@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.21

package/dist/index.d.ts

@@ -1,10 +1,13 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, K as KeySummary, c as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, d as OAuthNativeResult, U as UserProfile, e as ProfileInfo } from './authenticate-55LeXHqZ.js';
-export { A as AuthInitOptions, f as AuthSession, g as PERMISSION_CATEGORIES, h as PermissionCategory, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, j as VerificationPurpose, k as VerificationTargetType } from './authenticate-55LeXHqZ.js';
+import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, b as RequestSignupLinkResult, C as ConfirmSignupLinkResult, c as RequestPasswordResetResult, d as ConfirmPasswordResetResult, L as LoginResult, e as StartDeviceAuthResult, D as DeviceAuthInfoResult, F as FinishPasskeyEnrollmentResult, f as PasskeySummary, g as RotateKeyResult, K as KeySummary, h as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, i as OAuthNativeResult, U as UserProfile, j as ProfileInfo, k as OAuth2ConsentView, l as OAuth2AuthorizationCodeIssued, n as OAuth2GrantSummary } from './machine-principals-B7N8gux0.js';
+export { A as AuthInitOptions, o as AuthSession, p as PERMISSION_CATEGORIES, q as PermissionCategory, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, s as VerificationPurpose, t as VerificationTargetType } from './machine-principals-B7N8gux0.js';
+import * as _simplewebauthn_server from '@simplewebauthn/server';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, c as AccountDeletionRequestedBy, I as INVITATION_STATUSES, d as InvitationStatus, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, K as KeyAlgorithmType, h as KeyPlatformType, P as PURGE_STRATEGIES, i as PurgeStrategy, S as SOCIAL_PROVIDERS, j as SocialProvider, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
+import 'drizzle-orm/pg-core';
+import '@spfn/core/event';
 import 'hono';
 import '@spfn/auth/server';
 
@@ -125,6 +128,59 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
+    requestSignupLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TString;
+            returnPath: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, RequestSignupLinkResult>;
+    confirmSignupLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, ConfirmSignupLinkResult>;
+    completeSignup: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            password: _sinclair_typebox.TString;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            setupSecret: _sinclair_typebox.TString;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, RegisterResult>;
+    requestPasswordReset: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TString;
+            returnPath: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, RequestPasswordResetResult>;
+    confirmPasswordReset: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, ConfirmPasswordResetResult>;
+    completePasswordReset: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            password: _sinclair_typebox.TString;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            setupSecret: _sinclair_typebox.TString;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -142,6 +198,97 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
+    startDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, {}, StartDeviceAuthResult>;
+    pollDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            deviceCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        status: "pending";
+        intervalMillis: number;
+    } | {
+        email?: string | undefined;
+        phone?: string | undefined;
+        status: "approved";
+        userId: string;
+        publicId: string;
+        passwordChangeRequired: boolean;
+    }>;
+    getDeviceAuthInfo: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, DeviceAuthInfoResult>;
+    approveDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, DeviceAuthInfoResult>;
+    denyDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, void>;
+    passkeyRegisterOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialCreationOptionsJSON>;
+    passkeyRegisterVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            response: _sinclair_typebox.TUnknown;
+            label: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, FinishPasskeyEnrollmentResult>;
+    passkeyLoginOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    passkeyLoginVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            response: _sinclair_typebox.TUnknown;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, LoginResult>;
+    listPasskeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, {
+        passkeys: PasskeySummary[];
+    }>;
+    renamePasskey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            passkeyId: _sinclair_typebox.TString;
+            label: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        passkeyId: string;
+        label: string;
+    }>;
+    revokePasskey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            passkeyId: _sinclair_typebox.TString;
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        passkeyId: string;
+    }>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
     rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
@@ -173,6 +320,21 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
         }>;
     }, {}, RevokeAllKeysResult>;
+    confirmRevokeAllLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        expiresAt: string;
+        activeKeyCount: number;
+    }>;
+    consumeRevokeAllLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        revokedCount: number;
+    }>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -474,6 +636,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     updateLocale: _spfn_core_route.RouteDef<{
@@ -607,6 +770,43 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             createdAt: string | null;
         };
     }>;
+    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
+    getOAuth2Authorize: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuth2ConsentView>;
+    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            approve: _sinclair_typebox.TBoolean;
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuth2AuthorizationCodeIssued>;
+    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
+    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
+    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
+        grants: OAuth2GrantSummary[];
+    }>;
+    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, {
+        revoked: boolean;
+    }>;
+    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
 }>>;
 type AuthRouter = typeof mainAuthRouter;
 

package/dist/index.js

@@ -16,7 +16,8 @@ import {
   UnauthorizedError,
   ForbiddenError,
   ConflictError,
-  NotFoundError
+  NotFoundError,
+  HttpError
 } from "@spfn/core/errors";
 var InvalidCredentialsError = class extends UnauthorizedError {
   constructor(data = {}) {
@@ -131,12 +132,63 @@ var InvalidKeyFingerprintError = class extends ValidationError {
     this.name = "InvalidKeyFingerprintError";
   }
 };
+var KeyAlgorithmMismatchError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Public key type does not match the declared algorithm",
+      details: data.details
+    });
+    this.name = "KeyAlgorithmMismatchError";
+  }
+};
 var KeyNotFoundError = class extends NotFoundError {
   constructor(data = {}) {
     super({ message: data.message || "Key not found", details: data.details });
     this.name = "KeyNotFoundError";
   }
 };
+var RevokeAllLinkError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This sign-out link is no longer valid. Request a new one.",
+      details: data.details
+    });
+    this.name = "RevokeAllLinkError";
+  }
+};
+var DeviceAuthNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "Device authorization not found", details: data.details });
+    this.name = "DeviceAuthNotFoundError";
+  }
+};
+var DeviceAuthExpiredError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This device code has expired. Start again on the other device.",
+      details: data.details
+    });
+    this.name = "DeviceAuthExpiredError";
+  }
+};
+var DeviceAuthAlreadyHandledError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This device request has already been answered",
+      details: data.details
+    });
+    this.name = "DeviceAuthAlreadyHandledError";
+  }
+};
+var DeviceAuthDeniedError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This device request was denied",
+      details: data.details
+    });
+    this.name = "DeviceAuthDeniedError";
+  }
+};
 var NonceKeyBindingError = class extends ValidationError {
   constructor(data = {}) {
     super({
@@ -155,6 +207,42 @@ var NativeSignInUnsupportedError = class extends ValidationError {
     this.name = "NativeSignInUnsupportedError";
   }
 };
+var InvalidSignupLinkError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This signup link is no longer valid. Request a new one.",
+      details: data.details
+    });
+    this.name = "InvalidSignupLinkError";
+  }
+};
+var InvalidSignupSetupSessionError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Password setup session is invalid or has expired. Start the signup again.",
+      details: data.details
+    });
+    this.name = "InvalidSignupSetupSessionError";
+  }
+};
+var PasswordResetLinkError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This password reset link is no longer valid. Request a new one.",
+      details: data.details
+    });
+    this.name = "PasswordResetLinkError";
+  }
+};
+var PasswordResetSessionError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Password reset session is invalid or has expired. Request a new link.",
+      details: data.details
+    });
+    this.name = "PasswordResetSessionError";
+  }
+};
 var UnverifiedEmailLinkError = class extends ValidationError {
   constructor(data = {}) {
     super({
@@ -222,6 +310,110 @@ var InsufficientRoleError = class extends ForbiddenError {
     this.name = "InsufficientRoleError";
   }
 };
+var PasskeyChallengeError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This passkey challenge is no longer valid. Try again.",
+      details: data.details
+    });
+    this.name = "PasskeyChallengeError";
+  }
+};
+var PasskeyVerificationError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Passkey verification failed.",
+      details: data.details
+    });
+    this.name = "PasskeyVerificationError";
+  }
+};
+var PasskeyNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Passkey not found",
+      details: data.details
+    });
+    this.name = "PasskeyNotFoundError";
+  }
+};
+var PasskeyAlreadyRegisteredError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This passkey is already registered",
+      details: data.details
+    });
+    this.name = "PasskeyAlreadyRegisteredError";
+  }
+};
+var RecentAuthenticationRequiredError = class extends ForbiddenError {
+  code = "RECENT_AUTH_REQUIRED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "Confirm it is you before changing passkeys. Sign in again or send your current password.",
+      details: data.details
+    });
+    this.name = "RecentAuthenticationRequiredError";
+  }
+};
+var LastRecoveryCredentialError = class extends ConflictError {
+  code = "LAST_RECOVERY_CREDENTIAL";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This is the only way you can sign in. Set a password or link a social account before removing it.",
+      details: data.details
+    });
+    this.name = "LastRecoveryCredentialError";
+  }
+};
+var PasskeyConfigError = class extends HttpError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: 500,
+      details: data.details
+    });
+    this.name = "PasskeyConfigError";
+  }
+};
+var OAuth2UnknownClientError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unknown OAuth client",
+      details: { error: "unknown_client", ...data.details }
+    });
+    this.name = "OAuth2UnknownClientError";
+  }
+};
+var OAuth2RedirectUriMismatchError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "redirect_uri does not match a registered URI for this client",
+      details: { error: "redirect_uri_mismatch", ...data.details }
+    });
+    this.name = "OAuth2RedirectUriMismatchError";
+  }
+};
+var OAuth2AuthorizeRedirectError = class extends ValidationError {
+  constructor(data) {
+    super({
+      message: data.message || `OAuth authorize request refused: ${data.error}`,
+      details: {
+        error: data.error,
+        redirectUri: data.redirectUri,
+        state: data.state,
+        ...data.details
+      }
+    });
+    this.name = "OAuth2AuthorizeRedirectError";
+  }
+};
+var OAuth2GrantNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "No such connected application", details: data.details });
+    this.name = "OAuth2GrantNotFoundError";
+  }
+};
 
 // src/errors/index.ts
 var authErrorRegistry = new ErrorRegistry();
@@ -243,15 +435,36 @@ authErrorRegistry.append([
   InvalidVerificationCodeError,
   InvalidVerificationTokenError,
   InvalidKeyFingerprintError,
+  KeyAlgorithmMismatchError,
   NonceKeyBindingError,
   NativeSignInUnsupportedError,
   UnverifiedEmailLinkError,
+  InvalidSignupLinkError,
+  InvalidSignupSetupSessionError,
+  PasswordResetLinkError,
+  PasswordResetSessionError,
   KeyNotFoundError,
   KeyIdAlreadyRegisteredError,
+  RevokeAllLinkError,
+  DeviceAuthNotFoundError,
+  DeviceAuthExpiredError,
+  DeviceAuthAlreadyHandledError,
+  DeviceAuthDeniedError,
   VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError,
   InsufficientPermissionsError,
-  InsufficientRoleError
+  InsufficientRoleError,
+  PasskeyChallengeError,
+  PasskeyVerificationError,
+  PasskeyNotFoundError,
+  PasskeyAlreadyRegisteredError,
+  RecentAuthenticationRequiredError,
+  LastRecoveryCredentialError,
+  PasskeyConfigError,
+  OAuth2UnknownClientError,
+  OAuth2RedirectUriMismatchError,
+  OAuth2AuthorizeRedirectError,
+  OAuth2GrantNotFoundError
 ]);
 
 // src/generated/route-map.ts
@@ -259,7 +472,15 @@ var routeMap = {
   sendVerificationCode: { method: "POST", path: "/_auth/codes" },
   verifyCode: { method: "POST", path: "/_auth/codes/verify" },
   register: { method: "POST", path: "/_auth/register" },
+  requestSignupLink: { method: "POST", path: "/_auth/signup/email" },
+  confirmSignupLink: { method: "POST", path: "/_auth/signup/email/confirm" },
+  completeSignup: { method: "POST", path: "/_auth/signup/password" },
   login: { method: "POST", path: "/_auth/login" },
+  startDeviceAuth: { method: "POST", path: "/_auth/device/start" },
+  pollDeviceAuth: { method: "POST", path: "/_auth/device/poll" },
+  getDeviceAuthInfo: { method: "POST", path: "/_auth/device/info" },
+  approveDeviceAuth: { method: "POST", path: "/_auth/device/approve" },
+  denyDeviceAuth: { method: "POST", path: "/_auth/device/deny" },
   logout: { method: "POST", path: "/_auth/logout" },
   rotateKey: { method: "POST", path: "/_auth/keys/rotate" },
   listKeys: { method: "POST", path: "/_auth/keys/list" },
@@ -268,6 +489,18 @@ var routeMap = {
   changePassword: { method: "PUT", path: "/_auth/password" },
   getAuthSession: { method: "GET", path: "/_auth/session" },
   issueOneTimeToken: { method: "POST", path: "/_auth/tokens" },
+  requestPasswordReset: { method: "POST", path: "/_auth/password/reset" },
+  confirmPasswordReset: { method: "POST", path: "/_auth/password/reset/confirm" },
+  completePasswordReset: { method: "POST", path: "/_auth/password/reset/complete" },
+  confirmRevokeAllLink: { method: "POST", path: "/_auth/keys/revoke-all/confirm" },
+  consumeRevokeAllLink: { method: "POST", path: "/_auth/keys/revoke-all/consume" },
+  passkeyRegisterOptions: { method: "POST", path: "/_auth/passkeys/register/options" },
+  passkeyRegisterVerify: { method: "POST", path: "/_auth/passkeys/register/verify" },
+  passkeyLoginOptions: { method: "POST", path: "/_auth/passkeys/login/options" },
+  passkeyLoginVerify: { method: "POST", path: "/_auth/passkeys/login/verify" },
+  listPasskeys: { method: "POST", path: "/_auth/passkeys/list" },
+  renamePasskey: { method: "POST", path: "/_auth/passkeys/rename" },
+  revokePasskey: { method: "POST", path: "/_auth/passkeys/revoke" },
   getInvitation: { method: "GET", path: "/_auth/invitations/:token" },
   acceptInvitation: { method: "POST", path: "/_auth/invitations/accept" },
   createInvitation: { method: "POST", path: "/_auth/invitations" },
@@ -301,7 +534,15 @@ var routeMap = {
   cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" },
   issueOpsToken: { method: "POST", path: "/_auth/ops-tokens" },
   listOpsTokens: { method: "GET", path: "/_auth/ops-tokens" },
-  revokeOpsToken: { method: "DELETE", path: "/_auth/ops-tokens/:id" }
+  revokeOpsToken: { method: "DELETE", path: "/_auth/ops-tokens/:id" },
+  registerOAuth2Client: { method: "POST", path: "/_auth/oauth2/register" },
+  listOAuth2Grants: { method: "GET", path: "/_auth/oauth2/grants" },
+  revokeOAuth2Grant: { method: "DELETE", path: "/_auth/oauth2/grants/:id" },
+  oauth2AuthorizationServerMetadata: { method: "GET", path: "/.well-known/oauth-authorization-server" },
+  getOAuth2Authorize: { method: "GET", path: "/_auth/oauth2/authorize" },
+  createOAuth2AuthorizationCode: { method: "POST", path: "/_auth/oauth2/authorize" },
+  oauth2Token: { method: "POST", path: "/_auth/oauth2/token" },
+  oauth2Revoke: { method: "POST", path: "/_auth/oauth2/revoke" }
 };
 
 // src/lib/types.ts
@@ -3075,6 +3316,39 @@ var PlatformSchema = Type.Union(
   KEY_PLATFORM.map((platform) => Type.Literal(platform)),
   { description: "Platform the key lives on" }
 );
+var PublicKeySchema = Type.String({
+  maxLength: 2048,
+  description: "Client public key, SPKI DER in base64"
+});
+var KeyIdSchema = Type.String({
+  maxLength: 64,
+  description: "Key identifier"
+});
+var FingerprintSchema = Type.String({
+  maxLength: 128,
+  description: "SHA-256 hex fingerprint of the public key"
+});
+var UserCodeSchema = Type.String({
+  minLength: 8,
+  maxLength: 16,
+  description: "Device user code as displayed, e.g. WXYZ-2345. Dashes, spaces and case are ignored."
+});
+var DeviceAuthPollResponseSchema = Type.Union([
+  Type.Object({
+    status: Type.Literal("pending"),
+    intervalMillis: Type.Integer({ description: "Milliseconds to wait before polling again" })
+  }),
+  Type.Object({
+    status: Type.Literal("approved"),
+    userId: Type.String(),
+    publicId: Type.String(),
+    email: Type.Optional(Type.String()),
+    phone: Type.Optional(Type.String()),
+    passwordChangeRequired: Type.Boolean()
+  })
+], {
+  description: "Pending, or the login the approval produced"
+});
 var PasswordSchema = Type.String({
   minLength: 8,
   maxLength: 72,