@structured-id/ui-core 1.2.0 → 1.3.0

package/src/generated/sid/v1/attestation/attestation.ts

@@ -26,7 +26,7 @@ export interface DeviceAttestation {
     /**
      * @generated from protobuf field: string device_id = 2
      */
-    deviceId: string; // References Device in sid-identity
+    deviceId: string; // Attested device (`Device.id` in sid-identity, UUIDv7)
     /**
      * @generated from protobuf field: string profile_id = 3
      */
@@ -85,7 +85,7 @@ export interface RegisterDeviceKeyRequest {
     /**
      * @generated from protobuf field: string device_id = 1
      */
-    deviceId: string; // Device to register key for
+    deviceId: string; // Device to register key for (`Device.id`, UUIDv7)
     /**
      * @generated from protobuf field: sid.v1.attestation.AttestationFormat format = 2
      */
@@ -122,7 +122,7 @@ export interface GetDeviceAttestationRequest {
     /**
      * @generated from protobuf field: string device_id = 1
      */
-    deviceId: string;
+    deviceId: string; // Device to fetch attestation for (`Device.id`, UUIDv7)
 }
 /**
  * @generated from protobuf message sid.v1.attestation.RotateDeviceKeyRequest
@@ -131,7 +131,7 @@ export interface RotateDeviceKeyRequest {
     /**
      * @generated from protobuf field: string device_id = 1
      */
-    deviceId: string;
+    deviceId: string; // Device whose key is rotated (`Device.id`, UUIDv7)
     /**
      * @generated from protobuf field: bytes new_device_public_key = 2
      */
@@ -152,7 +152,7 @@ export interface RevokeDeviceKeyRequest {
     /**
      * @generated from protobuf field: string device_id = 1
      */
-    deviceId: string;
+    deviceId: string; // Device whose key is revoked (`Device.id`, UUIDv7)
 }
 /**
  * @generated from protobuf message sid.v1.attestation.ListDeviceAttestationsRequest
@@ -277,19 +277,19 @@ export enum AttestationStatus {
      */
     PENDING = 1,
     /**
-     * Attestation chain verified (EE)
+     * Attestation chain verified
      *
      * @generated from protobuf enum value: ATTESTATION_STATUS_VERIFIED = 2;
      */
     VERIFIED = 2,
     /**
-     * Stored but not verified (CE default)
+     * Stored; the server does not verify chains
      *
      * @generated from protobuf enum value: ATTESTATION_STATUS_UNVERIFIED = 3;
      */
     UNVERIFIED = 3,
     /**
-     * Verification failed (EE)
+     * Verification failed
      *
      * @generated from protobuf enum value: ATTESTATION_STATUS_REJECTED = 4;
      */

package/src/generated/sid/v1/authn/auth.client.ts

@@ -6,6 +6,8 @@ import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
 import { AuthService } from "./auth";
 import type { CompletePasswordResetResponse } from "./auth";
 import type { CompletePasswordResetRequest } from "./auth";
+import type { ExecutePasswordResetResponse } from "./auth";
+import type { ExecutePasswordResetRequest } from "./auth";
 import type { VerifyPasswordResetResponse } from "./auth";
 import type { VerifyPasswordResetRequest } from "./auth";
 import type { RequestPasswordResetResponse } from "./auth";
@@ -79,7 +81,6 @@ import type { RequestMagicLinkResponse } from "./auth";
 import type { RequestMagicLinkRequest } from "./auth";
 import type { SubmitDeviceUserCodeResponse } from "./auth";
 import type { SubmitDeviceUserCodeRequest } from "./auth";
-import type { PollDeviceTokenRequest } from "./auth";
 import type { DeviceAuthorizationResponse } from "./auth";
 import type { DeviceAuthorizationRequest } from "./auth";
 import type { OAuth2RevokeResponse } from "./auth";
@@ -186,10 +187,28 @@ export interface IAuthServiceClient {
     /**
      * OAuth2 / OIDC flows.
      *
+     * Every OAuth client belongs to exactly one logical OIDC issuer, and these
+     * are that issuer's endpoints: `/i/{issuer_handle}/oauth2/*`, as advertised
+     * in its discovery document. There is no issuer-less OAuth surface; SID's
+     * own sign-in sessions are issued by the authentication RPCs above, not
+     * here. The sign-in UI calls OAuth2Authorize with the signed-in user's
+     * token after consent and redirects the browser itself; the issuer's
+     * browser authorization endpoint (OidcProviderService) runs the same logic.
+     *
      * @generated from protobuf rpc: OAuth2Authorize
      */
     oAuth2Authorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse>;
     /**
+     *
+     * The token, introspection, revocation and device authorization RPCs have
+     * no HTTP binding: their HTTP form is fixed by the RFCs (form-encoded
+     * request, RFC error body and status), which OidcProviderService serves on
+     * the issuer's paths with the same logic. A refusal here is a canonical
+     * status whose ErrorInfo metadata `oauth_error` is the RFC 6749 §5.2 or
+     * RFC 8628 §3.5 error code. A confidential client authenticates with the
+     * secret in the body, or with HTTP Basic in the `authorization` metadata
+     * (RFC 6749 §2.3.1), never both.
+     *
      * @generated from protobuf rpc: OAuth2Token
      */
     oAuth2Token(input: OAuth2TokenRequest, options?: RpcOptions): UnaryCall<OAuth2TokenRequest, OAuth2TokenResponse>;
@@ -202,15 +221,12 @@ export interface IAuthServiceClient {
      */
     oAuth2Revoke(input: OAuth2RevokeRequest, options?: RpcOptions): UnaryCall<OAuth2RevokeRequest, OAuth2RevokeResponse>;
     /**
-     * Device Authorization Grant (RFC 8628).
+     * Device Authorization Grant (RFC 8628): the device starts here and polls
+     * OAuth2Token with the device_code grant (RFC 8628 §3.4).
      *
      * @generated from protobuf rpc: StartDeviceAuthorization
      */
     startDeviceAuthorization(input: DeviceAuthorizationRequest, options?: RpcOptions): UnaryCall<DeviceAuthorizationRequest, DeviceAuthorizationResponse>;
-    /**
-     * @generated from protobuf rpc: PollDeviceToken
-     */
-    pollDeviceToken(input: PollDeviceTokenRequest, options?: RpcOptions): UnaryCall<PollDeviceTokenRequest, OAuth2TokenResponse>;
     /**
      * @generated from protobuf rpc: SubmitDeviceUserCode
      */
@@ -348,7 +364,7 @@ export interface IAuthServiceClient {
      * @generated from protobuf rpc: AcceptTerms
      */
     acceptTerms(input: AcceptTermsRequest, options?: RpcOptions): UnaryCall<AcceptTermsRequest, AcceptTermsResponse>;
-    // ── CIBA consent (EE) ──
+    // ── CIBA consent ──
 
     /**
      * @generated from protobuf rpc: ApproveCiba
@@ -364,7 +380,7 @@ export interface IAuthServiceClient {
      * @generated from protobuf rpc: VerifyCaptcha
      */
     verifyCaptcha(input: VerifyCaptchaRequest, options?: RpcOptions): UnaryCall<VerifyCaptchaRequest, VerifyCaptchaResponse>;
-    // ── Dynamic prompt (EE custom auth steps) ──
+    // ── Dynamic prompt (custom auth steps) ──
 
     /**
      * @generated from protobuf rpc: GetDynamicPrompt
@@ -405,7 +421,6 @@ export interface IAuthServiceClient {
     confirmAccountDeletion(input: ConfirmAccountDeletionRequest, options?: RpcOptions): UnaryCall<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse>;
     /**
      * Password reset flow (magic link → new OPAQUE credential).
-     * SaaS extends this with key recovery (Shamir shards, DownloadRecoveryShard) in proto-ee.
      *
      * @generated from protobuf rpc: RequestPasswordReset
      */
@@ -414,6 +429,13 @@ export interface IAuthServiceClient {
      * @generated from protobuf rpc: VerifyPasswordReset
      */
     verifyPasswordReset(input: VerifyPasswordResetRequest, options?: RpcOptions): UnaryCall<VerifyPasswordResetRequest, VerifyPasswordResetResponse>;
+    /**
+     * OPAQUE registration start of the replacement password, under the verified
+     * reset's operation.
+     *
+     * @generated from protobuf rpc: ExecutePasswordReset
+     */
+    executePasswordReset(input: ExecutePasswordResetRequest, options?: RpcOptions): UnaryCall<ExecutePasswordResetRequest, ExecutePasswordResetResponse>;
     /**
      * @generated from protobuf rpc: CompletePasswordReset
      */
@@ -530,6 +552,14 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
     /**
      * OAuth2 / OIDC flows.
      *
+     * Every OAuth client belongs to exactly one logical OIDC issuer, and these
+     * are that issuer's endpoints: `/i/{issuer_handle}/oauth2/*`, as advertised
+     * in its discovery document. There is no issuer-less OAuth surface; SID's
+     * own sign-in sessions are issued by the authentication RPCs above, not
+     * here. The sign-in UI calls OAuth2Authorize with the signed-in user's
+     * token after consent and redirects the browser itself; the issuer's
+     * browser authorization endpoint (OidcProviderService) runs the same logic.
+     *
      * @generated from protobuf rpc: OAuth2Authorize
      */
     oAuth2Authorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse> {
@@ -537,6 +567,16 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
         return stackIntercept<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse>("unary", this._transport, method, opt, input);
     }
     /**
+     *
+     * The token, introspection, revocation and device authorization RPCs have
+     * no HTTP binding: their HTTP form is fixed by the RFCs (form-encoded
+     * request, RFC error body and status), which OidcProviderService serves on
+     * the issuer's paths with the same logic. A refusal here is a canonical
+     * status whose ErrorInfo metadata `oauth_error` is the RFC 6749 §5.2 or
+     * RFC 8628 §3.5 error code. A confidential client authenticates with the
+     * secret in the body, or with HTTP Basic in the `authorization` metadata
+     * (RFC 6749 §2.3.1), never both.
+     *
      * @generated from protobuf rpc: OAuth2Token
      */
     oAuth2Token(input: OAuth2TokenRequest, options?: RpcOptions): UnaryCall<OAuth2TokenRequest, OAuth2TokenResponse> {
@@ -558,7 +598,8 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
         return stackIntercept<OAuth2RevokeRequest, OAuth2RevokeResponse>("unary", this._transport, method, opt, input);
     }
     /**
-     * Device Authorization Grant (RFC 8628).
+     * Device Authorization Grant (RFC 8628): the device starts here and polls
+     * OAuth2Token with the device_code grant (RFC 8628 §3.4).
      *
      * @generated from protobuf rpc: StartDeviceAuthorization
      */
@@ -566,18 +607,11 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
         const method = this.methods[17], opt = this._transport.mergeOptions(options);
         return stackIntercept<DeviceAuthorizationRequest, DeviceAuthorizationResponse>("unary", this._transport, method, opt, input);
     }
-    /**
-     * @generated from protobuf rpc: PollDeviceToken
-     */
-    pollDeviceToken(input: PollDeviceTokenRequest, options?: RpcOptions): UnaryCall<PollDeviceTokenRequest, OAuth2TokenResponse> {
-        const method = this.methods[18], opt = this._transport.mergeOptions(options);
-        return stackIntercept<PollDeviceTokenRequest, OAuth2TokenResponse>("unary", this._transport, method, opt, input);
-    }
     /**
      * @generated from protobuf rpc: SubmitDeviceUserCode
      */
     submitDeviceUserCode(input: SubmitDeviceUserCodeRequest, options?: RpcOptions): UnaryCall<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse> {
-        const method = this.methods[19], opt = this._transport.mergeOptions(options);
+        const method = this.methods[18], opt = this._transport.mergeOptions(options);
         return stackIntercept<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse>("unary", this._transport, method, opt, input);
     }
     // ── Magic Link (passwordless, corporate profiles) ──
@@ -586,14 +620,14 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: RequestMagicLink
      */
     requestMagicLink(input: RequestMagicLinkRequest, options?: RpcOptions): UnaryCall<RequestMagicLinkRequest, RequestMagicLinkResponse> {
-        const method = this.methods[20], opt = this._transport.mergeOptions(options);
+        const method = this.methods[19], opt = this._transport.mergeOptions(options);
         return stackIntercept<RequestMagicLinkRequest, RequestMagicLinkResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: VerifyMagicLink
      */
     verifyMagicLink(input: VerifyMagicLinkRequest, options?: RpcOptions): UnaryCall<VerifyMagicLinkRequest, VerifyMagicLinkResponse> {
-        const method = this.methods[21], opt = this._transport.mergeOptions(options);
+        const method = this.methods[20], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyMagicLinkRequest, VerifyMagicLinkResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -602,14 +636,14 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: LegacyMigrateStart
      */
     legacyMigrateStart(input: LegacyMigrateStartRequest, options?: RpcOptions): UnaryCall<LegacyMigrateStartRequest, LegacyMigrateStartResponse> {
-        const method = this.methods[22], opt = this._transport.mergeOptions(options);
+        const method = this.methods[21], opt = this._transport.mergeOptions(options);
         return stackIntercept<LegacyMigrateStartRequest, LegacyMigrateStartResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: LegacyMigrateFinish
      */
     legacyMigrateFinish(input: LegacyMigrateFinishRequest, options?: RpcOptions): UnaryCall<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse> {
-        const method = this.methods[23], opt = this._transport.mergeOptions(options);
+        const method = this.methods[22], opt = this._transport.mergeOptions(options);
         return stackIntercept<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -618,7 +652,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: ValidateSession
      */
     validateSession(input: ValidateSessionRequest, options?: RpcOptions): UnaryCall<ValidateSessionRequest, ValidateSessionResponse> {
-        const method = this.methods[24], opt = this._transport.mergeOptions(options);
+        const method = this.methods[23], opt = this._transport.mergeOptions(options);
         return stackIntercept<ValidateSessionRequest, ValidateSessionResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -627,7 +661,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: ResolvePrincipal
      */
     resolvePrincipal(input: ResolvePrincipalRequest, options?: RpcOptions): UnaryCall<ResolvePrincipalRequest, ResolvePrincipalResponse> {
-        const method = this.methods[25], opt = this._transport.mergeOptions(options);
+        const method = this.methods[24], opt = this._transport.mergeOptions(options);
         return stackIntercept<ResolvePrincipalRequest, ResolvePrincipalResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -636,7 +670,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: GetZkppPolicy
      */
     getZkppPolicy(input: GetZkppPolicyRequest, options?: RpcOptions): UnaryCall<GetZkppPolicyRequest, GetZkppPolicyResponse> {
-        const method = this.methods[26], opt = this._transport.mergeOptions(options);
+        const method = this.methods[25], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetZkppPolicyRequest, GetZkppPolicyResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -646,7 +680,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: SubmitDeferredZkProof
      */
     submitDeferredZkProof(input: SubmitDeferredZkProofRequest, options?: RpcOptions): UnaryCall<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse> {
-        const method = this.methods[27], opt = this._transport.mergeOptions(options);
+        const method = this.methods[26], opt = this._transport.mergeOptions(options);
         return stackIntercept<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse>("unary", this._transport, method, opt, input);
     }
     // ── MFA TOTP ──
@@ -655,21 +689,21 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: StartTotpEnrollment
      */
     startTotpEnrollment(input: StartTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<StartTotpEnrollmentRequest, TotpEnrollmentChallenge> {
-        const method = this.methods[28], opt = this._transport.mergeOptions(options);
+        const method = this.methods[27], opt = this._transport.mergeOptions(options);
         return stackIntercept<StartTotpEnrollmentRequest, TotpEnrollmentChallenge>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: FinishTotpEnrollment
      */
     finishTotpEnrollment(input: FinishTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse> {
-        const method = this.methods[29], opt = this._transport.mergeOptions(options);
+        const method = this.methods[28], opt = this._transport.mergeOptions(options);
         return stackIntercept<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: VerifyTotp
      */
     verifyTotp(input: VerifyTotpRequest, options?: RpcOptions): UnaryCall<VerifyTotpRequest, MfaVerifyResponse> {
-        const method = this.methods[30], opt = this._transport.mergeOptions(options);
+        const method = this.methods[29], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyTotpRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
     }
     // ── MFA SMS ──
@@ -678,14 +712,14 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: VerifySmsMfa
      */
     verifySmsMfa(input: VerifySmsMfaRequest, options?: RpcOptions): UnaryCall<VerifySmsMfaRequest, MfaVerifyResponse> {
-        const method = this.methods[31], opt = this._transport.mergeOptions(options);
+        const method = this.methods[30], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifySmsMfaRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: ResendSmsMfa
      */
     resendSmsMfa(input: ResendSmsMfaRequest, options?: RpcOptions): UnaryCall<ResendSmsMfaRequest, ResendSmsMfaResponse> {
-        const method = this.methods[32], opt = this._transport.mergeOptions(options);
+        const method = this.methods[31], opt = this._transport.mergeOptions(options);
         return stackIntercept<ResendSmsMfaRequest, ResendSmsMfaResponse>("unary", this._transport, method, opt, input);
     }
     // ── MFA Recovery Codes ──
@@ -694,14 +728,14 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: GenerateRecoveryCodes
      */
     generateRecoveryCodes(input: GenerateRecoveryCodesRequest, options?: RpcOptions): UnaryCall<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse> {
-        const method = this.methods[33], opt = this._transport.mergeOptions(options);
+        const method = this.methods[32], opt = this._transport.mergeOptions(options);
         return stackIntercept<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: VerifyRecoveryCode
      */
     verifyRecoveryCode(input: VerifyRecoveryCodeRequest, options?: RpcOptions): UnaryCall<VerifyRecoveryCodeRequest, MfaVerifyResponse> {
-        const method = this.methods[34], opt = this._transport.mergeOptions(options);
+        const method = this.methods[33], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyRecoveryCodeRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
     }
     // ── OTP verification (email/phone, non-MFA) ──
@@ -710,21 +744,21 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: RequestOtp
      */
     requestOtp(input: RequestOtpRequest, options?: RpcOptions): UnaryCall<RequestOtpRequest, RequestOtpResponse> {
-        const method = this.methods[35], opt = this._transport.mergeOptions(options);
+        const method = this.methods[34], opt = this._transport.mergeOptions(options);
         return stackIntercept<RequestOtpRequest, RequestOtpResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: VerifyOtp
      */
     verifyOtp(input: VerifyOtpRequest, options?: RpcOptions): UnaryCall<VerifyOtpRequest, VerifyOtpResponse> {
-        const method = this.methods[36], opt = this._transport.mergeOptions(options);
+        const method = this.methods[35], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyOtpRequest, VerifyOtpResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: ResendOtp
      */
     resendOtp(input: ResendOtpRequest, options?: RpcOptions): UnaryCall<ResendOtpRequest, ResendOtpResponse> {
-        const method = this.methods[37], opt = this._transport.mergeOptions(options);
+        const method = this.methods[36], opt = this._transport.mergeOptions(options);
         return stackIntercept<ResendOtpRequest, ResendOtpResponse>("unary", this._transport, method, opt, input);
     }
     // ── Email/Phone verification ──
@@ -733,21 +767,21 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: ResendEmailVerification
      */
     resendEmailVerification(input: ResendEmailVerificationRequest, options?: RpcOptions): UnaryCall<ResendEmailVerificationRequest, ResendEmailVerificationResponse> {
-        const method = this.methods[38], opt = this._transport.mergeOptions(options);
+        const method = this.methods[37], opt = this._transport.mergeOptions(options);
         return stackIntercept<ResendEmailVerificationRequest, ResendEmailVerificationResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: VerifyPhone
      */
     verifyPhone(input: VerifyPhoneRequest, options?: RpcOptions): UnaryCall<VerifyPhoneRequest, VerifyPhoneResponse> {
-        const method = this.methods[39], opt = this._transport.mergeOptions(options);
+        const method = this.methods[38], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyPhoneRequest, VerifyPhoneResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: ResendPhoneVerification
      */
     resendPhoneVerification(input: ResendPhoneVerificationRequest, options?: RpcOptions): UnaryCall<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse> {
-        const method = this.methods[40], opt = this._transport.mergeOptions(options);
+        const method = this.methods[39], opt = this._transport.mergeOptions(options);
         return stackIntercept<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse>("unary", this._transport, method, opt, input);
     }
     // ── IdP linking ──
@@ -756,7 +790,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: ConfirmIdpLink
      */
     confirmIdpLink(input: ConfirmIdpLinkRequest, options?: RpcOptions): UnaryCall<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse> {
-        const method = this.methods[41], opt = this._transport.mergeOptions(options);
+        const method = this.methods[40], opt = this._transport.mergeOptions(options);
         return stackIntercept<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse>("unary", this._transport, method, opt, input);
     }
     // ── Organization selector (multi-org login) ──
@@ -765,14 +799,14 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: ListUserOrganizations
      */
     listUserOrganizations(input: ListUserOrganizationsRequest, options?: RpcOptions): UnaryCall<ListUserOrganizationsRequest, ListUserOrganizationsResponse> {
-        const method = this.methods[42], opt = this._transport.mergeOptions(options);
+        const method = this.methods[41], opt = this._transport.mergeOptions(options);
         return stackIntercept<ListUserOrganizationsRequest, ListUserOrganizationsResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: SelectOrganization
      */
     selectOrganization(input: SelectOrganizationRequest, options?: RpcOptions): UnaryCall<SelectOrganizationRequest, SelectOrganizationResponse> {
-        const method = this.methods[43], opt = this._transport.mergeOptions(options);
+        const method = this.methods[42], opt = this._transport.mergeOptions(options);
         return stackIntercept<SelectOrganizationRequest, SelectOrganizationResponse>("unary", this._transport, method, opt, input);
     }
     // ── Terms acceptance ──
@@ -781,30 +815,30 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: GetTerms
      */
     getTerms(input: GetTermsRequest, options?: RpcOptions): UnaryCall<GetTermsRequest, GetTermsResponse> {
-        const method = this.methods[44], opt = this._transport.mergeOptions(options);
+        const method = this.methods[43], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetTermsRequest, GetTermsResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: AcceptTerms
      */
     acceptTerms(input: AcceptTermsRequest, options?: RpcOptions): UnaryCall<AcceptTermsRequest, AcceptTermsResponse> {
-        const method = this.methods[45], opt = this._transport.mergeOptions(options);
+        const method = this.methods[44], opt = this._transport.mergeOptions(options);
         return stackIntercept<AcceptTermsRequest, AcceptTermsResponse>("unary", this._transport, method, opt, input);
     }
-    // ── CIBA consent (EE) ──
+    // ── CIBA consent ──
 
     /**
      * @generated from protobuf rpc: ApproveCiba
      */
     approveCiba(input: ApproveCibaRequest, options?: RpcOptions): UnaryCall<ApproveCibaRequest, CibaConsentResponse> {
-        const method = this.methods[46], opt = this._transport.mergeOptions(options);
+        const method = this.methods[45], opt = this._transport.mergeOptions(options);
         return stackIntercept<ApproveCibaRequest, CibaConsentResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: DenyCiba
      */
     denyCiba(input: DenyCibaRequest, options?: RpcOptions): UnaryCall<DenyCibaRequest, CibaConsentResponse> {
-        const method = this.methods[47], opt = this._transport.mergeOptions(options);
+        const method = this.methods[46], opt = this._transport.mergeOptions(options);
         return stackIntercept<DenyCibaRequest, CibaConsentResponse>("unary", this._transport, method, opt, input);
     }
     // ── Captcha ──
@@ -813,23 +847,23 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: VerifyCaptcha
      */
     verifyCaptcha(input: VerifyCaptchaRequest, options?: RpcOptions): UnaryCall<VerifyCaptchaRequest, VerifyCaptchaResponse> {
-        const method = this.methods[48], opt = this._transport.mergeOptions(options);
+        const method = this.methods[47], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyCaptchaRequest, VerifyCaptchaResponse>("unary", this._transport, method, opt, input);
     }
-    // ── Dynamic prompt (EE custom auth steps) ──
+    // ── Dynamic prompt (custom auth steps) ──
 
     /**
      * @generated from protobuf rpc: GetDynamicPrompt
      */
     getDynamicPrompt(input: GetDynamicPromptRequest, options?: RpcOptions): UnaryCall<GetDynamicPromptRequest, DynamicPrompt> {
-        const method = this.methods[49], opt = this._transport.mergeOptions(options);
+        const method = this.methods[48], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetDynamicPromptRequest, DynamicPrompt>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: SubmitDynamicPrompt
      */
     submitDynamicPrompt(input: SubmitDynamicPromptRequest, options?: RpcOptions): UnaryCall<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse> {
-        const method = this.methods[50], opt = this._transport.mergeOptions(options);
+        const method = this.methods[49], opt = this._transport.mergeOptions(options);
         return stackIntercept<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse>("unary", this._transport, method, opt, input);
     }
     // ── Step-up authentication ──
@@ -840,7 +874,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: RequestStepUp
      */
     requestStepUp(input: RequestStepUpRequest, options?: RpcOptions): UnaryCall<RequestStepUpRequest, StepUpChallenge> {
-        const method = this.methods[51], opt = this._transport.mergeOptions(options);
+        const method = this.methods[50], opt = this._transport.mergeOptions(options);
         return stackIntercept<RequestStepUpRequest, StepUpChallenge>("unary", this._transport, method, opt, input);
     }
     /**
@@ -849,7 +883,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: CompleteStepUp
      */
     completeStepUp(input: CompleteStepUpRequest, options?: RpcOptions): UnaryCall<CompleteStepUpRequest, CompleteStepUpResponse> {
-        const method = this.methods[52], opt = this._transport.mergeOptions(options);
+        const method = this.methods[51], opt = this._transport.mergeOptions(options);
         return stackIntercept<CompleteStepUpRequest, CompleteStepUpResponse>("unary", this._transport, method, opt, input);
     }
     // ── MFA credential management ──
@@ -861,7 +895,7 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: DeleteMfaCredential
      */
     deleteMfaCredential(input: DeleteMfaCredentialRequest, options?: RpcOptions): UnaryCall<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse> {
-        const method = this.methods[53], opt = this._transport.mergeOptions(options);
+        const method = this.methods[52], opt = this._transport.mergeOptions(options);
         return stackIntercept<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse>("unary", this._transport, method, opt, input);
     }
     // ── Account deletion confirmation ──
@@ -870,26 +904,35 @@ export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
      * @generated from protobuf rpc: ConfirmAccountDeletion
      */
     confirmAccountDeletion(input: ConfirmAccountDeletionRequest, options?: RpcOptions): UnaryCall<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse> {
-        const method = this.methods[54], opt = this._transport.mergeOptions(options);
+        const method = this.methods[53], opt = this._transport.mergeOptions(options);
         return stackIntercept<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * Password reset flow (magic link → new OPAQUE credential).
-     * SaaS extends this with key recovery (Shamir shards, DownloadRecoveryShard) in proto-ee.
      *
      * @generated from protobuf rpc: RequestPasswordReset
      */
     requestPasswordReset(input: RequestPasswordResetRequest, options?: RpcOptions): UnaryCall<RequestPasswordResetRequest, RequestPasswordResetResponse> {
-        const method = this.methods[55], opt = this._transport.mergeOptions(options);
+        const method = this.methods[54], opt = this._transport.mergeOptions(options);
         return stackIntercept<RequestPasswordResetRequest, RequestPasswordResetResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: VerifyPasswordReset
      */
     verifyPasswordReset(input: VerifyPasswordResetRequest, options?: RpcOptions): UnaryCall<VerifyPasswordResetRequest, VerifyPasswordResetResponse> {
-        const method = this.methods[56], opt = this._transport.mergeOptions(options);
+        const method = this.methods[55], opt = this._transport.mergeOptions(options);
         return stackIntercept<VerifyPasswordResetRequest, VerifyPasswordResetResponse>("unary", this._transport, method, opt, input);
     }
+    /**
+     * OPAQUE registration start of the replacement password, under the verified
+     * reset's operation.
+     *
+     * @generated from protobuf rpc: ExecutePasswordReset
+     */
+    executePasswordReset(input: ExecutePasswordResetRequest, options?: RpcOptions): UnaryCall<ExecutePasswordResetRequest, ExecutePasswordResetResponse> {
+        const method = this.methods[56], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ExecutePasswordResetRequest, ExecutePasswordResetResponse>("unary", this._transport, method, opt, input);
+    }
     /**
      * @generated from protobuf rpc: CompletePasswordReset
      */