@structured-id/ui-core 0.1.5

package/src/generated/sid/v1/authn/auth.client.ts

@@ -0,0 +1,900 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "sid/v1/authn/auth.proto" (package "sid.v1.authn", syntax proto3)
+// tslint:disable
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { AuthService } from "./auth";
+import type { CompletePasswordResetResponse } from "./auth";
+import type { CompletePasswordResetRequest } from "./auth";
+import type { VerifyPasswordResetResponse } from "./auth";
+import type { VerifyPasswordResetRequest } from "./auth";
+import type { RequestPasswordResetResponse } from "./auth";
+import type { RequestPasswordResetRequest } from "./auth";
+import type { ConfirmAccountDeletionResponse } from "./auth";
+import type { ConfirmAccountDeletionRequest } from "./auth";
+import type { DeleteMfaCredentialResponse } from "./auth";
+import type { DeleteMfaCredentialRequest } from "./auth";
+import type { CompleteStepUpResponse } from "./auth";
+import type { CompleteStepUpRequest } from "./auth";
+import type { StepUpChallenge } from "./auth";
+import type { RequestStepUpRequest } from "./auth";
+import type { SubmitDynamicPromptResponse } from "./auth";
+import type { SubmitDynamicPromptRequest } from "./auth";
+import type { DynamicPrompt } from "./auth";
+import type { GetDynamicPromptRequest } from "./auth";
+import type { VerifyCaptchaResponse } from "./auth";
+import type { VerifyCaptchaRequest } from "./auth";
+import type { DenyCibaRequest } from "./auth";
+import type { CibaConsentResponse } from "./auth";
+import type { ApproveCibaRequest } from "./auth";
+import type { AcceptTermsResponse } from "./auth";
+import type { AcceptTermsRequest } from "./auth";
+import type { GetTermsResponse } from "./auth";
+import type { GetTermsRequest } from "./auth";
+import type { SelectOrganizationResponse } from "./auth";
+import type { SelectOrganizationRequest } from "./auth";
+import type { ListUserOrganizationsResponse } from "./auth";
+import type { ListUserOrganizationsRequest } from "./auth";
+import type { ConfirmIdpLinkResponse } from "./auth";
+import type { ConfirmIdpLinkRequest } from "./auth";
+import type { ResendPhoneVerificationResponse } from "./auth";
+import type { ResendPhoneVerificationRequest } from "./auth";
+import type { VerifyPhoneResponse } from "./auth";
+import type { VerifyPhoneRequest } from "./auth";
+import type { ResendEmailVerificationResponse } from "./auth";
+import type { ResendEmailVerificationRequest } from "./auth";
+import type { ResendOtpResponse } from "./auth";
+import type { ResendOtpRequest } from "./auth";
+import type { VerifyOtpResponse } from "./auth";
+import type { VerifyOtpRequest } from "./auth";
+import type { RequestOtpResponse } from "./auth";
+import type { RequestOtpRequest } from "./auth";
+import type { VerifyRecoveryCodeRequest } from "./auth";
+import type { GenerateRecoveryCodesResponse } from "./auth";
+import type { GenerateRecoveryCodesRequest } from "./auth";
+import type { ResendSmsMfaResponse } from "./auth";
+import type { ResendSmsMfaRequest } from "./auth";
+import type { VerifySmsMfaRequest } from "./auth";
+import type { MfaVerifyResponse } from "./auth";
+import type { VerifyTotpRequest } from "./auth";
+import type { FinishTotpEnrollmentResponse } from "./auth";
+import type { FinishTotpEnrollmentRequest } from "./auth";
+import type { TotpEnrollmentChallenge } from "./auth";
+import type { StartTotpEnrollmentRequest } from "./auth";
+import type { SubmitDeferredZkProofResponse } from "./auth";
+import type { SubmitDeferredZkProofRequest } from "./auth";
+import type { GetZkppPolicyResponse } from "./auth";
+import type { GetZkppPolicyRequest } from "./auth";
+import type { ResolvePrincipalResponse } from "./auth";
+import type { ResolvePrincipalRequest } from "./auth";
+import type { ValidateSessionResponse } from "./auth";
+import type { ValidateSessionRequest } from "./auth";
+import type { LegacyMigrateFinishResponse } from "./auth";
+import type { LegacyMigrateFinishRequest } from "./auth";
+import type { LegacyMigrateStartResponse } from "./auth";
+import type { LegacyMigrateStartRequest } from "./auth";
+import type { VerifyMagicLinkResponse } from "./auth";
+import type { VerifyMagicLinkRequest } from "./auth";
+import type { RequestMagicLinkResponse } from "./auth";
+import type { RequestMagicLinkRequest } from "./auth";
+import type { SubmitDeviceUserCodeResponse } from "./auth";
+import type { SubmitDeviceUserCodeRequest } from "./auth";
+import type { PollDeviceTokenRequest } from "./auth";
+import type { DeviceAuthorizationResponse } from "./auth";
+import type { DeviceAuthorizationRequest } from "./auth";
+import type { OAuth2RevokeResponse } from "./auth";
+import type { OAuth2RevokeRequest } from "./auth";
+import type { OAuth2IntrospectResponse } from "./auth";
+import type { OAuth2IntrospectRequest } from "./auth";
+import type { OAuth2TokenResponse } from "./auth";
+import type { OAuth2TokenRequest } from "./auth";
+import type { OAuth2AuthorizeResponse } from "./auth";
+import type { OAuth2AuthorizeRequest } from "./auth";
+import type { WebAuthnAuthenticationFinishResponse } from "./auth";
+import type { WebAuthnAuthenticationFinishRequest } from "./auth";
+import type { WebAuthnAuthenticationStartResponse } from "./auth";
+import type { WebAuthnAuthenticationStartRequest } from "./auth";
+import type { WebAuthnRegistrationFinishResponse } from "./auth";
+import type { WebAuthnRegistrationFinishRequest } from "./auth";
+import type { WebAuthnRegistrationStartResponse } from "./auth";
+import type { WebAuthnRegistrationStartRequest } from "./auth";
+import type { PasswordChangeFinishResponse } from "./auth";
+import type { PasswordChangeFinishRequest } from "./auth";
+import type { PasswordChangeExecuteResponse } from "./auth";
+import type { PasswordChangeExecuteRequest } from "./auth";
+import type { PasswordChangeChallengeResponse } from "./auth";
+import type { PasswordChangeChallengeRequest } from "./auth";
+import type { OpaqueZkppRegistrationFinishResponse } from "./auth";
+import type { OpaqueZkppRegistrationFinishRequest } from "./auth";
+import type { OpaqueZkppRegistrationStartResponse } from "./auth";
+import type { OpaqueZkppRegistrationStartRequest } from "./auth";
+import type { OpaqueLoginFinishResponse } from "./auth";
+import type { OpaqueLoginFinishRequest } from "./auth";
+import type { OpaqueLoginStartResponse } from "./auth";
+import type { OpaqueLoginStartRequest } from "./auth";
+import type { OpaqueRegistrationFinishResponse } from "./auth";
+import type { OpaqueRegistrationFinishRequest } from "./auth";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { OpaqueRegistrationStartResponse } from "./auth";
+import type { OpaqueRegistrationStartRequest } from "./auth";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * AuthService handles authentication flows.
+ *
+ * @generated from protobuf service sid.v1.authn.AuthService
+ */
+export interface IAuthServiceClient {
+    /**
+     * OPAQUE password authentication (RFC 9807).
+     *
+     * @generated from protobuf rpc: OpaqueRegistrationStart
+     */
+    opaqueRegistrationStart(input: OpaqueRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationStartRequest, OpaqueRegistrationStartResponse>;
+    /**
+     * @generated from protobuf rpc: OpaqueRegistrationFinish
+     */
+    opaqueRegistrationFinish(input: OpaqueRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationFinishRequest, OpaqueRegistrationFinishResponse>;
+    /**
+     * @generated from protobuf rpc: OpaqueLoginStart
+     */
+    opaqueLoginStart(input: OpaqueLoginStartRequest, options?: RpcOptions): UnaryCall<OpaqueLoginStartRequest, OpaqueLoginStartResponse>;
+    /**
+     * @generated from protobuf rpc: OpaqueLoginFinish
+     */
+    opaqueLoginFinish(input: OpaqueLoginFinishRequest, options?: RpcOptions): UnaryCall<OpaqueLoginFinishRequest, OpaqueLoginFinishResponse>;
+    /**
+     * OPAQUE-ZKPP: OPAQUE with zero-knowledge password policy proof (Pallas curve).
+     *
+     * @generated from protobuf rpc: OpaqueZkppRegistrationStart
+     */
+    opaqueZkppRegistrationStart(input: OpaqueZkppRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationStartRequest, OpaqueZkppRegistrationStartResponse>;
+    /**
+     * @generated from protobuf rpc: OpaqueZkppRegistrationFinish
+     */
+    opaqueZkppRegistrationFinish(input: OpaqueZkppRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationFinishRequest, OpaqueZkppRegistrationFinishResponse>;
+    /**
+     * @generated from protobuf rpc: PasswordChangeChallenge
+     */
+    passwordChangeChallenge(input: PasswordChangeChallengeRequest, options?: RpcOptions): UnaryCall<PasswordChangeChallengeRequest, PasswordChangeChallengeResponse>;
+    /**
+     * @generated from protobuf rpc: PasswordChangeExecute
+     */
+    passwordChangeExecute(input: PasswordChangeExecuteRequest, options?: RpcOptions): UnaryCall<PasswordChangeExecuteRequest, PasswordChangeExecuteResponse>;
+    /**
+     * @generated from protobuf rpc: PasswordChangeFinish
+     */
+    passwordChangeFinish(input: PasswordChangeFinishRequest, options?: RpcOptions): UnaryCall<PasswordChangeFinishRequest, PasswordChangeFinishResponse>;
+    /**
+     * WebAuthn (passkeys).
+     *
+     * @generated from protobuf rpc: WebAuthnRegistrationStart
+     */
+    webAuthnRegistrationStart(input: WebAuthnRegistrationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationStartRequest, WebAuthnRegistrationStartResponse>;
+    /**
+     * @generated from protobuf rpc: WebAuthnRegistrationFinish
+     */
+    webAuthnRegistrationFinish(input: WebAuthnRegistrationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationFinishRequest, WebAuthnRegistrationFinishResponse>;
+    /**
+     * @generated from protobuf rpc: WebAuthnAuthenticationStart
+     */
+    webAuthnAuthenticationStart(input: WebAuthnAuthenticationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationStartRequest, WebAuthnAuthenticationStartResponse>;
+    /**
+     * @generated from protobuf rpc: WebAuthnAuthenticationFinish
+     */
+    webAuthnAuthenticationFinish(input: WebAuthnAuthenticationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationFinishRequest, WebAuthnAuthenticationFinishResponse>;
+    /**
+     * OAuth2 / OIDC flows.
+     *
+     * @generated from protobuf rpc: OAuth2Authorize
+     */
+    oAuth2Authorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse>;
+    /**
+     * @generated from protobuf rpc: OAuth2Token
+     */
+    oAuth2Token(input: OAuth2TokenRequest, options?: RpcOptions): UnaryCall<OAuth2TokenRequest, OAuth2TokenResponse>;
+    /**
+     * @generated from protobuf rpc: OAuth2Introspect
+     */
+    oAuth2Introspect(input: OAuth2IntrospectRequest, options?: RpcOptions): UnaryCall<OAuth2IntrospectRequest, OAuth2IntrospectResponse>;
+    /**
+     * @generated from protobuf rpc: OAuth2Revoke
+     */
+    oAuth2Revoke(input: OAuth2RevokeRequest, options?: RpcOptions): UnaryCall<OAuth2RevokeRequest, OAuth2RevokeResponse>;
+    /**
+     * Device Authorization Grant (RFC 8628).
+     *
+     * @generated from protobuf rpc: StartDeviceAuthorization
+     */
+    startDeviceAuthorization(input: DeviceAuthorizationRequest, options?: RpcOptions): UnaryCall<DeviceAuthorizationRequest, DeviceAuthorizationResponse>;
+    /**
+     * @generated from protobuf rpc: PollDeviceToken
+     */
+    pollDeviceToken(input: PollDeviceTokenRequest, options?: RpcOptions): UnaryCall<PollDeviceTokenRequest, OAuth2TokenResponse>;
+    /**
+     * @generated from protobuf rpc: SubmitDeviceUserCode
+     */
+    submitDeviceUserCode(input: SubmitDeviceUserCodeRequest, options?: RpcOptions): UnaryCall<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse>;
+    // ── Magic Link (passwordless, corporate profiles) ──
+
+    /**
+     * @generated from protobuf rpc: RequestMagicLink
+     */
+    requestMagicLink(input: RequestMagicLinkRequest, options?: RpcOptions): UnaryCall<RequestMagicLinkRequest, RequestMagicLinkResponse>;
+    /**
+     * @generated from protobuf rpc: VerifyMagicLink
+     */
+    verifyMagicLink(input: VerifyMagicLinkRequest, options?: RpcOptions): UnaryCall<VerifyMagicLinkRequest, VerifyMagicLinkResponse>;
+    /**
+     * Legacy password migration (on-login OPAQUE re-registration).
+     *
+     * @generated from protobuf rpc: LegacyMigrateStart
+     */
+    legacyMigrateStart(input: LegacyMigrateStartRequest, options?: RpcOptions): UnaryCall<LegacyMigrateStartRequest, LegacyMigrateStartResponse>;
+    /**
+     * @generated from protobuf rpc: LegacyMigrateFinish
+     */
+    legacyMigrateFinish(input: LegacyMigrateFinishRequest, options?: RpcOptions): UnaryCall<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse>;
+    /**
+     * Session validation.
+     *
+     * @generated from protobuf rpc: ValidateSession
+     */
+    validateSession(input: ValidateSessionRequest, options?: RpcOptions): UnaryCall<ValidateSessionRequest, ValidateSessionResponse>;
+    /**
+     * Unified login flow: resolve principal → available auth methods.
+     *
+     * @generated from protobuf rpc: ResolvePrincipal
+     */
+    resolvePrincipal(input: ResolvePrincipalRequest, options?: RpcOptions): UnaryCall<ResolvePrincipalRequest, ResolvePrincipalResponse>;
+    /**
+     * ZKPP password policy: current policy version and parameters.
+     *
+     * @generated from protobuf rpc: GetZkppPolicy
+     */
+    getZkppPolicy(input: GetZkppPolicyRequest, options?: RpcOptions): UnaryCall<GetZkppPolicyRequest, GetZkppPolicyResponse>;
+    /**
+     * Submit a deferred ZK proof for a credential registered without WASM.
+     * Must be called within 24h of registration from a WASM-capable device.
+     *
+     * @generated from protobuf rpc: SubmitDeferredZkProof
+     */
+    submitDeferredZkProof(input: SubmitDeferredZkProofRequest, options?: RpcOptions): UnaryCall<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse>;
+    // ── MFA TOTP ──
+
+    /**
+     * @generated from protobuf rpc: StartTotpEnrollment
+     */
+    startTotpEnrollment(input: StartTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<StartTotpEnrollmentRequest, TotpEnrollmentChallenge>;
+    /**
+     * @generated from protobuf rpc: FinishTotpEnrollment
+     */
+    finishTotpEnrollment(input: FinishTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse>;
+    /**
+     * @generated from protobuf rpc: VerifyTotp
+     */
+    verifyTotp(input: VerifyTotpRequest, options?: RpcOptions): UnaryCall<VerifyTotpRequest, MfaVerifyResponse>;
+    // ── MFA SMS ──
+
+    /**
+     * @generated from protobuf rpc: VerifySmsMfa
+     */
+    verifySmsMfa(input: VerifySmsMfaRequest, options?: RpcOptions): UnaryCall<VerifySmsMfaRequest, MfaVerifyResponse>;
+    /**
+     * @generated from protobuf rpc: ResendSmsMfa
+     */
+    resendSmsMfa(input: ResendSmsMfaRequest, options?: RpcOptions): UnaryCall<ResendSmsMfaRequest, ResendSmsMfaResponse>;
+    // ── MFA Recovery Codes ──
+
+    /**
+     * @generated from protobuf rpc: GenerateRecoveryCodes
+     */
+    generateRecoveryCodes(input: GenerateRecoveryCodesRequest, options?: RpcOptions): UnaryCall<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse>;
+    /**
+     * @generated from protobuf rpc: VerifyRecoveryCode
+     */
+    verifyRecoveryCode(input: VerifyRecoveryCodeRequest, options?: RpcOptions): UnaryCall<VerifyRecoveryCodeRequest, MfaVerifyResponse>;
+    // ── OTP verification (email/phone, non-MFA) ──
+
+    /**
+     * @generated from protobuf rpc: RequestOtp
+     */
+    requestOtp(input: RequestOtpRequest, options?: RpcOptions): UnaryCall<RequestOtpRequest, RequestOtpResponse>;
+    /**
+     * @generated from protobuf rpc: VerifyOtp
+     */
+    verifyOtp(input: VerifyOtpRequest, options?: RpcOptions): UnaryCall<VerifyOtpRequest, VerifyOtpResponse>;
+    /**
+     * @generated from protobuf rpc: ResendOtp
+     */
+    resendOtp(input: ResendOtpRequest, options?: RpcOptions): UnaryCall<ResendOtpRequest, ResendOtpResponse>;
+    // ── Email/Phone verification ──
+
+    /**
+     * @generated from protobuf rpc: ResendEmailVerification
+     */
+    resendEmailVerification(input: ResendEmailVerificationRequest, options?: RpcOptions): UnaryCall<ResendEmailVerificationRequest, ResendEmailVerificationResponse>;
+    /**
+     * @generated from protobuf rpc: VerifyPhone
+     */
+    verifyPhone(input: VerifyPhoneRequest, options?: RpcOptions): UnaryCall<VerifyPhoneRequest, VerifyPhoneResponse>;
+    /**
+     * @generated from protobuf rpc: ResendPhoneVerification
+     */
+    resendPhoneVerification(input: ResendPhoneVerificationRequest, options?: RpcOptions): UnaryCall<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse>;
+    // ── IdP linking ──
+
+    /**
+     * @generated from protobuf rpc: ConfirmIdpLink
+     */
+    confirmIdpLink(input: ConfirmIdpLinkRequest, options?: RpcOptions): UnaryCall<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse>;
+    // ── Organization selector (multi-org login) ──
+
+    /**
+     * @generated from protobuf rpc: ListUserOrganizations
+     */
+    listUserOrganizations(input: ListUserOrganizationsRequest, options?: RpcOptions): UnaryCall<ListUserOrganizationsRequest, ListUserOrganizationsResponse>;
+    /**
+     * @generated from protobuf rpc: SelectOrganization
+     */
+    selectOrganization(input: SelectOrganizationRequest, options?: RpcOptions): UnaryCall<SelectOrganizationRequest, SelectOrganizationResponse>;
+    // ── Terms acceptance ──
+
+    /**
+     * @generated from protobuf rpc: GetTerms
+     */
+    getTerms(input: GetTermsRequest, options?: RpcOptions): UnaryCall<GetTermsRequest, GetTermsResponse>;
+    /**
+     * @generated from protobuf rpc: AcceptTerms
+     */
+    acceptTerms(input: AcceptTermsRequest, options?: RpcOptions): UnaryCall<AcceptTermsRequest, AcceptTermsResponse>;
+    // ── CIBA consent (EE) ──
+
+    /**
+     * @generated from protobuf rpc: ApproveCiba
+     */
+    approveCiba(input: ApproveCibaRequest, options?: RpcOptions): UnaryCall<ApproveCibaRequest, CibaConsentResponse>;
+    /**
+     * @generated from protobuf rpc: DenyCiba
+     */
+    denyCiba(input: DenyCibaRequest, options?: RpcOptions): UnaryCall<DenyCibaRequest, CibaConsentResponse>;
+    // ── Captcha ──
+
+    /**
+     * @generated from protobuf rpc: VerifyCaptcha
+     */
+    verifyCaptcha(input: VerifyCaptchaRequest, options?: RpcOptions): UnaryCall<VerifyCaptchaRequest, VerifyCaptchaResponse>;
+    // ── Dynamic prompt (EE custom auth steps) ──
+
+    /**
+     * @generated from protobuf rpc: GetDynamicPrompt
+     */
+    getDynamicPrompt(input: GetDynamicPromptRequest, options?: RpcOptions): UnaryCall<GetDynamicPromptRequest, DynamicPrompt>;
+    /**
+     * @generated from protobuf rpc: SubmitDynamicPrompt
+     */
+    submitDynamicPrompt(input: SubmitDynamicPromptRequest, options?: RpcOptions): UnaryCall<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse>;
+    // ── Step-up authentication ──
+
+    /**
+     * Generic step-up Phase 1: request challenge (WebAuthn). Skip for TOTP/recovery.
+     *
+     * @generated from protobuf rpc: RequestStepUp
+     */
+    requestStepUp(input: RequestStepUpRequest, options?: RpcOptions): UnaryCall<RequestStepUpRequest, StepUpChallenge>;
+    /**
+     * Generic step-up Phase 2: submit proof → elevate session → rotate token.
+     *
+     * @generated from protobuf rpc: CompleteStepUp
+     */
+    completeStepUp(input: CompleteStepUpRequest, options?: RpcOptions): UnaryCall<CompleteStepUpRequest, CompleteStepUpResponse>;
+    // ── MFA credential management ──
+
+    /**
+     * Delete an MFA credential (TOTP, WebAuthn, Recovery).
+     * Requires elevated session (step-up auth) before calling.
+     *
+     * @generated from protobuf rpc: DeleteMfaCredential
+     */
+    deleteMfaCredential(input: DeleteMfaCredentialRequest, options?: RpcOptions): UnaryCall<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse>;
+    // ── Account deletion confirmation ──
+
+    /**
+     * @generated from protobuf rpc: ConfirmAccountDeletion
+     */
+    confirmAccountDeletion(input: ConfirmAccountDeletionRequest, options?: RpcOptions): UnaryCall<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse>;
+    /**
+     * Password reset flow (magic link → new OPAQUE credential).
+     * SaaS extends this with key recovery (Shamir shards, DownloadRecoveryShard) in proto-ee.
+     *
+     * @generated from protobuf rpc: RequestPasswordReset
+     */
+    requestPasswordReset(input: RequestPasswordResetRequest, options?: RpcOptions): UnaryCall<RequestPasswordResetRequest, RequestPasswordResetResponse>;
+    /**
+     * @generated from protobuf rpc: VerifyPasswordReset
+     */
+    verifyPasswordReset(input: VerifyPasswordResetRequest, options?: RpcOptions): UnaryCall<VerifyPasswordResetRequest, VerifyPasswordResetResponse>;
+    /**
+     * @generated from protobuf rpc: CompletePasswordReset
+     */
+    completePasswordReset(input: CompletePasswordResetRequest, options?: RpcOptions): UnaryCall<CompletePasswordResetRequest, CompletePasswordResetResponse>;
+}
+/**
+ * AuthService handles authentication flows.
+ *
+ * @generated from protobuf service sid.v1.authn.AuthService
+ */
+export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
+    typeName = AuthService.typeName;
+    methods = AuthService.methods;
+    options = AuthService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * OPAQUE password authentication (RFC 9807).
+     *
+     * @generated from protobuf rpc: OpaqueRegistrationStart
+     */
+    opaqueRegistrationStart(input: OpaqueRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationStartRequest, OpaqueRegistrationStartResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OpaqueRegistrationStartRequest, OpaqueRegistrationStartResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OpaqueRegistrationFinish
+     */
+    opaqueRegistrationFinish(input: OpaqueRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationFinishRequest, OpaqueRegistrationFinishResponse> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OpaqueRegistrationFinishRequest, OpaqueRegistrationFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OpaqueLoginStart
+     */
+    opaqueLoginStart(input: OpaqueLoginStartRequest, options?: RpcOptions): UnaryCall<OpaqueLoginStartRequest, OpaqueLoginStartResponse> {
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OpaqueLoginStartRequest, OpaqueLoginStartResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OpaqueLoginFinish
+     */
+    opaqueLoginFinish(input: OpaqueLoginFinishRequest, options?: RpcOptions): UnaryCall<OpaqueLoginFinishRequest, OpaqueLoginFinishResponse> {
+        const method = this.methods[3], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OpaqueLoginFinishRequest, OpaqueLoginFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * OPAQUE-ZKPP: OPAQUE with zero-knowledge password policy proof (Pallas curve).
+     *
+     * @generated from protobuf rpc: OpaqueZkppRegistrationStart
+     */
+    opaqueZkppRegistrationStart(input: OpaqueZkppRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationStartRequest, OpaqueZkppRegistrationStartResponse> {
+        const method = this.methods[4], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OpaqueZkppRegistrationStartRequest, OpaqueZkppRegistrationStartResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OpaqueZkppRegistrationFinish
+     */
+    opaqueZkppRegistrationFinish(input: OpaqueZkppRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationFinishRequest, OpaqueZkppRegistrationFinishResponse> {
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OpaqueZkppRegistrationFinishRequest, OpaqueZkppRegistrationFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: PasswordChangeChallenge
+     */
+    passwordChangeChallenge(input: PasswordChangeChallengeRequest, options?: RpcOptions): UnaryCall<PasswordChangeChallengeRequest, PasswordChangeChallengeResponse> {
+        const method = this.methods[6], opt = this._transport.mergeOptions(options);
+        return stackIntercept<PasswordChangeChallengeRequest, PasswordChangeChallengeResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: PasswordChangeExecute
+     */
+    passwordChangeExecute(input: PasswordChangeExecuteRequest, options?: RpcOptions): UnaryCall<PasswordChangeExecuteRequest, PasswordChangeExecuteResponse> {
+        const method = this.methods[7], opt = this._transport.mergeOptions(options);
+        return stackIntercept<PasswordChangeExecuteRequest, PasswordChangeExecuteResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: PasswordChangeFinish
+     */
+    passwordChangeFinish(input: PasswordChangeFinishRequest, options?: RpcOptions): UnaryCall<PasswordChangeFinishRequest, PasswordChangeFinishResponse> {
+        const method = this.methods[8], opt = this._transport.mergeOptions(options);
+        return stackIntercept<PasswordChangeFinishRequest, PasswordChangeFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * WebAuthn (passkeys).
+     *
+     * @generated from protobuf rpc: WebAuthnRegistrationStart
+     */
+    webAuthnRegistrationStart(input: WebAuthnRegistrationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationStartRequest, WebAuthnRegistrationStartResponse> {
+        const method = this.methods[9], opt = this._transport.mergeOptions(options);
+        return stackIntercept<WebAuthnRegistrationStartRequest, WebAuthnRegistrationStartResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: WebAuthnRegistrationFinish
+     */
+    webAuthnRegistrationFinish(input: WebAuthnRegistrationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationFinishRequest, WebAuthnRegistrationFinishResponse> {
+        const method = this.methods[10], opt = this._transport.mergeOptions(options);
+        return stackIntercept<WebAuthnRegistrationFinishRequest, WebAuthnRegistrationFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: WebAuthnAuthenticationStart
+     */
+    webAuthnAuthenticationStart(input: WebAuthnAuthenticationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationStartRequest, WebAuthnAuthenticationStartResponse> {
+        const method = this.methods[11], opt = this._transport.mergeOptions(options);
+        return stackIntercept<WebAuthnAuthenticationStartRequest, WebAuthnAuthenticationStartResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: WebAuthnAuthenticationFinish
+     */
+    webAuthnAuthenticationFinish(input: WebAuthnAuthenticationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationFinishRequest, WebAuthnAuthenticationFinishResponse> {
+        const method = this.methods[12], opt = this._transport.mergeOptions(options);
+        return stackIntercept<WebAuthnAuthenticationFinishRequest, WebAuthnAuthenticationFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * OAuth2 / OIDC flows.
+     *
+     * @generated from protobuf rpc: OAuth2Authorize
+     */
+    oAuth2Authorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse> {
+        const method = this.methods[13], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OAuth2Token
+     */
+    oAuth2Token(input: OAuth2TokenRequest, options?: RpcOptions): UnaryCall<OAuth2TokenRequest, OAuth2TokenResponse> {
+        const method = this.methods[14], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OAuth2TokenRequest, OAuth2TokenResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OAuth2Introspect
+     */
+    oAuth2Introspect(input: OAuth2IntrospectRequest, options?: RpcOptions): UnaryCall<OAuth2IntrospectRequest, OAuth2IntrospectResponse> {
+        const method = this.methods[15], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OAuth2IntrospectRequest, OAuth2IntrospectResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: OAuth2Revoke
+     */
+    oAuth2Revoke(input: OAuth2RevokeRequest, options?: RpcOptions): UnaryCall<OAuth2RevokeRequest, OAuth2RevokeResponse> {
+        const method = this.methods[16], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OAuth2RevokeRequest, OAuth2RevokeResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Device Authorization Grant (RFC 8628).
+     *
+     * @generated from protobuf rpc: StartDeviceAuthorization
+     */
+    startDeviceAuthorization(input: DeviceAuthorizationRequest, options?: RpcOptions): UnaryCall<DeviceAuthorizationRequest, DeviceAuthorizationResponse> {
+        const method = this.methods[17], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeviceAuthorizationRequest, DeviceAuthorizationResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: PollDeviceToken
+     */
+    pollDeviceToken(input: PollDeviceTokenRequest, options?: RpcOptions): UnaryCall<PollDeviceTokenRequest, OAuth2TokenResponse> {
+        const method = this.methods[18], opt = this._transport.mergeOptions(options);
+        return stackIntercept<PollDeviceTokenRequest, OAuth2TokenResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: SubmitDeviceUserCode
+     */
+    submitDeviceUserCode(input: SubmitDeviceUserCodeRequest, options?: RpcOptions): UnaryCall<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse> {
+        const method = this.methods[19], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Magic Link (passwordless, corporate profiles) ──
+
+    /**
+     * @generated from protobuf rpc: RequestMagicLink
+     */
+    requestMagicLink(input: RequestMagicLinkRequest, options?: RpcOptions): UnaryCall<RequestMagicLinkRequest, RequestMagicLinkResponse> {
+        const method = this.methods[20], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RequestMagicLinkRequest, RequestMagicLinkResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: VerifyMagicLink
+     */
+    verifyMagicLink(input: VerifyMagicLinkRequest, options?: RpcOptions): UnaryCall<VerifyMagicLinkRequest, VerifyMagicLinkResponse> {
+        const method = this.methods[21], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyMagicLinkRequest, VerifyMagicLinkResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Legacy password migration (on-login OPAQUE re-registration).
+     *
+     * @generated from protobuf rpc: LegacyMigrateStart
+     */
+    legacyMigrateStart(input: LegacyMigrateStartRequest, options?: RpcOptions): UnaryCall<LegacyMigrateStartRequest, LegacyMigrateStartResponse> {
+        const method = this.methods[22], opt = this._transport.mergeOptions(options);
+        return stackIntercept<LegacyMigrateStartRequest, LegacyMigrateStartResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: LegacyMigrateFinish
+     */
+    legacyMigrateFinish(input: LegacyMigrateFinishRequest, options?: RpcOptions): UnaryCall<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse> {
+        const method = this.methods[23], opt = this._transport.mergeOptions(options);
+        return stackIntercept<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Session validation.
+     *
+     * @generated from protobuf rpc: ValidateSession
+     */
+    validateSession(input: ValidateSessionRequest, options?: RpcOptions): UnaryCall<ValidateSessionRequest, ValidateSessionResponse> {
+        const method = this.methods[24], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ValidateSessionRequest, ValidateSessionResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Unified login flow: resolve principal → available auth methods.
+     *
+     * @generated from protobuf rpc: ResolvePrincipal
+     */
+    resolvePrincipal(input: ResolvePrincipalRequest, options?: RpcOptions): UnaryCall<ResolvePrincipalRequest, ResolvePrincipalResponse> {
+        const method = this.methods[25], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ResolvePrincipalRequest, ResolvePrincipalResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ZKPP password policy: current policy version and parameters.
+     *
+     * @generated from protobuf rpc: GetZkppPolicy
+     */
+    getZkppPolicy(input: GetZkppPolicyRequest, options?: RpcOptions): UnaryCall<GetZkppPolicyRequest, GetZkppPolicyResponse> {
+        const method = this.methods[26], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetZkppPolicyRequest, GetZkppPolicyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Submit a deferred ZK proof for a credential registered without WASM.
+     * Must be called within 24h of registration from a WASM-capable device.
+     *
+     * @generated from protobuf rpc: SubmitDeferredZkProof
+     */
+    submitDeferredZkProof(input: SubmitDeferredZkProofRequest, options?: RpcOptions): UnaryCall<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse> {
+        const method = this.methods[27], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── MFA TOTP ──
+
+    /**
+     * @generated from protobuf rpc: StartTotpEnrollment
+     */
+    startTotpEnrollment(input: StartTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<StartTotpEnrollmentRequest, TotpEnrollmentChallenge> {
+        const method = this.methods[28], opt = this._transport.mergeOptions(options);
+        return stackIntercept<StartTotpEnrollmentRequest, TotpEnrollmentChallenge>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: FinishTotpEnrollment
+     */
+    finishTotpEnrollment(input: FinishTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse> {
+        const method = this.methods[29], opt = this._transport.mergeOptions(options);
+        return stackIntercept<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: VerifyTotp
+     */
+    verifyTotp(input: VerifyTotpRequest, options?: RpcOptions): UnaryCall<VerifyTotpRequest, MfaVerifyResponse> {
+        const method = this.methods[30], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyTotpRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── MFA SMS ──
+
+    /**
+     * @generated from protobuf rpc: VerifySmsMfa
+     */
+    verifySmsMfa(input: VerifySmsMfaRequest, options?: RpcOptions): UnaryCall<VerifySmsMfaRequest, MfaVerifyResponse> {
+        const method = this.methods[31], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifySmsMfaRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: ResendSmsMfa
+     */
+    resendSmsMfa(input: ResendSmsMfaRequest, options?: RpcOptions): UnaryCall<ResendSmsMfaRequest, ResendSmsMfaResponse> {
+        const method = this.methods[32], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ResendSmsMfaRequest, ResendSmsMfaResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── MFA Recovery Codes ──
+
+    /**
+     * @generated from protobuf rpc: GenerateRecoveryCodes
+     */
+    generateRecoveryCodes(input: GenerateRecoveryCodesRequest, options?: RpcOptions): UnaryCall<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse> {
+        const method = this.methods[33], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: VerifyRecoveryCode
+     */
+    verifyRecoveryCode(input: VerifyRecoveryCodeRequest, options?: RpcOptions): UnaryCall<VerifyRecoveryCodeRequest, MfaVerifyResponse> {
+        const method = this.methods[34], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyRecoveryCodeRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── OTP verification (email/phone, non-MFA) ──
+
+    /**
+     * @generated from protobuf rpc: RequestOtp
+     */
+    requestOtp(input: RequestOtpRequest, options?: RpcOptions): UnaryCall<RequestOtpRequest, RequestOtpResponse> {
+        const method = this.methods[35], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RequestOtpRequest, RequestOtpResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: VerifyOtp
+     */
+    verifyOtp(input: VerifyOtpRequest, options?: RpcOptions): UnaryCall<VerifyOtpRequest, VerifyOtpResponse> {
+        const method = this.methods[36], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyOtpRequest, VerifyOtpResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: ResendOtp
+     */
+    resendOtp(input: ResendOtpRequest, options?: RpcOptions): UnaryCall<ResendOtpRequest, ResendOtpResponse> {
+        const method = this.methods[37], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ResendOtpRequest, ResendOtpResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Email/Phone verification ──
+
+    /**
+     * @generated from protobuf rpc: ResendEmailVerification
+     */
+    resendEmailVerification(input: ResendEmailVerificationRequest, options?: RpcOptions): UnaryCall<ResendEmailVerificationRequest, ResendEmailVerificationResponse> {
+        const method = this.methods[38], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ResendEmailVerificationRequest, ResendEmailVerificationResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: VerifyPhone
+     */
+    verifyPhone(input: VerifyPhoneRequest, options?: RpcOptions): UnaryCall<VerifyPhoneRequest, VerifyPhoneResponse> {
+        const method = this.methods[39], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyPhoneRequest, VerifyPhoneResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: ResendPhoneVerification
+     */
+    resendPhoneVerification(input: ResendPhoneVerificationRequest, options?: RpcOptions): UnaryCall<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse> {
+        const method = this.methods[40], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── IdP linking ──
+
+    /**
+     * @generated from protobuf rpc: ConfirmIdpLink
+     */
+    confirmIdpLink(input: ConfirmIdpLinkRequest, options?: RpcOptions): UnaryCall<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse> {
+        const method = this.methods[41], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Organization selector (multi-org login) ──
+
+    /**
+     * @generated from protobuf rpc: ListUserOrganizations
+     */
+    listUserOrganizations(input: ListUserOrganizationsRequest, options?: RpcOptions): UnaryCall<ListUserOrganizationsRequest, ListUserOrganizationsResponse> {
+        const method = this.methods[42], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListUserOrganizationsRequest, ListUserOrganizationsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: SelectOrganization
+     */
+    selectOrganization(input: SelectOrganizationRequest, options?: RpcOptions): UnaryCall<SelectOrganizationRequest, SelectOrganizationResponse> {
+        const method = this.methods[43], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SelectOrganizationRequest, SelectOrganizationResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Terms acceptance ──
+
+    /**
+     * @generated from protobuf rpc: GetTerms
+     */
+    getTerms(input: GetTermsRequest, options?: RpcOptions): UnaryCall<GetTermsRequest, GetTermsResponse> {
+        const method = this.methods[44], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetTermsRequest, GetTermsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: AcceptTerms
+     */
+    acceptTerms(input: AcceptTermsRequest, options?: RpcOptions): UnaryCall<AcceptTermsRequest, AcceptTermsResponse> {
+        const method = this.methods[45], opt = this._transport.mergeOptions(options);
+        return stackIntercept<AcceptTermsRequest, AcceptTermsResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── CIBA consent (EE) ──
+
+    /**
+     * @generated from protobuf rpc: ApproveCiba
+     */
+    approveCiba(input: ApproveCibaRequest, options?: RpcOptions): UnaryCall<ApproveCibaRequest, CibaConsentResponse> {
+        const method = this.methods[46], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ApproveCibaRequest, CibaConsentResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: DenyCiba
+     */
+    denyCiba(input: DenyCibaRequest, options?: RpcOptions): UnaryCall<DenyCibaRequest, CibaConsentResponse> {
+        const method = this.methods[47], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DenyCibaRequest, CibaConsentResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Captcha ──
+
+    /**
+     * @generated from protobuf rpc: VerifyCaptcha
+     */
+    verifyCaptcha(input: VerifyCaptchaRequest, options?: RpcOptions): UnaryCall<VerifyCaptchaRequest, VerifyCaptchaResponse> {
+        const method = this.methods[48], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyCaptchaRequest, VerifyCaptchaResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Dynamic prompt (EE custom auth steps) ──
+
+    /**
+     * @generated from protobuf rpc: GetDynamicPrompt
+     */
+    getDynamicPrompt(input: GetDynamicPromptRequest, options?: RpcOptions): UnaryCall<GetDynamicPromptRequest, DynamicPrompt> {
+        const method = this.methods[49], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetDynamicPromptRequest, DynamicPrompt>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: SubmitDynamicPrompt
+     */
+    submitDynamicPrompt(input: SubmitDynamicPromptRequest, options?: RpcOptions): UnaryCall<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse> {
+        const method = this.methods[50], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Step-up authentication ──
+
+    /**
+     * Generic step-up Phase 1: request challenge (WebAuthn). Skip for TOTP/recovery.
+     *
+     * @generated from protobuf rpc: RequestStepUp
+     */
+    requestStepUp(input: RequestStepUpRequest, options?: RpcOptions): UnaryCall<RequestStepUpRequest, StepUpChallenge> {
+        const method = this.methods[51], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RequestStepUpRequest, StepUpChallenge>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Generic step-up Phase 2: submit proof → elevate session → rotate token.
+     *
+     * @generated from protobuf rpc: CompleteStepUp
+     */
+    completeStepUp(input: CompleteStepUpRequest, options?: RpcOptions): UnaryCall<CompleteStepUpRequest, CompleteStepUpResponse> {
+        const method = this.methods[52], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CompleteStepUpRequest, CompleteStepUpResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── MFA credential management ──
+
+    /**
+     * Delete an MFA credential (TOTP, WebAuthn, Recovery).
+     * Requires elevated session (step-up auth) before calling.
+     *
+     * @generated from protobuf rpc: DeleteMfaCredential
+     */
+    deleteMfaCredential(input: DeleteMfaCredentialRequest, options?: RpcOptions): UnaryCall<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse> {
+        const method = this.methods[53], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse>("unary", this._transport, method, opt, input);
+    }
+    // ── Account deletion confirmation ──
+
+    /**
+     * @generated from protobuf rpc: ConfirmAccountDeletion
+     */
+    confirmAccountDeletion(input: ConfirmAccountDeletionRequest, options?: RpcOptions): UnaryCall<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse> {
+        const method = this.methods[54], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Password reset flow (magic link → new OPAQUE credential).
+     * SaaS extends this with key recovery (Shamir shards, DownloadRecoveryShard) in proto-ee.
+     *
+     * @generated from protobuf rpc: RequestPasswordReset
+     */
+    requestPasswordReset(input: RequestPasswordResetRequest, options?: RpcOptions): UnaryCall<RequestPasswordResetRequest, RequestPasswordResetResponse> {
+        const method = this.methods[55], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RequestPasswordResetRequest, RequestPasswordResetResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: VerifyPasswordReset
+     */
+    verifyPasswordReset(input: VerifyPasswordResetRequest, options?: RpcOptions): UnaryCall<VerifyPasswordResetRequest, VerifyPasswordResetResponse> {
+        const method = this.methods[56], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyPasswordResetRequest, VerifyPasswordResetResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: CompletePasswordReset
+     */
+    completePasswordReset(input: CompletePasswordResetRequest, options?: RpcOptions): UnaryCall<CompletePasswordResetRequest, CompletePasswordResetResponse> {
+        const method = this.methods[57], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CompletePasswordResetRequest, CompletePasswordResetResponse>("unary", this._transport, method, opt, input);
+    }
+}