@structured-id/ui-core 1.1.0 → 1.3.0

package/src/generated/sid/v1/authn/auth.ts

@@ -12,6 +12,9 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
 import { Timestamp } from "../../../google/protobuf/timestamp";
+import { PasswordRegistrationProof } from "./password_history";
+import { PasswordOperationId } from "../ids/ids";
+import { PasswordHistoryContext } from "./password_history";
 // ══════════════════════════════════════════════════════════════════════════
 // OPAQUE registration flow (RFC 9807, 2-step).
 // 
@@ -27,7 +30,7 @@ export interface OpaqueRegistrationStartRequest {
     /**
      * User-provided login identifier: email address, phone in E.164 format (+380...),
      * or username. Server resolves principal type from the value and looks up or creates
-     * the profile. CE/EE: resolves to Profile. SaaS: may trigger Person creation.
+     * the profile.
      *
      * @generated from protobuf field: string principal = 1
      */
@@ -40,6 +43,16 @@ export interface OpaqueRegistrationStartRequest {
      * @generated from protobuf field: bytes registration_request = 2
      */
     registrationRequest: Uint8Array;
+    /**
+     * Instance claim token (`sidclaim_...`) the operator read from the service log.
+     * Required while the installation has no administrator: it is then the only
+     * registration accepted, and the new profile becomes the first administrator
+     * (the token is consumed with the registration). Ignored once the installation
+     * is claimed. Bearer secret: never logged or echoed.
+     *
+     * @generated from protobuf field: optional string claim_token = 3
+     */
+    claimToken?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OpaqueRegistrationStartResponse
@@ -124,8 +137,7 @@ export interface OpaqueLoginStartRequest {
     /**
      * User-provided login identifier. Server looks up the OPAQUE credential
      * associated with this principal. If not found, server returns a fake
-     * response (timing-safe, anti-enumeration). CE/EE: resolves to Profile.
-     * SaaS: may resolve to Person (profile picker shown after auth).
+     * response (timing-safe, anti-enumeration). Resolves to a Profile.
      *
      * @generated from protobuf field: string principal = 1
      */
@@ -214,15 +226,22 @@ export interface OpaqueLoginFinishResponse {
     expiresIn: bigint;
 }
 // ══════════════════════════════════════════════════════════════════════════
-// OPAQUE-ZKPP registration flow (2-step with zero-knowledge password policy proof).
+// OPAQUE-ZKPP password installation: registration, change and reset share one
+// operation lifecycle (see password_history.proto):
 // 
-// Extends OPAQUE registration with a Halo2 ZK proof that the password meets
-// the server's policy (min length, character classes) WITHOUT revealing the password.
-// Uses Pallas curve (from Pasta family) for both OPAQUE and ZK circuits.
+//   prepare     registration start / change challenge / reset verification:
+//               authorizes the operation and returns its PasswordHistoryContext
+//   evaluate    PasswordHistoryEvaluatorService.EvaluatePasswordHistory
+//   OPAQUE      the OPAQUE registration request/response of the operation
+//   prove       local, on the client: policy and history over the same password
+//   finish      the final registration record with its PasswordRegistrationProof;
+//               the server verifies, checks history and commits the credential,
+//               its evidence, the accepted history entry and the audit in one step
 // 
-// Graceful degradation: if client lacks WASM capability, zkpp_proof is empty.
-// Server sets zkpp_verified=false and starts a 24h deferred verification window
-// (see SubmitDeferredZkProof RPC).
+// Registration carries its OPAQUE request in the start step, so it takes three
+// exchanges; change and reset take four. If the client cannot prove, the
+// finish carries no proof and the credential installs policy-unverified; it
+// becomes verified only through a later installation that carries its own proof.
 // 
 // Reference: Prudnikov, D. (2026). "Zero-Knowledge Proof System for Password Policy
 // Verification in Asymmetric Password-Authenticated Key Exchange."
@@ -240,37 +259,18 @@ export interface OpaqueZkppRegistrationStartRequest {
      */
     principal: string;
     /**
-     * OPAQUE RegistrationRequest on Pallas curve. Client-generated by WASM module.
+     * OPAQUE RegistrationRequest on Pallas curve, generated by the client.
      * Same semantics as basic OPAQUE but uses Pallas-based cipher suite.
      *
      * @generated from protobuf field: bytes registration_request = 2
      */
     registrationRequest: Uint8Array;
     /**
-     * Halo2 zero-knowledge proof that the password satisfies the server's policy.
-     * Client-generated by WASM module. Proves: min_length, character class counts,
-     * and password history (not reusing recent passwords) — all without revealing
-     * the password itself. Empty if WASM not available (graceful degradation).
-     *
-     * @generated from protobuf field: bytes zkpp_proof = 3
-     */
-    zkppProof: Uint8Array;
-    /**
-     * 5 public instance values for the ZK proof verifier (32 bytes each, Pallas scalar field).
-     * Encoding: [min_length, char_classes_packed, history_commitment, new_commitment, policy_version].
-     * Client-generated alongside zkpp_proof. Empty if no proof.
+     * Instance claim token; same semantics as OpaqueRegistrationStartRequest.claim_token.
      *
-     * @generated from protobuf field: repeated bytes instances = 4
+     * @generated from protobuf field: optional string claim_token = 6
      */
-    instances: Uint8Array[];
-    /**
-     * Password policy version the proof was generated against. Server compares with
-     * its current version — if mismatch, returns error (client must re-fetch policy
-     * via GetZkppPolicy and regenerate proof). Version negotiation, not derivable.
-     *
-     * @generated from protobuf field: uint32 policy_version = 5
-     */
-    policyVersion: number;
+    claimToken?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OpaqueZkppRegistrationStartResponse
@@ -283,24 +283,23 @@ export interface OpaqueZkppRegistrationStartResponse {
      */
     registrationResponse: Uint8Array;
     /**
-     * Whether the ZK proof was successfully verified. If false, server starts
-     * 24h deferred verification window. Client echoes this in Finish request
-     * so server knows whether to set credential.zkpp_verified = true/false.
+     * The history context of this registration: its operation ID, the new
+     * owner's history domain and the comparison domains to evaluate.
      *
-     * @generated from protobuf field: bool zkpp_verified = 2
+     * @generated from protobuf field: sid.v1.authn.PasswordHistoryContext history = 3
      */
-    zkppVerified: boolean;
+    history?: PasswordHistoryContext;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OpaqueZkppRegistrationFinishRequest
  */
 export interface OpaqueZkppRegistrationFinishRequest {
     /**
-     * Same principal as in Start.
+     * The registration operation (from OpaqueZkppRegistrationStartResponse.history).
      *
-     * @generated from protobuf field: string principal = 1
+     * @generated from protobuf field: sid.v1.ids.PasswordOperationId operation_id = 6
      */
-    principal: string;
+    operationId?: PasswordOperationId;
     /**
      * OPAQUE RegistrationRecord on Pallas curve (same role as basic OPAQUE record).
      *
@@ -308,27 +307,11 @@ export interface OpaqueZkppRegistrationFinishRequest {
      */
     registrationRecord: Uint8Array;
     /**
-     * Poseidon hash H(password, salt) — stored server-side for password history.
-     * Used during future password changes to prove new password differs from old.
-     * Client-computed by WASM module. 32 bytes.
+     * The registration proof; absent when the client cannot prove.
      *
-     * @generated from protobuf field: bytes history_commitment = 3
+     * @generated from protobuf field: sid.v1.authn.PasswordRegistrationProof proof = 7
      */
-    historyCommitment: Uint8Array;
-    /**
-     * Random 32-byte salt used in history_commitment. Client-generated.
-     * Stored alongside commitment for future verification.
-     *
-     * @generated from protobuf field: bytes commitment_salt = 4
-     */
-    commitmentSalt: Uint8Array;
-    /**
-     * Echoed from OpaqueZkppRegistrationStartResponse.zkpp_verified.
-     * Server validates consistency with its own record.
-     *
-     * @generated from protobuf field: bool zkpp_verified = 5
-     */
-    zkppVerified: boolean;
+    proof?: PasswordRegistrationProof;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OpaqueZkppRegistrationFinishResponse
@@ -370,52 +353,30 @@ export interface PasswordChangeChallengeRequest {
  */
 export interface PasswordChangeChallengeResponse {
     /**
-     * Server-stored Poseidon hash H(old_password, salt). Client uses this to
-     * generate ZK proof that the new password differs from the old one.
-     *
-     * @generated from protobuf field: bytes history_commitment = 1
-     */
-    historyCommitment: Uint8Array;
-    /**
-     * Server-stored salt used in history_commitment computation.
-     *
-     * @generated from protobuf field: bytes commitment_salt = 2
-     */
-    commitmentSalt: Uint8Array;
-    /**
-     * Current password policy version. Client must generate ZKPP proof
-     * against this version. If policy updated since last login, client
-     * re-fetches via GetZkppPolicy and regenerates proof.
+     * The history context of this change: its operation ID, the owner's history
+     * domain, the comparison domains the new password is checked in and the
+     * policy version the proof is made for.
      *
-     * @generated from protobuf field: uint32 policy_version = 3
+     * @generated from protobuf field: sid.v1.authn.PasswordHistoryContext history = 4
      */
-    policyVersion: number;
+    history?: PasswordHistoryContext;
 }
 /**
  * @generated from protobuf message sid.v1.authn.PasswordChangeExecuteRequest
  */
 export interface PasswordChangeExecuteRequest {
     /**
-     * Target OPAQUE credential (same as in ChallengeRequest).
-     *
-     * @generated from protobuf field: string credential_id = 1
-     */
-    credentialId: string;
-    /**
-     * Halo2 ZK proof that the new password satisfies the policy AND differs
-     * from the old password (verified against history_commitment).
-     * Client-generated by WASM module. Optional if ZKPP not available (graceful degradation).
+     * The change operation (from PasswordChangeChallengeResponse.history).
      *
-     * @generated from protobuf field: bytes zkpp_proof = 3
+     * @generated from protobuf field: sid.v1.ids.PasswordOperationId operation_id = 9
      */
-    zkppProof: Uint8Array;
+    operationId?: PasswordOperationId;
     /**
-     * 5 public instance values for the ZK proof verifier (32 bytes each, Pallas base field).
-     * Encoding: [min_length, char_classes_packed, history_commitment, new_commitment, policy_version].
+     * Target OPAQUE credential (same as in ChallengeRequest).
      *
-     * @generated from protobuf field: repeated bytes instances = 4
+     * @generated from protobuf field: string credential_id = 1
      */
-    instances: Uint8Array[];
+    credentialId: string;
     /**
      * New OPAQUE RegistrationRequest (Pallas curve). Client-side blinded password hash
      * for the new password. Generated by OpaqueClient.registrationStart(newPassword).
@@ -423,19 +384,6 @@ export interface PasswordChangeExecuteRequest {
      * @generated from protobuf field: bytes registration_request = 5
      */
     registrationRequest: Uint8Array;
-    /**
-     * Poseidon H(new_password, new_salt) — stored server-side for future password change
-     * history checks (prevents reuse of recent passwords).
-     *
-     * @generated from protobuf field: bytes new_history_commitment = 6
-     */
-    newHistoryCommitment: Uint8Array;
-    /**
-     * Random 32-byte salt for new_history_commitment. Client-generated.
-     *
-     * @generated from protobuf field: bytes new_commitment_salt = 7
-     */
-    newCommitmentSalt: Uint8Array;
 }
 /**
  * @generated from protobuf message sid.v1.authn.PasswordChangeExecuteResponse
@@ -453,6 +401,12 @@ export interface PasswordChangeExecuteResponse {
  * @generated from protobuf message sid.v1.authn.PasswordChangeFinishRequest
  */
 export interface PasswordChangeFinishRequest {
+    /**
+     * The change operation (from PasswordChangeChallengeResponse.history).
+     *
+     * @generated from protobuf field: sid.v1.ids.PasswordOperationId operation_id = 4
+     */
+    operationId?: PasswordOperationId;
     /**
      * Target OPAQUE credential (same as in Challenge/Execute).
      *
@@ -467,6 +421,13 @@ export interface PasswordChangeFinishRequest {
      * @generated from protobuf field: bytes registration_record = 3
      */
     registrationRecord: Uint8Array;
+    /**
+     * The registration proof for the new password; absent when the client
+     * cannot prove, in which case the change installs policy-unverified.
+     *
+     * @generated from protobuf field: sid.v1.authn.PasswordRegistrationProof proof = 5
+     */
+    proof?: PasswordRegistrationProof;
 }
 /**
  * @generated from protobuf message sid.v1.authn.PasswordChangeFinishResponse
@@ -476,7 +437,6 @@ export interface PasswordChangeFinishResponse {
 // WebAuthn registration flow (2-step).
 // Profile is resolved from the Bearer token (session subject) — not client-provided.
 // Self-service: user registers passkeys on their own profile.
-// Admin registration of passkeys for other users = separate admin RPC (future).
 
 /**
  * @generated from protobuf message sid.v1.authn.WebAuthnRegistrationStartRequest
@@ -559,7 +519,7 @@ export interface WebAuthnAuthenticationStartRequest {
      * User-provided login identifier for principal-first flow. When present,
      * server returns allowCredentials filtered to this user's passkeys.
      * When absent, conditional UI mode: browser shows all available credentials.
-     * CE/EE: resolves to Profile. SaaS: may resolve to Person.
+     * Resolves to a Profile.
      *
      * @generated from protobuf field: optional string principal = 1
      */
@@ -650,8 +610,9 @@ export interface WebAuthnAuthenticationFinishResponse {
  */
 export interface OAuth2AuthorizeRequest {
     /**
-     * OAuth2 client identifier. Registered via admin API (CreateApplication).
-     * Determines ServiceSector for pairwise sub computation.
+     * OAuth2 client identifier, registered by CreateApplication or Dynamic
+     * Client Registration. Names the relying party; the issuer it belongs to is
+     * fixed by its registration, never chosen by this request.
      *
      * @generated from protobuf field: string client_id = 1
      */
@@ -711,6 +672,60 @@ export interface OAuth2AuthorizeRequest {
      * @generated from protobuf field: optional string acr_values = 9
      */
     acrValues?: string;
+    /**
+     * Handle of the OIDC issuer whose authorization endpoint received the
+     * request: the `<handle>` in `https://<host>/i/<handle>/oauth2/authorize`,
+     * taken from that path by the protocol edge (or carried by the sign-in UI
+     * from the request it is completing). Required. An unknown handle, and a
+     * client registered under another issuer, are refused as an unknown client
+     * (never redirected), without falling back to another issuer.
+     *
+     * @generated from protobuf field: string issuer_handle = 10
+     */
+    issuerHandle: string;
+    /**
+     * Resource indicators (RFC 8707 §2): absolute URIs without a fragment
+     * naming the registered protected resource the access token is for. At most
+     * one distinct value; repeating the same value names the same resource.
+     * Empty selects the client's configured default resource. An unknown,
+     * inactive or not permitted resource, several distinct values, or none with
+     * no default are refused with `invalid_target`. The code is bound to the
+     * selected resource.
+     *
+     * @generated from protobuf field: repeated string resource = 11
+     */
+    resource: string[];
+    /**
+     * Space-separated OIDC `prompt` values (OpenID Connect Core §3.1.2.1):
+     * `none` (no interaction; refused with `login_required`,
+     * `account_selection_required`, `consent_required` or
+     * `interaction_required` when one is needed), `login` (fresh
+     * authentication), `consent`, `select_account`. `none` with any other
+     * value is refused with `invalid_request`; an unknown value too.
+     *
+     * @generated from protobuf field: optional string prompt = 12
+     */
+    prompt?: string;
+    /**
+     * OIDC `max_age` (OpenID Connect Core §3.1.2.1): the longest time in
+     * seconds since the user last actively authenticated that the request
+     * accepts; older authentication requires a new one. 0 behaves like
+     * `prompt=login`.
+     *
+     * @generated from protobuf field: optional uint32 max_age = 13
+     */
+    maxAge?: number;
+    /**
+     * Reference to an authorization request the server stored and continues
+     * (form of RFC 9126 §2.2), e.g. a cross-site POST resumed through a
+     * top-level GET on the issuer host. Opaque, single-issuer, short-lived;
+     * when present, every other parameter except `client_id` and
+     * `issuer_handle` comes from the stored request, and a `client_id` that
+     * differs from the stored one is refused.
+     *
+     * @generated from protobuf field: optional string request_uri = 14
+     */
+    requestUri?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OAuth2AuthorizeResponse
@@ -760,10 +775,13 @@ export interface OAuth2AuthorizeResponse {
 export interface OAuth2TokenRequest {
     /**
      * Grant type. Determines which other fields are required. RFC 6749 §4.
-     * "authorization_code": requires code, redirect_uri, client_id, code_verifier.
-     * "refresh_token": requires refresh_token, client_id.
-     * "client_credentials": requires client_id, client_secret (or client_assertion).
+     * "authorization_code": requires code, redirect_uri, code_verifier.
+     * "refresh_token": requires refresh_token.
+     * "client_credentials": a confidential client acting for itself.
      * "urn:ietf:params:oauth:grant-type:token-exchange": RFC 8693 token exchange.
+     * "urn:ietf:params:oauth:grant-type:device_code": RFC 8628 §3.4 device poll,
+     * requires device_code.
+     * Every grant names or authenticates the client (RFC 6749 §2.3).
      *
      * @generated from protobuf field: string grant_type = 1
      */
@@ -783,15 +801,18 @@ export interface OAuth2TokenRequest {
      */
     redirectUri?: string;
     /**
-     * Client identifier. Required for public clients, optional for confidential
-     * (when using client_secret or client_assertion). RFC 6749 §2.2.
+     * Client identifier (RFC 6749 §2.2). Required unless HTTP Basic in the
+     * `authorization` metadata names the client; when both are present they
+     * must be equal.
      *
      * @generated from protobuf field: optional string client_id = 4
      */
     clientId?: string;
     /**
-     * Client secret for confidential clients. Sent in body (not Basic auth).
-     * Mutually exclusive with client_assertion. RFC 6749 §2.3.1.
+     * Client secret of a confidential client registered for
+     * `client_secret_post` (RFC 6749 §2.3.1). A client registered for
+     * `client_secret_basic` sends it in the `authorization` metadata instead.
+     * At most one authentication method per request (RFC 6749 §2.3).
      *
      * @generated from protobuf field: optional string client_secret = 5
      */
@@ -854,6 +875,51 @@ export interface OAuth2TokenRequest {
      * @generated from protobuf field: optional string subject_token_type = 13
      */
     subjectTokenType?: string;
+    /**
+     * Handle of the OIDC issuer whose token endpoint received the request,
+     * bound from the path `/i/{issuer_handle}/oauth2/token`. The client, and
+     * every code or refresh token redeemed, must belong to this issuer; anything
+     * issued in another context is refused as unknown before any side effect.
+     *
+     * @generated from protobuf field: string issuer_handle = 14
+     */
+    issuerHandle: string;
+    /**
+     * Device code from StartDeviceAuthorization, for the device_code grant
+     * (RFC 8628 §3.4). Opaque; a code started under another issuer or client is
+     * refused as `invalid_grant`.
+     *
+     * @generated from protobuf field: optional string device_code = 15
+     */
+    deviceCode?: string;
+    /**
+     * Resource indicators (RFC 8707 §2), at most one distinct value. For
+     * client_credentials it selects the resource as at OAuth2Authorize (empty =
+     * the client's configured default). For a code, refresh token or device
+     * code it may only repeat the resource the grant is bound to: another
+     * resource is refused with `invalid_target`, never substituted (RFC 8707
+     * §2.2). Refresh keeps the grant's resource.
+     *
+     * @generated from protobuf field: repeated string resource = 16
+     */
+    resource: string[];
+    /**
+     * Token exchange only: logical names of the target service (RFC 8693
+     * §2.1), at most one distinct value. The name is a registered resource
+     * indicator; with `resource` present both must name the same resource,
+     * otherwise the request is refused with `invalid_target`.
+     *
+     * @generated from protobuf field: repeated string audience = 17
+     */
+    audience: string[];
+    /**
+     * Token exchange only: the type of token wanted (RFC 8693 §2.1). Absent or
+     * "urn:ietf:params:oauth:token-type:access_token"; any other type is
+     * refused with `invalid_request` (§2.2.2).
+     *
+     * @generated from protobuf field: optional string requested_token_type = 18
+     */
+    requestedTokenType?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OAuth2TokenResponse
@@ -900,17 +966,72 @@ export interface OAuth2TokenResponse {
      * @generated from protobuf field: optional string scope = 6
      */
     scope?: string;
+    /**
+     * Token exchange only: the type of the issued token (RFC 8693 §2.2.1,
+     * required there), "urn:ietf:params:oauth:token-type:access_token".
+     * Absent for every other grant.
+     *
+     * @generated from protobuf field: optional string issued_token_type = 7
+     */
+    issuedTokenType?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OAuth2IntrospectRequest
  */
 export interface OAuth2IntrospectRequest {
     /**
-     * Token to introspect (access_token or refresh_token). RFC 7662 §2.1.
+     * Token to introspect. RFC 7662 §2.1.
      *
      * @generated from protobuf field: string token = 1
      */
     token: string;
+    /**
+     * Handle of the OIDC issuer whose introspection endpoint received the
+     * request, bound from the path `/i/{issuer_handle}/oauth2/introspect`. The
+     * caller must be a service identity this issuer serves; a token issued by
+     * another issuer is reported inactive (RFC 7662 §2.2).
+     *
+     * @generated from protobuf field: string issuer_handle = 2
+     */
+    issuerHandle: string;
+    /**
+     * Identifier of the calling service (RFC 6749 §2.2): a confidential OAuth
+     * client, or a machine user, which authenticates with its own credentials
+     * as at the token endpoint (RFC 7662 §2.1): HTTP Basic in the
+     * `authorization` metadata, or this field with `client_secret`. A token is
+     * reported active only to a caller holding the `oauth.token.introspect`
+     * permission (the built-in token inspector role) on the registered
+     * protected resource the token is for; the caller need not be the token's
+     * client nor in its `aud`. To any other caller it is inactive (RFC 7662
+     * §4). When the permission cannot be decided the call fails UNAVAILABLE
+     * and discloses nothing.
+     *
+     * @generated from protobuf field: optional string client_id = 3
+     */
+    clientId?: string;
+    /**
+     * Client secret of a client registered for `client_secret_post`
+     * (RFC 6749 §2.3.1). At most one authentication method per request.
+     *
+     * @generated from protobuf field: optional string client_secret = 4
+     */
+    clientSecret?: string;
+    /**
+     * Signed JWT assertion of a client registered for `private_key_jwt`
+     * (RFC 7523 §2.2), as at the token endpoint: `iss` and `sub` the client,
+     * `aud` the issuer's token endpoint, a single-use `jti`. Signed with the
+     * client's private key, which never leaves it; carries no secret.
+     *
+     * @generated from protobuf field: optional string client_assertion = 5
+     */
+    clientAssertion?: string;
+    /**
+     * Assertion type URN, "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+     * required with `client_assertion` (RFC 7523 §2.2).
+     *
+     * @generated from protobuf field: optional string client_assertion_type = 6
+     */
+    clientAssertionType?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OAuth2IntrospectResponse
@@ -929,7 +1050,7 @@ export interface OAuth2IntrospectResponse {
      */
     scope?: string;
     /**
-     * Client that the token was issued to.
+     * Client the token was issued to (RFC 7662 §2.2, RFC 9068 §2.2).
      *
      * @generated from protobuf field: optional string client_id = 3
      */
@@ -953,8 +1074,9 @@ export interface OAuth2IntrospectResponse {
      */
     iat?: bigint;
     /**
-     * Subject identifier (polymorphic: ProfileId UUID for public, pairwise hash
-     * for pairwise clients). See CLAUDE.md Identity Terminology for sub semantics.
+     * Subject identifier exactly as the token carries it. Polymorphic: the
+     * ProfileId for an installation's own users, the opaque BindingId (UUIDv7,
+     * no prefix) for a pairwise recipient. Never parse it as a ProfileId.
      *
      * @generated from protobuf field: optional string sub = 7
      */
@@ -965,8 +1087,8 @@ export interface OAuth2IntrospectResponse {
  */
 export interface OAuth2RevokeRequest {
     /**
-     * Token to revoke (access or refresh). RFC 7009 §2.1.
-     * Server always returns success (even if token unknown — anti-enumeration).
+     * Token to revoke (access or refresh). RFC 7009 §2.1. An unknown or
+     * already invalid token is not an error (RFC 7009 §2.2).
      *
      * @generated from protobuf field: string token = 1
      */
@@ -978,6 +1100,48 @@ export interface OAuth2RevokeRequest {
      * @generated from protobuf field: optional string token_type_hint = 2
      */
     tokenTypeHint?: string;
+    /**
+     * Handle of the OIDC issuer whose revocation endpoint received the request,
+     * bound from the path `/i/{issuer_handle}/oauth2/revoke`. The caller must
+     * be a client of this issuer; a token issued by another issuer is left
+     * untouched and the answer is still success (RFC 7009 §2.2).
+     *
+     * @generated from protobuf field: string issuer_handle = 3
+     */
+    issuerHandle: string;
+    /**
+     * Identifier of the calling client (RFC 6749 §2.2). A confidential client
+     * authenticates by its registered method, as at the token endpoint: HTTP
+     * Basic in the `authorization` metadata, or this field with
+     * `client_secret`; a public client only names itself (RFC 7009 §2.1). A
+     * token issued to another client is refused with `unauthorized_client`.
+     *
+     * @generated from protobuf field: optional string client_id = 4
+     */
+    clientId?: string;
+    /**
+     * Client secret of a client registered for `client_secret_post`
+     * (RFC 6749 §2.3.1). At most one authentication method per request.
+     *
+     * @generated from protobuf field: optional string client_secret = 5
+     */
+    clientSecret?: string;
+    /**
+     * Signed JWT assertion of a client registered for `private_key_jwt`
+     * (RFC 7523 §2.2), as at the token endpoint: `iss` and `sub` the client,
+     * `aud` the issuer's token endpoint, a single-use `jti`. Signed with the
+     * client's private key, which never leaves it; carries no secret.
+     *
+     * @generated from protobuf field: optional string client_assertion = 6
+     */
+    clientAssertion?: string;
+    /**
+     * Assertion type URN, "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+     * required with `client_assertion` (RFC 7523 §2.2).
+     *
+     * @generated from protobuf field: optional string client_assertion_type = 7
+     */
+    clientAssertionType?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.OAuth2RevokeResponse
@@ -1041,17 +1205,60 @@ export interface ValidateSessionResponse {
  */
 export interface DeviceAuthorizationRequest {
     /**
-     * OAuth2 client identifier of the device application. RFC 8628 §3.1.
+     * OAuth2 client identifier of the device application (RFC 8628 §3.1).
+     * Required unless HTTP Basic in the `authorization` metadata names the
+     * client.
      *
-     * @generated from protobuf field: string client_id = 1
+     * @generated from protobuf field: optional string client_id = 1
      */
-    clientId: string;
+    clientId?: string;
     /**
      * Requested scopes (space-separated). RFC 8628 §3.1.
      *
      * @generated from protobuf field: optional string scope = 2
      */
     scope?: string;
+    /**
+     * Handle of the OIDC issuer whose device authorization endpoint received
+     * the request, bound from the path `/i/{issuer_handle}/oauth2/device`. The
+     * client must belong to this issuer; the device transaction stays bound to
+     * it.
+     *
+     * @generated from protobuf field: string issuer_handle = 3
+     */
+    issuerHandle: string;
+    /**
+     * Client secret of a confidential client registered for
+     * `client_secret_post`, which authenticates here as at the token endpoint
+     * (RFC 8628 §3.1, RFC 6749 §2.3.1).
+     *
+     * @generated from protobuf field: optional string client_secret = 4
+     */
+    clientSecret?: string;
+    /**
+     * Resource indicators (RFC 8707 §2), selected as at OAuth2Authorize. The
+     * device transaction is bound to the selected resource; the device code
+     * grant cannot change it.
+     *
+     * @generated from protobuf field: repeated string resource = 5
+     */
+    resource: string[];
+    /**
+     * Signed JWT assertion of a client registered for `private_key_jwt`
+     * (RFC 7523 §2.2), which authenticates here as at the token endpoint
+     * (RFC 8628 §3.1): `iss` and `sub` the client, `aud` the issuer's token
+     * endpoint, a single-use `jti`. Carries no secret.
+     *
+     * @generated from protobuf field: optional string client_assertion = 6
+     */
+    clientAssertion?: string;
+    /**
+     * Assertion type URN, "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+     * required with `client_assertion` (RFC 7523 §2.2).
+     *
+     * @generated from protobuf field: optional string client_assertion_type = 7
+     */
+    clientAssertionType?: string;
 }
 /**
  * @generated from protobuf message sid.v1.authn.DeviceAuthorizationResponse
@@ -1098,23 +1305,6 @@ export interface DeviceAuthorizationResponse {
      */
     interval: number;
 }
-/**
- * @generated from protobuf message sid.v1.authn.PollDeviceTokenRequest
- */
-export interface PollDeviceTokenRequest {
-    /**
-     * OAuth2 client identifier (same as in DeviceAuthorizationRequest).
-     *
-     * @generated from protobuf field: string client_id = 1
-     */
-    clientId: string;
-    /**
-     * Device code from DeviceAuthorizationResponse. RFC 8628 §3.4.
-     *
-     * @generated from protobuf field: string device_code = 2
-     */
-    deviceCode: string;
-}
 /**
  * @generated from protobuf message sid.v1.authn.SubmitDeviceUserCodeRequest
  */
@@ -1258,7 +1448,8 @@ export interface VerifyMagicLinkResponse {
  */
 export interface ResolvePrincipalRequest {
     /**
-     * User-provided login identifier (email, phone, or username).
+     * User-provided login identifier (email, phone, or username). Only its
+     * type is read; the server looks up no account.
      *
      * @generated from protobuf field: string principal = 1
      */
@@ -1269,19 +1460,18 @@ export interface ResolvePrincipalRequest {
  */
 export interface ResolvePrincipalResponse {
     /**
-     * Auth methods available for this principal: "opaque", "webauthn", "magic_link".
-     * For non-existent principals, returns plausible defaults (anti-enumeration).
+     * Sign-in methods this installation offers for an identifier of this type,
+     * the same for every identifier of the type whether or not an account
+     * holds it (WebAuthn Level 3 §14.6.2): "opaque" when password sign-in is
+     * enabled, "webauthn" when passkeys are enabled (the discoverable flow,
+     * started without credential IDs), "magic_link" when magic links are
+     * enabled and the identifier is an email address or phone number. Whether
+     * the account can use a method is decided at that method's step, which
+     * refuses an unknown account exactly as a wrong secret.
      *
      * @generated from protobuf field: repeated string available_methods = 1
      */
     availableMethods: string[];
-    /**
-     * Server-suggested method based on user's last successful login.
-     * UI may highlight this as the default option.
-     *
-     * @generated from protobuf field: optional string suggested_method = 2
-     */
-    suggestedMethod?: string;
 }
 // ══════════════════════════════════════════════════════════════════════════
 // Legacy password migration (transparent on-login OPAQUE re-registration).
@@ -1454,13 +1644,13 @@ export interface SubmitDeferredZkProofRequest {
      */
     credentialId: string;
     /**
-     * Halo2 ZK proof (same format as OpaqueZkppRegistrationStartRequest.zkpp_proof).
+     * Halo2 password-policy proof over the credential's OPAQUE blinded element.
      *
      * @generated from protobuf field: bytes zkpp_proof = 2
      */
     zkppProof: Uint8Array;
     /**
-     * Public instances (same format as OpaqueZkppRegistrationStartRequest.instances).
+     * Public instances of the proof, each a serialized circuit field element.
      *
      * @generated from protobuf field: repeated bytes instances = 3
      */
@@ -1490,7 +1680,7 @@ export interface SubmitDeferredZkProofResponse {
 // Enrollment: server generates secret → client displays QR → user scans with
 // authenticator app → client submits verification code → server confirms.
 // Verification: during MFA challenge, user enters 6-digit code from app.
-// ══════════════════════════════════════════════════════════════��═══════════
+// ══════════════════════════════════════════════════════════════════════════
 
 /**
  * Empty request — profile resolved from Bearer token.
@@ -1742,6 +1932,27 @@ export interface VerifyOtpResponse {
      * @generated from protobuf field: optional string redirect_to = 2
      */
     redirectTo?: string;
+    /**
+     * Provisional session the verified code opened (set only when verified).
+     * Mailbox possession grants provisional scopes only: it cannot add or
+     * change a credential of an existing account.
+     *
+     * @generated from protobuf field: optional string session_id = 3
+     */
+    sessionId?: string;
+    /**
+     * Access token of that provisional session (same semantics as
+     * OpaqueLoginFinishResponse.access_token, restricted scopes).
+     *
+     * @generated from protobuf field: optional string access_token = 4
+     */
+    accessToken?: string;
+    /**
+     * Access token lifetime in seconds.
+     *
+     * @generated from protobuf field: optional int64 expires_in = 5
+     */
+    expiresIn?: bigint;
 }
 /**
  * @generated from protobuf message sid.v1.authn.ResendOtpRequest
@@ -1975,7 +2186,7 @@ export interface AcceptTermsResponse {
     redirectTo?: string;
 }
 // ══════════════════════════════════════════════════════════════════════════
-// CIBA consent (EE)
+// CIBA consent
 // ══════════════════════════════════════════════════════════════════════════
 
 /**
@@ -2039,15 +2250,17 @@ export interface VerifyCaptchaResponse {
      */
     redirectTo?: string;
     /**
-     * Short-lived HMAC token. Include as `captcha_token` metadata on login retry
-     * to bypass RequireCaptcha for 60 seconds.
+     * Single-use pass for the sign-in the challenge was asked of: the same
+     * profile from the same client address, within 60 seconds. Sent back as
+     * `captcha-pass` metadata on the retry; it answers the CAPTCHA requirement
+     * only, never a lockout or a block.
      *
      * @generated from protobuf field: string bypass_token = 3
      */
     bypassToken: string;
 }
 // ══════════════════════════════════════════════════════════════════════════
-// Dynamic prompt (EE custom auth steps)
+// Dynamic prompt (custom auth steps)
 // ══════════════════════════════════════════════════════════════════════════
 
 /**
@@ -2157,7 +2370,7 @@ export interface SubmitDynamicPromptResponse {
     redirectTo?: string;
 }
 /**
- * Phase 1: Request challenge (WebAuthn, future: Push). Skipped for TOTP/recovery.
+ * Phase 1: Request challenge (WebAuthn). Skipped for TOTP/recovery.
  *
  * @generated from protobuf message sid.v1.authn.RequestStepUpRequest
  */
@@ -2198,7 +2411,7 @@ export interface StepUpChallenge {
         oneofKind: undefined;
     };
     /**
-     * Available step-up methods at current session decay level (#666).
+     * Available step-up methods at current session decay level.
      * Populated by RequestStepUp based on enrolled methods + decay filtering.
      * Frontend uses this to show only valid method buttons.
      *
@@ -2329,8 +2542,7 @@ export interface ConfirmAccountDeletionResponse {
     redirectTo?: string;
 }
 // ══════════════════════════════════════════════════════════════════════════
-// Password reset (CE: simple credential replacement)
-// SaaS extends with: recovery shard RPCs, key recovery — in proto-ee.
+// Password reset (credential replacement)
 // ══════════════════════════════════════════════════════════════════════════
 
 /**
@@ -2388,40 +2600,74 @@ export interface VerifyPasswordResetResponse {
      * @generated from protobuf field: int32 expires_in = 2
      */
     expiresIn: number; // Reset session TTL (seconds)
+    /**
+     * The history context of the replacement password: its operation ID, the
+     * owner's history domain and the comparison domains it is checked in. The
+     * reset needs no old password: the retained history is the owner's, not the client's.
+     *
+     * @generated from protobuf field: sid.v1.authn.PasswordHistoryContext history = 3
+     */
+    history?: PasswordHistoryContext;
 }
 /**
- * @generated from protobuf message sid.v1.authn.CompletePasswordResetRequest
+ * @generated from protobuf message sid.v1.authn.ExecutePasswordResetRequest
  */
-export interface CompletePasswordResetRequest {
+export interface ExecutePasswordResetRequest {
     /**
-     * @generated from protobuf field: string reset_session_id = 1
+     * The reset operation (from VerifyPasswordResetResponse.history). Carries
+     * the verified reset session's authority; no bearer token is involved.
+     *
+     * @generated from protobuf field: sid.v1.ids.PasswordOperationId operation_id = 1
      */
-    resetSessionId: string;
+    operationId?: PasswordOperationId;
     /**
-     * New OPAQUE credential (client calls OpaqueRegistrationStart separately first,
-     * then computes registration_record from the server's RegistrationResponse).
+     * OPAQUE RegistrationRequest (Pallas curve) for the replacement password.
+     * Generated by the client, as in registration.
      *
-     * @generated from protobuf field: bytes registration_record = 2
+     * @generated from protobuf field: bytes registration_request = 2
      */
-    registrationRecord: Uint8Array;
+    registrationRequest: Uint8Array;
+}
+/**
+ * @generated from protobuf message sid.v1.authn.ExecutePasswordResetResponse
+ */
+export interface ExecutePasswordResetResponse {
     /**
-     * ZK policy proof (optional, deferred if no WASM)
+     * Server's OPAQUE RegistrationResponse for the replacement password. The
+     * client computes the final RegistrationRecord from it for CompletePasswordReset.
      *
-     * @generated from protobuf field: bytes zkpp_proof = 3
+     * @generated from protobuf field: bytes registration_response = 1
      */
-    zkppProof: Uint8Array;
+    registrationResponse: Uint8Array;
+}
+/**
+ * @generated from protobuf message sid.v1.authn.CompletePasswordResetRequest
+ */
+export interface CompletePasswordResetRequest {
     /**
-     * @generated from protobuf field: repeated bytes zkpp_instances = 4
+     * @generated from protobuf field: string reset_session_id = 1
      */
-    zkppInstances: Uint8Array[];
+    resetSessionId: string;
     /**
-     * @generated from protobuf field: bytes history_commitment = 5
+     * The reset operation (from VerifyPasswordResetResponse.history).
+     *
+     * @generated from protobuf field: sid.v1.ids.PasswordOperationId operation_id = 7
      */
-    historyCommitment: Uint8Array;
+    operationId?: PasswordOperationId;
     /**
-     * @generated from protobuf field: bytes commitment_salt = 6
+     * Final OPAQUE RegistrationRecord of the replacement password, computed from
+     * ExecutePasswordResetResponse.registration_response.
+     *
+     * @generated from protobuf field: bytes registration_record = 2
      */
-    commitmentSalt: Uint8Array; // SaaS extends with: wrapped_data_key, encrypted_shard_a/b/c (in proto-ee)
+    registrationRecord: Uint8Array;
+    /**
+     * The registration proof for the replacement password; absent when the
+     * client cannot prove, in which case it installs policy-unverified.
+     *
+     * @generated from protobuf field: sid.v1.authn.PasswordRegistrationProof proof = 8
+     */
+    proof?: PasswordRegistrationProof;
 }
 /**
  * @generated from protobuf message sid.v1.authn.CompletePasswordResetResponse
@@ -2441,7 +2687,7 @@ export interface CompletePasswordResetResponse {
     expiresIn: number;
 }
 /**
- * Field type for EE dynamic prompt fields.
+ * Field type of a dynamic prompt field.
  *
  * @generated from protobuf enum sid.v1.authn.DynamicPromptFieldType
  */
@@ -2488,7 +2734,7 @@ export enum DynamicPromptFieldType {
     INFO = 6
 }
 // ══════════════════════════════════════════════════════════════════════════
-// Step-up authentication (D006: Pattern D — 2-phase)
+// Step-up authentication
 // 
 // 1-phase methods (TOTP, Recovery): call CompleteStepUp directly.
 // 2-phase methods (WebAuthn): RequestStepUp → challenge → CompleteStepUp.
@@ -2528,7 +2774,8 @@ class OpaqueRegistrationStartRequest$Type extends MessageType<OpaqueRegistration
     constructor() {
         super("sid.v1.authn.OpaqueRegistrationStartRequest", [
             { no: 1, name: "principal", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "registration_request", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+            { no: 2, name: "registration_request", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
+            { no: 3, name: "claim_token", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OpaqueRegistrationStartRequest>): OpaqueRegistrationStartRequest {
@@ -2550,6 +2797,9 @@ class OpaqueRegistrationStartRequest$Type extends MessageType<OpaqueRegistration
                 case /* bytes registration_request */ 2:
                     message.registrationRequest = reader.bytes();
                     break;
+                case /* optional string claim_token */ 3:
+                    message.claimToken = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2568,6 +2818,9 @@ class OpaqueRegistrationStartRequest$Type extends MessageType<OpaqueRegistration
         /* bytes registration_request = 2; */
         if (message.registrationRequest.length)
             writer.tag(2, WireType.LengthDelimited).bytes(message.registrationRequest);
+        /* optional string claim_token = 3; */
+        if (message.claimToken !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.claimToken);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2993,18 +3246,13 @@ class OpaqueZkppRegistrationStartRequest$Type extends MessageType<OpaqueZkppRegi
         super("sid.v1.authn.OpaqueZkppRegistrationStartRequest", [
             { no: 1, name: "principal", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "registration_request", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "zkpp_proof", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "instances", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 12 /*ScalarType.BYTES*/ },
-            { no: 5, name: "policy_version", kind: "scalar", T: 13 /*ScalarType.UINT32*/ }
+            { no: 6, name: "claim_token", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OpaqueZkppRegistrationStartRequest>): OpaqueZkppRegistrationStartRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.principal = "";
         message.registrationRequest = new Uint8Array(0);
-        message.zkppProof = new Uint8Array(0);
-        message.instances = [];
-        message.policyVersion = 0;
         if (value !== undefined)
             reflectionMergePartial<OpaqueZkppRegistrationStartRequest>(this, message, value);
         return message;
@@ -3020,14 +3268,8 @@ class OpaqueZkppRegistrationStartRequest$Type extends MessageType<OpaqueZkppRegi
                 case /* bytes registration_request */ 2:
                     message.registrationRequest = reader.bytes();
                     break;
-                case /* bytes zkpp_proof */ 3:
-                    message.zkppProof = reader.bytes();
-                    break;
-                case /* repeated bytes instances */ 4:
-                    message.instances.push(reader.bytes());
-                    break;
-                case /* uint32 policy_version */ 5:
-                    message.policyVersion = reader.uint32();
+                case /* optional string claim_token */ 6:
+                    message.claimToken = reader.string();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -3047,15 +3289,9 @@ class OpaqueZkppRegistrationStartRequest$Type extends MessageType<OpaqueZkppRegi
         /* bytes registration_request = 2; */
         if (message.registrationRequest.length)
             writer.tag(2, WireType.LengthDelimited).bytes(message.registrationRequest);
-        /* bytes zkpp_proof = 3; */
-        if (message.zkppProof.length)
-            writer.tag(3, WireType.LengthDelimited).bytes(message.zkppProof);
-        /* repeated bytes instances = 4; */
-        for (let i = 0; i < message.instances.length; i++)
-            writer.tag(4, WireType.LengthDelimited).bytes(message.instances[i]);
-        /* uint32 policy_version = 5; */
-        if (message.policyVersion !== 0)
-            writer.tag(5, WireType.Varint).uint32(message.policyVersion);
+        /* optional string claim_token = 6; */
+        if (message.claimToken !== undefined)
+            writer.tag(6, WireType.LengthDelimited).string(message.claimToken);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -3071,13 +3307,12 @@ class OpaqueZkppRegistrationStartResponse$Type extends MessageType<OpaqueZkppReg
     constructor() {
         super("sid.v1.authn.OpaqueZkppRegistrationStartResponse", [
             { no: 1, name: "registration_response", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "zkpp_verified", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+            { no: 3, name: "history", kind: "message", T: () => PasswordHistoryContext }
         ]);
     }
     create(value?: PartialMessage<OpaqueZkppRegistrationStartResponse>): OpaqueZkppRegistrationStartResponse {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.registrationResponse = new Uint8Array(0);
-        message.zkppVerified = false;
         if (value !== undefined)
             reflectionMergePartial<OpaqueZkppRegistrationStartResponse>(this, message, value);
         return message;
@@ -3090,8 +3325,8 @@ class OpaqueZkppRegistrationStartResponse$Type extends MessageType<OpaqueZkppReg
                 case /* bytes registration_response */ 1:
                     message.registrationResponse = reader.bytes();
                     break;
-                case /* bool zkpp_verified */ 2:
-                    message.zkppVerified = reader.bool();
+                case /* sid.v1.authn.PasswordHistoryContext history */ 3:
+                    message.history = PasswordHistoryContext.internalBinaryRead(reader, reader.uint32(), options, message.history);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -3108,9 +3343,9 @@ class OpaqueZkppRegistrationStartResponse$Type extends MessageType<OpaqueZkppReg
         /* bytes registration_response = 1; */
         if (message.registrationResponse.length)
             writer.tag(1, WireType.LengthDelimited).bytes(message.registrationResponse);
-        /* bool zkpp_verified = 2; */
-        if (message.zkppVerified !== false)
-            writer.tag(2, WireType.Varint).bool(message.zkppVerified);
+        /* sid.v1.authn.PasswordHistoryContext history = 3; */
+        if (message.history)
+            PasswordHistoryContext.internalBinaryWrite(message.history, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -3125,20 +3360,14 @@ export const OpaqueZkppRegistrationStartResponse = new OpaqueZkppRegistrationSta
 class OpaqueZkppRegistrationFinishRequest$Type extends MessageType<OpaqueZkppRegistrationFinishRequest> {
     constructor() {
         super("sid.v1.authn.OpaqueZkppRegistrationFinishRequest", [
-            { no: 1, name: "principal", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "operation_id", kind: "message", T: () => PasswordOperationId },
             { no: 2, name: "registration_record", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "history_commitment", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "commitment_salt", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 5, name: "zkpp_verified", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+            { no: 7, name: "proof", kind: "message", T: () => PasswordRegistrationProof }
         ]);
     }
     create(value?: PartialMessage<OpaqueZkppRegistrationFinishRequest>): OpaqueZkppRegistrationFinishRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.principal = "";
         message.registrationRecord = new Uint8Array(0);
-        message.historyCommitment = new Uint8Array(0);
-        message.commitmentSalt = new Uint8Array(0);
-        message.zkppVerified = false;
         if (value !== undefined)
             reflectionMergePartial<OpaqueZkppRegistrationFinishRequest>(this, message, value);
         return message;
@@ -3148,20 +3377,14 @@ class OpaqueZkppRegistrationFinishRequest$Type extends MessageType<OpaqueZkppReg
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string principal */ 1:
-                    message.principal = reader.string();
+                case /* sid.v1.ids.PasswordOperationId operation_id */ 6:
+                    message.operationId = PasswordOperationId.internalBinaryRead(reader, reader.uint32(), options, message.operationId);
                     break;
                 case /* bytes registration_record */ 2:
                     message.registrationRecord = reader.bytes();
                     break;
-                case /* bytes history_commitment */ 3:
-                    message.historyCommitment = reader.bytes();
-                    break;
-                case /* bytes commitment_salt */ 4:
-                    message.commitmentSalt = reader.bytes();
-                    break;
-                case /* bool zkpp_verified */ 5:
-                    message.zkppVerified = reader.bool();
+                case /* sid.v1.authn.PasswordRegistrationProof proof */ 7:
+                    message.proof = PasswordRegistrationProof.internalBinaryRead(reader, reader.uint32(), options, message.proof);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -3175,21 +3398,15 @@ class OpaqueZkppRegistrationFinishRequest$Type extends MessageType<OpaqueZkppReg
         return message;
     }
     internalBinaryWrite(message: OpaqueZkppRegistrationFinishRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string principal = 1; */
-        if (message.principal !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.principal);
         /* bytes registration_record = 2; */
         if (message.registrationRecord.length)
             writer.tag(2, WireType.LengthDelimited).bytes(message.registrationRecord);
-        /* bytes history_commitment = 3; */
-        if (message.historyCommitment.length)
-            writer.tag(3, WireType.LengthDelimited).bytes(message.historyCommitment);
-        /* bytes commitment_salt = 4; */
-        if (message.commitmentSalt.length)
-            writer.tag(4, WireType.LengthDelimited).bytes(message.commitmentSalt);
-        /* bool zkpp_verified = 5; */
-        if (message.zkppVerified !== false)
-            writer.tag(5, WireType.Varint).bool(message.zkppVerified);
+        /* sid.v1.ids.PasswordOperationId operation_id = 6; */
+        if (message.operationId)
+            PasswordOperationId.internalBinaryWrite(message.operationId, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.authn.PasswordRegistrationProof proof = 7; */
+        if (message.proof)
+            PasswordRegistrationProof.internalBinaryWrite(message.proof, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -3306,16 +3523,11 @@ export const PasswordChangeChallengeRequest = new PasswordChangeChallengeRequest
 class PasswordChangeChallengeResponse$Type extends MessageType<PasswordChangeChallengeResponse> {
     constructor() {
         super("sid.v1.authn.PasswordChangeChallengeResponse", [
-            { no: 1, name: "history_commitment", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "commitment_salt", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "policy_version", kind: "scalar", T: 13 /*ScalarType.UINT32*/ }
+            { no: 4, name: "history", kind: "message", T: () => PasswordHistoryContext }
         ]);
     }
     create(value?: PartialMessage<PasswordChangeChallengeResponse>): PasswordChangeChallengeResponse {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.historyCommitment = new Uint8Array(0);
-        message.commitmentSalt = new Uint8Array(0);
-        message.policyVersion = 0;
         if (value !== undefined)
             reflectionMergePartial<PasswordChangeChallengeResponse>(this, message, value);
         return message;
@@ -3325,14 +3537,8 @@ class PasswordChangeChallengeResponse$Type extends MessageType<PasswordChangeCha
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* bytes history_commitment */ 1:
-                    message.historyCommitment = reader.bytes();
-                    break;
-                case /* bytes commitment_salt */ 2:
-                    message.commitmentSalt = reader.bytes();
-                    break;
-                case /* uint32 policy_version */ 3:
-                    message.policyVersion = reader.uint32();
+                case /* sid.v1.authn.PasswordHistoryContext history */ 4:
+                    message.history = PasswordHistoryContext.internalBinaryRead(reader, reader.uint32(), options, message.history);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -3346,15 +3552,9 @@ class PasswordChangeChallengeResponse$Type extends MessageType<PasswordChangeCha
         return message;
     }
     internalBinaryWrite(message: PasswordChangeChallengeResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes history_commitment = 1; */
-        if (message.historyCommitment.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.historyCommitment);
-        /* bytes commitment_salt = 2; */
-        if (message.commitmentSalt.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.commitmentSalt);
-        /* uint32 policy_version = 3; */
-        if (message.policyVersion !== 0)
-            writer.tag(3, WireType.Varint).uint32(message.policyVersion);
+        /* sid.v1.authn.PasswordHistoryContext history = 4; */
+        if (message.history)
+            PasswordHistoryContext.internalBinaryWrite(message.history, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -3369,22 +3569,15 @@ export const PasswordChangeChallengeResponse = new PasswordChangeChallengeRespon
 class PasswordChangeExecuteRequest$Type extends MessageType<PasswordChangeExecuteRequest> {
     constructor() {
         super("sid.v1.authn.PasswordChangeExecuteRequest", [
+            { no: 9, name: "operation_id", kind: "message", T: () => PasswordOperationId },
             { no: 1, name: "credential_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "zkpp_proof", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "instances", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 12 /*ScalarType.BYTES*/ },
-            { no: 5, name: "registration_request", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 6, name: "new_history_commitment", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 7, name: "new_commitment_salt", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+            { no: 5, name: "registration_request", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
         ]);
     }
     create(value?: PartialMessage<PasswordChangeExecuteRequest>): PasswordChangeExecuteRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.credentialId = "";
-        message.zkppProof = new Uint8Array(0);
-        message.instances = [];
         message.registrationRequest = new Uint8Array(0);
-        message.newHistoryCommitment = new Uint8Array(0);
-        message.newCommitmentSalt = new Uint8Array(0);
         if (value !== undefined)
             reflectionMergePartial<PasswordChangeExecuteRequest>(this, message, value);
         return message;
@@ -3394,24 +3587,15 @@ class PasswordChangeExecuteRequest$Type extends MessageType<PasswordChangeExecut
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
+                case /* sid.v1.ids.PasswordOperationId operation_id */ 9:
+                    message.operationId = PasswordOperationId.internalBinaryRead(reader, reader.uint32(), options, message.operationId);
+                    break;
                 case /* string credential_id */ 1:
                     message.credentialId = reader.string();
                     break;
-                case /* bytes zkpp_proof */ 3:
-                    message.zkppProof = reader.bytes();
-                    break;
-                case /* repeated bytes instances */ 4:
-                    message.instances.push(reader.bytes());
-                    break;
                 case /* bytes registration_request */ 5:
                     message.registrationRequest = reader.bytes();
                     break;
-                case /* bytes new_history_commitment */ 6:
-                    message.newHistoryCommitment = reader.bytes();
-                    break;
-                case /* bytes new_commitment_salt */ 7:
-                    message.newCommitmentSalt = reader.bytes();
-                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -3427,21 +3611,12 @@ class PasswordChangeExecuteRequest$Type extends MessageType<PasswordChangeExecut
         /* string credential_id = 1; */
         if (message.credentialId !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.credentialId);
-        /* bytes zkpp_proof = 3; */
-        if (message.zkppProof.length)
-            writer.tag(3, WireType.LengthDelimited).bytes(message.zkppProof);
-        /* repeated bytes instances = 4; */
-        for (let i = 0; i < message.instances.length; i++)
-            writer.tag(4, WireType.LengthDelimited).bytes(message.instances[i]);
         /* bytes registration_request = 5; */
         if (message.registrationRequest.length)
             writer.tag(5, WireType.LengthDelimited).bytes(message.registrationRequest);
-        /* bytes new_history_commitment = 6; */
-        if (message.newHistoryCommitment.length)
-            writer.tag(6, WireType.LengthDelimited).bytes(message.newHistoryCommitment);
-        /* bytes new_commitment_salt = 7; */
-        if (message.newCommitmentSalt.length)
-            writer.tag(7, WireType.LengthDelimited).bytes(message.newCommitmentSalt);
+        /* sid.v1.ids.PasswordOperationId operation_id = 9; */
+        if (message.operationId)
+            PasswordOperationId.internalBinaryWrite(message.operationId, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -3503,8 +3678,10 @@ export const PasswordChangeExecuteResponse = new PasswordChangeExecuteResponse$T
 class PasswordChangeFinishRequest$Type extends MessageType<PasswordChangeFinishRequest> {
     constructor() {
         super("sid.v1.authn.PasswordChangeFinishRequest", [
+            { no: 4, name: "operation_id", kind: "message", T: () => PasswordOperationId },
             { no: 1, name: "credential_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "registration_record", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+            { no: 3, name: "registration_record", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
+            { no: 5, name: "proof", kind: "message", T: () => PasswordRegistrationProof }
         ]);
     }
     create(value?: PartialMessage<PasswordChangeFinishRequest>): PasswordChangeFinishRequest {
@@ -3520,12 +3697,18 @@ class PasswordChangeFinishRequest$Type extends MessageType<PasswordChangeFinishR
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
+                case /* sid.v1.ids.PasswordOperationId operation_id */ 4:
+                    message.operationId = PasswordOperationId.internalBinaryRead(reader, reader.uint32(), options, message.operationId);
+                    break;
                 case /* string credential_id */ 1:
                     message.credentialId = reader.string();
                     break;
                 case /* bytes registration_record */ 3:
                     message.registrationRecord = reader.bytes();
                     break;
+                case /* sid.v1.authn.PasswordRegistrationProof proof */ 5:
+                    message.proof = PasswordRegistrationProof.internalBinaryRead(reader, reader.uint32(), options, message.proof);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -3544,6 +3727,12 @@ class PasswordChangeFinishRequest$Type extends MessageType<PasswordChangeFinishR
         /* bytes registration_record = 3; */
         if (message.registrationRecord.length)
             writer.tag(3, WireType.LengthDelimited).bytes(message.registrationRecord);
+        /* sid.v1.ids.PasswordOperationId operation_id = 4; */
+        if (message.operationId)
+            PasswordOperationId.internalBinaryWrite(message.operationId, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.authn.PasswordRegistrationProof proof = 5; */
+        if (message.proof)
+            PasswordRegistrationProof.internalBinaryWrite(message.proof, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4039,7 +4228,12 @@ class OAuth2AuthorizeRequest$Type extends MessageType<OAuth2AuthorizeRequest> {
             { no: 6, name: "code_challenge", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 7, name: "code_challenge_method", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 8, name: "nonce", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "acr_values", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 9, name: "acr_values", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 10, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "resource", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 12, name: "prompt", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 13, name: "max_age", kind: "scalar", opt: true, T: 13 /*ScalarType.UINT32*/ },
+            { no: 14, name: "request_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OAuth2AuthorizeRequest>): OAuth2AuthorizeRequest {
@@ -4047,6 +4241,8 @@ class OAuth2AuthorizeRequest$Type extends MessageType<OAuth2AuthorizeRequest> {
         message.clientId = "";
         message.redirectUri = "";
         message.responseType = "";
+        message.issuerHandle = "";
+        message.resource = [];
         if (value !== undefined)
             reflectionMergePartial<OAuth2AuthorizeRequest>(this, message, value);
         return message;
@@ -4083,6 +4279,21 @@ class OAuth2AuthorizeRequest$Type extends MessageType<OAuth2AuthorizeRequest> {
                 case /* optional string acr_values */ 9:
                     message.acrValues = reader.string();
                     break;
+                case /* string issuer_handle */ 10:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* repeated string resource */ 11:
+                    message.resource.push(reader.string());
+                    break;
+                case /* optional string prompt */ 12:
+                    message.prompt = reader.string();
+                    break;
+                case /* optional uint32 max_age */ 13:
+                    message.maxAge = reader.uint32();
+                    break;
+                case /* optional string request_uri */ 14:
+                    message.requestUri = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4122,6 +4333,21 @@ class OAuth2AuthorizeRequest$Type extends MessageType<OAuth2AuthorizeRequest> {
         /* optional string acr_values = 9; */
         if (message.acrValues !== undefined)
             writer.tag(9, WireType.LengthDelimited).string(message.acrValues);
+        /* string issuer_handle = 10; */
+        if (message.issuerHandle !== "")
+            writer.tag(10, WireType.LengthDelimited).string(message.issuerHandle);
+        /* repeated string resource = 11; */
+        for (let i = 0; i < message.resource.length; i++)
+            writer.tag(11, WireType.LengthDelimited).string(message.resource[i]);
+        /* optional string prompt = 12; */
+        if (message.prompt !== undefined)
+            writer.tag(12, WireType.LengthDelimited).string(message.prompt);
+        /* optional uint32 max_age = 13; */
+        if (message.maxAge !== undefined)
+            writer.tag(13, WireType.Varint).uint32(message.maxAge);
+        /* optional string request_uri = 14; */
+        if (message.requestUri !== undefined)
+            writer.tag(14, WireType.LengthDelimited).string(message.requestUri);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4225,12 +4451,20 @@ class OAuth2TokenRequest$Type extends MessageType<OAuth2TokenRequest> {
             { no: 10, name: "client_assertion", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 11, name: "client_assertion_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 12, name: "subject_token", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 13, name: "subject_token_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 13, name: "subject_token_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 14, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 15, name: "device_code", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 16, name: "resource", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 17, name: "audience", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 18, name: "requested_token_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OAuth2TokenRequest>): OAuth2TokenRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.grantType = "";
+        message.issuerHandle = "";
+        message.resource = [];
+        message.audience = [];
         if (value !== undefined)
             reflectionMergePartial<OAuth2TokenRequest>(this, message, value);
         return message;
@@ -4279,6 +4513,21 @@ class OAuth2TokenRequest$Type extends MessageType<OAuth2TokenRequest> {
                 case /* optional string subject_token_type */ 13:
                     message.subjectTokenType = reader.string();
                     break;
+                case /* string issuer_handle */ 14:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string device_code */ 15:
+                    message.deviceCode = reader.string();
+                    break;
+                case /* repeated string resource */ 16:
+                    message.resource.push(reader.string());
+                    break;
+                case /* repeated string audience */ 17:
+                    message.audience.push(reader.string());
+                    break;
+                case /* optional string requested_token_type */ 18:
+                    message.requestedTokenType = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4330,6 +4579,21 @@ class OAuth2TokenRequest$Type extends MessageType<OAuth2TokenRequest> {
         /* optional string subject_token_type = 13; */
         if (message.subjectTokenType !== undefined)
             writer.tag(13, WireType.LengthDelimited).string(message.subjectTokenType);
+        /* string issuer_handle = 14; */
+        if (message.issuerHandle !== "")
+            writer.tag(14, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string device_code = 15; */
+        if (message.deviceCode !== undefined)
+            writer.tag(15, WireType.LengthDelimited).string(message.deviceCode);
+        /* repeated string resource = 16; */
+        for (let i = 0; i < message.resource.length; i++)
+            writer.tag(16, WireType.LengthDelimited).string(message.resource[i]);
+        /* repeated string audience = 17; */
+        for (let i = 0; i < message.audience.length; i++)
+            writer.tag(17, WireType.LengthDelimited).string(message.audience[i]);
+        /* optional string requested_token_type = 18; */
+        if (message.requestedTokenType !== undefined)
+            writer.tag(18, WireType.LengthDelimited).string(message.requestedTokenType);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4349,7 +4613,8 @@ class OAuth2TokenResponse$Type extends MessageType<OAuth2TokenResponse> {
             { no: 3, name: "expires_in", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
             { no: 4, name: "refresh_token", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 5, name: "id_token", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 6, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "issued_token_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OAuth2TokenResponse>): OAuth2TokenResponse {
@@ -4384,6 +4649,9 @@ class OAuth2TokenResponse$Type extends MessageType<OAuth2TokenResponse> {
                 case /* optional string scope */ 6:
                     message.scope = reader.string();
                     break;
+                case /* optional string issued_token_type */ 7:
+                    message.issuedTokenType = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4414,6 +4682,9 @@ class OAuth2TokenResponse$Type extends MessageType<OAuth2TokenResponse> {
         /* optional string scope = 6; */
         if (message.scope !== undefined)
             writer.tag(6, WireType.LengthDelimited).string(message.scope);
+        /* optional string issued_token_type = 7; */
+        if (message.issuedTokenType !== undefined)
+            writer.tag(7, WireType.LengthDelimited).string(message.issuedTokenType);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4428,12 +4699,18 @@ export const OAuth2TokenResponse = new OAuth2TokenResponse$Type();
 class OAuth2IntrospectRequest$Type extends MessageType<OAuth2IntrospectRequest> {
     constructor() {
         super("sid.v1.authn.OAuth2IntrospectRequest", [
-            { no: 1, name: "token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 1, name: "token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "client_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "client_secret", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "client_assertion", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "client_assertion_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OAuth2IntrospectRequest>): OAuth2IntrospectRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.token = "";
+        message.issuerHandle = "";
         if (value !== undefined)
             reflectionMergePartial<OAuth2IntrospectRequest>(this, message, value);
         return message;
@@ -4446,6 +4723,21 @@ class OAuth2IntrospectRequest$Type extends MessageType<OAuth2IntrospectRequest>
                 case /* string token */ 1:
                     message.token = reader.string();
                     break;
+                case /* string issuer_handle */ 2:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string client_id */ 3:
+                    message.clientId = reader.string();
+                    break;
+                case /* optional string client_secret */ 4:
+                    message.clientSecret = reader.string();
+                    break;
+                case /* optional string client_assertion */ 5:
+                    message.clientAssertion = reader.string();
+                    break;
+                case /* optional string client_assertion_type */ 6:
+                    message.clientAssertionType = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4461,6 +4753,21 @@ class OAuth2IntrospectRequest$Type extends MessageType<OAuth2IntrospectRequest>
         /* string token = 1; */
         if (message.token !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.token);
+        /* string issuer_handle = 2; */
+        if (message.issuerHandle !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string client_id = 3; */
+        if (message.clientId !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.clientId);
+        /* optional string client_secret = 4; */
+        if (message.clientSecret !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.clientSecret);
+        /* optional string client_assertion = 5; */
+        if (message.clientAssertion !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.clientAssertion);
+        /* optional string client_assertion_type = 6; */
+        if (message.clientAssertionType !== undefined)
+            writer.tag(6, WireType.LengthDelimited).string(message.clientAssertionType);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4565,12 +4872,18 @@ class OAuth2RevokeRequest$Type extends MessageType<OAuth2RevokeRequest> {
     constructor() {
         super("sid.v1.authn.OAuth2RevokeRequest", [
             { no: 1, name: "token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "token_type_hint", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 2, name: "token_type_hint", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "client_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "client_secret", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "client_assertion", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "client_assertion_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<OAuth2RevokeRequest>): OAuth2RevokeRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.token = "";
+        message.issuerHandle = "";
         if (value !== undefined)
             reflectionMergePartial<OAuth2RevokeRequest>(this, message, value);
         return message;
@@ -4586,6 +4899,21 @@ class OAuth2RevokeRequest$Type extends MessageType<OAuth2RevokeRequest> {
                 case /* optional string token_type_hint */ 2:
                     message.tokenTypeHint = reader.string();
                     break;
+                case /* string issuer_handle */ 3:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string client_id */ 4:
+                    message.clientId = reader.string();
+                    break;
+                case /* optional string client_secret */ 5:
+                    message.clientSecret = reader.string();
+                    break;
+                case /* optional string client_assertion */ 6:
+                    message.clientAssertion = reader.string();
+                    break;
+                case /* optional string client_assertion_type */ 7:
+                    message.clientAssertionType = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4604,6 +4932,21 @@ class OAuth2RevokeRequest$Type extends MessageType<OAuth2RevokeRequest> {
         /* optional string token_type_hint = 2; */
         if (message.tokenTypeHint !== undefined)
             writer.tag(2, WireType.LengthDelimited).string(message.tokenTypeHint);
+        /* string issuer_handle = 3; */
+        if (message.issuerHandle !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string client_id = 4; */
+        if (message.clientId !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.clientId);
+        /* optional string client_secret = 5; */
+        if (message.clientSecret !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.clientSecret);
+        /* optional string client_assertion = 6; */
+        if (message.clientAssertion !== undefined)
+            writer.tag(6, WireType.LengthDelimited).string(message.clientAssertion);
+        /* optional string client_assertion_type = 7; */
+        if (message.clientAssertionType !== undefined)
+            writer.tag(7, WireType.LengthDelimited).string(message.clientAssertionType);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4772,13 +5115,19 @@ export const ValidateSessionResponse = new ValidateSessionResponse$Type();
 class DeviceAuthorizationRequest$Type extends MessageType<DeviceAuthorizationRequest> {
     constructor() {
         super("sid.v1.authn.DeviceAuthorizationRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 1, name: "client_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "client_secret", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "resource", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "client_assertion", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "client_assertion_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<DeviceAuthorizationRequest>): DeviceAuthorizationRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.clientId = "";
+        message.issuerHandle = "";
+        message.resource = [];
         if (value !== undefined)
             reflectionMergePartial<DeviceAuthorizationRequest>(this, message, value);
         return message;
@@ -4788,12 +5137,27 @@ class DeviceAuthorizationRequest$Type extends MessageType<DeviceAuthorizationReq
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string client_id */ 1:
+                case /* optional string client_id */ 1:
                     message.clientId = reader.string();
                     break;
                 case /* optional string scope */ 2:
                     message.scope = reader.string();
                     break;
+                case /* string issuer_handle */ 3:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string client_secret */ 4:
+                    message.clientSecret = reader.string();
+                    break;
+                case /* repeated string resource */ 5:
+                    message.resource.push(reader.string());
+                    break;
+                case /* optional string client_assertion */ 6:
+                    message.clientAssertion = reader.string();
+                    break;
+                case /* optional string client_assertion_type */ 7:
+                    message.clientAssertionType = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4806,12 +5170,27 @@ class DeviceAuthorizationRequest$Type extends MessageType<DeviceAuthorizationReq
         return message;
     }
     internalBinaryWrite(message: DeviceAuthorizationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string client_id = 1; */
-        if (message.clientId !== "")
+        /* optional string client_id = 1; */
+        if (message.clientId !== undefined)
             writer.tag(1, WireType.LengthDelimited).string(message.clientId);
         /* optional string scope = 2; */
         if (message.scope !== undefined)
             writer.tag(2, WireType.LengthDelimited).string(message.scope);
+        /* string issuer_handle = 3; */
+        if (message.issuerHandle !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string client_secret = 4; */
+        if (message.clientSecret !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.clientSecret);
+        /* repeated string resource = 5; */
+        for (let i = 0; i < message.resource.length; i++)
+            writer.tag(5, WireType.LengthDelimited).string(message.resource[i]);
+        /* optional string client_assertion = 6; */
+        if (message.clientAssertion !== undefined)
+            writer.tag(6, WireType.LengthDelimited).string(message.clientAssertion);
+        /* optional string client_assertion_type = 7; */
+        if (message.clientAssertionType !== undefined)
+            writer.tag(7, WireType.LengthDelimited).string(message.clientAssertionType);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4910,61 +5289,6 @@ class DeviceAuthorizationResponse$Type extends MessageType<DeviceAuthorizationRe
  */
 export const DeviceAuthorizationResponse = new DeviceAuthorizationResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class PollDeviceTokenRequest$Type extends MessageType<PollDeviceTokenRequest> {
-    constructor() {
-        super("sid.v1.authn.PollDeviceTokenRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "device_code", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<PollDeviceTokenRequest>): PollDeviceTokenRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.clientId = "";
-        message.deviceCode = "";
-        if (value !== undefined)
-            reflectionMergePartial<PollDeviceTokenRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PollDeviceTokenRequest): PollDeviceTokenRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string client_id */ 1:
-                    message.clientId = reader.string();
-                    break;
-                case /* string device_code */ 2:
-                    message.deviceCode = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: PollDeviceTokenRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string client_id = 1; */
-        if (message.clientId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
-        /* string device_code = 2; */
-        if (message.deviceCode !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.deviceCode);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.PollDeviceTokenRequest
- */
-export const PollDeviceTokenRequest = new PollDeviceTokenRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
 class SubmitDeviceUserCodeRequest$Type extends MessageType<SubmitDeviceUserCodeRequest> {
     constructor() {
         super("sid.v1.authn.SubmitDeviceUserCodeRequest", [
@@ -5368,8 +5692,7 @@ export const ResolvePrincipalRequest = new ResolvePrincipalRequest$Type();
 class ResolvePrincipalResponse$Type extends MessageType<ResolvePrincipalResponse> {
     constructor() {
         super("sid.v1.authn.ResolvePrincipalResponse", [
-            { no: 1, name: "available_methods", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "suggested_method", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 1, name: "available_methods", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<ResolvePrincipalResponse>): ResolvePrincipalResponse {
@@ -5387,9 +5710,6 @@ class ResolvePrincipalResponse$Type extends MessageType<ResolvePrincipalResponse
                 case /* repeated string available_methods */ 1:
                     message.availableMethods.push(reader.string());
                     break;
-                case /* optional string suggested_method */ 2:
-                    message.suggestedMethod = reader.string();
-                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -5405,9 +5725,6 @@ class ResolvePrincipalResponse$Type extends MessageType<ResolvePrincipalResponse
         /* repeated string available_methods = 1; */
         for (let i = 0; i < message.availableMethods.length; i++)
             writer.tag(1, WireType.LengthDelimited).string(message.availableMethods[i]);
-        /* optional string suggested_method = 2; */
-        if (message.suggestedMethod !== undefined)
-            writer.tag(2, WireType.LengthDelimited).string(message.suggestedMethod);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -6686,7 +7003,10 @@ class VerifyOtpResponse$Type extends MessageType<VerifyOtpResponse> {
     constructor() {
         super("sid.v1.authn.VerifyOtpResponse", [
             { no: 1, name: "verified", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "redirect_to", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 2, name: "redirect_to", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "session_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "access_token", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "expires_in", kind: "scalar", opt: true, T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ }
         ]);
     }
     create(value?: PartialMessage<VerifyOtpResponse>): VerifyOtpResponse {
@@ -6707,6 +7027,15 @@ class VerifyOtpResponse$Type extends MessageType<VerifyOtpResponse> {
                 case /* optional string redirect_to */ 2:
                     message.redirectTo = reader.string();
                     break;
+                case /* optional string session_id */ 3:
+                    message.sessionId = reader.string();
+                    break;
+                case /* optional string access_token */ 4:
+                    message.accessToken = reader.string();
+                    break;
+                case /* optional int64 expires_in */ 5:
+                    message.expiresIn = reader.int64().toBigInt();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -6725,6 +7054,15 @@ class VerifyOtpResponse$Type extends MessageType<VerifyOtpResponse> {
         /* optional string redirect_to = 2; */
         if (message.redirectTo !== undefined)
             writer.tag(2, WireType.LengthDelimited).string(message.redirectTo);
+        /* optional string session_id = 3; */
+        if (message.sessionId !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.sessionId);
+        /* optional string access_token = 4; */
+        if (message.accessToken !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.accessToken);
+        /* optional int64 expires_in = 5; */
+        if (message.expiresIn !== undefined)
+            writer.tag(5, WireType.Varint).int64(message.expiresIn);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -9026,7 +9364,8 @@ class VerifyPasswordResetResponse$Type extends MessageType<VerifyPasswordResetRe
     constructor() {
         super("sid.v1.authn.VerifyPasswordResetResponse", [
             { no: 1, name: "reset_session_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "expires_in", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
+            { no: 2, name: "expires_in", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 3, name: "history", kind: "message", T: () => PasswordHistoryContext }
         ]);
     }
     create(value?: PartialMessage<VerifyPasswordResetResponse>): VerifyPasswordResetResponse {
@@ -9048,6 +9387,9 @@ class VerifyPasswordResetResponse$Type extends MessageType<VerifyPasswordResetRe
                 case /* int32 expires_in */ 2:
                     message.expiresIn = reader.int32();
                     break;
+                case /* sid.v1.authn.PasswordHistoryContext history */ 3:
+                    message.history = PasswordHistoryContext.internalBinaryRead(reader, reader.uint32(), options, message.history);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -9066,6 +9408,9 @@ class VerifyPasswordResetResponse$Type extends MessageType<VerifyPasswordResetRe
         /* int32 expires_in = 2; */
         if (message.expiresIn !== 0)
             writer.tag(2, WireType.Varint).int32(message.expiresIn);
+        /* sid.v1.authn.PasswordHistoryContext history = 3; */
+        if (message.history)
+            PasswordHistoryContext.internalBinaryWrite(message.history, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -9077,25 +9422,120 @@ class VerifyPasswordResetResponse$Type extends MessageType<VerifyPasswordResetRe
  */
 export const VerifyPasswordResetResponse = new VerifyPasswordResetResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class ExecutePasswordResetRequest$Type extends MessageType<ExecutePasswordResetRequest> {
+    constructor() {
+        super("sid.v1.authn.ExecutePasswordResetRequest", [
+            { no: 1, name: "operation_id", kind: "message", T: () => PasswordOperationId },
+            { no: 2, name: "registration_request", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ExecutePasswordResetRequest>): ExecutePasswordResetRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.registrationRequest = new Uint8Array(0);
+        if (value !== undefined)
+            reflectionMergePartial<ExecutePasswordResetRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ExecutePasswordResetRequest): ExecutePasswordResetRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.ids.PasswordOperationId operation_id */ 1:
+                    message.operationId = PasswordOperationId.internalBinaryRead(reader, reader.uint32(), options, message.operationId);
+                    break;
+                case /* bytes registration_request */ 2:
+                    message.registrationRequest = reader.bytes();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ExecutePasswordResetRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.ids.PasswordOperationId operation_id = 1; */
+        if (message.operationId)
+            PasswordOperationId.internalBinaryWrite(message.operationId, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* bytes registration_request = 2; */
+        if (message.registrationRequest.length)
+            writer.tag(2, WireType.LengthDelimited).bytes(message.registrationRequest);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.ExecutePasswordResetRequest
+ */
+export const ExecutePasswordResetRequest = new ExecutePasswordResetRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ExecutePasswordResetResponse$Type extends MessageType<ExecutePasswordResetResponse> {
+    constructor() {
+        super("sid.v1.authn.ExecutePasswordResetResponse", [
+            { no: 1, name: "registration_response", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ExecutePasswordResetResponse>): ExecutePasswordResetResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.registrationResponse = new Uint8Array(0);
+        if (value !== undefined)
+            reflectionMergePartial<ExecutePasswordResetResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ExecutePasswordResetResponse): ExecutePasswordResetResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bytes registration_response */ 1:
+                    message.registrationResponse = reader.bytes();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ExecutePasswordResetResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bytes registration_response = 1; */
+        if (message.registrationResponse.length)
+            writer.tag(1, WireType.LengthDelimited).bytes(message.registrationResponse);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.ExecutePasswordResetResponse
+ */
+export const ExecutePasswordResetResponse = new ExecutePasswordResetResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class CompletePasswordResetRequest$Type extends MessageType<CompletePasswordResetRequest> {
     constructor() {
         super("sid.v1.authn.CompletePasswordResetRequest", [
             { no: 1, name: "reset_session_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "operation_id", kind: "message", T: () => PasswordOperationId },
             { no: 2, name: "registration_record", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "zkpp_proof", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "zkpp_instances", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 12 /*ScalarType.BYTES*/ },
-            { no: 5, name: "history_commitment", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 6, name: "commitment_salt", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+            { no: 8, name: "proof", kind: "message", T: () => PasswordRegistrationProof }
         ]);
     }
     create(value?: PartialMessage<CompletePasswordResetRequest>): CompletePasswordResetRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.resetSessionId = "";
         message.registrationRecord = new Uint8Array(0);
-        message.zkppProof = new Uint8Array(0);
-        message.zkppInstances = [];
-        message.historyCommitment = new Uint8Array(0);
-        message.commitmentSalt = new Uint8Array(0);
         if (value !== undefined)
             reflectionMergePartial<CompletePasswordResetRequest>(this, message, value);
         return message;
@@ -9108,20 +9548,14 @@ class CompletePasswordResetRequest$Type extends MessageType<CompletePasswordRese
                 case /* string reset_session_id */ 1:
                     message.resetSessionId = reader.string();
                     break;
+                case /* sid.v1.ids.PasswordOperationId operation_id */ 7:
+                    message.operationId = PasswordOperationId.internalBinaryRead(reader, reader.uint32(), options, message.operationId);
+                    break;
                 case /* bytes registration_record */ 2:
                     message.registrationRecord = reader.bytes();
                     break;
-                case /* bytes zkpp_proof */ 3:
-                    message.zkppProof = reader.bytes();
-                    break;
-                case /* repeated bytes zkpp_instances */ 4:
-                    message.zkppInstances.push(reader.bytes());
-                    break;
-                case /* bytes history_commitment */ 5:
-                    message.historyCommitment = reader.bytes();
-                    break;
-                case /* bytes commitment_salt */ 6:
-                    message.commitmentSalt = reader.bytes();
+                case /* sid.v1.authn.PasswordRegistrationProof proof */ 8:
+                    message.proof = PasswordRegistrationProof.internalBinaryRead(reader, reader.uint32(), options, message.proof);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -9141,18 +9575,12 @@ class CompletePasswordResetRequest$Type extends MessageType<CompletePasswordRese
         /* bytes registration_record = 2; */
         if (message.registrationRecord.length)
             writer.tag(2, WireType.LengthDelimited).bytes(message.registrationRecord);
-        /* bytes zkpp_proof = 3; */
-        if (message.zkppProof.length)
-            writer.tag(3, WireType.LengthDelimited).bytes(message.zkppProof);
-        /* repeated bytes zkpp_instances = 4; */
-        for (let i = 0; i < message.zkppInstances.length; i++)
-            writer.tag(4, WireType.LengthDelimited).bytes(message.zkppInstances[i]);
-        /* bytes history_commitment = 5; */
-        if (message.historyCommitment.length)
-            writer.tag(5, WireType.LengthDelimited).bytes(message.historyCommitment);
-        /* bytes commitment_salt = 6; */
-        if (message.commitmentSalt.length)
-            writer.tag(6, WireType.LengthDelimited).bytes(message.commitmentSalt);
+        /* sid.v1.ids.PasswordOperationId operation_id = 7; */
+        if (message.operationId)
+            PasswordOperationId.internalBinaryWrite(message.operationId, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.authn.PasswordRegistrationProof proof = 8; */
+        if (message.proof)
+            PasswordRegistrationProof.internalBinaryWrite(message.proof, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -9243,12 +9671,11 @@ export const AuthService = new ServiceType("sid.v1.authn.AuthService", [
     { name: "WebAuthnRegistrationFinish", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/auth/webauthn/registration/finish", body: "*" } }, I: WebAuthnRegistrationFinishRequest, O: WebAuthnRegistrationFinishResponse },
     { name: "WebAuthnAuthenticationStart", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { post: "/v1/auth/webauthn/authentication/start", body: "*" } }, I: WebAuthnAuthenticationStartRequest, O: WebAuthnAuthenticationStartResponse },
     { name: "WebAuthnAuthenticationFinish", options: { "google.api.http": { post: "/v1/auth/webauthn/authentication/finish", body: "*" } }, I: WebAuthnAuthenticationFinishRequest, O: WebAuthnAuthenticationFinishResponse },
-    { name: "OAuth2Authorize", options: { "google.api.http": { post: "/v1/oauth2/authorize", body: "*" } }, I: OAuth2AuthorizeRequest, O: OAuth2AuthorizeResponse },
-    { name: "OAuth2Token", options: { "google.api.http": { post: "/v1/oauth2/token", body: "*" } }, I: OAuth2TokenRequest, O: OAuth2TokenResponse },
-    { name: "OAuth2Introspect", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { post: "/v1/oauth2/introspect", body: "*" } }, I: OAuth2IntrospectRequest, O: OAuth2IntrospectResponse },
-    { name: "OAuth2Revoke", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/oauth2/revoke", body: "*" } }, I: OAuth2RevokeRequest, O: OAuth2RevokeResponse },
-    { name: "StartDeviceAuthorization", options: { "google.api.http": { post: "/v1/oauth2/device", body: "*" } }, I: DeviceAuthorizationRequest, O: DeviceAuthorizationResponse },
-    { name: "PollDeviceToken", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { post: "/v1/oauth2/device/token", body: "*" } }, I: PollDeviceTokenRequest, O: OAuth2TokenResponse },
+    { name: "OAuth2Authorize", options: {}, I: OAuth2AuthorizeRequest, O: OAuth2AuthorizeResponse },
+    { name: "OAuth2Token", options: {}, I: OAuth2TokenRequest, O: OAuth2TokenResponse },
+    { name: "OAuth2Introspect", idempotency: "NO_SIDE_EFFECTS", options: {}, I: OAuth2IntrospectRequest, O: OAuth2IntrospectResponse },
+    { name: "OAuth2Revoke", idempotency: "IDEMPOTENT", options: {}, I: OAuth2RevokeRequest, O: OAuth2RevokeResponse },
+    { name: "StartDeviceAuthorization", options: {}, I: DeviceAuthorizationRequest, O: DeviceAuthorizationResponse },
     { name: "SubmitDeviceUserCode", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/oauth2/device/submit", body: "*" } }, I: SubmitDeviceUserCodeRequest, O: SubmitDeviceUserCodeResponse },
     { name: "RequestMagicLink", options: { "google.api.http": { post: "/v1/auth/magic-link/request", body: "*" } }, I: RequestMagicLinkRequest, O: RequestMagicLinkResponse },
     { name: "VerifyMagicLink", options: { "google.api.http": { post: "/v1/auth/magic-link/verify", body: "*" } }, I: VerifyMagicLinkRequest, O: VerifyMagicLinkResponse },
@@ -9287,5 +9714,6 @@ export const AuthService = new ServiceType("sid.v1.authn.AuthService", [
     { name: "ConfirmAccountDeletion", options: { "google.api.http": { post: "/v1/auth/delete-confirm", body: "*" } }, I: ConfirmAccountDeletionRequest, O: ConfirmAccountDeletionResponse },
     { name: "RequestPasswordReset", options: { "google.api.http": { post: "/v1/auth/password/reset/request", body: "*" } }, I: RequestPasswordResetRequest, O: RequestPasswordResetResponse },
     { name: "VerifyPasswordReset", options: { "google.api.http": { post: "/v1/auth/password/reset/verify", body: "*" } }, I: VerifyPasswordResetRequest, O: VerifyPasswordResetResponse },
+    { name: "ExecutePasswordReset", options: { "google.api.http": { post: "/v1/auth/password/reset/execute", body: "*" } }, I: ExecutePasswordResetRequest, O: ExecutePasswordResetResponse },
     { name: "CompletePasswordReset", options: { "google.api.http": { post: "/v1/auth/password/reset/complete", body: "*" } }, I: CompletePasswordResetRequest, O: CompletePasswordResetResponse }
 ]);