@effect-auth/core 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/HttpApi/Api.d.ts

@@ -1,34 +1,262 @@
-import { Effect, Layer } from "effect";
-import type { Schema } from "effect";
+import { Effect, Layer, Redacted } from "effect";
+import type { Duration, Schema } from "effect";
 import type { HttpServerRequest } from "effect/unstable/http";
 import { HttpServerResponse } from "effect/unstable/http";
 import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";
-import { AuthResult } from "../AuthFlow.js";
+import { ApiKeyId } from "../ApiKey.js";
+import type { ApiKeyCreateForUserInput, ApiKeyManagementRevokeInput, ApiKeyManagementService } from "../ApiKey.js";
+import type { JwtAudience, JwtIssueInput, JwtIssuerService, JwtRevokeJwtIdInput, JwtRevocationService, JwtVerifyInput } from "../Jwt.js";
+import { AuthFlow, AuthFlowState, AuthResult } from "../AuthFlow.js";
+import type { AuthFlowService, AuthFlowStateService, LoginApprovalFinalizeService } from "../AuthFlow.js";
+import { EmailOtpLogin } from "../EmailOtp.js";
+import type { EmailOtpLoginService, EmailOtpStartInput, EmailOtpVerifyInput } from "../EmailOtp.js";
 import { EmailVerification, EmailVerificationFlow } from "../EmailVerification.js";
 import type { EmailVerificationFlowService, EmailVerificationService, EmailVerificationIssueInput, EmailVerificationVerifyInput } from "../EmailVerification.js";
-import { PasswordLogin, PasswordRegistration } from "../Password.js";
-import type { PasswordLoginService, PasswordRegistrationService, PasswordSignInInput, PasswordSignUpInput } from "../Password.js";
+import type { Email, UnixMillis, UserId } from "../Identifiers.js";
+import { LoginApproval } from "../LoginApproval.js";
+import type { LoginApprovalReviewService, LoginApprovalService, LoginApprovalVerifyInput } from "../LoginApproval.js";
+import type { LoginRequestContext } from "../LoginRisk.js";
+import type { LoginNotificationReportInput, LoginNotificationService } from "../LoginNotification.js";
+import { MagicLinkLogin } from "../MagicLink.js";
+import type { MagicLinkLoginService, MagicLinkStartInput, MagicLinkVerifyInput } from "../MagicLink.js";
+import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset } from "../Password.js";
+import { PasskeyCredentialId } from "../Passkey.js";
+import type { FinishedPasskeyAuthentication, PasskeyAttestation, PasskeyAuthenticationStartInput, PasskeyAuthenticatorSelection, PasskeyCredentialManagementService, PasskeyOptionsService, PasskeyPublicKeyCredentialParameters, PasskeyRelyingParty, PasskeyUserVerification, PasskeyVerificationService } from "../Passkey.js";
+import type { PasswordChangeInput, PasswordManagementService, PasswordLoginService, PasswordRegistrationService, PasswordResetService, PasswordResetStartInput, PasswordResetVerifyInput, PasswordSetInput, PasswordSignInInput, PasswordSignUpInput } from "../Password.js";
+import type { RecoveryCodeGenerateForUserInput, RecoveryCodeManagementRevokeInput, RecoveryCodeManagementService, RecoveryCodeVerifyForUserInput } from "../RecoveryCode.js";
+import type { RefreshTokenInfo, RefreshTokenManagementService, RefreshTokenRotateInput } from "../RefreshToken.js";
 import { SessionCookie, Sessions } from "../Sessions.js";
-import type { SessionCookieService, SessionsService } from "../Sessions.js";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError } from "./Errors.js";
-import type { EmailVerificationStartBody, EmailVerificationVerifyBody, PasswordSignInBody, PasswordSignUpBody } from "./Schemas.js";
+import type { SessionClaims, SessionCookieService, SessionCreateInput, SessionsService } from "../Sessions.js";
+import { UserStore } from "../Storage.js";
+import type { UserStoreService } from "../Storage.js";
+import type { TotpAlgorithm, TotpEnrollmentConfirmInput, TotpEnrollmentStartInput, TotpFactorManagementService, TotpFactorManagementRevokeInput, TotpVerifyForUserInput } from "../Totp.js";
+import type { TrustedDeviceCookieService, TrustedDeviceService } from "../TrustedDevice.js";
+import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError } from "./Errors.js";
+import type { ApiKeyCreateBody, ApiKeyRevokeBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtRevokeBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaOptionsBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasswordChangeBody, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
 import { AuthApiRateLimit, AuthOriginCheckMiddleware, AuthRateLimitMiddleware } from "./Security.js";
 import type { AuthApiRateLimitService } from "./Security.js";
 import { AuthHttp } from "./Transport.js";
-import type { AuthHttpService } from "./Transport.js";
-export declare const passwordSignInInput: (payload: Schema.Schema.Type<typeof PasswordSignInBody>) => PasswordSignInInput;
-export declare const passwordSignUpInput: (payload: Schema.Schema.Type<typeof PasswordSignUpBody>) => PasswordSignUpInput;
+import type { AuthHttpService, LoginApprovalPendingCookieService } from "./Transport.js";
+export declare const passwordSignInInput: (payload: Schema.Schema.Type<typeof PasswordSignInBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => PasswordSignInInput;
+export declare const passwordSignUpInput: (payload: Schema.Schema.Type<typeof PasswordSignUpBody>, request?: LoginRequestContext) => PasswordSignUpInput;
+export declare const passwordResetStartInput: (payload: Schema.Schema.Type<typeof PasswordResetStartBody>) => PasswordResetStartInput;
+export declare const passwordResetVerifyInput: (payload: Schema.Schema.Type<typeof PasswordResetVerifyBody>) => PasswordResetVerifyInput;
+export declare const passwordSetInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasswordSetBody>) => PasswordSetInput;
+export declare const passwordChangeInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasswordChangeBody>) => PasswordChangeInput;
 export declare const emailVerificationStartInput: (payload: Schema.Schema.Type<typeof EmailVerificationStartBody>) => EmailVerificationIssueInput;
 export declare const emailVerificationVerifyInput: (payload: Schema.Schema.Type<typeof EmailVerificationVerifyBody>) => EmailVerificationVerifyInput;
+export declare const emailOtpStartInput: (payload: Schema.Schema.Type<typeof EmailOtpStartBody>) => EmailOtpStartInput;
+export declare const emailOtpVerifyInput: (payload: Schema.Schema.Type<typeof EmailOtpVerifyBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => EmailOtpVerifyInput;
+export declare const magicLinkStartInput: (payload: Schema.Schema.Type<typeof MagicLinkStartBody>) => MagicLinkStartInput;
+export declare const magicLinkVerifyInput: (payload: Schema.Schema.Type<typeof MagicLinkVerifyBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => MagicLinkVerifyInput;
+export interface PasskeyRegistrationStartHttpOptions {
+    readonly relyingParty: PasskeyRelyingParty;
+    readonly timeout?: number;
+    readonly pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[];
+    readonly authenticatorSelection?: PasskeyAuthenticatorSelection;
+    readonly attestation?: PasskeyAttestation;
+}
+export interface PasskeyAuthenticationStartHttpOptions {
+    readonly relyingPartyId: string;
+    readonly timeout?: number;
+    readonly userVerification?: PasskeyUserVerification;
+}
+export interface PasskeyFinishHttpOptions {
+    readonly relyingPartyId: string;
+    readonly expectedOrigin: string | readonly string[];
+    readonly requireUserVerification?: boolean;
+}
+export interface TotpEnrollmentStartHttpOptions {
+    readonly issuer: string;
+    readonly secretBytes?: number;
+    readonly algorithm?: TotpAlgorithm;
+    readonly digits?: number;
+    readonly period?: number;
+}
+export interface TotpCodeHttpOptions {
+    readonly window?: number;
+}
+export interface RecoveryCodeGenerateHttpOptions {
+    readonly count?: number;
+    readonly length?: number;
+    readonly groupSize?: number;
+}
+export declare const passkeyRegistrationStartInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>, options: PasskeyRegistrationStartHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    attestation?: PasskeyAttestation | undefined;
+    authenticatorSelection?: PasskeyAuthenticatorSelection | undefined;
+    pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[] | undefined;
+    timeout?: number | undefined;
+    relyingParty: PasskeyRelyingParty;
+    userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    userName: string;
+    userDisplayName: string;
+};
+export declare const passkeyAuthenticationStartInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>, options: PasskeyAuthenticationStartHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    userVerification?: PasskeyUserVerification | undefined;
+    timeout?: number | undefined;
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    relyingPartyId: string;
+};
+export declare const passkeyMfaStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>, options: PasskeyAuthenticationStartHttpOptions) => PasskeyAuthenticationStartInput;
+export declare const passkeyRegistrationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>, options: PasskeyFinishHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    requireUserVerification?: boolean | undefined;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    response: {
+        readonly id: string;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly rawId?: string | undefined;
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+};
+export declare const passkeyAuthenticationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>, options: PasskeyFinishHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    requireUserVerification?: boolean | undefined;
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    response: {
+        readonly id: string;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly rawId?: string | undefined;
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+};
+export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>, options: PasskeyFinishHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    requireUserVerification?: boolean | undefined;
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    response: {
+        readonly id: string;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly rawId?: string | undefined;
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+};
+export declare const passkeyCredentialRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyCredentialRevokeBody>) => {
+    reason?: string | undefined;
+    userId: UserId;
+    credentialId: PasskeyCredentialId;
+};
+export declare const totpEnrollmentStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpEnrollmentStartBody>, options: TotpEnrollmentStartHttpOptions) => TotpEnrollmentStartInput;
+export declare const totpEnrollmentConfirmInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpEnrollmentConfirmBody>, options?: TotpCodeHttpOptions) => TotpEnrollmentConfirmInput;
+export declare const totpVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const totpFactorRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpFactorRevokeBody>) => TotpFactorManagementRevokeInput;
+export declare const recoveryCodeGenerateInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeGenerateBody>, options?: RecoveryCodeGenerateHttpOptions) => RecoveryCodeGenerateForUserInput;
+export declare const recoveryCodeVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeVerifyBody>) => RecoveryCodeVerifyForUserInput;
+export declare const recoveryCodeRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeRevokeBody>) => RecoveryCodeManagementRevokeInput;
+export declare const apiKeyCreateInput: (userId: UserId, payload: Schema.Schema.Type<typeof ApiKeyCreateBody>) => ApiKeyCreateForUserInput;
+export declare const apiKeyRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof ApiKeyRevokeBody>) => ApiKeyManagementRevokeInput;
+export interface RefreshTokenRefreshHttpPolicyInput {
+    readonly now: UnixMillis;
+}
+export interface RefreshTokenAccessTokenHttpInput extends RefreshTokenRefreshHttpPolicyInput {
+    readonly refreshToken: RefreshTokenInfo;
+    readonly previousToken: RefreshTokenInfo;
+}
+export interface RefreshTokenRefreshHttpOptions {
+    readonly refreshTokenExpiresAt: (input: RefreshTokenRefreshHttpPolicyInput) => UnixMillis;
+    readonly accessToken: (input: RefreshTokenAccessTokenHttpInput) => JwtIssueInput;
+}
+export declare const refreshTokenRefreshInput: (payload: Schema.Schema.Type<typeof RefreshTokenRefreshBody>, now: UnixMillis, expiresAt: UnixMillis) => RefreshTokenRotateInput;
+export interface JwtIntrospectionHttpOptions {
+    readonly issuer?: string;
+    readonly audience?: JwtAudience;
+    readonly clockTolerance?: Duration.Duration;
+}
+export declare const jwtIntrospectInput: (payload: Schema.Schema.Type<typeof JwtIntrospectBody>, options?: JwtIntrospectionHttpOptions) => JwtVerifyInput;
+export declare const jwtRevokeInput: (payload: Schema.Schema.Type<typeof JwtRevokeBody>) => JwtRevokeJwtIdInput;
+export declare const totpMfaVerifyInput: (payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const totpMfaVerifyForFlowInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpMfaVerifyForFlowBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const recoveryCodeMfaVerifyInput: (payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>) => RecoveryCodeVerifyForUserInput;
+export declare const recoveryCodeMfaVerifyForFlowInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyForFlowBody>) => RecoveryCodeVerifyForUserInput;
+export interface LoginApprovalApproveInput {
+    readonly flowId: Schema.Schema.Type<typeof LoginApprovalApproveBody>["flowId"];
+    readonly approval: LoginApprovalVerifyInput;
+    readonly rememberDevice: boolean;
+}
+export declare const loginApprovalApproveInput: (payload: Schema.Schema.Type<typeof LoginApprovalApproveBody>) => LoginApprovalApproveInput;
+export interface LoginApprovalStatusInput {
+    readonly flowId: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>["flowId"];
+    readonly approvalChallengeId: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>["approvalChallengeId"];
+}
+export declare const loginApprovalStatusInput: (payload: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>) => LoginApprovalStatusInput;
+export interface LoginApprovalFinalizeHttpInput {
+    readonly flowId: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>["flowId"];
+    readonly approvalChallengeId: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>["approvalChallengeId"];
+    readonly rememberDevice: boolean;
+}
+export declare const loginApprovalFinalizeInput: (payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>) => LoginApprovalFinalizeHttpInput;
+export declare const loginNotificationReportInput: (payload: Schema.Schema.Type<typeof LoginNotificationReportBody>) => LoginNotificationReportInput;
 export type PasswordSignInHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof PasswordSignInBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
 };
 export type PasswordSignUpHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof PasswordSignUpBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasswordResetStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordResetStartBody>;
+};
+export type PasswordResetVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordResetVerifyBody>;
+};
+export type PasswordSetHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordSetBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type PasswordChangeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordChangeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
 };
 export type SessionHandlerRequest = {
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type SessionRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof SessionRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type LoginNotificationReportHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginNotificationReportBody>;
+};
 export type EmailVerificationStartHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof EmailVerificationStartBody>;
 };
@@ -36,11 +264,137 @@ export type EmailVerificationVerifyHandlerRequest = {
     readonly payload: Schema.Schema.Type<typeof EmailVerificationVerifyBody>;
     readonly request: HttpServerRequest.HttpServerRequest;
 };
+export type EmailOtpStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof EmailOtpStartBody>;
+};
+export type EmailOtpVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof EmailOtpVerifyBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type MagicLinkStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof MagicLinkStartBody>;
+};
+export type MagicLinkVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof MagicLinkVerifyBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasskeyRegistrationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>;
+};
+export type PasskeyRegistrationFinishHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>;
+};
+export type PasskeyAuthenticationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>;
+};
+export type PasskeyAuthenticationFinishHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasskeyCredentialListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type PasskeyCredentialRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyCredentialRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpEnrollmentStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpEnrollmentStartBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpEnrollmentConfirmHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpEnrollmentConfirmBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpFactorListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpFactorRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpFactorRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeGenerateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeGenerateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type ApiKeyCreateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof ApiKeyCreateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type ApiKeyListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type ApiKeyRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof ApiKeyRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RefreshTokenRefreshHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RefreshTokenRefreshBody>;
+};
+export type JwtIntrospectHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof JwtIntrospectBody>;
+};
+export type JwtRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof JwtRevokeBody>;
+};
+export type TotpMfaVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>;
+};
+export type TotpMfaVerifyForFlowHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyForFlowBody>;
+};
+export type MfaOptionsHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof MfaOptionsBody>;
+};
+export type RecoveryCodeMfaVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>;
+};
+export type RecoveryCodeMfaVerifyForFlowHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyForFlowBody>;
+};
+export type PasskeyMfaStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>;
+};
+export type PasskeyMfaVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>;
+};
+export interface PasskeyAuthenticationSessionContext {
+    readonly finished: FinishedPasskeyAuthentication;
+    readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+}
+export type LoginApprovalApproveHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginApprovalApproveBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type LoginApprovalStatusHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>;
+};
+export type LoginApprovalFinalizeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
 export declare const makePasswordSignInHandler: (dependencies: {
     readonly password: PasswordLoginService;
     readonly authHttp: AuthHttpService;
     readonly emailVerificationFlow?: EmailVerificationFlowService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
 }) => (args_0: PasswordSignInHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | import("./Transport.js").PasswordSignInHttpError, never>;
 export declare const makePasswordSignUpHandler: (dependencies: {
     readonly registration: PasswordRegistrationService;
@@ -48,6 +402,23 @@ export declare const makePasswordSignUpHandler: (dependencies: {
     readonly emailVerificationFlow?: EmailVerificationFlowService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
 }) => (args_0: PasswordSignUpHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | AuthEmailAlreadyRegisteredError | import("./Transport.js").PasswordSignUpHttpError, never>;
+export declare const makePasswordResetStartHandler: (dependencies: {
+    readonly passwordReset: PasswordResetService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: PasswordResetStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | AuthInternalError, never>;
+export declare const makePasswordResetVerifyHandler: (dependencies: {
+    readonly passwordReset: PasswordResetService;
+}) => (args_0: PasswordResetVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError, never>;
+export declare const makePasswordSetHandler: (dependencies: {
+    readonly passwordManagement: PasswordManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasswordSetHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makePasswordChangeHandler: (dependencies: {
+    readonly passwordManagement: PasswordManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasswordChangeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
 export declare const makeCurrentSessionHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
@@ -63,6 +434,44 @@ export declare const makeLogoutHandler: (dependencies: {
     readonly sessionCookie: SessionCookieService;
     readonly authHttp: AuthHttpService;
 }) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError, never>;
+export declare const makeListSessionsHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<{
+    sessions: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        longitude?: number | undefined;
+        latitude?: number | undefined;
+        city?: string | undefined;
+        region?: string | undefined;
+        country?: string | undefined;
+        userAgent?: string | undefined;
+        ip?: string | undefined;
+        claims?: SessionClaims | undefined;
+        current: boolean;
+        mfaVerifiedAt?: UnixMillis | undefined;
+        expiresAt: UnixMillis;
+        aal: import("../Sessions.js").AuthAssuranceLevel;
+        amr: readonly import("../Sessions.js").AuthMethodReference[];
+        lastSeenAt?: UnixMillis | undefined;
+        sessionId: import("../Identifiers.js").SessionId;
+        userId: UserId;
+        createdAt: UnixMillis;
+        authTime: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRevokeSessionHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: SessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRevokeOtherSessionsHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeLoginNotificationReportHandler: (dependencies: {
+    readonly loginNotification?: LoginNotificationService;
+}) => (args_0: LoginNotificationReportHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
 export declare const makeEmailVerificationStartHandler: (dependencies: {
     readonly emailVerificationFlow: EmailVerificationFlowService;
     readonly authApiRateLimit?: AuthApiRateLimitService;
@@ -72,6 +481,343 @@ export declare const makeEmailVerificationVerifyHandler: (dependencies: {
     readonly sessions: SessionsService;
     readonly sessionCookie: SessionCookieService;
 }) => (args_0: EmailVerificationVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeEmailOtpStartHandler: (dependencies: {
+    readonly emailOtp: EmailOtpLoginService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: EmailOtpStartHandlerRequest) => Effect.Effect<import("../EmailOtp.js").EmailOtpStarted, AuthRateLimitedError | AuthInternalError, never>;
+export declare const makeEmailOtpVerifyHandler: (dependencies: {
+    readonly emailOtp: EmailOtpLoginService;
+    readonly authHttp: AuthHttpService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: EmailOtpVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Transport.js").PasswordSignInHttpError, never>;
+export declare const makeMagicLinkStartHandler: (dependencies: {
+    readonly magicLink: MagicLinkLoginService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: MagicLinkStartHandlerRequest) => Effect.Effect<{
+    email: Email;
+    expiresAt: UnixMillis;
+}, AuthRateLimitedError | AuthInternalError, never>;
+export declare const makeMagicLinkVerifyHandler: (dependencies: {
+    readonly magicLink: MagicLinkLoginService;
+    readonly authHttp: AuthHttpService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: MagicLinkVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Transport.js").PasswordSignInHttpError, never>;
+export declare const makePasskeyRegistrationStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+} & PasskeyRegistrationStartHttpOptions) => (args_0: PasskeyRegistrationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyRegistration, AuthInternalError, never>;
+export declare const makePasskeyRegistrationFinishHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyRegistrationFinishHandlerRequest) => Effect.Effect<{
+    credentialId: PasskeyCredentialId;
+}, AuthBadRequestError | AuthInternalError, never>;
+export declare const makePasskeyAuthenticationStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+} & PasskeyAuthenticationStartHttpOptions) => (args_0: PasskeyAuthenticationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthInternalError, never>;
+export declare const makePasskeyAuthenticationFinishHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+    readonly sessions: SessionsService;
+    readonly authHttp: AuthHttpService;
+    readonly makeSessionInput: (context: PasskeyAuthenticationSessionContext) => SessionCreateInput;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyAuthenticationFinishHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makePasskeyCredentialListHandler: (dependencies: {
+    readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasskeyCredentialListHandlerRequest) => Effect.Effect<{
+    credentials: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        createdAt: UnixMillis;
+        backedUp?: boolean | undefined;
+        transports?: readonly import("../Passkey.js").PasskeyTransport[] | undefined;
+        credentialId: PasskeyCredentialId;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makePasskeyCredentialRevokeHandler: (dependencies: {
+    readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasskeyCredentialRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpEnrollmentStartHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpEnrollmentStartHttpOptions) => (args_0: TotpEnrollmentStartHandlerRequest) => Effect.Effect<{
+    factor: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        confirmedAt?: UnixMillis | undefined;
+        factorId: import("../Identifiers.js").CredentialId;
+        algorithm: TotpAlgorithm;
+        digits: number;
+        period: number;
+        createdAt: UnixMillis;
+    };
+    secret: import("../Totp.js").TotpSecret;
+    uri: string;
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpEnrollmentConfirmHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpCodeHttpOptions) => (args_0: TotpEnrollmentConfirmHandlerRequest) => Effect.Effect<{
+    metadata?: Readonly<Record<string, unknown>> | undefined;
+    revokedAt?: UnixMillis | undefined;
+    lastUsedAt?: UnixMillis | undefined;
+    confirmedAt?: UnixMillis | undefined;
+    factorId: import("../Identifiers.js").CredentialId;
+    algorithm: TotpAlgorithm;
+    digits: number;
+    period: number;
+    createdAt: UnixMillis;
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpVerifyHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpCodeHttpOptions) => (args_0: TotpVerifyHandlerRequest) => Effect.Effect<{
+    delta?: number | undefined;
+    factor?: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        confirmedAt?: UnixMillis | undefined;
+        factorId: import("../Identifiers.js").CredentialId;
+        algorithm: TotpAlgorithm;
+        digits: number;
+        period: number;
+        createdAt: UnixMillis;
+    } | undefined;
+    valid: boolean;
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpFactorListHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: TotpFactorListHandlerRequest) => Effect.Effect<{
+    factors: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        confirmedAt?: UnixMillis | undefined;
+        factorId: import("../Identifiers.js").CredentialId;
+        algorithm: TotpAlgorithm;
+        digits: number;
+        period: number;
+        createdAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpFactorRevokeHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: TotpFactorRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeGenerateHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & RecoveryCodeGenerateHttpOptions) => (args_0: RecoveryCodeGenerateHandlerRequest) => Effect.Effect<{
+    codes: import("../RecoveryCode.js").RecoveryCode[];
+    records: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        usedAt?: UnixMillis | undefined;
+        codeId: import("../Identifiers.js").CredentialId;
+        createdAt: UnixMillis;
+    }[];
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeVerifyHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: RecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
+    code?: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        usedAt?: UnixMillis | undefined;
+        codeId: import("../Identifiers.js").CredentialId;
+        createdAt: UnixMillis;
+    } | undefined;
+    valid: boolean;
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeListHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: RecoveryCodeListHandlerRequest) => Effect.Effect<{
+    codes: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        usedAt?: UnixMillis | undefined;
+        codeId: import("../Identifiers.js").CredentialId;
+        createdAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeRevokeHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: RecoveryCodeRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeApiKeyCreateHandler: (dependencies: {
+    readonly apiKeyManagement: ApiKeyManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: ApiKeyCreateHandlerRequest) => Effect.Effect<{
+    secret: import("../ApiKey.js").ApiKeySecret;
+    key: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        expiresAt?: UnixMillis | undefined;
+        keyId: ApiKeyId;
+        prefix: import("../ApiKey.js").ApiKeyPrefix;
+        scopes: readonly string[];
+        createdAt: UnixMillis;
+    };
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeApiKeyListHandler: (dependencies: {
+    readonly apiKeyManagement: ApiKeyManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: ApiKeyListHandlerRequest) => Effect.Effect<{
+    keys: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        expiresAt?: UnixMillis | undefined;
+        keyId: ApiKeyId;
+        prefix: import("../ApiKey.js").ApiKeyPrefix;
+        scopes: readonly string[];
+        createdAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeApiKeyRevokeHandler: (dependencies: {
+    readonly apiKeyManagement: ApiKeyManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: ApiKeyRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRefreshTokenRefreshHandler: (dependencies: {
+    readonly refreshTokenManagement: RefreshTokenManagementService;
+    readonly jwtIssuer: JwtIssuerService;
+} & RefreshTokenRefreshHttpOptions) => (args_0: RefreshTokenRefreshHandlerRequest) => Effect.Effect<{
+    refreshToken: string;
+    refreshTokenRecord: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        reuseDetectedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        replacedById?: import("../RefreshToken.js").RefreshTokenId | undefined;
+        rotatedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        tokenId: import("../RefreshToken.js").RefreshTokenId;
+        familyId: import("../RefreshToken.js").RefreshTokenFamilyId;
+        createdAt: UnixMillis;
+        expiresAt: UnixMillis;
+    };
+    accessTokenExpiresAt?: UnixMillis | undefined;
+    accessToken: import("../Jwt.js").JwtToken;
+}, AuthInvalidCredentialsError | AuthInternalError, never>;
+export declare const makeJwtIntrospectHandler: (dependencies: {
+    readonly jwtRevocation: JwtRevocationService;
+} & JwtIntrospectionHttpOptions) => (args_0: JwtIntrospectHandlerRequest) => Effect.Effect<{
+    readonly active: true;
+    readonly header: {
+        readonly typ: "JWT";
+        readonly alg: "HS256" | "RS256" | "ES256" | "EdDSA";
+        readonly kid: string;
+    };
+    readonly claims: {
+        readonly [x: string]: unknown;
+    };
+    readonly key: {
+        readonly keyId: string;
+        readonly alg: "HS256" | "RS256" | "ES256" | "EdDSA";
+        readonly status: "active" | "retired" | "disabled";
+        readonly createdAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+        readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+        readonly metadata?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+    readonly revoked: false;
+    readonly jwtId?: string | undefined;
+    readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+} | {
+    readonly active: false;
+    readonly reason: "expired" | "revoked" | "malformed" | "unsupported_alg" | "unknown_key" | "invalid_signature" | "not_yet_valid" | "issuer_mismatch" | "audience_mismatch";
+    readonly jwtId?: string | undefined;
+    readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+    readonly revokedAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+    readonly revokedReason?: string | undefined;
+}, AuthInternalError, never>;
+export declare const makeJwtRevokeHandler: (dependencies: {
+    readonly jwtRevocation: JwtRevocationService;
+}) => (args_0: JwtRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeMfaOptionsHandler: (dependencies: {
+    readonly authFlowState: AuthFlowStateService;
+    readonly totpFactorManagement?: TotpFactorManagementService;
+    readonly recoveryCodeManagement?: RecoveryCodeManagementService;
+    readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
+}) => (args_0: MfaOptionsHandlerRequest) => Effect.Effect<{
+    factors: {
+        readonly type: "totp" | "backup-code" | "passkey";
+    }[];
+}, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeTotpMfaVerifyHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeTotpMfaVerifyForFlowHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeMfaVerifyHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: RecoveryCodeMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeMfaVerifyForFlowHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: RecoveryCodeMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makePasskeyMfaStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+    readonly authFlowState: AuthFlowStateService;
+} & PasskeyAuthenticationStartHttpOptions) => (args_0: PasskeyMfaStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError, never>;
+export declare const makePasskeyMfaVerifyHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeLoginApprovalApproveHandler: (dependencies: {
+    readonly loginApproval: LoginApprovalService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+    readonly users: UserStoreService;
+    readonly authHttp: AuthHttpService;
+    readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
+    readonly trustedDevice?: TrustedDeviceService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: LoginApprovalApproveHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeLoginApprovalStatusHandler: (dependencies: {
+    readonly loginApprovalReview?: LoginApprovalReviewService;
+}) => (args_0: LoginApprovalStatusHandlerRequest) => Effect.Effect<{
+    status: import("../LoginApproval.js").LoginApprovalReviewStatus | "expired";
+    expiresAt: UnixMillis;
+}, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeLoginApprovalFinalizeHandler: (dependencies: {
+    readonly loginApprovalFinalize?: LoginApprovalFinalizeService;
+    readonly authHttp: AuthHttpService;
+    readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
+    readonly trustedDevice?: TrustedDeviceService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: LoginApprovalFinalizeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthPolicyDeniedError | AuthInternalError, never>;
 declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signIn", "POST", "/auth/password/sign-in", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly password: Schema.String;
@@ -80,6 +826,7 @@ declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("ef
     readonly expiresAt: Schema.Number;
     readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
@@ -93,10 +840,18 @@ declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("ef
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_email_verification">;
     readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof import("./Errors.js").AuthInvalidCredentialsError | typeof import("./Errors.js").AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signUp", "POST", "/auth/password/sign-up", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signUp", "POST", "/auth/password/sign-up", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly email: Schema.brand<Schema.String, "auth/Email">;
     readonly password: Schema.String;
     readonly emailVerified: Schema.optional<Schema.Boolean>;
@@ -106,6 +861,7 @@ declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("ef
     readonly expiresAt: Schema.Number;
     readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
@@ -119,10 +875,33 @@ declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("ef
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_email_verification">;
     readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"requires_passkey_enrollment">;
     readonly flowId: Schema.String;
-}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof import("./Errors.js").AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetStart", "POST", "/auth/password/reset/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetVerify", "POST", "/auth/password/reset/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+    readonly password: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"set", "POST", "/auth/password/set", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly password: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"change", "POST", "/auth/password/change", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly currentPassword: Schema.String;
+    readonly newPassword: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
 export declare class PasswordApi extends PasswordApi_base {
 }
 declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"current", "GET", "/auth/session", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -133,10 +912,36 @@ declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effe
     readonly expiresAt: Schema.Number;
     readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/sessions", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly sessions: Schema.$Array<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly authTime: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastSeenAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+        readonly amr: Schema.$Array<Schema.String>;
+        readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly current: Schema.Boolean;
+        readonly claims: Schema.optional<Schema.Struct<{
+            readonly emailVerified: Schema.optional<Schema.Boolean>;
+            readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>;
+        readonly ip: Schema.optional<Schema.String>;
+        readonly userAgent: Schema.optional<Schema.String>;
+        readonly country: Schema.optional<Schema.String>;
+        readonly region: Schema.optional<Schema.String>;
+        readonly city: Schema.optional<Schema.String>;
+        readonly latitude: Schema.optional<Schema.Number>;
+        readonly longitude: Schema.optional<Schema.Number>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/session/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
     readonly type: Schema.Literal<"authenticated">;
     readonly userId: Schema.String;
@@ -145,11 +950,14 @@ declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effe
     readonly expiresAt: Schema.Number;
     readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
     readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
     readonly claims: Schema.optional<Schema.Struct<{
         readonly emailVerified: Schema.optional<Schema.Boolean>;
         readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
     }>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"logout", "POST", "/auth/logout", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthOriginCheckMiddleware, never>, false>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"logout", "POST", "/auth/logout", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeOthers", "POST", "/auth/sessions/revoke-others", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never>, false>;
 export declare class SessionApi extends SessionApi_base {
 }
 declare const EmailVerificationApi_base: HttpApiGroup.HttpApiGroup<"emailVerification", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-verification/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
@@ -163,13 +971,347 @@ declare const EmailVerificationApi_base: HttpApiGroup.HttpApiGroup<"emailVerific
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
 export declare class EmailVerificationApi extends EmailVerificationApi_base {
 }
-declare const AuthApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordApi | typeof SessionApi | typeof EmailVerificationApi>;
+declare const EmailOtpApi_base: HttpApiGroup.HttpApiGroup<"emailOtp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-otp/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-otp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_mfa">;
+    readonly flowId: Schema.String;
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_email_verification">;
+    readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_passkey_enrollment">;
+    readonly flowId: Schema.String;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+export declare class EmailOtpApi extends EmailOtpApi_base {
+}
+declare const MagicLinkApi_base: HttpApiGroup.HttpApiGroup<"magicLink", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/magic-link/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/magic-link/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_mfa">;
+    readonly flowId: Schema.String;
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_email_verification">;
+    readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_passkey_enrollment">;
+    readonly flowId: Schema.String;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+export declare class MagicLinkApi extends MagicLinkApi_base {
+}
+declare const LoginApprovalApi_base: HttpApiGroup.HttpApiGroup<"loginApproval", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"approve", "POST", "/auth/login-approval/approve", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly rememberDevice: Schema.optional<Schema.Boolean>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "POST", "/auth/login-approval/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly status: Schema.Literals<readonly ["pending", "approved", "denied", "expired"]>;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"finalize", "POST", "/auth/login-approval/finalize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly rememberDevice: Schema.optional<Schema.Boolean>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class LoginApprovalApi extends LoginApprovalApi_base {
+}
+declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "POST", "/auth/mfa/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/mfa/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotpForFlow", "POST", "/auth/mfa/totp/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/mfa/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/auth/mfa/recovery-code/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/mfa/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly publicKey: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.optional<Schema.Number>;
+        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.String;
+            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>>;
+        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/mfa/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly credential: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly rawId: Schema.optional<Schema.String>;
+        readonly type: Schema.Literal<"public-key">;
+        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly authenticatorAttachment: Schema.optional<Schema.String>;
+        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class MfaApi extends MfaApi_base {
+}
+declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly secret: Schema.String;
+    readonly key: Schema.Struct<{
+        readonly keyId: Schema.String;
+        readonly prefix: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listApiKeys", "GET", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keys: Schema.$Array<Schema.Struct<{
+        readonly keyId: Schema.String;
+        readonly prefix: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keyId: Schema.String;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class ApiKeyApi extends ApiKeyApi_base {
+}
+declare const RefreshTokenApi_base: HttpApiGroup.HttpApiGroup<"refreshToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/token/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly refreshToken: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly accessToken: Schema.String;
+    readonly accessTokenExpiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly refreshToken: Schema.String;
+    readonly refreshTokenRecord: Schema.Struct<{
+        readonly tokenId: Schema.String;
+        readonly familyId: Schema.String;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly rotatedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly replacedById: Schema.optional<Schema.String>;
+        readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly reuseDetectedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class RefreshTokenApi extends RefreshTokenApi_base {
+}
+declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly token: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly active: Schema.Literal<true>;
+    readonly header: Schema.Struct<{
+        readonly typ: Schema.Literal<"JWT">;
+        readonly alg: Schema.Literals<readonly ["HS256", "RS256", "ES256", "EdDSA"]>;
+        readonly kid: Schema.String;
+    }>;
+    readonly claims: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly key: Schema.Struct<{
+        readonly keyId: Schema.String;
+        readonly alg: Schema.Literals<readonly ["HS256", "RS256", "ES256", "EdDSA"]>;
+        readonly status: Schema.Literals<readonly ["active", "retired", "disabled"]>;
+        readonly createdAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly jwtId: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly revoked: Schema.Literal<false>;
+}>, Schema.Struct<{
+    readonly active: Schema.Literal<false>;
+    readonly reason: Schema.Literals<readonly ["malformed", "unsupported_alg", "unknown_key", "invalid_signature", "expired", "not_yet_valid", "issuer_mismatch", "audience_mismatch", "revoked"]>;
+    readonly jwtId: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly revokedReason: Schema.optional<Schema.String>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class JwtApi extends JwtApi_base {
+}
+declare const SecurityApi_base: HttpApiGroup.HttpApiGroup<"security", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"reportLogin", "POST", "/auth/security/login/report", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class SecurityApi extends SecurityApi_base {
+}
+declare const AuthApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordApi | typeof SessionApi | typeof EmailVerificationApi | typeof EmailOtpApi | typeof MagicLinkApi | typeof LoginApprovalApi | typeof SecurityApi>;
 export declare class AuthApi extends AuthApi_base {
 }
-export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, EmailVerificationFlow | PasswordLogin | PasswordRegistration | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, Sessions | SessionCookie | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthSchemaErrorMiddleware | AuthHttp | EmailVerificationFlow | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
 export declare const SessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "session">, never, Sessions | SessionCookie | AuthHttp | AuthOriginCheckMiddleware>;
-export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, Sessions | SessionCookie | EmailVerificationFlow | EmailVerification | AuthSchemaErrorMiddleware | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
-export declare const AuthHttpApiBareLive: Layer.Layer<never, never, Sessions | SessionCookie | EmailVerificationFlow | EmailVerification | PasswordLogin | PasswordRegistration | AuthHttp | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
-export declare const AuthHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | EmailVerificationFlow | EmailVerification | PasswordLogin | PasswordRegistration | import("../Privacy.js").Privacy | AuthHttp | import("../RateLimiter.js").RateLimiter | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | EmailVerificationFlow | EmailVerification | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const EmailOtpApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailOtp">, never, EmailOtpLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const MagicLinkApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "magicLink">, never, MagicLinkLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const LoginApprovalApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "loginApproval">, never, UserStore | LoginApproval | AuthFlowState | AuthFlow | AuthSchemaErrorMiddleware | AuthHttp | AuthOriginCheckMiddleware>;
+export declare const SecurityApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "security">, never, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
+export declare const AuthHttpApiBareLive: Layer.Layer<never, never, UserStore | Sessions | SessionCookie | LoginApproval | AuthFlowState | AuthFlow | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AuthHttpApiLive: Layer.Layer<never, never, UserStore | Sessions | SessionCookie | LoginApproval | AuthFlowState | AuthFlow | import("../Privacy.js").Privacy | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("../RateLimiter.js").RateLimiter | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
 export { AuthResult };
 //# sourceMappingURL=Api.d.ts.map