@structured-id/ui-core 2.0.0 → 3.0.0

package/src/generated/sid/v1/authn/auth.client.ts

@@ -1,943 +0,0 @@
-// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
-// @generated from protobuf file "sid/v1/authn/auth.proto" (package "sid.v1.authn", syntax proto3)
-// tslint:disable
-import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
-import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
-import { AuthService } from "./auth";
-import type { CompletePasswordResetResponse } from "./auth";
-import type { CompletePasswordResetRequest } from "./auth";
-import type { ExecutePasswordResetResponse } from "./auth";
-import type { ExecutePasswordResetRequest } from "./auth";
-import type { VerifyPasswordResetResponse } from "./auth";
-import type { VerifyPasswordResetRequest } from "./auth";
-import type { RequestPasswordResetResponse } from "./auth";
-import type { RequestPasswordResetRequest } from "./auth";
-import type { ConfirmAccountDeletionResponse } from "./auth";
-import type { ConfirmAccountDeletionRequest } from "./auth";
-import type { DeleteMfaCredentialResponse } from "./auth";
-import type { DeleteMfaCredentialRequest } from "./auth";
-import type { CompleteStepUpResponse } from "./auth";
-import type { CompleteStepUpRequest } from "./auth";
-import type { StepUpChallenge } from "./auth";
-import type { RequestStepUpRequest } from "./auth";
-import type { SubmitDynamicPromptResponse } from "./auth";
-import type { SubmitDynamicPromptRequest } from "./auth";
-import type { DynamicPrompt } from "./auth";
-import type { GetDynamicPromptRequest } from "./auth";
-import type { VerifyCaptchaResponse } from "./auth";
-import type { VerifyCaptchaRequest } from "./auth";
-import type { DenyCibaRequest } from "./auth";
-import type { CibaConsentResponse } from "./auth";
-import type { ApproveCibaRequest } from "./auth";
-import type { AcceptTermsResponse } from "./auth";
-import type { AcceptTermsRequest } from "./auth";
-import type { GetTermsResponse } from "./auth";
-import type { GetTermsRequest } from "./auth";
-import type { SelectOrganizationResponse } from "./auth";
-import type { SelectOrganizationRequest } from "./auth";
-import type { ListUserOrganizationsResponse } from "./auth";
-import type { ListUserOrganizationsRequest } from "./auth";
-import type { ConfirmIdpLinkResponse } from "./auth";
-import type { ConfirmIdpLinkRequest } from "./auth";
-import type { ResendPhoneVerificationResponse } from "./auth";
-import type { ResendPhoneVerificationRequest } from "./auth";
-import type { VerifyPhoneResponse } from "./auth";
-import type { VerifyPhoneRequest } from "./auth";
-import type { ResendEmailVerificationResponse } from "./auth";
-import type { ResendEmailVerificationRequest } from "./auth";
-import type { ResendOtpResponse } from "./auth";
-import type { ResendOtpRequest } from "./auth";
-import type { VerifyOtpResponse } from "./auth";
-import type { VerifyOtpRequest } from "./auth";
-import type { RequestOtpResponse } from "./auth";
-import type { RequestOtpRequest } from "./auth";
-import type { VerifyRecoveryCodeRequest } from "./auth";
-import type { GenerateRecoveryCodesResponse } from "./auth";
-import type { GenerateRecoveryCodesRequest } from "./auth";
-import type { ResendSmsMfaResponse } from "./auth";
-import type { ResendSmsMfaRequest } from "./auth";
-import type { VerifySmsMfaRequest } from "./auth";
-import type { MfaVerifyResponse } from "./auth";
-import type { VerifyTotpRequest } from "./auth";
-import type { FinishTotpEnrollmentResponse } from "./auth";
-import type { FinishTotpEnrollmentRequest } from "./auth";
-import type { TotpEnrollmentChallenge } from "./auth";
-import type { StartTotpEnrollmentRequest } from "./auth";
-import type { SubmitDeferredZkProofResponse } from "./auth";
-import type { SubmitDeferredZkProofRequest } from "./auth";
-import type { GetZkppPolicyResponse } from "./auth";
-import type { GetZkppPolicyRequest } from "./auth";
-import type { ResolvePrincipalResponse } from "./auth";
-import type { ResolvePrincipalRequest } from "./auth";
-import type { ValidateSessionResponse } from "./auth";
-import type { ValidateSessionRequest } from "./auth";
-import type { LegacyMigrateFinishResponse } from "./auth";
-import type { LegacyMigrateFinishRequest } from "./auth";
-import type { LegacyMigrateStartResponse } from "./auth";
-import type { LegacyMigrateStartRequest } from "./auth";
-import type { VerifyMagicLinkResponse } from "./auth";
-import type { VerifyMagicLinkRequest } from "./auth";
-import type { RequestMagicLinkResponse } from "./auth";
-import type { RequestMagicLinkRequest } from "./auth";
-import type { SubmitDeviceUserCodeResponse } from "./auth";
-import type { SubmitDeviceUserCodeRequest } from "./auth";
-import type { DeviceAuthorizationResponse } from "./auth";
-import type { DeviceAuthorizationRequest } from "./auth";
-import type { OAuth2RevokeResponse } from "./auth";
-import type { OAuth2RevokeRequest } from "./auth";
-import type { OAuth2IntrospectResponse } from "./auth";
-import type { OAuth2IntrospectRequest } from "./auth";
-import type { OAuth2TokenResponse } from "./auth";
-import type { OAuth2TokenRequest } from "./auth";
-import type { OAuth2AuthorizeResponse } from "./auth";
-import type { OAuth2AuthorizeRequest } from "./auth";
-import type { WebAuthnAuthenticationFinishResponse } from "./auth";
-import type { WebAuthnAuthenticationFinishRequest } from "./auth";
-import type { WebAuthnAuthenticationStartResponse } from "./auth";
-import type { WebAuthnAuthenticationStartRequest } from "./auth";
-import type { WebAuthnRegistrationFinishResponse } from "./auth";
-import type { WebAuthnRegistrationFinishRequest } from "./auth";
-import type { WebAuthnRegistrationStartResponse } from "./auth";
-import type { WebAuthnRegistrationStartRequest } from "./auth";
-import type { PasswordChangeFinishResponse } from "./auth";
-import type { PasswordChangeFinishRequest } from "./auth";
-import type { PasswordChangeExecuteResponse } from "./auth";
-import type { PasswordChangeExecuteRequest } from "./auth";
-import type { PasswordChangeChallengeResponse } from "./auth";
-import type { PasswordChangeChallengeRequest } from "./auth";
-import type { OpaqueZkppRegistrationFinishResponse } from "./auth";
-import type { OpaqueZkppRegistrationFinishRequest } from "./auth";
-import type { OpaqueZkppRegistrationStartResponse } from "./auth";
-import type { OpaqueZkppRegistrationStartRequest } from "./auth";
-import type { OpaqueLoginFinishResponse } from "./auth";
-import type { OpaqueLoginFinishRequest } from "./auth";
-import type { OpaqueLoginStartResponse } from "./auth";
-import type { OpaqueLoginStartRequest } from "./auth";
-import type { OpaqueRegistrationFinishResponse } from "./auth";
-import type { OpaqueRegistrationFinishRequest } from "./auth";
-import { stackIntercept } from "@protobuf-ts/runtime-rpc";
-import type { OpaqueRegistrationStartResponse } from "./auth";
-import type { OpaqueRegistrationStartRequest } from "./auth";
-import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
-import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
-/**
- * AuthService handles authentication flows.
- *
- * @generated from protobuf service sid.v1.authn.AuthService
- */
-export interface IAuthServiceClient {
-    /**
-     * OPAQUE password authentication (RFC 9807).
-     *
-     * @generated from protobuf rpc: OpaqueRegistrationStart
-     */
-    opaqueRegistrationStart(input: OpaqueRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationStartRequest, OpaqueRegistrationStartResponse>;
-    /**
-     * @generated from protobuf rpc: OpaqueRegistrationFinish
-     */
-    opaqueRegistrationFinish(input: OpaqueRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationFinishRequest, OpaqueRegistrationFinishResponse>;
-    /**
-     * @generated from protobuf rpc: OpaqueLoginStart
-     */
-    opaqueLoginStart(input: OpaqueLoginStartRequest, options?: RpcOptions): UnaryCall<OpaqueLoginStartRequest, OpaqueLoginStartResponse>;
-    /**
-     * @generated from protobuf rpc: OpaqueLoginFinish
-     */
-    opaqueLoginFinish(input: OpaqueLoginFinishRequest, options?: RpcOptions): UnaryCall<OpaqueLoginFinishRequest, OpaqueLoginFinishResponse>;
-    /**
-     * OPAQUE-ZKPP: OPAQUE with zero-knowledge password policy proof (Pallas curve).
-     *
-     * @generated from protobuf rpc: OpaqueZkppRegistrationStart
-     */
-    opaqueZkppRegistrationStart(input: OpaqueZkppRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationStartRequest, OpaqueZkppRegistrationStartResponse>;
-    /**
-     * @generated from protobuf rpc: OpaqueZkppRegistrationFinish
-     */
-    opaqueZkppRegistrationFinish(input: OpaqueZkppRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationFinishRequest, OpaqueZkppRegistrationFinishResponse>;
-    /**
-     * @generated from protobuf rpc: PasswordChangeChallenge
-     */
-    passwordChangeChallenge(input: PasswordChangeChallengeRequest, options?: RpcOptions): UnaryCall<PasswordChangeChallengeRequest, PasswordChangeChallengeResponse>;
-    /**
-     * @generated from protobuf rpc: PasswordChangeExecute
-     */
-    passwordChangeExecute(input: PasswordChangeExecuteRequest, options?: RpcOptions): UnaryCall<PasswordChangeExecuteRequest, PasswordChangeExecuteResponse>;
-    /**
-     * @generated from protobuf rpc: PasswordChangeFinish
-     */
-    passwordChangeFinish(input: PasswordChangeFinishRequest, options?: RpcOptions): UnaryCall<PasswordChangeFinishRequest, PasswordChangeFinishResponse>;
-    /**
-     * WebAuthn (passkeys).
-     *
-     * @generated from protobuf rpc: WebAuthnRegistrationStart
-     */
-    webAuthnRegistrationStart(input: WebAuthnRegistrationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationStartRequest, WebAuthnRegistrationStartResponse>;
-    /**
-     * @generated from protobuf rpc: WebAuthnRegistrationFinish
-     */
-    webAuthnRegistrationFinish(input: WebAuthnRegistrationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationFinishRequest, WebAuthnRegistrationFinishResponse>;
-    /**
-     * @generated from protobuf rpc: WebAuthnAuthenticationStart
-     */
-    webAuthnAuthenticationStart(input: WebAuthnAuthenticationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationStartRequest, WebAuthnAuthenticationStartResponse>;
-    /**
-     * @generated from protobuf rpc: WebAuthnAuthenticationFinish
-     */
-    webAuthnAuthenticationFinish(input: WebAuthnAuthenticationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationFinishRequest, WebAuthnAuthenticationFinishResponse>;
-    /**
-     * OAuth2 / OIDC flows.
-     *
-     * Every OAuth client belongs to exactly one logical OIDC issuer, and these
-     * are that issuer's endpoints: `/i/{issuer_handle}/oauth2/*`, as advertised
-     * in its discovery document. There is no issuer-less OAuth surface; SID's
-     * own sign-in sessions are issued by the authentication RPCs above, not
-     * here. The sign-in UI calls OAuth2Authorize with the signed-in user's
-     * token after consent and redirects the browser itself; the issuer's
-     * browser authorization endpoint (OidcProviderService) runs the same logic.
-     *
-     * @generated from protobuf rpc: OAuth2Authorize
-     */
-    oAuth2Authorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse>;
-    /**
-     *
-     * The token, introspection, revocation and device authorization RPCs have
-     * no HTTP binding: their HTTP form is fixed by the RFCs (form-encoded
-     * request, RFC error body and status), which OidcProviderService serves on
-     * the issuer's paths with the same logic. A refusal here is a canonical
-     * status whose ErrorInfo metadata `oauth_error` is the RFC 6749 §5.2 or
-     * RFC 8628 §3.5 error code. A confidential client authenticates with the
-     * secret in the body, or with HTTP Basic in the `authorization` metadata
-     * (RFC 6749 §2.3.1), never both.
-     *
-     * @generated from protobuf rpc: OAuth2Token
-     */
-    oAuth2Token(input: OAuth2TokenRequest, options?: RpcOptions): UnaryCall<OAuth2TokenRequest, OAuth2TokenResponse>;
-    /**
-     * @generated from protobuf rpc: OAuth2Introspect
-     */
-    oAuth2Introspect(input: OAuth2IntrospectRequest, options?: RpcOptions): UnaryCall<OAuth2IntrospectRequest, OAuth2IntrospectResponse>;
-    /**
-     * @generated from protobuf rpc: OAuth2Revoke
-     */
-    oAuth2Revoke(input: OAuth2RevokeRequest, options?: RpcOptions): UnaryCall<OAuth2RevokeRequest, OAuth2RevokeResponse>;
-    /**
-     * Device Authorization Grant (RFC 8628): the device starts here and polls
-     * OAuth2Token with the device_code grant (RFC 8628 §3.4).
-     *
-     * @generated from protobuf rpc: StartDeviceAuthorization
-     */
-    startDeviceAuthorization(input: DeviceAuthorizationRequest, options?: RpcOptions): UnaryCall<DeviceAuthorizationRequest, DeviceAuthorizationResponse>;
-    /**
-     * @generated from protobuf rpc: SubmitDeviceUserCode
-     */
-    submitDeviceUserCode(input: SubmitDeviceUserCodeRequest, options?: RpcOptions): UnaryCall<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse>;
-    // ── Magic Link (passwordless, corporate profiles) ──
-
-    /**
-     * @generated from protobuf rpc: RequestMagicLink
-     */
-    requestMagicLink(input: RequestMagicLinkRequest, options?: RpcOptions): UnaryCall<RequestMagicLinkRequest, RequestMagicLinkResponse>;
-    /**
-     * @generated from protobuf rpc: VerifyMagicLink
-     */
-    verifyMagicLink(input: VerifyMagicLinkRequest, options?: RpcOptions): UnaryCall<VerifyMagicLinkRequest, VerifyMagicLinkResponse>;
-    /**
-     * Legacy password migration (on-login OPAQUE re-registration).
-     *
-     * @generated from protobuf rpc: LegacyMigrateStart
-     */
-    legacyMigrateStart(input: LegacyMigrateStartRequest, options?: RpcOptions): UnaryCall<LegacyMigrateStartRequest, LegacyMigrateStartResponse>;
-    /**
-     * @generated from protobuf rpc: LegacyMigrateFinish
-     */
-    legacyMigrateFinish(input: LegacyMigrateFinishRequest, options?: RpcOptions): UnaryCall<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse>;
-    /**
-     * Session validation.
-     *
-     * @generated from protobuf rpc: ValidateSession
-     */
-    validateSession(input: ValidateSessionRequest, options?: RpcOptions): UnaryCall<ValidateSessionRequest, ValidateSessionResponse>;
-    /**
-     * Unified login flow: resolve principal → available auth methods.
-     *
-     * @generated from protobuf rpc: ResolvePrincipal
-     */
-    resolvePrincipal(input: ResolvePrincipalRequest, options?: RpcOptions): UnaryCall<ResolvePrincipalRequest, ResolvePrincipalResponse>;
-    /**
-     * ZKPP password policy: current policy version and parameters.
-     *
-     * @generated from protobuf rpc: GetZkppPolicy
-     */
-    getZkppPolicy(input: GetZkppPolicyRequest, options?: RpcOptions): UnaryCall<GetZkppPolicyRequest, GetZkppPolicyResponse>;
-    /**
-     * Submit a deferred ZK proof for a credential registered without WASM.
-     * Must be called within 24h of registration from a WASM-capable device.
-     *
-     * @generated from protobuf rpc: SubmitDeferredZkProof
-     */
-    submitDeferredZkProof(input: SubmitDeferredZkProofRequest, options?: RpcOptions): UnaryCall<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse>;
-    // ── MFA TOTP ──
-
-    /**
-     * @generated from protobuf rpc: StartTotpEnrollment
-     */
-    startTotpEnrollment(input: StartTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<StartTotpEnrollmentRequest, TotpEnrollmentChallenge>;
-    /**
-     * @generated from protobuf rpc: FinishTotpEnrollment
-     */
-    finishTotpEnrollment(input: FinishTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse>;
-    /**
-     * @generated from protobuf rpc: VerifyTotp
-     */
-    verifyTotp(input: VerifyTotpRequest, options?: RpcOptions): UnaryCall<VerifyTotpRequest, MfaVerifyResponse>;
-    // ── MFA SMS ──
-
-    /**
-     * @generated from protobuf rpc: VerifySmsMfa
-     */
-    verifySmsMfa(input: VerifySmsMfaRequest, options?: RpcOptions): UnaryCall<VerifySmsMfaRequest, MfaVerifyResponse>;
-    /**
-     * @generated from protobuf rpc: ResendSmsMfa
-     */
-    resendSmsMfa(input: ResendSmsMfaRequest, options?: RpcOptions): UnaryCall<ResendSmsMfaRequest, ResendSmsMfaResponse>;
-    // ── MFA Recovery Codes ──
-
-    /**
-     * @generated from protobuf rpc: GenerateRecoveryCodes
-     */
-    generateRecoveryCodes(input: GenerateRecoveryCodesRequest, options?: RpcOptions): UnaryCall<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse>;
-    /**
-     * @generated from protobuf rpc: VerifyRecoveryCode
-     */
-    verifyRecoveryCode(input: VerifyRecoveryCodeRequest, options?: RpcOptions): UnaryCall<VerifyRecoveryCodeRequest, MfaVerifyResponse>;
-    // ── OTP verification (email/phone, non-MFA) ──
-
-    /**
-     * @generated from protobuf rpc: RequestOtp
-     */
-    requestOtp(input: RequestOtpRequest, options?: RpcOptions): UnaryCall<RequestOtpRequest, RequestOtpResponse>;
-    /**
-     * @generated from protobuf rpc: VerifyOtp
-     */
-    verifyOtp(input: VerifyOtpRequest, options?: RpcOptions): UnaryCall<VerifyOtpRequest, VerifyOtpResponse>;
-    /**
-     * @generated from protobuf rpc: ResendOtp
-     */
-    resendOtp(input: ResendOtpRequest, options?: RpcOptions): UnaryCall<ResendOtpRequest, ResendOtpResponse>;
-    // ── Email/Phone verification ──
-
-    /**
-     * @generated from protobuf rpc: ResendEmailVerification
-     */
-    resendEmailVerification(input: ResendEmailVerificationRequest, options?: RpcOptions): UnaryCall<ResendEmailVerificationRequest, ResendEmailVerificationResponse>;
-    /**
-     * @generated from protobuf rpc: VerifyPhone
-     */
-    verifyPhone(input: VerifyPhoneRequest, options?: RpcOptions): UnaryCall<VerifyPhoneRequest, VerifyPhoneResponse>;
-    /**
-     * @generated from protobuf rpc: ResendPhoneVerification
-     */
-    resendPhoneVerification(input: ResendPhoneVerificationRequest, options?: RpcOptions): UnaryCall<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse>;
-    // ── IdP linking ──
-
-    /**
-     * @generated from protobuf rpc: ConfirmIdpLink
-     */
-    confirmIdpLink(input: ConfirmIdpLinkRequest, options?: RpcOptions): UnaryCall<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse>;
-    // ── Organization selector (multi-org login) ──
-
-    /**
-     * @generated from protobuf rpc: ListUserOrganizations
-     */
-    listUserOrganizations(input: ListUserOrganizationsRequest, options?: RpcOptions): UnaryCall<ListUserOrganizationsRequest, ListUserOrganizationsResponse>;
-    /**
-     * @generated from protobuf rpc: SelectOrganization
-     */
-    selectOrganization(input: SelectOrganizationRequest, options?: RpcOptions): UnaryCall<SelectOrganizationRequest, SelectOrganizationResponse>;
-    // ── Terms acceptance ──
-
-    /**
-     * @generated from protobuf rpc: GetTerms
-     */
-    getTerms(input: GetTermsRequest, options?: RpcOptions): UnaryCall<GetTermsRequest, GetTermsResponse>;
-    /**
-     * @generated from protobuf rpc: AcceptTerms
-     */
-    acceptTerms(input: AcceptTermsRequest, options?: RpcOptions): UnaryCall<AcceptTermsRequest, AcceptTermsResponse>;
-    // ── CIBA consent ──
-
-    /**
-     * @generated from protobuf rpc: ApproveCiba
-     */
-    approveCiba(input: ApproveCibaRequest, options?: RpcOptions): UnaryCall<ApproveCibaRequest, CibaConsentResponse>;
-    /**
-     * @generated from protobuf rpc: DenyCiba
-     */
-    denyCiba(input: DenyCibaRequest, options?: RpcOptions): UnaryCall<DenyCibaRequest, CibaConsentResponse>;
-    // ── Captcha ──
-
-    /**
-     * @generated from protobuf rpc: VerifyCaptcha
-     */
-    verifyCaptcha(input: VerifyCaptchaRequest, options?: RpcOptions): UnaryCall<VerifyCaptchaRequest, VerifyCaptchaResponse>;
-    // ── Dynamic prompt (custom auth steps) ──
-
-    /**
-     * @generated from protobuf rpc: GetDynamicPrompt
-     */
-    getDynamicPrompt(input: GetDynamicPromptRequest, options?: RpcOptions): UnaryCall<GetDynamicPromptRequest, DynamicPrompt>;
-    /**
-     * @generated from protobuf rpc: SubmitDynamicPrompt
-     */
-    submitDynamicPrompt(input: SubmitDynamicPromptRequest, options?: RpcOptions): UnaryCall<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse>;
-    // ── Step-up authentication ──
-
-    /**
-     * Generic step-up Phase 1: request challenge (WebAuthn). Skip for TOTP/recovery.
-     *
-     * @generated from protobuf rpc: RequestStepUp
-     */
-    requestStepUp(input: RequestStepUpRequest, options?: RpcOptions): UnaryCall<RequestStepUpRequest, StepUpChallenge>;
-    /**
-     * Generic step-up Phase 2: submit proof → elevate session → rotate token.
-     *
-     * @generated from protobuf rpc: CompleteStepUp
-     */
-    completeStepUp(input: CompleteStepUpRequest, options?: RpcOptions): UnaryCall<CompleteStepUpRequest, CompleteStepUpResponse>;
-    // ── MFA credential management ──
-
-    /**
-     * Delete an MFA credential (TOTP, WebAuthn, Recovery).
-     * Requires elevated session (step-up auth) before calling.
-     *
-     * @generated from protobuf rpc: DeleteMfaCredential
-     */
-    deleteMfaCredential(input: DeleteMfaCredentialRequest, options?: RpcOptions): UnaryCall<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse>;
-    // ── Account deletion confirmation ──
-
-    /**
-     * @generated from protobuf rpc: ConfirmAccountDeletion
-     */
-    confirmAccountDeletion(input: ConfirmAccountDeletionRequest, options?: RpcOptions): UnaryCall<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse>;
-    /**
-     * Password reset flow (magic link → new OPAQUE credential).
-     *
-     * @generated from protobuf rpc: RequestPasswordReset
-     */
-    requestPasswordReset(input: RequestPasswordResetRequest, options?: RpcOptions): UnaryCall<RequestPasswordResetRequest, RequestPasswordResetResponse>;
-    /**
-     * @generated from protobuf rpc: VerifyPasswordReset
-     */
-    verifyPasswordReset(input: VerifyPasswordResetRequest, options?: RpcOptions): UnaryCall<VerifyPasswordResetRequest, VerifyPasswordResetResponse>;
-    /**
-     * OPAQUE registration start of the replacement password, under the verified
-     * reset's operation.
-     *
-     * @generated from protobuf rpc: ExecutePasswordReset
-     */
-    executePasswordReset(input: ExecutePasswordResetRequest, options?: RpcOptions): UnaryCall<ExecutePasswordResetRequest, ExecutePasswordResetResponse>;
-    /**
-     * @generated from protobuf rpc: CompletePasswordReset
-     */
-    completePasswordReset(input: CompletePasswordResetRequest, options?: RpcOptions): UnaryCall<CompletePasswordResetRequest, CompletePasswordResetResponse>;
-}
-/**
- * AuthService handles authentication flows.
- *
- * @generated from protobuf service sid.v1.authn.AuthService
- */
-export class AuthServiceClient implements IAuthServiceClient, ServiceInfo {
-    typeName = AuthService.typeName;
-    methods = AuthService.methods;
-    options = AuthService.options;
-    constructor(private readonly _transport: RpcTransport) {
-    }
-    /**
-     * OPAQUE password authentication (RFC 9807).
-     *
-     * @generated from protobuf rpc: OpaqueRegistrationStart
-     */
-    opaqueRegistrationStart(input: OpaqueRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationStartRequest, OpaqueRegistrationStartResponse> {
-        const method = this.methods[0], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OpaqueRegistrationStartRequest, OpaqueRegistrationStartResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: OpaqueRegistrationFinish
-     */
-    opaqueRegistrationFinish(input: OpaqueRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueRegistrationFinishRequest, OpaqueRegistrationFinishResponse> {
-        const method = this.methods[1], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OpaqueRegistrationFinishRequest, OpaqueRegistrationFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: OpaqueLoginStart
-     */
-    opaqueLoginStart(input: OpaqueLoginStartRequest, options?: RpcOptions): UnaryCall<OpaqueLoginStartRequest, OpaqueLoginStartResponse> {
-        const method = this.methods[2], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OpaqueLoginStartRequest, OpaqueLoginStartResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: OpaqueLoginFinish
-     */
-    opaqueLoginFinish(input: OpaqueLoginFinishRequest, options?: RpcOptions): UnaryCall<OpaqueLoginFinishRequest, OpaqueLoginFinishResponse> {
-        const method = this.methods[3], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OpaqueLoginFinishRequest, OpaqueLoginFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * OPAQUE-ZKPP: OPAQUE with zero-knowledge password policy proof (Pallas curve).
-     *
-     * @generated from protobuf rpc: OpaqueZkppRegistrationStart
-     */
-    opaqueZkppRegistrationStart(input: OpaqueZkppRegistrationStartRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationStartRequest, OpaqueZkppRegistrationStartResponse> {
-        const method = this.methods[4], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OpaqueZkppRegistrationStartRequest, OpaqueZkppRegistrationStartResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: OpaqueZkppRegistrationFinish
-     */
-    opaqueZkppRegistrationFinish(input: OpaqueZkppRegistrationFinishRequest, options?: RpcOptions): UnaryCall<OpaqueZkppRegistrationFinishRequest, OpaqueZkppRegistrationFinishResponse> {
-        const method = this.methods[5], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OpaqueZkppRegistrationFinishRequest, OpaqueZkppRegistrationFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: PasswordChangeChallenge
-     */
-    passwordChangeChallenge(input: PasswordChangeChallengeRequest, options?: RpcOptions): UnaryCall<PasswordChangeChallengeRequest, PasswordChangeChallengeResponse> {
-        const method = this.methods[6], opt = this._transport.mergeOptions(options);
-        return stackIntercept<PasswordChangeChallengeRequest, PasswordChangeChallengeResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: PasswordChangeExecute
-     */
-    passwordChangeExecute(input: PasswordChangeExecuteRequest, options?: RpcOptions): UnaryCall<PasswordChangeExecuteRequest, PasswordChangeExecuteResponse> {
-        const method = this.methods[7], opt = this._transport.mergeOptions(options);
-        return stackIntercept<PasswordChangeExecuteRequest, PasswordChangeExecuteResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: PasswordChangeFinish
-     */
-    passwordChangeFinish(input: PasswordChangeFinishRequest, options?: RpcOptions): UnaryCall<PasswordChangeFinishRequest, PasswordChangeFinishResponse> {
-        const method = this.methods[8], opt = this._transport.mergeOptions(options);
-        return stackIntercept<PasswordChangeFinishRequest, PasswordChangeFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * WebAuthn (passkeys).
-     *
-     * @generated from protobuf rpc: WebAuthnRegistrationStart
-     */
-    webAuthnRegistrationStart(input: WebAuthnRegistrationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationStartRequest, WebAuthnRegistrationStartResponse> {
-        const method = this.methods[9], opt = this._transport.mergeOptions(options);
-        return stackIntercept<WebAuthnRegistrationStartRequest, WebAuthnRegistrationStartResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: WebAuthnRegistrationFinish
-     */
-    webAuthnRegistrationFinish(input: WebAuthnRegistrationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnRegistrationFinishRequest, WebAuthnRegistrationFinishResponse> {
-        const method = this.methods[10], opt = this._transport.mergeOptions(options);
-        return stackIntercept<WebAuthnRegistrationFinishRequest, WebAuthnRegistrationFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: WebAuthnAuthenticationStart
-     */
-    webAuthnAuthenticationStart(input: WebAuthnAuthenticationStartRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationStartRequest, WebAuthnAuthenticationStartResponse> {
-        const method = this.methods[11], opt = this._transport.mergeOptions(options);
-        return stackIntercept<WebAuthnAuthenticationStartRequest, WebAuthnAuthenticationStartResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: WebAuthnAuthenticationFinish
-     */
-    webAuthnAuthenticationFinish(input: WebAuthnAuthenticationFinishRequest, options?: RpcOptions): UnaryCall<WebAuthnAuthenticationFinishRequest, WebAuthnAuthenticationFinishResponse> {
-        const method = this.methods[12], opt = this._transport.mergeOptions(options);
-        return stackIntercept<WebAuthnAuthenticationFinishRequest, WebAuthnAuthenticationFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * OAuth2 / OIDC flows.
-     *
-     * Every OAuth client belongs to exactly one logical OIDC issuer, and these
-     * are that issuer's endpoints: `/i/{issuer_handle}/oauth2/*`, as advertised
-     * in its discovery document. There is no issuer-less OAuth surface; SID's
-     * own sign-in sessions are issued by the authentication RPCs above, not
-     * here. The sign-in UI calls OAuth2Authorize with the signed-in user's
-     * token after consent and redirects the browser itself; the issuer's
-     * browser authorization endpoint (OidcProviderService) runs the same logic.
-     *
-     * @generated from protobuf rpc: OAuth2Authorize
-     */
-    oAuth2Authorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse> {
-        const method = this.methods[13], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OAuth2AuthorizeRequest, OAuth2AuthorizeResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     *
-     * The token, introspection, revocation and device authorization RPCs have
-     * no HTTP binding: their HTTP form is fixed by the RFCs (form-encoded
-     * request, RFC error body and status), which OidcProviderService serves on
-     * the issuer's paths with the same logic. A refusal here is a canonical
-     * status whose ErrorInfo metadata `oauth_error` is the RFC 6749 §5.2 or
-     * RFC 8628 §3.5 error code. A confidential client authenticates with the
-     * secret in the body, or with HTTP Basic in the `authorization` metadata
-     * (RFC 6749 §2.3.1), never both.
-     *
-     * @generated from protobuf rpc: OAuth2Token
-     */
-    oAuth2Token(input: OAuth2TokenRequest, options?: RpcOptions): UnaryCall<OAuth2TokenRequest, OAuth2TokenResponse> {
-        const method = this.methods[14], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OAuth2TokenRequest, OAuth2TokenResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: OAuth2Introspect
-     */
-    oAuth2Introspect(input: OAuth2IntrospectRequest, options?: RpcOptions): UnaryCall<OAuth2IntrospectRequest, OAuth2IntrospectResponse> {
-        const method = this.methods[15], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OAuth2IntrospectRequest, OAuth2IntrospectResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: OAuth2Revoke
-     */
-    oAuth2Revoke(input: OAuth2RevokeRequest, options?: RpcOptions): UnaryCall<OAuth2RevokeRequest, OAuth2RevokeResponse> {
-        const method = this.methods[16], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OAuth2RevokeRequest, OAuth2RevokeResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Device Authorization Grant (RFC 8628): the device starts here and polls
-     * OAuth2Token with the device_code grant (RFC 8628 §3.4).
-     *
-     * @generated from protobuf rpc: StartDeviceAuthorization
-     */
-    startDeviceAuthorization(input: DeviceAuthorizationRequest, options?: RpcOptions): UnaryCall<DeviceAuthorizationRequest, DeviceAuthorizationResponse> {
-        const method = this.methods[17], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeviceAuthorizationRequest, DeviceAuthorizationResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: SubmitDeviceUserCode
-     */
-    submitDeviceUserCode(input: SubmitDeviceUserCodeRequest, options?: RpcOptions): UnaryCall<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse> {
-        const method = this.methods[18], opt = this._transport.mergeOptions(options);
-        return stackIntercept<SubmitDeviceUserCodeRequest, SubmitDeviceUserCodeResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Magic Link (passwordless, corporate profiles) ──
-
-    /**
-     * @generated from protobuf rpc: RequestMagicLink
-     */
-    requestMagicLink(input: RequestMagicLinkRequest, options?: RpcOptions): UnaryCall<RequestMagicLinkRequest, RequestMagicLinkResponse> {
-        const method = this.methods[19], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RequestMagicLinkRequest, RequestMagicLinkResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: VerifyMagicLink
-     */
-    verifyMagicLink(input: VerifyMagicLinkRequest, options?: RpcOptions): UnaryCall<VerifyMagicLinkRequest, VerifyMagicLinkResponse> {
-        const method = this.methods[20], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyMagicLinkRequest, VerifyMagicLinkResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Legacy password migration (on-login OPAQUE re-registration).
-     *
-     * @generated from protobuf rpc: LegacyMigrateStart
-     */
-    legacyMigrateStart(input: LegacyMigrateStartRequest, options?: RpcOptions): UnaryCall<LegacyMigrateStartRequest, LegacyMigrateStartResponse> {
-        const method = this.methods[21], opt = this._transport.mergeOptions(options);
-        return stackIntercept<LegacyMigrateStartRequest, LegacyMigrateStartResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: LegacyMigrateFinish
-     */
-    legacyMigrateFinish(input: LegacyMigrateFinishRequest, options?: RpcOptions): UnaryCall<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse> {
-        const method = this.methods[22], opt = this._transport.mergeOptions(options);
-        return stackIntercept<LegacyMigrateFinishRequest, LegacyMigrateFinishResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Session validation.
-     *
-     * @generated from protobuf rpc: ValidateSession
-     */
-    validateSession(input: ValidateSessionRequest, options?: RpcOptions): UnaryCall<ValidateSessionRequest, ValidateSessionResponse> {
-        const method = this.methods[23], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ValidateSessionRequest, ValidateSessionResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Unified login flow: resolve principal → available auth methods.
-     *
-     * @generated from protobuf rpc: ResolvePrincipal
-     */
-    resolvePrincipal(input: ResolvePrincipalRequest, options?: RpcOptions): UnaryCall<ResolvePrincipalRequest, ResolvePrincipalResponse> {
-        const method = this.methods[24], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ResolvePrincipalRequest, ResolvePrincipalResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ZKPP password policy: current policy version and parameters.
-     *
-     * @generated from protobuf rpc: GetZkppPolicy
-     */
-    getZkppPolicy(input: GetZkppPolicyRequest, options?: RpcOptions): UnaryCall<GetZkppPolicyRequest, GetZkppPolicyResponse> {
-        const method = this.methods[25], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetZkppPolicyRequest, GetZkppPolicyResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Submit a deferred ZK proof for a credential registered without WASM.
-     * Must be called within 24h of registration from a WASM-capable device.
-     *
-     * @generated from protobuf rpc: SubmitDeferredZkProof
-     */
-    submitDeferredZkProof(input: SubmitDeferredZkProofRequest, options?: RpcOptions): UnaryCall<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse> {
-        const method = this.methods[26], opt = this._transport.mergeOptions(options);
-        return stackIntercept<SubmitDeferredZkProofRequest, SubmitDeferredZkProofResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── MFA TOTP ──
-
-    /**
-     * @generated from protobuf rpc: StartTotpEnrollment
-     */
-    startTotpEnrollment(input: StartTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<StartTotpEnrollmentRequest, TotpEnrollmentChallenge> {
-        const method = this.methods[27], opt = this._transport.mergeOptions(options);
-        return stackIntercept<StartTotpEnrollmentRequest, TotpEnrollmentChallenge>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: FinishTotpEnrollment
-     */
-    finishTotpEnrollment(input: FinishTotpEnrollmentRequest, options?: RpcOptions): UnaryCall<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse> {
-        const method = this.methods[28], opt = this._transport.mergeOptions(options);
-        return stackIntercept<FinishTotpEnrollmentRequest, FinishTotpEnrollmentResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: VerifyTotp
-     */
-    verifyTotp(input: VerifyTotpRequest, options?: RpcOptions): UnaryCall<VerifyTotpRequest, MfaVerifyResponse> {
-        const method = this.methods[29], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyTotpRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── MFA SMS ──
-
-    /**
-     * @generated from protobuf rpc: VerifySmsMfa
-     */
-    verifySmsMfa(input: VerifySmsMfaRequest, options?: RpcOptions): UnaryCall<VerifySmsMfaRequest, MfaVerifyResponse> {
-        const method = this.methods[30], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifySmsMfaRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: ResendSmsMfa
-     */
-    resendSmsMfa(input: ResendSmsMfaRequest, options?: RpcOptions): UnaryCall<ResendSmsMfaRequest, ResendSmsMfaResponse> {
-        const method = this.methods[31], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ResendSmsMfaRequest, ResendSmsMfaResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── MFA Recovery Codes ──
-
-    /**
-     * @generated from protobuf rpc: GenerateRecoveryCodes
-     */
-    generateRecoveryCodes(input: GenerateRecoveryCodesRequest, options?: RpcOptions): UnaryCall<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse> {
-        const method = this.methods[32], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GenerateRecoveryCodesRequest, GenerateRecoveryCodesResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: VerifyRecoveryCode
-     */
-    verifyRecoveryCode(input: VerifyRecoveryCodeRequest, options?: RpcOptions): UnaryCall<VerifyRecoveryCodeRequest, MfaVerifyResponse> {
-        const method = this.methods[33], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyRecoveryCodeRequest, MfaVerifyResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── OTP verification (email/phone, non-MFA) ──
-
-    /**
-     * @generated from protobuf rpc: RequestOtp
-     */
-    requestOtp(input: RequestOtpRequest, options?: RpcOptions): UnaryCall<RequestOtpRequest, RequestOtpResponse> {
-        const method = this.methods[34], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RequestOtpRequest, RequestOtpResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: VerifyOtp
-     */
-    verifyOtp(input: VerifyOtpRequest, options?: RpcOptions): UnaryCall<VerifyOtpRequest, VerifyOtpResponse> {
-        const method = this.methods[35], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyOtpRequest, VerifyOtpResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: ResendOtp
-     */
-    resendOtp(input: ResendOtpRequest, options?: RpcOptions): UnaryCall<ResendOtpRequest, ResendOtpResponse> {
-        const method = this.methods[36], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ResendOtpRequest, ResendOtpResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Email/Phone verification ──
-
-    /**
-     * @generated from protobuf rpc: ResendEmailVerification
-     */
-    resendEmailVerification(input: ResendEmailVerificationRequest, options?: RpcOptions): UnaryCall<ResendEmailVerificationRequest, ResendEmailVerificationResponse> {
-        const method = this.methods[37], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ResendEmailVerificationRequest, ResendEmailVerificationResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: VerifyPhone
-     */
-    verifyPhone(input: VerifyPhoneRequest, options?: RpcOptions): UnaryCall<VerifyPhoneRequest, VerifyPhoneResponse> {
-        const method = this.methods[38], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyPhoneRequest, VerifyPhoneResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: ResendPhoneVerification
-     */
-    resendPhoneVerification(input: ResendPhoneVerificationRequest, options?: RpcOptions): UnaryCall<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse> {
-        const method = this.methods[39], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ResendPhoneVerificationRequest, ResendPhoneVerificationResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── IdP linking ──
-
-    /**
-     * @generated from protobuf rpc: ConfirmIdpLink
-     */
-    confirmIdpLink(input: ConfirmIdpLinkRequest, options?: RpcOptions): UnaryCall<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse> {
-        const method = this.methods[40], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ConfirmIdpLinkRequest, ConfirmIdpLinkResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Organization selector (multi-org login) ──
-
-    /**
-     * @generated from protobuf rpc: ListUserOrganizations
-     */
-    listUserOrganizations(input: ListUserOrganizationsRequest, options?: RpcOptions): UnaryCall<ListUserOrganizationsRequest, ListUserOrganizationsResponse> {
-        const method = this.methods[41], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListUserOrganizationsRequest, ListUserOrganizationsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: SelectOrganization
-     */
-    selectOrganization(input: SelectOrganizationRequest, options?: RpcOptions): UnaryCall<SelectOrganizationRequest, SelectOrganizationResponse> {
-        const method = this.methods[42], opt = this._transport.mergeOptions(options);
-        return stackIntercept<SelectOrganizationRequest, SelectOrganizationResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Terms acceptance ──
-
-    /**
-     * @generated from protobuf rpc: GetTerms
-     */
-    getTerms(input: GetTermsRequest, options?: RpcOptions): UnaryCall<GetTermsRequest, GetTermsResponse> {
-        const method = this.methods[43], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetTermsRequest, GetTermsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: AcceptTerms
-     */
-    acceptTerms(input: AcceptTermsRequest, options?: RpcOptions): UnaryCall<AcceptTermsRequest, AcceptTermsResponse> {
-        const method = this.methods[44], opt = this._transport.mergeOptions(options);
-        return stackIntercept<AcceptTermsRequest, AcceptTermsResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── CIBA consent ──
-
-    /**
-     * @generated from protobuf rpc: ApproveCiba
-     */
-    approveCiba(input: ApproveCibaRequest, options?: RpcOptions): UnaryCall<ApproveCibaRequest, CibaConsentResponse> {
-        const method = this.methods[45], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ApproveCibaRequest, CibaConsentResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: DenyCiba
-     */
-    denyCiba(input: DenyCibaRequest, options?: RpcOptions): UnaryCall<DenyCibaRequest, CibaConsentResponse> {
-        const method = this.methods[46], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DenyCibaRequest, CibaConsentResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Captcha ──
-
-    /**
-     * @generated from protobuf rpc: VerifyCaptcha
-     */
-    verifyCaptcha(input: VerifyCaptchaRequest, options?: RpcOptions): UnaryCall<VerifyCaptchaRequest, VerifyCaptchaResponse> {
-        const method = this.methods[47], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyCaptchaRequest, VerifyCaptchaResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Dynamic prompt (custom auth steps) ──
-
-    /**
-     * @generated from protobuf rpc: GetDynamicPrompt
-     */
-    getDynamicPrompt(input: GetDynamicPromptRequest, options?: RpcOptions): UnaryCall<GetDynamicPromptRequest, DynamicPrompt> {
-        const method = this.methods[48], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetDynamicPromptRequest, DynamicPrompt>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: SubmitDynamicPrompt
-     */
-    submitDynamicPrompt(input: SubmitDynamicPromptRequest, options?: RpcOptions): UnaryCall<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse> {
-        const method = this.methods[49], opt = this._transport.mergeOptions(options);
-        return stackIntercept<SubmitDynamicPromptRequest, SubmitDynamicPromptResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Step-up authentication ──
-
-    /**
-     * Generic step-up Phase 1: request challenge (WebAuthn). Skip for TOTP/recovery.
-     *
-     * @generated from protobuf rpc: RequestStepUp
-     */
-    requestStepUp(input: RequestStepUpRequest, options?: RpcOptions): UnaryCall<RequestStepUpRequest, StepUpChallenge> {
-        const method = this.methods[50], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RequestStepUpRequest, StepUpChallenge>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Generic step-up Phase 2: submit proof → elevate session → rotate token.
-     *
-     * @generated from protobuf rpc: CompleteStepUp
-     */
-    completeStepUp(input: CompleteStepUpRequest, options?: RpcOptions): UnaryCall<CompleteStepUpRequest, CompleteStepUpResponse> {
-        const method = this.methods[51], opt = this._transport.mergeOptions(options);
-        return stackIntercept<CompleteStepUpRequest, CompleteStepUpResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── MFA credential management ──
-
-    /**
-     * Delete an MFA credential (TOTP, WebAuthn, Recovery).
-     * Requires elevated session (step-up auth) before calling.
-     *
-     * @generated from protobuf rpc: DeleteMfaCredential
-     */
-    deleteMfaCredential(input: DeleteMfaCredentialRequest, options?: RpcOptions): UnaryCall<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse> {
-        const method = this.methods[52], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteMfaCredentialRequest, DeleteMfaCredentialResponse>("unary", this._transport, method, opt, input);
-    }
-    // ── Account deletion confirmation ──
-
-    /**
-     * @generated from protobuf rpc: ConfirmAccountDeletion
-     */
-    confirmAccountDeletion(input: ConfirmAccountDeletionRequest, options?: RpcOptions): UnaryCall<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse> {
-        const method = this.methods[53], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ConfirmAccountDeletionRequest, ConfirmAccountDeletionResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Password reset flow (magic link → new OPAQUE credential).
-     *
-     * @generated from protobuf rpc: RequestPasswordReset
-     */
-    requestPasswordReset(input: RequestPasswordResetRequest, options?: RpcOptions): UnaryCall<RequestPasswordResetRequest, RequestPasswordResetResponse> {
-        const method = this.methods[54], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RequestPasswordResetRequest, RequestPasswordResetResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: VerifyPasswordReset
-     */
-    verifyPasswordReset(input: VerifyPasswordResetRequest, options?: RpcOptions): UnaryCall<VerifyPasswordResetRequest, VerifyPasswordResetResponse> {
-        const method = this.methods[55], opt = this._transport.mergeOptions(options);
-        return stackIntercept<VerifyPasswordResetRequest, VerifyPasswordResetResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * OPAQUE registration start of the replacement password, under the verified
-     * reset's operation.
-     *
-     * @generated from protobuf rpc: ExecutePasswordReset
-     */
-    executePasswordReset(input: ExecutePasswordResetRequest, options?: RpcOptions): UnaryCall<ExecutePasswordResetRequest, ExecutePasswordResetResponse> {
-        const method = this.methods[56], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ExecutePasswordResetRequest, ExecutePasswordResetResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * @generated from protobuf rpc: CompletePasswordReset
-     */
-    completePasswordReset(input: CompletePasswordResetRequest, options?: RpcOptions): UnaryCall<CompletePasswordResetRequest, CompletePasswordResetResponse> {
-        const method = this.methods[57], opt = this._transport.mergeOptions(options);
-        return stackIntercept<CompletePasswordResetRequest, CompletePasswordResetResponse>("unary", this._transport, method, opt, input);
-    }
-}