@effect-auth/core 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/HttpApi/Api.js

@@ -1,14 +1,23 @@
 import { Effect, Layer, Option, Redacted } from "effect";
 import { HttpServerResponse } from "effect/unstable/http";
 import { HttpApi, HttpApiBuilder, HttpApiGroup } from "effect/unstable/httpapi";
-import { AuthResult } from "../AuthFlow.js";
+import { ApiKeyId } from "../ApiKey.js";
+import { AuthFlow, AuthFlowState, AuthResult, LoginApprovalFinalize, } from "../AuthFlow.js";
+import { EmailOtpLogin } from "../EmailOtp.js";
 import { EmailDeliveryError, EmailVerification, EmailVerificationFlow, EmailVerificationIssueError, } from "../EmailVerification.js";
-import { PasswordLogin, PasswordRegistration } from "../Password.js";
-import { SessionCookie, Sessions } from "../Sessions.js";
-import { currentSessionEndpoint, emailVerificationStartEndpoint, emailVerificationVerifyEndpoint, logoutEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, refreshSessionEndpoint, } from "./Endpoints.js";
-import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, } from "./Errors.js";
-import { AuthApiRateLimit, AuthApiRateLimitLive, AuthApiRateLimitNoopLive, AuthOriginCheckMiddleware, AuthOriginCheckMiddlewareConfigLive, AuthRateLimitMiddleware, } from "./Security.js";
-import { AuthHttp } from "./Transport.js";
+import { currentUnixMillis } from "../Internal.js";
+import { LoginApproval, LoginApprovalReview } from "../LoginApproval.js";
+import { LoginNotification } from "../LoginNotification.js";
+import { MagicLinkLogin } from "../MagicLink.js";
+import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset, } from "../Password.js";
+import { PasskeyCredentialId } from "../Passkey.js";
+import { SessionCookie, Sessions, sessionRequestMetadataKey } from "../Sessions.js";
+import { UserStore } from "../Storage.js";
+import { TrustedDevice, TrustedDeviceCookie } from "../TrustedDevice.js";
+import { apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint, currentSessionEndpoint, emailOtpStartEndpoint, emailOtpVerifyEndpoint, emailVerificationStartEndpoint, emailVerificationVerifyEndpoint, loginApprovalApproveEndpoint, loginApprovalFinalizeEndpoint, loginApprovalStatusEndpoint, loginNotificationReportEndpoint, jwtIntrospectEndpoint, jwtRevokeEndpoint, listSessionsEndpoint, logoutEndpoint, magicLinkStartEndpoint, magicLinkVerifyEndpoint, mfaOptionsEndpoint, oauthAccountUnlinkEndpoint, oauthAuthorizationStartEndpoint, passwordChangeEndpoint, passwordResetStartEndpoint, passwordResetVerifyEndpoint, passwordSetEndpoint, passwordSignInEndpoint, passwordSignUpEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, refreshTokenRefreshEndpoint, refreshSessionEndpoint, revokeOtherSessionsEndpoint, revokeSessionEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, } from "./Endpoints.js";
+import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthSchemaErrorMiddlewareLive, AuthUnauthenticatedError, } from "./Errors.js";
+import { AuthApiRateLimit, AuthApiRateLimitLive, AuthApiRateLimitNoopLive, AuthHttpApiConfig, AuthOriginCheckMiddleware, AuthOriginCheckMiddlewareConfigLive, AuthRateLimitMiddleware, makeAuthRequestMetadata, } from "./Security.js";
+import { AuthHttp, LoginApprovalPendingCookie, makeLoginApprovalPendingCookie, } from "./Transport.js";
 const canStartRequiredEmailVerification = (result) => result._tag === "RequiresEmailVerification" &&
     result.userId !== undefined &&
     result.email !== undefined;
@@ -16,15 +25,43 @@ const noopAuthApiRateLimit = AuthApiRateLimit.make({
     request: () => Effect.void,
     passwordSignIn: () => Effect.void,
     passwordSignUp: () => Effect.void,
+    passwordResetStart: () => Effect.void,
+    emailOtpStart: () => Effect.void,
+    magicLinkStart: () => Effect.void,
     emailVerificationStart: () => Effect.void,
 });
-export const passwordSignInInput = (payload) => ({
+export const passwordSignInInput = (payload, trustedDeviceToken, request) => ({
     ...payload,
     password: Redacted.make(payload.password),
+    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+    ...(request === undefined ? {} : { request }),
 });
-export const passwordSignUpInput = (payload) => ({
+export const passwordSignUpInput = (payload, request) => ({
     ...payload,
     password: Redacted.make(payload.password),
+    ...(request === undefined ? {} : { request }),
+});
+export const passwordResetStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const passwordResetVerifyInput = (payload) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    password: Redacted.make(payload.password),
+});
+export const passwordSetInput = (userId, payload) => ({
+    userId,
+    password: Redacted.make(payload.password),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passwordChangeInput = (userId, payload) => ({
+    userId,
+    currentPassword: Redacted.make(payload.currentPassword),
+    newPassword: Redacted.make(payload.newPassword),
 });
 export const emailVerificationStartInput = (payload) => {
     const { secret, ...input } = payload;
@@ -40,7 +77,549 @@ export const emailVerificationVerifyInput = (payload) => {
         ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
     };
 };
+export const emailOtpStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const emailOtpVerifyInput = (payload, trustedDeviceToken, request) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+    ...(request === undefined ? {} : { request }),
+});
+export const magicLinkStartInput = (payload) => {
+    const { secret, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const magicLinkVerifyInput = (payload, trustedDeviceToken, request) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+    ...(request === undefined ? {} : { request }),
+});
+export const oauthAuthorizationStartInput = (payload, provider, options = {}) => ({
+    provider,
+    ...(options.ttl === undefined ? {} : { ttl: options.ttl }),
+    ...(payload.redirectUri === undefined ? {} : { redirectUri: payload.redirectUri }),
+    ...(payload.scopes === undefined ? {} : { scopes: payload.scopes }),
+    ...(payload.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: payload.authorizationParams }),
+    ...(payload.codeVerifier === undefined
+        ? {}
+        : { codeVerifier: Redacted.make(payload.codeVerifier) }),
+    ...(payload.includeNonce === undefined
+        ? {}
+        : { includeNonce: payload.includeNonce }),
+    ...(payload.nonce === undefined ? {} : { nonce: payload.nonce }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const oauthAuthorizationStartedHttpBody = (started) => ({
+    providerId: started.providerId,
+    authorizationUrl: started.authorizationUrl,
+    state: started.state,
+    challengeId: started.challengeId,
+    expiresAt: started.expiresAt,
+    codeChallenge: started.codeChallenge,
+    codeChallengeMethod: started.codeChallengeMethod,
+    ...(started.nonce === undefined ? {} : { nonce: started.nonce }),
+    redirectUri: started.redirectUri,
+    scopes: started.scopes,
+});
+const oauthAuthorizationCallbackField = (fields, name) => {
+    const maybeSearchParams = fields;
+    const value = typeof maybeSearchParams.get === "function"
+        ? maybeSearchParams.get(name)
+        : fields[name];
+    const stringValue = Array.isArray(value) ? value[0] : value;
+    return typeof stringValue === "string" && stringValue.trim() !== ""
+        ? stringValue
+        : undefined;
+};
+const oauthAuthorizationCallbackPayload = (input, options) => Effect.gen(function* () {
+    const state = oauthAuthorizationCallbackField(input.fields, "state");
+    const code = oauthAuthorizationCallbackField(input.fields, "code");
+    const error = oauthAuthorizationCallbackField(input.fields, "error");
+    const errorDescription = oauthAuthorizationCallbackField(input.fields, "error_description");
+    const errorUri = oauthAuthorizationCallbackField(input.fields, "error_uri");
+    if (state === undefined) {
+        return yield* oauthBadRequest("OAuth callback is missing state");
+    }
+    const authorizationUser = options.includeAuthorizationUser
+        ? oauthAuthorizationCallbackField(input.fields, "user")
+        : undefined;
+    return {
+        providerId: input.providerId,
+        state,
+        ...(code === undefined ? {} : { code }),
+        ...(error === undefined ? {} : { error }),
+        ...(errorDescription === undefined ? {} : { errorDescription }),
+        ...(errorUri === undefined ? {} : { errorUri }),
+        ...(authorizationUser === undefined ? {} : { authorizationUser }),
+    };
+});
+export const oauthAuthorizationCallbackQueryPayload = (input) => oauthAuthorizationCallbackPayload(input, { includeAuthorizationUser: false });
+export const oauthAuthorizationCallbackFormPostPayload = (input) => oauthAuthorizationCallbackPayload(input, { includeAuthorizationUser: true });
+export const oauthAuthorizationCallbackInput = (payload, options) => Effect.gen(function* () {
+    if (payload.providerId !== options.provider.id) {
+        return yield* oauthBadRequest("OAuth callback provider mismatch");
+    }
+    if (payload.error !== undefined) {
+        return yield* oauthBadRequest("OAuth provider returned an error");
+    }
+    if (payload.code === undefined || payload.code.trim() === "") {
+        return yield* oauthBadRequest("OAuth callback is missing code");
+    }
+    return {
+        provider: options.provider,
+        state: payload.state,
+        code: payload.code,
+        codeVerifier: options.codeVerifier,
+        ...(options.redirectUri === undefined
+            ? {}
+            : { redirectUri: options.redirectUri }),
+        ...(options.clientAuthentication === undefined
+            ? {}
+            : { clientAuthentication: options.clientAuthentication }),
+        ...(options.tokenParams === undefined
+            ? {}
+            : { tokenParams: options.tokenParams }),
+    };
+});
+const oauthLinkedAccountHttpBody = (account) => ({
+    accountId: account.id,
+    providerId: account.providerId,
+    providerAccountId: account.providerAccountId,
+});
+export const oauthAccountUnlinkResolutionHttpBody = (resolution, options = {}) => {
+    switch (resolution.type) {
+        case "allow": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                account: oauthLinkedAccountHttpBody(resolution.account),
+                remainingAccounts: resolution.remainingAccounts.map(oauthLinkedAccountHttpBody),
+                unlinked: options.unlinked === true,
+            };
+        }
+        case "requires-step-up": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                account: oauthLinkedAccountHttpBody(resolution.account),
+                remainingAccounts: resolution.remainingAccounts.map(oauthLinkedAccountHttpBody),
+            };
+        }
+        case "deny-last-account": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                account: oauthLinkedAccountHttpBody(resolution.account),
+            };
+        }
+        case "deny-not-owner": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                providerId: resolution.account.providerId,
+                providerAccountId: resolution.account.providerAccountId,
+            };
+        }
+        case "deny-not-found": {
+            return {
+                type: resolution.type,
+                reason: resolution.reason,
+                providerId: resolution.providerId,
+                providerAccountId: resolution.providerAccountId,
+            };
+        }
+    }
+};
+export const passkeyRegistrationStartInput = (payload, options) => ({
+    relyingParty: options.relyingParty,
+    userId: payload.userId,
+    userName: payload.userName,
+    userDisplayName: payload.userDisplayName,
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    ...(options.pubKeyCredParams === undefined
+        ? {}
+        : { pubKeyCredParams: options.pubKeyCredParams }),
+    ...(options.authenticatorSelection === undefined
+        ? {}
+        : { authenticatorSelection: options.authenticatorSelection }),
+    ...(options.attestation === undefined ? {} : { attestation: options.attestation }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyAuthenticationStartInput = (payload, options) => ({
+    relyingPartyId: options.relyingPartyId,
+    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    ...(options.userVerification === undefined
+        ? {}
+        : { userVerification: options.userVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyMfaStartInput = (userId, payload, options) => ({
+    relyingPartyId: options.relyingPartyId,
+    userId,
+    ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+    userVerification: options.userVerification ?? "required",
+    metadata: {
+        ...payload.metadata,
+        flowId: payload.flowId,
+    },
+});
+export const passkeyRegistrationFinishInput = (payload, options) => ({
+    challengeId: payload.challengeId,
+    userId: payload.userId,
+    response: payload.credential,
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyAuthenticationFinishInput = (payload, options) => ({
+    challengeId: payload.challengeId,
+    response: payload.credential,
+    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyMfaVerifyInput = (payload, options) => ({
+    challengeId: payload.challengeId,
+    response: payload.credential,
+    ...(payload.userId === undefined ? {} : { userId: payload.userId }),
+    relyingPartyId: options.relyingPartyId,
+    expectedOrigin: options.expectedOrigin,
+    ...(options.requireUserVerification === undefined
+        ? {}
+        : { requireUserVerification: options.requireUserVerification }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const passkeyCredentialRevokeInput = (userId, payload) => ({
+    userId,
+    credentialId: PasskeyCredentialId(payload.credentialId),
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const passkeyCredentialInfoHttpBody = (credential) => ({
+    credentialId: credential.credentialId,
+    ...(credential.transports === undefined
+        ? {}
+        : { transports: credential.transports }),
+    ...(credential.backedUp === undefined ? {} : { backedUp: credential.backedUp }),
+    createdAt: credential.createdAt,
+    ...(credential.lastUsedAt === undefined
+        ? {}
+        : { lastUsedAt: credential.lastUsedAt }),
+    ...(credential.revokedAt === undefined
+        ? {}
+        : { revokedAt: credential.revokedAt }),
+    ...(credential.metadata === undefined ? {} : { metadata: credential.metadata }),
+});
+export const totpEnrollmentStartInput = (userId, payload, options) => ({
+    userId,
+    issuer: options.issuer,
+    accountName: payload.accountName,
+    ...(options.secretBytes === undefined ? {} : { secretBytes: options.secretBytes }),
+    ...(options.algorithm === undefined ? {} : { algorithm: options.algorithm }),
+    ...(options.digits === undefined ? {} : { digits: options.digits }),
+    ...(options.period === undefined ? {} : { period: options.period }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpEnrollmentConfirmInput = (userId, payload, options = {}) => ({
+    userId,
+    factorId: payload.factorId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpVerifyInput = (userId, payload, options = {}) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpFactorRevokeInput = (userId, payload) => ({
+    userId,
+    factorId: payload.factorId,
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const totpFactorInfoHttpBody = (factor) => ({
+    factorId: factor.id,
+    algorithm: factor.algorithm,
+    digits: factor.digits,
+    period: factor.period,
+    createdAt: factor.createdAt,
+    ...(factor.confirmedAt === undefined ? {} : { confirmedAt: factor.confirmedAt }),
+    ...(factor.lastUsedAt === undefined ? {} : { lastUsedAt: factor.lastUsedAt }),
+    ...(factor.revokedAt === undefined ? {} : { revokedAt: factor.revokedAt }),
+    ...(factor.metadata === undefined ? {} : { metadata: factor.metadata }),
+});
+const totpEnrollmentStartedHttpBody = (started) => ({
+    factor: totpFactorInfoHttpBody(started.factor),
+    secret: Redacted.value(started.secret),
+    uri: Redacted.value(started.uri),
+});
+const totpVerifyResultHttpBody = (result) => ({
+    valid: result.valid,
+    ...(result.factor === undefined
+        ? {}
+        : { factor: totpFactorInfoHttpBody(result.factor) }),
+    ...(result.delta === undefined ? {} : { delta: result.delta }),
+});
+export const recoveryCodeGenerateInput = (userId, payload, options = {}) => ({
+    userId,
+    ...(options.count === undefined ? {} : { count: options.count }),
+    ...(options.length === undefined ? {} : { length: options.length }),
+    ...(options.groupSize === undefined ? {} : { groupSize: options.groupSize }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeVerifyInput = (userId, payload) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeRevokeInput = (userId, payload) => ({
+    userId,
+    codeId: payload.codeId,
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const recoveryCodeInfoHttpBody = (code) => ({
+    codeId: code.id,
+    createdAt: code.createdAt,
+    ...(code.usedAt === undefined ? {} : { usedAt: code.usedAt }),
+    ...(code.revokedAt === undefined ? {} : { revokedAt: code.revokedAt }),
+    ...(code.metadata === undefined ? {} : { metadata: code.metadata }),
+});
+const recoveryCodesGeneratedHttpBody = (generated) => ({
+    codes: generated.codes.map(Redacted.value),
+    records: generated.records.map(recoveryCodeInfoHttpBody),
+});
+const recoveryCodeVerifyResultHttpBody = (result) => ({
+    valid: result.valid,
+    ...(result.code === undefined
+        ? {}
+        : { code: recoveryCodeInfoHttpBody(result.code) }),
+});
+export const apiKeyCreateInput = (userId, payload) => ({
+    userId,
+    ...(payload.scopes === undefined ? {} : { scopes: payload.scopes }),
+    ...(payload.expiresAt === undefined ? {} : { expiresAt: payload.expiresAt }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const apiKeyRevokeInput = (userId, payload) => ({
+    userId,
+    keyId: ApiKeyId(payload.keyId),
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const apiKeyInfoHttpBody = (key) => ({
+    keyId: key.id,
+    prefix: key.prefix,
+    scopes: key.scopes,
+    createdAt: key.createdAt,
+    ...(key.expiresAt === undefined ? {} : { expiresAt: key.expiresAt }),
+    ...(key.lastUsedAt === undefined ? {} : { lastUsedAt: key.lastUsedAt }),
+    ...(key.revokedAt === undefined ? {} : { revokedAt: key.revokedAt }),
+    ...(key.metadata === undefined ? {} : { metadata: key.metadata }),
+});
+const apiKeyCreatedHttpBody = (created) => ({
+    secret: Redacted.value(created.secret),
+    key: apiKeyInfoHttpBody(created.key),
+});
+export const refreshTokenRefreshInput = (payload, now, expiresAt) => ({
+    token: Redacted.make(payload.refreshToken),
+    now,
+    expiresAt,
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+const refreshTokenInfoHttpBody = (refreshToken) => ({
+    tokenId: refreshToken.id,
+    familyId: refreshToken.familyId,
+    createdAt: refreshToken.createdAt,
+    expiresAt: refreshToken.expiresAt,
+    ...(refreshToken.lastUsedAt === undefined
+        ? {}
+        : { lastUsedAt: refreshToken.lastUsedAt }),
+    ...(refreshToken.rotatedAt === undefined
+        ? {}
+        : { rotatedAt: refreshToken.rotatedAt }),
+    ...(refreshToken.replacedById === undefined
+        ? {}
+        : { replacedById: refreshToken.replacedById }),
+    ...(refreshToken.revokedAt === undefined
+        ? {}
+        : { revokedAt: refreshToken.revokedAt }),
+    ...(refreshToken.reuseDetectedAt === undefined
+        ? {}
+        : { reuseDetectedAt: refreshToken.reuseDetectedAt }),
+    ...(refreshToken.metadata === undefined ? {} : { metadata: refreshToken.metadata }),
+});
+const issuedJwtExpiresAt = (issued) => typeof issued.claims.exp === "number"
+    ? (issued.claims.exp * 1000)
+    : undefined;
+const refreshTokenRefreshedHttpBody = (input) => ({
+    accessToken: Redacted.value(input.accessToken.token),
+    ...(issuedJwtExpiresAt(input.accessToken) === undefined
+        ? {}
+        : { accessTokenExpiresAt: issuedJwtExpiresAt(input.accessToken) }),
+    refreshToken: input.refreshToken,
+    refreshTokenRecord: refreshTokenInfoHttpBody(input.refreshTokenRecord),
+});
+export const jwtIntrospectInput = (payload, options = {}) => ({
+    token: Redacted.make(payload.token),
+    ...(options.issuer === undefined ? {} : { issuer: options.issuer }),
+    ...(options.audience === undefined ? {} : { audience: options.audience }),
+    ...(options.clockTolerance === undefined
+        ? {}
+        : { clockTolerance: options.clockTolerance }),
+});
+export const jwtRevokeInput = (payload) => ({
+    jwtId: payload.jwtId,
+    ...(payload.expiresAt === undefined ? {} : { expiresAt: payload.expiresAt }),
+    ...(payload.reason === undefined ? {} : { reason: payload.reason }),
+});
+const jwtKeyInfoHttpBody = (result) => ({
+    keyId: result.key.id,
+    alg: result.key.alg,
+    status: result.key.status,
+    ...(result.key.createdAt === undefined ? {} : { createdAt: result.key.createdAt }),
+    ...(result.key.expiresAt === undefined ? {} : { expiresAt: result.key.expiresAt }),
+    ...(result.key.metadata === undefined ? {} : { metadata: result.key.metadata }),
+});
+const jwtIntrospectionHttpBody = (result) => result.active
+    ? {
+        active: true,
+        header: result.header,
+        claims: result.claims,
+        key: jwtKeyInfoHttpBody(result),
+        ...(result.jwtId === undefined ? {} : { jwtId: result.jwtId }),
+        ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
+        revoked: false,
+    }
+    : {
+        active: false,
+        reason: result.reason,
+        ...(result.jwtId === undefined ? {} : { jwtId: result.jwtId }),
+        ...(result.expiresAt === undefined ? {} : { expiresAt: result.expiresAt }),
+        ...(result.revokedAt === undefined ? {} : { revokedAt: result.revokedAt }),
+        ...(result.revokedReason === undefined
+            ? {}
+            : { revokedReason: result.revokedReason }),
+    };
+export const totpMfaVerifyInput = (payload, options = {}) => ({
+    userId: payload.userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const totpMfaVerifyForFlowInput = (userId, payload, options = {}) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(options.window === undefined ? {} : { window: options.window }),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeMfaVerifyInput = (payload) => ({
+    userId: payload.userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const recoveryCodeMfaVerifyForFlowInput = (userId, payload) => ({
+    userId,
+    code: Redacted.make(payload.code),
+    ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+});
+export const loginApprovalApproveInput = (payload) => ({
+    flowId: payload.flowId,
+    approval: {
+        challengeId: payload.approvalChallengeId,
+        ...(payload.secret === undefined
+            ? {}
+            : { secret: Redacted.make(payload.secret) }),
+    },
+    rememberDevice: payload.rememberDevice ?? false,
+});
+export const loginApprovalStatusInput = (payload) => ({
+    flowId: payload.flowId,
+    approvalChallengeId: payload.approvalChallengeId,
+});
+export const loginApprovalFinalizeInput = (payload) => ({
+    flowId: payload.flowId,
+    approvalChallengeId: payload.approvalChallengeId,
+    rememberDevice: payload.rememberDevice ?? false,
+});
+export const loginNotificationReportInput = (payload) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+});
 const webRequestFromHeaders = (headers) => new Request("http://localhost", { headers });
+const firstHeaderValue = (value) => {
+    const first = value?.split(",", 1)[0]?.trim();
+    return first === "" ? undefined : first;
+};
+const headerNumber = (value) => {
+    const parsed = Number(firstHeaderValue(value));
+    return Number.isFinite(parsed) ? parsed : undefined;
+};
+const authRequestMetadataOptions = Effect.gen(function* () {
+    const config = yield* Effect.serviceOption(AuthHttpApiConfig);
+    return Option.isSome(config) ? (config.value.requestMetadata ?? {}) : {};
+});
+const loginRequestContextFromRequest = (request, options) => {
+    if (request === undefined) {
+        return undefined;
+    }
+    const metadata = makeAuthRequestMetadata(request, options);
+    const trustProxyHeaders = options.trustProxyHeaders ?? false;
+    const { headers } = request;
+    const country = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-ipcountry"])
+        : undefined;
+    const region = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-region"])
+        : undefined;
+    const city = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-ipcity"])
+        : undefined;
+    const latitude = trustProxyHeaders
+        ? headerNumber(headers["cf-iplatitude"])
+        : undefined;
+    const longitude = trustProxyHeaders
+        ? headerNumber(headers["cf-iplongitude"])
+        : undefined;
+    const context = {
+        ...(metadata.ipAddress === undefined
+            ? {}
+            : { ip: String(metadata.ipAddress) }),
+        ...(metadata.userAgent === undefined
+            ? {}
+            : { userAgent: metadata.userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+    };
+    return Object.keys(context).length === 0 ? undefined : context;
+};
+const trustedDeviceTokenFromRequest = (trustedDeviceCookie, request) => trustedDeviceCookie === undefined || request === undefined
+    ? Effect.succeed(Option.none())
+    : trustedDeviceCookie.read(new Request("http://localhost", { headers: request.headers }));
+const metadataString = (metadata, key) => {
+    const value = metadata?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+};
 const emailVerifiedClaims = (claims) => {
     const requirements = claims?.requirements?.filter((requirement) => requirement !== "email_verification");
     return {
@@ -49,6 +628,50 @@ const emailVerifiedClaims = (claims) => {
         ...(requirements === undefined ? {} : { requirements }),
     };
 };
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const metadataNumber = (metadata, key) => {
+    const value = metadata?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+};
+const sessionRequestMetadata = (metadata) => {
+    const value = metadata?.[sessionRequestMetadataKey];
+    return isRecord(value) ? value : undefined;
+};
+const activeSessionBody = (session, currentSessionId) => {
+    const request = sessionRequestMetadata(session.metadata);
+    const ip = metadataString(request, "ip");
+    const userAgent = metadataString(request, "userAgent");
+    const country = metadataString(request, "country");
+    const region = metadataString(request, "region");
+    const city = metadataString(request, "city");
+    const latitude = metadataNumber(request, "latitude");
+    const longitude = metadataNumber(request, "longitude");
+    return {
+        sessionId: session.sessionId,
+        userId: session.userId,
+        createdAt: session.createdAt,
+        authTime: session.authTime,
+        ...(session.lastSeenAt === undefined
+            ? {}
+            : { lastSeenAt: session.lastSeenAt }),
+        expiresAt: session.expiresAt,
+        aal: session.aal,
+        amr: session.amr,
+        ...(session.mfaVerifiedAt === undefined
+            ? {}
+            : { mfaVerifiedAt: session.mfaVerifiedAt }),
+        current: session.sessionId === currentSessionId,
+        ...(session.claims === undefined ? {} : { claims: session.claims }),
+        ...(ip === undefined ? {} : { ip }),
+        ...(userAgent === undefined ? {} : { userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+        ...(session.metadata === undefined ? {} : { metadata: session.metadata }),
+    };
+};
 const readOptionalSession = (dependencies, request) => Effect.gen(function* () {
     const tokenOption = yield* dependencies.sessionCookie
         .read(webRequestFromHeaders(request.headers))
@@ -68,6 +691,12 @@ const readOptionalSession = (dependencies, request) => Effect.gen(function* () {
             message: "Failed to validate session",
         }))));
 });
+const readRequiredSession = (dependencies, request) => readOptionalSession(dependencies, request).pipe(Effect.flatMap((sessionOption) => Option.isSome(sessionOption)
+    ? Effect.succeed(sessionOption.value)
+    : Effect.fail(new AuthUnauthenticatedError({
+        code: "unauthenticated",
+        message: "Unauthenticated",
+    }))));
 const upgradeVerifiedEmailSession = (dependencies, request, verified) => Effect.gen(function* () {
     const sessionOption = yield* readOptionalSession(dependencies, request);
     if (Option.isNone(sessionOption)) {
@@ -115,28 +744,240 @@ const passwordInternalError = (message) => new AuthInternalError({
     code: "internal_error",
     message,
 });
+const loginApprovalBadRequest = () => new AuthBadRequestError({
+    code: "bad_request",
+    message: "Invalid login approval request",
+});
+const loginApprovalSameDeviceDenied = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval must be completed on the same device",
+});
+const loginApprovalNoSessionBindingDenied = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval does not create a user session",
+});
+const loginApprovalReviewNotConfigured = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval review is not configured",
+});
+const loginApprovalFinalizeNotConfigured = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login approval finalization is not configured",
+});
+const loginApprovalPolicyDenied = (reason) => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: reason ?? "Login approval denied",
+});
+const loginNotificationNotConfigured = () => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: "Login notification reporting is not configured",
+});
+const loginNotificationBadRequest = () => new AuthBadRequestError({
+    code: "bad_request",
+    message: "Invalid login notification report",
+});
+const oauthBadRequest = (message = "Invalid OAuth request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const oauthInternalError = (message = "Failed to complete OAuth request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const passkeyInternalError = (message = "Failed to complete passkey request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const passkeyBadRequest = (message = "Invalid passkey request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const passkeyVerificationHttpError = (error) => error.message === "Failed to load passkey credential" ||
+    error.message === "Failed to store passkey credential" ||
+    error.message === "Failed to update passkey credential" ||
+    error.message === "Failed to generate passkey credential record id"
+    ? passkeyInternalError()
+    : passkeyBadRequest();
+const passkeyCredentialManagementHttpError = (error) => error.message === "Passkey credential not found"
+    ? passkeyBadRequest("Invalid passkey credential")
+    : passkeyInternalError("Failed to update passkey credentials");
+const totpInternalError = (message = "Failed to complete TOTP request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const totpBadRequest = (message = "Invalid TOTP request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const totpFactorManagementHttpError = (error) => {
+    switch (error.message) {
+        case "Failed to build TOTP enrollment URI":
+        case "TOTP factor not found":
+        case "TOTP factor already confirmed":
+        case "Invalid TOTP code": {
+            return totpBadRequest();
+        }
+        default: {
+            return totpInternalError();
+        }
+    }
+};
+const recoveryCodeInternalError = (message = "Failed to complete recovery code request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const recoveryCodeBadRequest = (message = "Invalid recovery code request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const recoveryCodeManagementHttpError = (error) => {
+    switch (error.message) {
+        case "Recovery code not found": {
+            return recoveryCodeBadRequest();
+        }
+        default: {
+            return recoveryCodeInternalError();
+        }
+    }
+};
+const apiKeyInternalError = (message = "Failed to complete API key request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const apiKeyBadRequest = (message = "Invalid API key request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const apiKeyManagementHttpError = (error) => {
+    switch (error.message) {
+        case "API key not found": {
+            return apiKeyBadRequest();
+        }
+        default: {
+            return apiKeyInternalError();
+        }
+    }
+};
+const refreshTokenInternalError = (message = "Failed to complete refresh token request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const refreshTokenInvalidCredentials = (message = "Invalid refresh token") => new AuthInvalidCredentialsError({
+    code: "invalid_credentials",
+    message,
+});
+const jwtInternalError = (message = "Failed to complete JWT request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const jwtBadRequest = (message = "Invalid JWT request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const jwtRevocationHttpError = (error) => error.message === "JWT ID must not be empty" ? jwtBadRequest() : jwtInternalError();
+const mfaInternalError = (message = "Failed to complete MFA request") => new AuthInternalError({
+    code: "internal_error",
+    message,
+});
+const mfaBadRequest = (message = "Invalid MFA request") => new AuthBadRequestError({
+    code: "bad_request",
+    message,
+});
+const mfaInvalidCredentials = () => new AuthInvalidCredentialsError({
+    code: "invalid_credentials",
+    message: "Invalid MFA code",
+});
+const mfaPolicyDenied = (reason) => new AuthPolicyDeniedError({
+    code: "policy_denied",
+    message: reason ?? "MFA policy denied the request",
+});
+const authFlowMfaHttpError = (error) => error._tag === "AuthFlowStateError" ? mfaBadRequest() : mfaInternalError();
+const trustedDeviceSetCookies = (dependencies) => Effect.gen(function* () {
+    if (!dependencies.rememberDevice ||
+        dependencies.trustedDevice === undefined ||
+        dependencies.trustedDeviceCookie === undefined) {
+        return [];
+    }
+    const token = yield* dependencies.trustedDevice
+        .trust({ userId: dependencies.userId })
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to remember trusted device")));
+    const cookie = yield* dependencies.trustedDeviceCookie
+        .commit({ token })
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to remember trusted device")));
+    return [cookie];
+});
 const catchAuthApiRateLimit = (effect, internalMessage) => effect.pipe(Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(rateLimited(error.retryAfter))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(passwordInternalError(internalMessage))), Effect.catchTag("PrivacyError", () => Effect.fail(passwordInternalError(internalMessage))));
-export const makePasswordSignInHandler = (dependencies) => Effect.fn("auth.http.password.sign_in")(function* ({ payload, }) {
+export const makePasswordSignInHandler = (dependencies) => Effect.fn("auth.http.password.sign_in")(function* ({ payload, request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_in");
-    const input = passwordSignInInput(payload);
+    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
+    const input = passwordSignInInput(payload, Option.isSome(trustedDeviceToken) ? trustedDeviceToken.value : undefined, requestContext);
     const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
     yield* catchAuthApiRateLimit(authApiRateLimit.passwordSignIn(input), "Failed to sign in with password");
-    const result = yield* dependencies.password.signIn(input).pipe(Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))));
+    const result = yield* dependencies.password.signIn(input).pipe(Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("TrustedDeviceError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginRiskError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("AuthFlowStateError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginApprovalReviewError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))), Effect.catchTag("LoginApprovalFlowStartError", () => Effect.fail(passwordInternalError("Failed to sign in with password"))));
     yield* startRequiredEmailVerification(dependencies, result);
     return yield* dependencies.authHttp.commitPasswordSignInResult(result);
 });
-export const makePasswordSignUpHandler = (dependencies) => Effect.fn("auth.http.password.sign_up")(function* ({ payload, }) {
+export const makePasswordSignUpHandler = (dependencies) => Effect.fn("auth.http.password.sign_up")(function* ({ payload, request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.sign_up");
-    const input = passwordSignUpInput(payload);
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const input = passwordSignUpInput(payload, loginRequestContextFromRequest(request, requestMetadataOptions));
     const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
     yield* catchAuthApiRateLimit(authApiRateLimit.passwordSignUp(input), "Failed to sign up with password");
     const result = yield* dependencies.registration.signUp(input).pipe(Effect.catchTag("EmailAlreadyRegisteredError", () => Effect.fail(new AuthEmailAlreadyRegisteredError({
         code: "email_already_registered",
         message: "Email is already registered",
-    }))), Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("CryptoError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))));
+    }))), Effect.catchTag("StorageError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("PasswordHashError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("CryptoError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("TrustedDeviceError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginRiskError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("SessionCreateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("AuthFlowStateError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginApprovalReviewError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))), Effect.catchTag("LoginApprovalFlowStartError", () => Effect.fail(passwordInternalError("Failed to sign up with password"))));
     yield* startRequiredEmailVerification(dependencies, result);
     return yield* dependencies.authHttp.commitPasswordSignUpResult(result);
 });
+export const makePasswordResetStartHandler = (dependencies) => Effect.fn("auth.http.password.reset_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.reset_start");
+    const input = passwordResetStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.passwordResetStart(input), "Failed to start password reset");
+    yield* dependencies.passwordReset.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start password reset",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makePasswordResetVerifyHandler = (dependencies) => Effect.fn("auth.http.password.reset_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.reset_verify");
+    yield* dependencies.passwordReset
+        .verify(passwordResetVerifyInput(payload))
+        .pipe(Effect.mapError(() => new AuthBadRequestError({
+        code: "bad_request",
+        message: "Invalid password reset request",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+const passwordManagementError = (error) => error.reason === "internal"
+    ? new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to update password",
+    })
+    : new AuthBadRequestError({
+        code: "bad_request",
+        message: "Invalid password update request",
+    });
+export const makePasswordSetHandler = (dependencies) => Effect.fn("auth.http.password.set")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.set");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.passwordManagement
+        .set(passwordSetInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(passwordManagementError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makePasswordChangeHandler = (dependencies) => Effect.fn("auth.http.password.change")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "password.change");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.passwordManagement
+        .change(passwordChangeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(passwordManagementError));
+    return HttpServerResponse.empty({ status: 204 });
+});
 export const makeCurrentSessionHandler = (dependencies) => Effect.fn("auth.http.session.current")(function* ({ request, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.current");
     const tokenOption = yield* dependencies.sessionCookie
@@ -234,6 +1075,66 @@ export const makeLogoutHandler = (dependencies) => Effect.fn("auth.http.session.
     }
     return yield* dependencies.authHttp.commitSessionCleared();
 });
+export const makeListSessionsHandler = (dependencies) => Effect.fn("auth.http.session.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const sessions = yield* dependencies.sessions
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to list sessions",
+    })));
+    return {
+        sessions: sessions.map((session) => activeSessionBody(session, current.currentSession.sessionId)),
+    };
+});
+export const makeRevokeSessionHandler = (dependencies) => Effect.fn("auth.http.session.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.sessions
+        .revokeForUser({
+        userId: current.currentSession.userId,
+        sessionId: payload.sessionId,
+        reason: "user_revoked_session",
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke session",
+    })));
+    return payload.sessionId === current.currentSession.sessionId
+        ? yield* dependencies.authHttp.commitSessionCleared()
+        : HttpServerResponse.empty({ status: 204 });
+});
+export const makeRevokeOtherSessionsHandler = (dependencies) => Effect.fn("auth.http.session.revoke_others")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "session.revoke_others");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.sessions
+        .revokeAllForUserExcept({
+        userId: current.currentSession.userId,
+        exceptSessionId: current.currentSession.sessionId,
+        reason: "user_revoked_other_sessions",
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to revoke other sessions",
+    })));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeLoginNotificationReportHandler = (dependencies) => Effect.fn("auth.http.security.login_notification.report")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "security.login_notification.report");
+    if (dependencies.loginNotification === undefined) {
+        return yield* loginNotificationNotConfigured();
+    }
+    yield* dependencies.loginNotification
+        .report(loginNotificationReportInput(payload))
+        .pipe(Effect.mapError((error) => error.reason === "invalid_report"
+        ? loginNotificationBadRequest()
+        : new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to process login notification report",
+        })));
+    return HttpServerResponse.empty({ status: 204 });
+});
 export const makeEmailVerificationStartHandler = (dependencies) => Effect.fn("auth.http.email_verification.start")(function* ({ payload, }) {
     yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_verification.start");
     const input = emailVerificationStartInput(payload);
@@ -266,14 +1167,552 @@ export const makeEmailVerificationVerifyHandler = (dependencies) => Effect.fn("a
     yield* upgradeVerifiedEmailSession(dependencies, request, verified);
     return HttpServerResponse.empty({ status: 204 });
 });
+export const makeEmailOtpStartHandler = (dependencies) => Effect.fn("auth.http.email_otp.start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_otp.start");
+    const input = emailOtpStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.emailOtpStart(input), "Failed to start email OTP");
+    return yield* dependencies.emailOtp.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start email OTP",
+    })));
+});
+export const makeEmailOtpVerifyHandler = (dependencies) => Effect.fn("auth.http.email_otp.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "email_otp.verify");
+    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
+    const result = yield* dependencies.emailOtp
+        .verify(emailOtpVerifyInput(payload, Option.isSome(trustedDeviceToken)
+        ? trustedDeviceToken.value
+        : undefined, requestContext))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to verify email OTP",
+    })));
+    return yield* dependencies.authHttp.commitEmailOtpVerifyResult(result);
+});
+export const makeMagicLinkStartHandler = (dependencies) => Effect.fn("auth.http.magic_link.start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "magic_link.start");
+    const input = magicLinkStartInput(payload);
+    const authApiRateLimit = dependencies.authApiRateLimit ?? noopAuthApiRateLimit;
+    yield* catchAuthApiRateLimit(authApiRateLimit.magicLinkStart(input), "Failed to start magic link");
+    const started = yield* dependencies.magicLink.start(input).pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to start magic link",
+    })));
+    return {
+        email: started.email,
+        expiresAt: started.expiresAt,
+    };
+});
+export const makeMagicLinkVerifyHandler = (dependencies) => Effect.fn("auth.http.magic_link.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "magic_link.verify");
+    const trustedDeviceToken = yield* trustedDeviceTokenFromRequest(dependencies.trustedDeviceCookie, request).pipe(Effect.mapError(() => passwordInternalError("Failed to read trusted device cookie")));
+    const requestMetadataOptions = yield* authRequestMetadataOptions;
+    const requestContext = loginRequestContextFromRequest(request, requestMetadataOptions);
+    const result = yield* dependencies.magicLink
+        .verify(magicLinkVerifyInput(payload, Option.isSome(trustedDeviceToken)
+        ? trustedDeviceToken.value
+        : undefined, requestContext))
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to verify magic link",
+    })));
+    return yield* dependencies.authHttp.commitMagicLinkVerifyResult(result);
+});
+export const makeOAuthAuthorizationStartHandler = (dependencies) => Effect.fn("auth.http.oauth.authorization_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.authorization_start");
+    const provider = yield* dependencies.oauthProviders.get(payload.providerId).pipe(Effect.mapError(() => oauthInternalError("Failed to load OAuth provider")));
+    if (Option.isNone(provider)) {
+        return yield* oauthBadRequest("Unknown OAuth provider");
+    }
+    const started = yield* dependencies.oauthState
+        .start(oauthAuthorizationStartInput(payload, provider.value, dependencies))
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to start OAuth authorization")));
+    if (dependencies.storeCodeVerifier !== undefined) {
+        yield* dependencies.storeCodeVerifier({ payload, started }).pipe(Effect.mapError(() => oauthInternalError("Failed to store OAuth verifier")));
+    }
+    return oauthAuthorizationStartedHttpBody(started);
+});
+export const makeOAuthAccountUnlinkHandler = (dependencies) => Effect.fn("auth.http.oauth.account_unlink")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "oauth.account_unlink");
+    const session = yield* readRequiredSession(dependencies, request);
+    const stepUpSatisfied = dependencies.stepUpSatisfied === undefined
+        ? undefined
+        : yield* dependencies.stepUpSatisfied({ payload, request, session }).pipe(Effect.mapError(() => oauthInternalError("Failed to evaluate OAuth unlink step-up")));
+    const decision = yield* dependencies.oauthAccountUnlinking
+        .resolve({
+        userId: session.currentSession.userId,
+        providerId: payload.providerId,
+        providerAccountId: payload.providerAccountId,
+        ...(stepUpSatisfied === undefined ? {} : { stepUpSatisfied }),
+    })
+        .pipe(Effect.mapError(() => oauthInternalError("Failed to resolve OAuth account unlinking")));
+    if (decision.type !== "allow") {
+        return oauthAccountUnlinkResolutionHttpBody(decision);
+    }
+    if (dependencies.unlinkAfterAllow !== undefined) {
+        yield* dependencies
+            .unlinkAfterAllow({ payload, request, session, decision })
+            .pipe(Effect.mapError(() => oauthInternalError("Failed to unlink OAuth account")));
+    }
+    return oauthAccountUnlinkResolutionHttpBody(decision, {
+        unlinked: dependencies.unlinkAfterAllow !== undefined,
+    });
+});
+export const makePasskeyRegistrationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.registration_start");
+    return yield* dependencies.passkeyOptions
+        .startRegistration(passkeyRegistrationStartInput(payload, dependencies))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey registration")));
+});
+export const makePasskeyRegistrationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.registration_finish")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.registration_finish");
+    const finished = yield* dependencies.passkeyVerification
+        .finishRegistration(passkeyRegistrationFinishInput(payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    return { credentialId: finished.credential.credentialId };
+});
+export const makePasskeyAuthenticationStartHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.authentication_start");
+    return yield* dependencies.passkeyOptions
+        .startAuthentication(passkeyAuthenticationStartInput(payload, dependencies))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey authentication")));
+});
+export const makePasskeyAuthenticationFinishHandler = (dependencies) => Effect.fn("auth.http.passkey.authentication_finish")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.authentication_finish");
+    const finished = yield* dependencies.passkeyVerification
+        .finishAuthentication(passkeyAuthenticationFinishInput(payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    const session = yield* dependencies.sessions
+        .create(dependencies.makeSessionInput({
+        finished,
+        payload,
+        ...(request === undefined ? {} : { request }),
+    }))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to create passkey session")));
+    return yield* dependencies.authHttp.commitAuthenticatedSession(session);
+});
+export const makePasskeyCredentialListHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.credential_list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const credentials = yield* dependencies.passkeyCredentialManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to list passkey credentials")));
+    return {
+        credentials: credentials.map(passkeyCredentialInfoHttpBody),
+    };
+});
+export const makePasskeyCredentialRevokeHandler = (dependencies) => Effect.fn("auth.http.passkey.credential_revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "passkey.credential_revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.passkeyCredentialManagement
+        .revokeForUser(passkeyCredentialRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(passkeyCredentialManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeTotpEnrollmentStartHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_start")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.enrollment_start");
+    const current = yield* readRequiredSession(dependencies, request);
+    const started = yield* dependencies.totpFactorManagement
+        .startEnrollment(totpEnrollmentStartInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(totpFactorManagementHttpError));
+    return totpEnrollmentStartedHttpBody(started);
+});
+export const makeTotpEnrollmentConfirmHandler = (dependencies) => Effect.fn("auth.http.totp.enrollment_confirm")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.enrollment_confirm");
+    const current = yield* readRequiredSession(dependencies, request);
+    const confirmed = yield* dependencies.totpFactorManagement
+        .confirmEnrollment(totpEnrollmentConfirmInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(totpFactorManagementHttpError));
+    return totpFactorInfoHttpBody(confirmed);
+});
+export const makeTotpVerifyHandler = (dependencies) => Effect.fn("auth.http.totp.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const result = yield* dependencies.totpFactorManagement
+        .verifyForUser(totpVerifyInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => totpInternalError("Failed to verify TOTP factor")));
+    return totpVerifyResultHttpBody(result);
+});
+export const makeTotpFactorListHandler = (dependencies) => Effect.fn("auth.http.totp.factor_list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.factor_list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const factors = yield* dependencies.totpFactorManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => totpInternalError("Failed to list TOTP factors")));
+    return { factors: factors.map(totpFactorInfoHttpBody) };
+});
+export const makeTotpFactorRevokeHandler = (dependencies) => Effect.fn("auth.http.totp.factor_revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "totp.factor_revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.totpFactorManagement
+        .revokeForUser(totpFactorRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(totpFactorManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeRecoveryCodeGenerateHandler = (dependencies) => Effect.fn("auth.http.recovery_code.generate")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.generate");
+    const current = yield* readRequiredSession(dependencies, request);
+    const generated = yield* dependencies.recoveryCodeManagement
+        .generateForUser(recoveryCodeGenerateInput(current.currentSession.userId, payload, dependencies))
+        .pipe(Effect.mapError(recoveryCodeManagementHttpError));
+    return recoveryCodesGeneratedHttpBody(generated);
+});
+export const makeRecoveryCodeVerifyHandler = (dependencies) => Effect.fn("auth.http.recovery_code.verify")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.verify");
+    const current = yield* readRequiredSession(dependencies, request);
+    const result = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(recoveryCodeVerifyInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(() => recoveryCodeInternalError("Failed to verify recovery code")));
+    return recoveryCodeVerifyResultHttpBody(result);
+});
+export const makeRecoveryCodeListHandler = (dependencies) => Effect.fn("auth.http.recovery_code.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const codes = yield* dependencies.recoveryCodeManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => recoveryCodeInternalError("Failed to list recovery codes")));
+    return { codes: codes.map(recoveryCodeInfoHttpBody) };
+});
+export const makeRecoveryCodeRevokeHandler = (dependencies) => Effect.fn("auth.http.recovery_code.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "recovery_code.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.recoveryCodeManagement
+        .revokeForUser(recoveryCodeRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(recoveryCodeManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeApiKeyCreateHandler = (dependencies) => Effect.fn("auth.http.api_key.create")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.create");
+    const current = yield* readRequiredSession(dependencies, request);
+    const created = yield* dependencies.apiKeyManagement
+        .createForUser(apiKeyCreateInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(apiKeyManagementHttpError));
+    return apiKeyCreatedHttpBody(created);
+});
+export const makeApiKeyListHandler = (dependencies) => Effect.fn("auth.http.api_key.list")(function* ({ request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.list");
+    const current = yield* readRequiredSession(dependencies, request);
+    const keys = yield* dependencies.apiKeyManagement
+        .listForUser({ userId: current.currentSession.userId })
+        .pipe(Effect.mapError(() => apiKeyInternalError("Failed to list API keys")));
+    return { keys: keys.map(apiKeyInfoHttpBody) };
+});
+export const makeApiKeyRevokeHandler = (dependencies) => Effect.fn("auth.http.api_key.revoke")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "api_key.revoke");
+    const current = yield* readRequiredSession(dependencies, request);
+    yield* dependencies.apiKeyManagement
+        .revokeForUser(apiKeyRevokeInput(current.currentSession.userId, payload))
+        .pipe(Effect.mapError(apiKeyManagementHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeRefreshTokenRefreshHandler = (dependencies) => Effect.fn("auth.http.refresh_token.refresh")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "refresh_token.refresh");
+    const now = yield* currentUnixMillis;
+    const expiresAt = dependencies.refreshTokenExpiresAt({ now });
+    const rotated = yield* dependencies.refreshTokenManagement
+        .rotate(refreshTokenRefreshInput(payload, now, expiresAt))
+        .pipe(Effect.mapError(() => refreshTokenInternalError("Failed to rotate refresh token")));
+    switch (rotated._tag) {
+        case "Invalid": {
+            return yield* refreshTokenInvalidCredentials();
+        }
+        case "ReuseDetected": {
+            return yield* refreshTokenInvalidCredentials("Refresh token reuse detected");
+        }
+        case "Rotated": {
+            const accessToken = yield* dependencies.jwtIssuer
+                .issue(dependencies.accessToken({
+                now,
+                refreshToken: rotated.refreshToken,
+                previousToken: rotated.previousToken,
+            }))
+                .pipe(Effect.mapError(() => refreshTokenInternalError("Failed to issue access token")));
+            return refreshTokenRefreshedHttpBody({
+                accessToken,
+                refreshToken: Redacted.value(rotated.token),
+                refreshTokenRecord: rotated.refreshToken,
+            });
+        }
+    }
+});
+export const makeJwtIntrospectHandler = (dependencies) => Effect.fn("auth.http.jwt.introspect")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.introspect");
+    const result = yield* dependencies.jwtRevocation
+        .introspect(jwtIntrospectInput(payload, dependencies))
+        .pipe(Effect.mapError(() => jwtInternalError("Failed to introspect JWT access token")));
+    return jwtIntrospectionHttpBody(result);
+});
+export const makeJwtRevokeHandler = (dependencies) => Effect.fn("auth.http.jwt.revoke")(function* ({ payload }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "jwt.revoke");
+    yield* dependencies.jwtRevocation
+        .revokeJwtId(jwtRevokeInput(payload))
+        .pipe(Effect.mapError(jwtRevocationHttpError));
+    return HttpServerResponse.empty({ status: 204 });
+});
+export const makeMfaOptionsHandler = (dependencies) => Effect.fn("auth.http.mfa.options")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.options");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    const factors = [];
+    if (dependencies.totpFactorManagement !== undefined) {
+        const totpFactors = yield* dependencies.totpFactorManagement
+            .listForUser({ userId: pending.userId })
+            .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
+        if (totpFactors.length > 0) {
+            factors.push({ type: "totp" });
+        }
+    }
+    if (dependencies.recoveryCodeManagement !== undefined) {
+        const recoveryCodes = yield* dependencies.recoveryCodeManagement
+            .listForUser({ userId: pending.userId })
+            .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
+        if (recoveryCodes.length > 0) {
+            factors.push({ type: "backup-code" });
+        }
+    }
+    if (dependencies.passkeyCredentialManagement !== undefined) {
+        const credentials = yield* dependencies.passkeyCredentialManagement
+            .listForUser({ userId: pending.userId })
+            .pipe(Effect.mapError(() => mfaInternalError("Failed to list MFA options")));
+        if (credentials.length > 0) {
+            factors.push({ type: "passkey" });
+        }
+    }
+    return { factors };
+});
+export const makeTotpMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.totp_verify");
+    const verified = yield* dependencies.totpFactorManagement
+        .verifyForUser(totpMfaVerifyInput(payload, dependencies))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify TOTP MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: payload.userId,
+        method: "totp",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeTotpMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.totp_verify_for_flow")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.totp_verify_for_flow");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    const verified = yield* dependencies.totpFactorManagement
+        .verifyForUser(totpMfaVerifyForFlowInput(pending.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify TOTP MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: pending.userId,
+        method: "totp",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeRecoveryCodeMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.recovery_code_verify");
+    const verified = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(recoveryCodeMfaVerifyInput(payload))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify recovery code MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: payload.userId,
+        method: "backup-code",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeRecoveryCodeMfaVerifyForFlowHandler = (dependencies) => Effect.fn("auth.http.mfa.recovery_code_verify_for_flow")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.recovery_code_verify_for_flow");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    const verified = yield* dependencies.recoveryCodeManagement
+        .verifyForUser(recoveryCodeMfaVerifyForFlowInput(pending.userId, payload))
+        .pipe(Effect.mapError(() => mfaInternalError("Failed to verify recovery code MFA factor")));
+    if (!verified.valid) {
+        return yield* mfaInvalidCredentials();
+    }
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: pending.userId,
+        method: "backup-code",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makePasskeyMfaStartHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_start")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.passkey_start");
+    const pending = yield* dependencies.authFlowState
+        .inspect(payload.flowId)
+        .pipe(Effect.mapError(() => mfaBadRequest()));
+    return yield* dependencies.passkeyOptions
+        .startAuthentication(passkeyMfaStartInput(pending.userId, payload, dependencies))
+        .pipe(Effect.mapError(() => passkeyInternalError("Failed to start passkey MFA authentication")));
+});
+export const makePasskeyMfaVerifyHandler = (dependencies) => Effect.fn("auth.http.mfa.passkey_verify")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "mfa.passkey_verify");
+    const finished = yield* dependencies.passkeyVerification
+        .finishAuthentication(passkeyMfaVerifyInput(payload, dependencies))
+        .pipe(Effect.mapError(passkeyVerificationHttpError));
+    const result = yield* dependencies.authFlow
+        .completeMfa({
+        flowId: payload.flowId,
+        userId: finished.userId,
+        method: "passkey",
+        ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }),
+    })
+        .pipe(Effect.mapError(authFlowMfaHttpError));
+    if (result._tag === "PolicyDenied") {
+        return yield* mfaPolicyDenied(result.reason);
+    }
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session);
+});
+export const makeLoginApprovalApproveHandler = (dependencies) => Effect.fn("auth.http.login_approval.approve")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.approve");
+    const input = loginApprovalApproveInput(payload);
+    const approval = yield* dependencies.loginApproval
+        .verify(input.approval)
+        .pipe(Effect.mapError(() => loginApprovalBadRequest()));
+    const approvedFlowId = metadataString(approval.metadata, "flowId");
+    if (approvedFlowId !== input.flowId) {
+        return yield* loginApprovalBadRequest();
+    }
+    if (approval.sessionBinding === "none") {
+        return yield* loginApprovalNoSessionBindingDenied();
+    }
+    const sameDeviceSecret = approval.sameDeviceRequired
+        ? yield* dependencies.loginApprovalPendingCookie
+            .read(new Request("http://localhost", { headers: request.headers }))
+            .pipe(Effect.flatMap((secret) => Option.isSome(secret)
+            ? Effect.succeed(secret.value)
+            : Effect.fail(loginApprovalSameDeviceDenied())))
+        : undefined;
+    const consumed = yield* dependencies.authFlowState
+        .consume(input.flowId, sameDeviceSecret)
+        .pipe(Effect.mapError(() => approval.sameDeviceRequired
+        ? loginApprovalSameDeviceDenied()
+        : loginApprovalBadRequest()));
+    if (consumed.userId !== approval.userId) {
+        return yield* loginApprovalBadRequest();
+    }
+    if (approval.markEmailVerified === true) {
+        const updated = yield* dependencies.users
+            .markEmailVerified({
+            userId: approval.userId,
+            updatedAt: yield* currentUnixMillis,
+        })
+            .pipe(Effect.mapError(() => passwordInternalError("Failed to mark email verified")));
+        if (Option.isNone(updated)) {
+            return yield* loginApprovalBadRequest();
+        }
+    }
+    const result = yield* dependencies.authFlow
+        .complete(consumed)
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to complete login approval")));
+    const setCookies = yield* trustedDeviceSetCookies({
+        trustedDevice: dependencies.trustedDevice,
+        trustedDeviceCookie: dependencies.trustedDeviceCookie,
+        userId: consumed.userId,
+        rememberDevice: input.rememberDevice,
+    });
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session, { setCookies });
+});
+export const makeLoginApprovalStatusHandler = (dependencies) => Effect.fn("auth.http.login_approval.status")(function* ({ payload, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.status");
+    if (dependencies.loginApprovalReview === undefined) {
+        return yield* loginApprovalReviewNotConfigured();
+    }
+    const input = loginApprovalStatusInput(payload);
+    const recordOption = yield* dependencies.loginApprovalReview
+        .status({ approvalChallengeId: input.approvalChallengeId })
+        .pipe(Effect.mapError(() => passwordInternalError("Failed to load login approval review")));
+    if (Option.isNone(recordOption)) {
+        return yield* loginApprovalBadRequest();
+    }
+    const record = recordOption.value;
+    if (record.flowId !== input.flowId) {
+        return yield* loginApprovalBadRequest();
+    }
+    const now = yield* currentUnixMillis;
+    const status = Number(record.expiresAt) <= Number(now)
+        ? "expired"
+        : record.status;
+    return {
+        status,
+        expiresAt: record.expiresAt,
+    };
+});
+export const makeLoginApprovalFinalizeHandler = (dependencies) => Effect.fn("auth.http.login_approval.finalize")(function* ({ payload, request, }) {
+    yield* Effect.annotateCurrentSpan("auth.http.endpoint", "login_approval.finalize");
+    if (dependencies.loginApprovalFinalize === undefined) {
+        return yield* loginApprovalFinalizeNotConfigured();
+    }
+    const input = loginApprovalFinalizeInput(payload);
+    const sameDeviceSecret = yield* dependencies.loginApprovalPendingCookie.read(new Request("http://localhost", { headers: request.headers }));
+    const result = yield* dependencies.loginApprovalFinalize
+        .complete({
+        flowId: input.flowId,
+        approvalChallengeId: input.approvalChallengeId,
+        ...(Option.isSome(sameDeviceSecret)
+            ? { sameDeviceSecret: sameDeviceSecret.value }
+            : {}),
+    })
+        .pipe(Effect.mapError((error) => error._tag === "AuthFlowStateError"
+        ? loginApprovalSameDeviceDenied()
+        : passwordInternalError("Failed to finalize login approval")));
+    if (result._tag === "PolicyDenied") {
+        return yield* loginApprovalPolicyDenied(result.reason);
+    }
+    const setCookies = yield* trustedDeviceSetCookies({
+        trustedDevice: dependencies.trustedDevice,
+        trustedDeviceCookie: dependencies.trustedDeviceCookie,
+        userId: result.session.userId,
+        rememberDevice: input.rememberDevice,
+    });
+    return yield* dependencies.authHttp.commitAuthenticatedSession(result.session, { setCookies });
+});
 export class PasswordApi extends HttpApiGroup.make("password")
-    .add(passwordSignInEndpoint.middleware(AuthRateLimitMiddleware), passwordSignUpEndpoint.middleware(AuthRateLimitMiddleware))
+    .add(passwordSignInEndpoint.middleware(AuthRateLimitMiddleware), passwordSignUpEndpoint.middleware(AuthRateLimitMiddleware), passwordResetStartEndpoint.middleware(AuthRateLimitMiddleware), passwordResetVerifyEndpoint.middleware(AuthRateLimitMiddleware), passwordSetEndpoint.middleware(AuthOriginCheckMiddleware), passwordChangeEndpoint.middleware(AuthOriginCheckMiddleware))
     .prefix("/auth/password")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
 export class SessionApi extends HttpApiGroup.make("session")
-    .add(currentSessionEndpoint, refreshSessionEndpoint.middleware(AuthOriginCheckMiddleware), logoutEndpoint.middleware(AuthOriginCheckMiddleware))
+    .add(currentSessionEndpoint, refreshSessionEndpoint.middleware(AuthOriginCheckMiddleware), logoutEndpoint.middleware(AuthOriginCheckMiddleware), listSessionsEndpoint, revokeSessionEndpoint.middleware(AuthOriginCheckMiddleware), revokeOtherSessionsEndpoint.middleware(AuthOriginCheckMiddleware))
     .prefix("/auth") {
 }
 export class EmailVerificationApi extends HttpApiGroup.make("emailVerification")
@@ -282,29 +1721,110 @@ export class EmailVerificationApi extends HttpApiGroup.make("emailVerification")
     .middleware(AuthSchemaErrorMiddleware)
     .middleware(AuthOriginCheckMiddleware) {
 }
+export class EmailOtpApi extends HttpApiGroup.make("emailOtp")
+    .add(emailOtpStartEndpoint.middleware(AuthRateLimitMiddleware), emailOtpVerifyEndpoint.middleware(AuthRateLimitMiddleware))
+    .prefix("/auth/email-otp")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class MagicLinkApi extends HttpApiGroup.make("magicLink")
+    .add(magicLinkStartEndpoint.middleware(AuthRateLimitMiddleware), magicLinkVerifyEndpoint.middleware(AuthRateLimitMiddleware))
+    .prefix("/auth/magic-link")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class OAuthApi extends HttpApiGroup.make("oauth")
+    .add(oauthAuthorizationStartEndpoint, oauthAccountUnlinkEndpoint)
+    .prefix("/auth/oauth")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class LoginApprovalApi extends HttpApiGroup.make("loginApproval")
+    .add(loginApprovalApproveEndpoint, loginApprovalStatusEndpoint, loginApprovalFinalizeEndpoint)
+    .prefix("/auth/login-approval")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class MfaApi extends HttpApiGroup.make("mfa")
+    .add(mfaOptionsEndpoint, totpMfaVerifyEndpoint, totpMfaVerifyForFlowEndpoint, recoveryCodeMfaVerifyEndpoint, recoveryCodeMfaVerifyForFlowEndpoint, passkeyMfaStartEndpoint, passkeyMfaVerifyEndpoint)
+    .prefix("/auth/mfa")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class ApiKeyApi extends HttpApiGroup.make("apiKey")
+    .add(apiKeyCreateEndpoint, apiKeyListEndpoint, apiKeyRevokeEndpoint)
+    .prefix("/auth/api-keys")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
+export class RefreshTokenApi extends HttpApiGroup.make("refreshToken")
+    .add(refreshTokenRefreshEndpoint)
+    .prefix("/auth/token")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class JwtApi extends HttpApiGroup.make("jwt")
+    .add(jwtIntrospectEndpoint, jwtRevokeEndpoint)
+    .prefix("/auth/jwt")
+    .middleware(AuthSchemaErrorMiddleware) {
+}
+export class SecurityApi extends HttpApiGroup.make("security")
+    .add(loginNotificationReportEndpoint)
+    .prefix("/auth/security")
+    .middleware(AuthSchemaErrorMiddleware)
+    .middleware(AuthOriginCheckMiddleware) {
+}
 export class AuthApi extends HttpApi.make("AuthApi")
     .add(PasswordApi)
     .add(SessionApi)
-    .add(EmailVerificationApi) {
+    .add(EmailVerificationApi)
+    .add(EmailOtpApi)
+    .add(MagicLinkApi)
+    .add(LoginApprovalApi)
+    .add(SecurityApi) {
 }
 export const PasswordApiLive = HttpApiBuilder.group(AuthApi, "password", Effect.fn("auth.http.password.group")(function* (handlers) {
     const password = yield* PasswordLogin;
     const registration = yield* PasswordRegistration;
+    const passwordReset = yield* PasswordReset;
+    const passwordManagement = yield* PasswordManagement;
     const authHttp = yield* AuthHttp;
     const emailVerificationFlow = yield* EmailVerificationFlow;
+    const sessions = yield* Sessions;
+    const sessionCookie = yield* SessionCookie;
     const authApiRateLimit = yield* AuthApiRateLimit;
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
     return handlers
         .handle("signIn", makePasswordSignInHandler({
         password,
         authHttp,
         emailVerificationFlow,
         authApiRateLimit,
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
     }))
         .handle("signUp", makePasswordSignUpHandler({
         registration,
         authHttp,
         emailVerificationFlow,
         authApiRateLimit,
+    }))
+        .handle("resetStart", makePasswordResetStartHandler({
+        passwordReset,
+        authApiRateLimit,
+    }))
+        .handle("resetVerify", makePasswordResetVerifyHandler({
+        passwordReset,
+    }))
+        .handle("set", makePasswordSetHandler({
+        passwordManagement,
+        sessions,
+        sessionCookie,
+    }))
+        .handle("change", makePasswordChangeHandler({
+        passwordManagement,
+        sessions,
+        sessionCookie,
     }));
 }));
 export const SessionApiLive = HttpApiBuilder.group(AuthApi, "session", Effect.fn("auth.http.session.group")(function* (handlers) {
@@ -314,7 +1834,10 @@ export const SessionApiLive = HttpApiBuilder.group(AuthApi, "session", Effect.fn
     return handlers
         .handle("current", makeCurrentSessionHandler({ sessions, sessionCookie, authHttp }))
         .handle("refresh", makeRefreshSessionHandler({ sessions, sessionCookie, authHttp }))
-        .handle("logout", makeLogoutHandler({ sessions, sessionCookie, authHttp }));
+        .handle("logout", makeLogoutHandler({ sessions, sessionCookie, authHttp }))
+        .handle("list", makeListSessionsHandler({ sessions, sessionCookie }))
+        .handle("revoke", makeRevokeSessionHandler({ sessions, sessionCookie, authHttp }))
+        .handle("revokeOthers", makeRevokeOtherSessionsHandler({ sessions, sessionCookie }));
 }));
 export const EmailVerificationApiLive = HttpApiBuilder.group(AuthApi, "emailVerification", Effect.fn("auth.http.email_verification.group")(function* (handlers) {
     const emailVerificationFlow = yield* EmailVerificationFlow;
@@ -333,7 +1856,89 @@ export const EmailVerificationApiLive = HttpApiBuilder.group(AuthApi, "emailVeri
         sessionCookie,
     }));
 }));
-const AuthHttpApiBaseLive = HttpApiBuilder.layer(AuthApi).pipe(Layer.provide(PasswordApiLive), Layer.provide(SessionApiLive), Layer.provide(EmailVerificationApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
+export const EmailOtpApiLive = HttpApiBuilder.group(AuthApi, "emailOtp", Effect.fn("auth.http.email_otp.group")(function* (handlers) {
+    const emailOtp = yield* EmailOtpLogin;
+    const authHttp = yield* AuthHttp;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    return handlers
+        .handle("start", makeEmailOtpStartHandler({ emailOtp, authApiRateLimit }))
+        .handle("verify", makeEmailOtpVerifyHandler({
+        emailOtp,
+        authHttp,
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }));
+}));
+export const MagicLinkApiLive = HttpApiBuilder.group(AuthApi, "magicLink", Effect.fn("auth.http.magic_link.group")(function* (handlers) {
+    const magicLink = yield* MagicLinkLogin;
+    const authHttp = yield* AuthHttp;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    return handlers
+        .handle("start", makeMagicLinkStartHandler({ magicLink, authApiRateLimit }))
+        .handle("verify", makeMagicLinkVerifyHandler({
+        magicLink,
+        authHttp,
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }));
+}));
+export const LoginApprovalApiLive = HttpApiBuilder.group(AuthApi, "loginApproval", Effect.fn("auth.http.login_approval.group")(function* (handlers) {
+    const loginApproval = yield* LoginApproval;
+    const authFlowState = yield* AuthFlowState;
+    const authFlow = yield* AuthFlow;
+    const users = yield* UserStore;
+    const authHttp = yield* AuthHttp;
+    const loginApprovalReview = yield* Effect.serviceOption(LoginApprovalReview);
+    const loginApprovalFinalize = yield* Effect.serviceOption(LoginApprovalFinalize);
+    const pendingCookieOption = yield* Effect.serviceOption(LoginApprovalPendingCookie);
+    const trustedDevice = yield* Effect.serviceOption(TrustedDevice);
+    const trustedDeviceCookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    const loginApprovalPendingCookie = Option.isSome(pendingCookieOption)
+        ? pendingCookieOption.value
+        : makeLoginApprovalPendingCookie();
+    return handlers
+        .handle("approve", makeLoginApprovalApproveHandler({
+        loginApproval,
+        authFlowState,
+        authFlow,
+        users,
+        authHttp,
+        loginApprovalPendingCookie,
+        ...(Option.isSome(trustedDevice)
+            ? { trustedDevice: trustedDevice.value }
+            : {}),
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }))
+        .handle("status", makeLoginApprovalStatusHandler(Option.isSome(loginApprovalReview)
+        ? { loginApprovalReview: loginApprovalReview.value }
+        : {}))
+        .handle("finalize", makeLoginApprovalFinalizeHandler({
+        authHttp,
+        loginApprovalPendingCookie,
+        ...(Option.isSome(loginApprovalFinalize)
+            ? { loginApprovalFinalize: loginApprovalFinalize.value }
+            : {}),
+        ...(Option.isSome(trustedDevice)
+            ? { trustedDevice: trustedDevice.value }
+            : {}),
+        ...(Option.isSome(trustedDeviceCookie)
+            ? { trustedDeviceCookie: trustedDeviceCookie.value }
+            : {}),
+    }));
+}));
+export const SecurityApiLive = HttpApiBuilder.group(AuthApi, "security", Effect.fn("auth.http.security.group")(function* (handlers) {
+    const loginNotification = yield* Effect.serviceOption(LoginNotification);
+    return handlers.handle("reportLogin", makeLoginNotificationReportHandler(Option.isSome(loginNotification)
+        ? { loginNotification: loginNotification.value }
+        : {}));
+}));
+const AuthHttpApiBaseLive = HttpApiBuilder.layer(AuthApi).pipe(Layer.provide(PasswordApiLive), Layer.provide(SessionApiLive), Layer.provide(EmailVerificationApiLive), Layer.provide(EmailOtpApiLive), Layer.provide(MagicLinkApiLive), Layer.provide(LoginApprovalApiLive), Layer.provide(SecurityApiLive), Layer.provide(AuthOriginCheckMiddlewareConfigLive), Layer.provide(AuthSchemaErrorMiddlewareLive));
 export const AuthHttpApiBareLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitNoopLive));
 export const AuthHttpApiLive = AuthHttpApiBaseLive.pipe(Layer.provide(AuthApiRateLimitLive));
 export { AuthResult };