_token: string;
     readonly token_type: string;
     readonly expires_in?: number | undefined;
@@ -1648,6 +1681,7 @@ export declare const makeOidcDiscoveryMetadataHandler: (dependencies: {
     readonly issuer: string;
     readonly authorization_endpoint: string;
     readonly token_endpoint: string;
+    readonly device_authorization_endpoint?: string | undefined;
     readonly jwks_uri: string;
     readonly response_types_supported: readonly string[];
     readonly subject_types_supported: readonly string[];
@@ -1797,19 +1831,16 @@ export declare const TrustedDeviceHttpOperationsLive: Layer.Layer<TrustedDeviceH
 export declare const AdminTrustedDeviceHttpOperationsLive: Layer.Layer<AdminTrustedDeviceHttpOperations, never, AdminTrustedDeviceAuthorization | SessionCookie | Sessions | TrustedDeviceStore>;
 export declare const OAuthHttpOperationsLive: Layer.Layer<OAuthHttpOperations, never, OAuthAccountUnlinking | OAuthLinkConfirmation | OAuthProviders | OAuthState | SessionCookie | Sessions>;
 export declare const OAuthProviderAuthorizationHttpOperationsLive: Layer.Layer<OAuthProviderAuthorizationHttpOperations, never, OAuthProviderAuthorization>;
-export declare const OAuthTokenHttpOperationsLive: Layer.Layer<OAuthTokenHttpOperations, never, OAuthAuthorizationCodeTokenGrant>;
+export declare const OAuthTokenHttpOperationsLive: Layer.Layer<OAuthTokenHttpOperations, never, OAuthTokenGrantRegistry>;
+export declare const OAuthTokenIntrospectionHttpOperationsLive: Layer.Layer<OAuthTokenIntrospectionHttpOperations, never, OAuthTokenIntrospection>;
+export declare const OAuthTokenRevocationHttpOperationsLive: Layer.Layer<OAuthTokenRevocationHttpOperations, never, OAuthTokenRevocation>;
 export declare const LoginApprovalHttpOperationsLive: Layer.Layer<LoginApprovalHttpOperations, never, AuthFlowState | AuthHttp | IdentityStore | LoginApproval | Sessions>;
 export declare const ApiKeyHttpOperationsLive: Layer.Layer<ApiKeyHttpOperations, never, ApiKeyManagement | SessionCookie | Sessions>;
 export declare const RefreshTokenHttpOperationsLive: Layer.Layer<RefreshTokenHttpOperations, never, JwtIssuer | RefreshTokenHttpConfig | RefreshTokenManagement>;
 export declare const JwtHttpOperationsLive: Layer.Layer<JwtHttpOperations, never, JwtRevocation>;
 export declare const JwtDiscoveryHttpOperationsLive: Layer.Layer<JwtDiscoveryHttpOperations, never, Jwks>;
 export declare const OidcDiscoveryHttpOperationsLive: Layer.Layer<OidcDiscoveryHttpOperations, never, OidcDiscoveryMetadata>;
-declare const AdminSessionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminSession", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
-}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/sessions/", never, Schema.toCodecStringTree<Schema.Struct<{
+declare const AdminSessionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminSession", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/sessions/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly sessions: Schema.$Array<Schema.Struct<{
@@ -1830,7 +1861,12 @@ declare const AdminSessionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminSes
         readonly latitude: Schema.optional<Schema.Number>;
         readonly longitude: Schema.optional<Schema.Number>;
     }>>;
-}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/sessions/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeAll", "POST", "/auth/admin/sessions/revoke-all", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class AdminSessionHttpApiGroup extends AdminSessionHttpApiGroup_base {
 }
 declare const AdminSessionHttpApi_base: HttpApi.HttpApi<"AdminSessionHttpApi", typeof AdminSessionHttpApiGroup>;
@@ -1881,19 +1917,6 @@ declare const AdminPermissionDefinitionHttpApiGroup_base: HttpApiGroup.HttpApiGr
     readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
     readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"update", "POST", "/auth/admin/permission-definitions/update", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
-    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly description: Schema.optional<Schema.NullOr<Schema.String>>;
-    readonly scopeType: Schema.optional<Schema.NullOr<Schema.String>>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
-    readonly description: Schema.optional<Schema.String>;
-    readonly scopeType: Schema.optional<Schema.String>;
-    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
 }>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"get", "GET", "/auth/admin/permission-definitions/get", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -1920,6 +1943,19 @@ declare const AdminPermissionDefinitionHttpApiGroup_base: HttpApiGroup.HttpApiGr
         readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     }>>;
     readonly nextAfter: Schema.optional<Schema.brand<Schema.String, "auth/PermissionId">>;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"update", "POST", "/auth/admin/permission-definitions/update", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly expectedUpdatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly description: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly scopeType: Schema.optional<Schema.NullOr<Schema.String>>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly updatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly disabledAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly deletedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
 }>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof AuthNotFoundError | typeof AuthConflictError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class AdminPermissionDefinitionHttpApiGroup extends AdminPermissionDefinitionHttpApiGroup_base {
 }
@@ -1941,7 +1977,42 @@ export declare class TotpHttpApi extends TotpHttpApi_base {
 declare const RecoveryCodesHttpApi_base: HttpApi.HttpApi<"RecoveryCodesHttpApi", typeof RecoveryCodesHttpApiGroup>;
 export declare class RecoveryCodesHttpApi extends RecoveryCodesHttpApi_base {
 }
-declare const OAuthHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startAuthorization", "POST", "/auth/oauth/start", never, never, Schema.toCodecJson<Schema.Struct<{
+declare const OAuthHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly expectedProviderId: Schema.optional<Schema.brand<Schema.String, "auth/OAuthProviderId">>;
+    readonly expectedProviderAccountId: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly existingAccount: Schema.optional<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+    readonly linked: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startAuthorization", "POST", "/auth/oauth/start", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
     readonly redirectUri: Schema.optional<Schema.String>;
     readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
@@ -1961,21 +2032,7 @@ declare const OAuthHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauth", import(
     readonly nonce: Schema.optional<Schema.String>;
     readonly redirectUri: Schema.String;
     readonly scopes: Schema.$Array<Schema.String>;
-}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.optional<Schema.String>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly identity: Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-    }>;
-    readonly reason: Schema.String;
-    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
     readonly identity: Schema.optional<Schema.Struct<{
         readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
@@ -1998,27 +2055,6 @@ declare const OAuthHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauth", import(
     }>;
     readonly reason: Schema.String;
     readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
-}>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly secret: Schema.optional<Schema.String>;
-    readonly expectedProviderId: Schema.optional<Schema.brand<Schema.String, "auth/OAuthProviderId">>;
-    readonly expectedProviderAccountId: Schema.optional<Schema.String>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly identity: Schema.Struct<{
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
-        readonly emailVerified: Schema.optional<Schema.Boolean>;
-    }>;
-    readonly reason: Schema.String;
-    readonly existingAccount: Schema.optional<Schema.Struct<{
-        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
-        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
-        readonly providerAccountId: Schema.String;
-    }>>;
-    readonly linked: Schema.Boolean;
 }>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"unlinkAccount", "POST", "/auth/oauth/unlink", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
     readonly providerAccountId: Schema.String;
@@ -2074,7 +2110,7 @@ export declare class OAuthHttpApiGroup extends OAuthHttpApiGroup_base {
 declare const OAuthHttpApi_base: HttpApi.HttpApi<"OAuthHttpApi", typeof OAuthHttpApiGroup>;
 export declare class OAuthHttpApi extends OAuthHttpApi_base {
 }
-declare const OAuthTokenHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", never, never, never, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"token", "POST", "/auth/oauth/token", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+declare const OAuthTokenHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"token", "POST", "/auth/oauth/token", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly access_token: Schema.String;
     readonly token_type: Schema.String;
     readonly expires_in: Schema.optional<Schema.Number>;
@@ -2082,7 +2118,13 @@ declare const OAuthTokenHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthToken
     readonly id_token: Schema.optional<Schema.String>;
     readonly scope: Schema.optional<Schema.String>;
     readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-}>>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenEndpointError>, AuthSchemaErrorMiddleware | OAuthNoStoreMiddleware, never>, false>;
+export declare class OAuthTokenHttpApiGroup extends OAuthTokenHttpApiGroup_base {
+}
+declare const OAuthTokenHttpApi_base: HttpApi.HttpApi<"OAuthTokenHttpApi", typeof OAuthTokenHttpApiGroup>;
+export declare class OAuthTokenHttpApi extends OAuthTokenHttpApi_base {
+}
+declare const OAuthTokenIntrospectionHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthTokenIntrospection", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/oauth/introspect", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly active: Schema.Boolean;
     readonly scope: Schema.optional<Schema.String>;
     readonly client_id: Schema.optional<Schema.String>;
@@ -2097,10 +2139,16 @@ declare const OAuthTokenHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthToken
     readonly jti: Schema.optional<Schema.String>;
     readonly extra: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenIntrospectionEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
-export declare class OAuthTokenHttpApiGroup extends OAuthTokenHttpApiGroup_base {
+export declare class OAuthTokenIntrospectionHttpApiGroup extends OAuthTokenIntrospectionHttpApiGroup_base {
 }
-declare const OAuthTokenHttpApi_base: HttpApi.HttpApi<"OAuthTokenHttpApi", typeof OAuthTokenHttpApiGroup>;
-export declare class OAuthTokenHttpApi extends OAuthTokenHttpApi_base {
+declare const OAuthTokenIntrospectionHttpApi_base: HttpApi.HttpApi<"OAuthTokenIntrospectionHttpApi", typeof OAuthTokenIntrospectionHttpApiGroup>;
+export declare class OAuthTokenIntrospectionHttpApi extends OAuthTokenIntrospectionHttpApi_base {
+}
+declare const OAuthTokenRevocationHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthTokenRevocation", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/oauth/revoke", never, never, never, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthInternalError | typeof OAuthTokenRevocationEndpointError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class OAuthTokenRevocationHttpApiGroup extends OAuthTokenRevocationHttpApiGroup_base {
+}
+declare const OAuthTokenRevocationHttpApi_base: HttpApi.HttpApi<"OAuthTokenRevocationHttpApi", typeof OAuthTokenRevocationHttpApiGroup>;
+export declare class OAuthTokenRevocationHttpApi extends OAuthTokenRevocationHttpApi_base {
 }
 declare const OAuthProviderAuthorizationHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oauthProviderAuthorization", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"authorize", "GET", "/auth/oauth/authorize", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly response_type: Schema.String;
@@ -2122,10 +2170,7 @@ export declare class MfaHttpApi extends MfaHttpApi_base {
 declare const StepUpHttpApi_base: HttpApi.HttpApi<"StepUpHttpApi", typeof StepUpHttpApiGroup>;
 export declare class StepUpHttpApi extends StepUpHttpApi_base {
 }
-declare const ApiKeyHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly keyId: Schema.String;
-    readonly reason: Schema.optional<Schema.String>;
-}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", never, never, Schema.toCodecJson<Schema.Struct<{
+declare const ApiKeyHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
     readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
@@ -2152,7 +2197,10 @@ declare const ApiKeyHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"apiKey", impor
         readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly keyId: Schema.String;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class ApiKeyHttpApiGroup extends ApiKeyHttpApiGroup_base {
 }
 declare const ApiKeyHttpApi_base: HttpApi.HttpApi<"ApiKeyHttpApi", typeof ApiKeyHttpApiGroup>;
@@ -2183,11 +2231,7 @@ export declare class RefreshTokenHttpApiGroup extends RefreshTokenHttpApiGroup_b
 declare const RefreshTokenHttpApi_base: HttpApi.HttpApi<"RefreshTokenHttpApi", typeof RefreshTokenHttpApiGroup>;
 export declare class RefreshTokenHttpApi extends RefreshTokenHttpApi_base {
 }
-declare const JwtHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly jwtId: Schema.String;
-    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
-    readonly reason: Schema.optional<Schema.String>;
-}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", never, never, Schema.toCodecJson<Schema.Struct<{
+declare const JwtHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly token: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
     readonly active: Schema.Literal<true>;
@@ -2215,7 +2259,11 @@ declare const JwtHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"jwt", import("eff
     readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly revokedReason: Schema.optional<Schema.String>;
-}>]>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+}>]>>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
 export declare class JwtHttpApiGroup extends JwtHttpApiGroup_base {
 }
 declare const JwtHttpApi_base: HttpApi.HttpApi<"JwtHttpApi", typeof JwtHttpApiGroup>;
@@ -2233,6 +2281,7 @@ declare const OidcDiscoveryHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"oidcDis
     readonly issuer: Schema.String;
     readonly authorization_endpoint: Schema.String;
     readonly token_endpoint: Schema.String;
+    readonly device_authorization_endpoint: Schema.optional<Schema.String>;
     readonly jwks_uri: Schema.String;
     readonly response_types_supported: Schema.$Array<Schema.String>;
     readonly subject_types_supported: Schema.$Array<Schema.String>;
@@ -2317,9 +2366,7 @@ export declare class AdminSecurityTimelineHttpApiGroup extends AdminSecurityTime
 declare const AdminSecurityTimelineHttpApi_base: HttpApi.HttpApi<"AdminSecurityTimelineHttpApi", typeof AdminSecurityTimelineHttpApiGroup>;
 export declare class AdminSecurityTimelineHttpApi extends AdminSecurityTimelineHttpApi_base {
 }
-declare const TrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"trustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly deviceId: Schema.String;
-}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/trusted-devices/", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+declare const TrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"trustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/trusted-devices/", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly devices: Schema.$Array<Schema.Struct<{
         readonly deviceId: Schema.String;
         readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
@@ -2327,16 +2374,15 @@ declare const TrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"trusted
         readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly deviceId: Schema.String;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class TrustedDeviceHttpApiGroup extends TrustedDeviceHttpApiGroup_base {
 }
 declare const TrustedDeviceHttpApi_base: HttpApi.HttpApi<"TrustedDeviceHttpApi", typeof TrustedDeviceHttpApiGroup>;
 export declare class TrustedDeviceHttpApi extends TrustedDeviceHttpApi_base {
 }
-declare const AdminTrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminTrustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
-    readonly deviceId: Schema.String;
-}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/trusted-devices/", never, Schema.toCodecStringTree<Schema.Struct<{
+declare const AdminTrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"adminTrustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/admin/trusted-devices/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly userId: Schema.brand<Schema.String, "auth/UserId">;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly devices: Schema.$Array<Schema.Struct<{
@@ -2346,7 +2392,10 @@ declare const AdminTrustedDeviceHttpApiGroup_base: HttpApiGroup.HttpApiGroup<"ad
         readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>>;
-}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
+}>>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/admin/trusted-devices/revoke", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly deviceId: Schema.String;
+}>>, never, Schema.toCodecJson<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof import("./Errors.js").AuthStepUpRequiredError | typeof import("./Errors.js").AuthRateLimitedError | typeof import("./Errors.js").AuthRequestRejectedError | typeof AuthInternalError>, AuthOriginCheckMiddleware | AuthSchemaErrorMiddleware, never>, false>;
 export declare class AdminTrustedDeviceHttpApiGroup extends AdminTrustedDeviceHttpApiGroup_base {
 }
 declare const AdminTrustedDeviceHttpApi_base: HttpApi.HttpApi<"AdminTrustedDeviceHttpApi", typeof AdminTrustedDeviceHttpApiGroup>;
@@ -2393,8 +2442,12 @@ export declare const SecurityTimelineHttpApiGroupLive: Layer.Layer<HttpApiGroup.
 export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | SecurityTimelineStore | SessionCookie | Sessions>;
 export declare const OAuthProviderAuthorizationHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthProviderAuthorizationHttpApi", "oauthProviderAuthorization">, never, AuthSchemaErrorMiddleware | OAuthProviderAuthorizationHttpOperations>;
 export declare const OAuthProviderAuthorizationHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthProviderAuthorization | import("effect/Path").Path>;
-export declare const OAuthTokenHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenHttpApi", "oauthToken">, never, AuthSchemaErrorMiddleware | OAuthTokenHttpOperations>;
-export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthAuthorizationCodeTokenGrant | import("effect/Path").Path>;
+export declare const OAuthTokenHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenHttpApi", "oauthToken">, never, OAuthTokenHttpOperations | (AuthSchemaErrorMiddleware | OAuthNoStoreMiddleware)>;
+export declare const OAuthTokenHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthTokenGrantRegistry | import("effect/Path").Path>;
+export declare const OAuthTokenIntrospectionHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenIntrospectionHttpApi", "oauthTokenIntrospection">, never, AuthSchemaErrorMiddleware | OAuthTokenIntrospectionHttpOperations>;
+export declare const OAuthTokenIntrospectionHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthTokenIntrospection | import("effect/Path").Path>;
+export declare const OAuthTokenRevocationHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OAuthTokenRevocationHttpApi", "oauthTokenRevocation">, never, AuthSchemaErrorMiddleware | OAuthTokenRevocationHttpOperations>;
+export declare const OAuthTokenRevocationHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | OAuthTokenRevocation | import("effect/Path").Path>;
 export declare const JwtDiscoveryHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"JwtDiscoveryHttpApi", "jwtDiscovery">, never, AuthSchemaErrorMiddleware | JwtDiscoveryHttpOperations>;
 export declare const JwtDiscoveryHttpApiLive: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | Jwks | import("effect/Path").Path>;
 export declare const OidcDiscoveryHttpApiGroupLive: Layer.Layer<HttpApiGroup.Service<"OidcDiscoveryHttpApi", "oidcDiscovery">, never, AuthSchemaErrorMiddleware | OidcDiscoveryHttpOperations>;