@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/HttpApi/Api.d.ts

@@ -0,0 +1,1956 @@
+import { Effect, Layer, Redacted } from "effect";
+import type { Duration, Schema } from "effect";
+import type { HttpServerRequest } from "effect/unstable/http";
+import { HttpServerResponse } from "effect/unstable/http";
+import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";
+import { ApiKeyId } from "../ApiKey.js";
+import type { ApiKeyCreateForUserInput, ApiKeyManagementRevokeInput, ApiKeyManagementService } from "../ApiKey.js";
+import type { JwtAudience, JwtIssueInput, JwtIssuerService, JwtRevokeJwtIdInput, JwtRevocationService, JwtVerifyInput } from "../Jwt.js";
+import { AuthFlow, AuthFlowState, AuthResult } from "../AuthFlow.js";
+import type { AuthFlowService, AuthFlowStateService, LoginApprovalFinalizeService } from "../AuthFlow.js";
+import { EmailOtpLogin } from "../EmailOtp.js";
+import type { EmailOtpLoginService, EmailOtpStartInput, EmailOtpVerifyInput } from "../EmailOtp.js";
+import { EmailVerification, EmailVerificationFlow } from "../EmailVerification.js";
+import type { EmailVerificationFlowService, EmailVerificationService, EmailVerificationIssueInput, EmailVerificationVerifyInput } from "../EmailVerification.js";
+import type { Email, OAuthProviderId, UnixMillis, UserId } from "../Identifiers.js";
+import { LoginApproval } from "../LoginApproval.js";
+import type { LoginApprovalReviewService, LoginApprovalService, LoginApprovalVerifyInput } from "../LoginApproval.js";
+import type { LoginRequestContext } from "../LoginRisk.js";
+import type { LoginNotificationReportInput, LoginNotificationService } from "../LoginNotification.js";
+import { MagicLinkLogin } from "../MagicLink.js";
+import type { MagicLinkLoginService, MagicLinkStartInput, MagicLinkVerifyInput } from "../MagicLink.js";
+import type { OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingService, OAuthAuthorizationStartInput, OAuthCallbackInput, OAuthClientAuthentication, OAuthCodeVerifier, OAuthLinkConfirmationConfirmInput, OAuthLinkConfirmationInspectInput, OAuthLinkConfirmationService, OAuthLinkConfirmationStartInput, OAuthProviderConfig, OAuthProvidersService, OAuthStateService, ConfirmedOAuthLinkConfirmation, PendingOAuthLinkConfirmation, StartedOAuthAuthorization, StartedOAuthLinkConfirmation } from "../OAuth.js";
+import { PasswordLogin, PasswordManagement, PasswordRegistration, PasswordReset } from "../Password.js";
+import { PasskeyCredentialId } from "../Passkey.js";
+import type { FinishedPasskeyAuthentication, PasskeyAttestation, PasskeyAuthenticationFinishInput, PasskeyAuthenticationStartInput, PasskeyAuthenticatorSelection, PasskeyCredentialManagementService, PasskeyOptionsService, PasskeyPublicKeyCredentialParameters, PasskeyRelyingParty, PasskeyUserVerification, PasskeyVerificationService } from "../Passkey.js";
+import type { PasswordChangeInput, PasswordManagementService, PasswordLoginService, PasswordRegistrationService, PasswordResetService, PasswordResetStartInput, PasswordResetVerifyInput, PasswordSetInput, PasswordSignInInput, PasswordSignUpInput } from "../Password.js";
+import type { RecoveryCodeGenerateForUserInput, RecoveryCodeManagementRevokeInput, RecoveryCodeManagementService, RecoveryCodeVerifyForUserInput } from "../RecoveryCode.js";
+import type { RefreshTokenInfo, RefreshTokenManagementService, RefreshTokenRotateInput } from "../RefreshToken.js";
+import { SessionCookie, Sessions } from "../Sessions.js";
+import type { AuthMethodReference, CurrentSessionShape, SessionClaims, SessionCookieService, SessionCreateInput, SessionsService, ValidatedSession } from "../Sessions.js";
+import { SecurityTimelineStore } from "../SecurityTimeline.js";
+import type { SecurityTimelineEvent, SecurityTimelineStoreService } from "../SecurityTimeline.js";
+import { UserStore } from "../Storage.js";
+import type { UserStoreService } from "../Storage.js";
+import type { TotpAlgorithm, TotpEnrollmentConfirmInput, TotpEnrollmentStartInput, TotpFactorManagementService, TotpFactorManagementRevokeInput, TotpVerifyForUserInput } from "../Totp.js";
+import { TrustedDeviceStore } from "../TrustedDevice.js";
+import type { TrustedDeviceRecord, TrustedDeviceCookieService, TrustedDeviceService, TrustedDeviceStoreService } from "../TrustedDevice.js";
+import { AuthBadRequestError, AuthEmailAlreadyRegisteredError, AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError, AuthRateLimitedError, AuthSchemaErrorMiddleware, AuthUnauthenticatedError } from "./Errors.js";
+import type { ApiKeyCreateBody, ApiKeyRevokeBody, EmailOtpStartBody, EmailOtpVerifyBody, EmailVerificationStartBody, EmailVerificationVerifyBody, LoginApprovalApproveBody, LoginApprovalFinalizeBody, LoginNotificationReportBody, LoginApprovalReviewStatusBody, JwtIntrospectBody, JwtRevokeBody, MagicLinkStartBody, MagicLinkVerifyBody, MfaOptionsBody, OAuthAccountUnlinkBody, OAuthAccountUnlinkResolutionBody, OAuthAuthorizationCallbackBody, OAuthAuthorizationStartBody, OAuthLinkConfirmationConfirmBody, OAuthLinkConfirmationConfirmedBody, OAuthLinkConfirmationInspectBody, OAuthLinkConfirmationPendingBody, OAuthLinkConfirmationStartBody, OAuthLinkConfirmationStartedBody, PasskeyAuthenticationFinishBody, PasskeyAuthenticationStartBody, PasskeyCredentialRevokeBody, PasskeyMfaStartBody, PasskeyMfaVerifyBody, PasskeyRegistrationFinishBody, PasskeyRegistrationStartBody, PasswordChangeBody, PasswordResetStartBody, PasswordResetVerifyBody, PasswordSetBody, SessionRevokeBody, PasswordSignInBody, PasswordSignUpBody, RecoveryCodeGenerateBody, RecoveryCodeMfaVerifyBody, RecoveryCodeMfaVerifyForFlowBody, RefreshTokenRefreshBody, RecoveryCodeRevokeBody, RecoveryCodeVerifyBody, SecurityTimelineListQuery, StepUpPasskeyStartBody, StepUpPasskeyVerifyBody, StepUpRecoveryCodeVerifyBody, StepUpTotpVerifyBody, TrustedDeviceRevokeBody, TotpEnrollmentConfirmBody, TotpEnrollmentStartBody, TotpFactorRevokeBody, TotpMfaVerifyBody, TotpMfaVerifyForFlowBody, TotpVerifyBody } from "./Schemas.js";
+import { AuthApiRateLimit, AuthOriginCheckMiddleware, AuthRateLimitMiddleware } from "./Security.js";
+import type { AuthApiRateLimitService } from "./Security.js";
+import { AuthHttp } from "./Transport.js";
+import type { AuthHttpService, LoginApprovalPendingCookieService } from "./Transport.js";
+export declare const passwordSignInInput: (payload: Schema.Schema.Type<typeof PasswordSignInBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => PasswordSignInInput;
+export declare const passwordSignUpInput: (payload: Schema.Schema.Type<typeof PasswordSignUpBody>, request?: LoginRequestContext) => PasswordSignUpInput;
+export declare const passwordResetStartInput: (payload: Schema.Schema.Type<typeof PasswordResetStartBody>) => PasswordResetStartInput;
+export declare const passwordResetVerifyInput: (payload: Schema.Schema.Type<typeof PasswordResetVerifyBody>) => PasswordResetVerifyInput;
+export declare const passwordSetInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasswordSetBody>) => PasswordSetInput;
+export declare const passwordChangeInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasswordChangeBody>) => PasswordChangeInput;
+export declare const emailVerificationStartInput: (payload: Schema.Schema.Type<typeof EmailVerificationStartBody>) => EmailVerificationIssueInput;
+export declare const emailVerificationVerifyInput: (payload: Schema.Schema.Type<typeof EmailVerificationVerifyBody>) => EmailVerificationVerifyInput;
+export declare const emailOtpStartInput: (payload: Schema.Schema.Type<typeof EmailOtpStartBody>) => EmailOtpStartInput;
+export declare const emailOtpVerifyInput: (payload: Schema.Schema.Type<typeof EmailOtpVerifyBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => EmailOtpVerifyInput;
+export declare const magicLinkStartInput: (payload: Schema.Schema.Type<typeof MagicLinkStartBody>) => MagicLinkStartInput;
+export declare const magicLinkVerifyInput: (payload: Schema.Schema.Type<typeof MagicLinkVerifyBody>, trustedDeviceToken?: Redacted.Redacted<string>, request?: LoginRequestContext) => MagicLinkVerifyInput;
+export interface OAuthAuthorizationCodeVerifierStoreInput {
+    readonly payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>;
+    readonly started: StartedOAuthAuthorization;
+}
+export interface OAuthAuthorizationStartHttpOptions {
+    readonly ttl?: Duration.Duration;
+    readonly storeCodeVerifier?: (input: OAuthAuthorizationCodeVerifierStoreInput) => Effect.Effect<void, unknown>;
+}
+export interface OAuthAuthorizationCallbackHttpOptions {
+    readonly provider: OAuthProviderConfig;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly redirectUri?: string;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly tokenParams?: Readonly<Record<string, string>>;
+}
+export type OAuthAuthorizationCallbackFieldValue = string | readonly string[] | null | undefined;
+export interface OAuthAuthorizationCallbackSearchParams {
+    readonly get: (name: string) => string | null;
+}
+export type OAuthAuthorizationCallbackFields = OAuthAuthorizationCallbackSearchParams | Readonly<Record<string, OAuthAuthorizationCallbackFieldValue>>;
+export interface OAuthAuthorizationCallbackPayloadInput {
+    readonly providerId: OAuthProviderId;
+    readonly fields: OAuthAuthorizationCallbackFields;
+}
+export interface OAuthLinkConfirmationStartHttpInput {
+    readonly payload: Schema.Schema.Type<typeof OAuthLinkConfirmationStartBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+}
+export interface OAuthLinkConfirmationStartedHttpInput extends OAuthLinkConfirmationStartHttpInput {
+    readonly started: StartedOAuthLinkConfirmation;
+}
+export interface OAuthLinkConfirmationCurrentUserHttpInput {
+    readonly payload: Schema.Schema.Type<typeof OAuthLinkConfirmationConfirmBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+}
+export interface OAuthLinkConfirmationAfterConfirmHttpInput extends OAuthLinkConfirmationCurrentUserHttpInput {
+    readonly confirmed: ConfirmedOAuthLinkConfirmation;
+}
+export interface OAuthLinkConfirmationStartHttpOptions {
+    readonly ttl?: Duration.Duration;
+    readonly startInput?: (input: OAuthLinkConfirmationStartHttpInput) => Effect.Effect<OAuthLinkConfirmationStartInput, unknown>;
+    readonly onStarted?: (input: OAuthLinkConfirmationStartedHttpInput) => Effect.Effect<void, unknown>;
+}
+export interface OAuthLinkConfirmationConfirmHttpOptions {
+    readonly currentUserId?: (input: OAuthLinkConfirmationCurrentUserHttpInput) => Effect.Effect<UserId | undefined, unknown>;
+    readonly linkAfterConfirm?: (input: OAuthLinkConfirmationAfterConfirmHttpInput) => Effect.Effect<void, unknown>;
+}
+export declare const oauthAuthorizationStartInput: (payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>, provider: OAuthProviderConfig, options?: OAuthAuthorizationStartHttpOptions) => OAuthAuthorizationStartInput;
+export declare const oauthAuthorizationStartedHttpBody: (started: StartedOAuthAuthorization) => {
+    redirectUri: string;
+    scopes: readonly string[];
+    nonce?: import("../OAuth.js").OAuthNonce | undefined;
+    providerId: OAuthProviderId;
+    authorizationUrl: string;
+    state: import("../OAuth.js").OAuthStateToken;
+    challengeId: import("../Identifiers.js").ChallengeId;
+    expiresAt: UnixMillis;
+    codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
+    codeChallengeMethod: "S256";
+};
+export declare const oauthLinkConfirmationStartInput: (payload: Schema.Schema.Type<typeof OAuthLinkConfirmationStartBody>, options?: Pick<OAuthLinkConfirmationStartHttpOptions, "ttl">) => Effect.Effect<OAuthLinkConfirmationStartInput, AuthBadRequestError>;
+export declare const oauthLinkConfirmationInspectInput: (payload: Schema.Schema.Type<typeof OAuthLinkConfirmationInspectBody>) => OAuthLinkConfirmationInspectInput;
+export declare const oauthLinkConfirmationConfirmInput: (payload: Schema.Schema.Type<typeof OAuthLinkConfirmationConfirmBody>, currentUserId?: UserId) => OAuthLinkConfirmationConfirmInput;
+export declare const oauthLinkConfirmationStartedHttpBody: (started: StartedOAuthLinkConfirmation) => Schema.Schema.Type<typeof OAuthLinkConfirmationStartedBody>;
+export declare const oauthLinkConfirmationPendingHttpBody: (pending: PendingOAuthLinkConfirmation) => Schema.Schema.Type<typeof OAuthLinkConfirmationPendingBody>;
+export declare const oauthAuthorizationCallbackQueryPayload: (input: OAuthAuthorizationCallbackPayloadInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, AuthBadRequestError>;
+export declare const oauthAuthorizationCallbackFormPostPayload: (input: OAuthAuthorizationCallbackPayloadInput) => Effect.Effect<Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, AuthBadRequestError>;
+export declare const oauthAuthorizationCallbackInput: (payload: Schema.Schema.Type<typeof OAuthAuthorizationCallbackBody>, options: OAuthAuthorizationCallbackHttpOptions) => Effect.Effect<OAuthCallbackInput, AuthBadRequestError>;
+export interface OAuthAccountUnlinkStepUpHttpInput {
+    readonly payload: Schema.Schema.Type<typeof OAuthAccountUnlinkBody>;
+    readonly session: ValidatedSession;
+    readonly request: HttpServerRequest.HttpServerRequest;
+}
+export interface OAuthAccountUnlinkAfterAllowHttpInput extends OAuthAccountUnlinkStepUpHttpInput {
+    readonly decision: Extract<OAuthAccountUnlinkingResolution, {
+        readonly type: "allow";
+    }>;
+}
+export interface OAuthAccountUnlinkHttpOptions {
+    readonly stepUpSatisfied?: (input: OAuthAccountUnlinkStepUpHttpInput) => Effect.Effect<boolean, unknown>;
+    readonly unlinkAfterAllow?: (input: OAuthAccountUnlinkAfterAllowHttpInput) => Effect.Effect<void, unknown>;
+}
+export declare const oauthLinkConfirmationConfirmedHttpBody: (confirmed: ConfirmedOAuthLinkConfirmation, options?: {
+    readonly linked?: boolean;
+}) => Schema.Schema.Type<typeof OAuthLinkConfirmationConfirmedBody>;
+export declare const oauthAccountUnlinkResolutionHttpBody: (resolution: OAuthAccountUnlinkingResolution, options?: {
+    readonly unlinked?: boolean;
+}) => Schema.Schema.Type<typeof OAuthAccountUnlinkResolutionBody>;
+export interface PasskeyRegistrationStartHttpOptions {
+    readonly relyingParty: PasskeyRelyingParty;
+    readonly timeout?: number;
+    readonly pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[];
+    readonly authenticatorSelection?: PasskeyAuthenticatorSelection;
+    readonly attestation?: PasskeyAttestation;
+}
+export interface PasskeyAuthenticationStartHttpOptions {
+    readonly relyingPartyId: string;
+    readonly timeout?: number;
+    readonly userVerification?: PasskeyUserVerification;
+}
+export interface PasskeyFinishHttpOptions {
+    readonly relyingPartyId: string;
+    readonly expectedOrigin: string | readonly string[];
+    readonly requireUserVerification?: boolean;
+}
+export interface TotpEnrollmentStartHttpOptions {
+    readonly issuer: string;
+    readonly secretBytes?: number;
+    readonly algorithm?: TotpAlgorithm;
+    readonly digits?: number;
+    readonly period?: number;
+}
+export interface TotpCodeHttpOptions {
+    readonly window?: number;
+}
+export interface RecoveryCodeGenerateHttpOptions {
+    readonly count?: number;
+    readonly length?: number;
+    readonly groupSize?: number;
+}
+export declare const passkeyRegistrationStartInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>, options: PasskeyRegistrationStartHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    attestation?: PasskeyAttestation | undefined;
+    authenticatorSelection?: PasskeyAuthenticatorSelection | undefined;
+    pubKeyCredParams?: readonly PasskeyPublicKeyCredentialParameters[] | undefined;
+    timeout?: number | undefined;
+    relyingParty: PasskeyRelyingParty;
+    userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    userName: string;
+    userDisplayName: string;
+};
+export declare const passkeyAuthenticationStartInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>, options: PasskeyAuthenticationStartHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    userVerification?: PasskeyUserVerification | undefined;
+    timeout?: number | undefined;
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    relyingPartyId: string;
+};
+export declare const passkeyMfaStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>, options: PasskeyAuthenticationStartHttpOptions) => PasskeyAuthenticationStartInput;
+export declare const passkeyRegistrationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>, options: PasskeyFinishHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    requireUserVerification?: boolean | undefined;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    response: {
+        readonly id: string;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly rawId?: string | undefined;
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+};
+export declare const passkeyAuthenticationFinishInput: (payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>, options: PasskeyFinishHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    requireUserVerification?: boolean | undefined;
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    response: {
+        readonly id: string;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly rawId?: string | undefined;
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+};
+export declare const passkeyMfaVerifyInput: (payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>, options: PasskeyFinishHttpOptions) => {
+    metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    requireUserVerification?: boolean | undefined;
+    relyingPartyId: string;
+    expectedOrigin: string | readonly string[];
+    userId?: (string & import("effect/Brand").Brand<"auth/UserId">) | undefined;
+    challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    response: {
+        readonly id: string;
+        readonly type: "public-key";
+        readonly response: {
+            readonly [x: string]: unknown;
+        };
+        readonly rawId?: string | undefined;
+        readonly authenticatorAttachment?: string | undefined;
+        readonly clientExtensionResults?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+};
+export declare const passkeyCredentialRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof PasskeyCredentialRevokeBody>) => {
+    reason?: string | undefined;
+    userId: UserId;
+    credentialId: PasskeyCredentialId;
+};
+export declare const totpEnrollmentStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpEnrollmentStartBody>, options: TotpEnrollmentStartHttpOptions) => TotpEnrollmentStartInput;
+export declare const totpEnrollmentConfirmInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpEnrollmentConfirmBody>, options?: TotpCodeHttpOptions) => TotpEnrollmentConfirmInput;
+export declare const totpVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const totpFactorRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpFactorRevokeBody>) => TotpFactorManagementRevokeInput;
+export declare const recoveryCodeGenerateInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeGenerateBody>, options?: RecoveryCodeGenerateHttpOptions) => RecoveryCodeGenerateForUserInput;
+export declare const recoveryCodeVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeVerifyBody>) => RecoveryCodeVerifyForUserInput;
+export declare const recoveryCodeRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeRevokeBody>) => RecoveryCodeManagementRevokeInput;
+export declare const apiKeyCreateInput: (userId: UserId, payload: Schema.Schema.Type<typeof ApiKeyCreateBody>) => ApiKeyCreateForUserInput;
+export declare const apiKeyRevokeInput: (userId: UserId, payload: Schema.Schema.Type<typeof ApiKeyRevokeBody>) => ApiKeyManagementRevokeInput;
+export interface RefreshTokenRefreshHttpPolicyInput {
+    readonly now: UnixMillis;
+}
+export interface RefreshTokenAccessTokenHttpInput extends RefreshTokenRefreshHttpPolicyInput {
+    readonly refreshToken: RefreshTokenInfo;
+    readonly previousToken: RefreshTokenInfo;
+}
+export interface RefreshTokenRefreshHttpOptions {
+    readonly refreshTokenExpiresAt: (input: RefreshTokenRefreshHttpPolicyInput) => UnixMillis;
+    readonly accessToken: (input: RefreshTokenAccessTokenHttpInput) => JwtIssueInput;
+}
+export declare const refreshTokenRefreshInput: (payload: Schema.Schema.Type<typeof RefreshTokenRefreshBody>, now: UnixMillis, expiresAt: UnixMillis) => RefreshTokenRotateInput;
+export interface JwtIntrospectionHttpOptions {
+    readonly issuer?: string;
+    readonly audience?: JwtAudience;
+    readonly clockTolerance?: Duration.Duration;
+}
+export declare const jwtIntrospectInput: (payload: Schema.Schema.Type<typeof JwtIntrospectBody>, options?: JwtIntrospectionHttpOptions) => JwtVerifyInput;
+export declare const jwtRevokeInput: (payload: Schema.Schema.Type<typeof JwtRevokeBody>) => JwtRevokeJwtIdInput;
+export declare const totpMfaVerifyInput: (payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const totpMfaVerifyForFlowInput: (userId: UserId, payload: Schema.Schema.Type<typeof TotpMfaVerifyForFlowBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const recoveryCodeMfaVerifyInput: (payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>) => RecoveryCodeVerifyForUserInput;
+export declare const recoveryCodeMfaVerifyForFlowInput: (userId: UserId, payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyForFlowBody>) => RecoveryCodeVerifyForUserInput;
+export declare const stepUpTotpVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpTotpVerifyBody>, options?: TotpCodeHttpOptions) => TotpVerifyForUserInput;
+export declare const stepUpRecoveryCodeVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpRecoveryCodeVerifyBody>) => RecoveryCodeVerifyForUserInput;
+export declare const stepUpPasskeyStartInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpPasskeyStartBody>, options: PasskeyAuthenticationStartHttpOptions) => PasskeyAuthenticationStartInput;
+export declare const stepUpPasskeyVerifyInput: (userId: UserId, payload: Schema.Schema.Type<typeof StepUpPasskeyVerifyBody>, options: PasskeyFinishHttpOptions) => PasskeyAuthenticationFinishInput;
+export interface LoginApprovalApproveInput {
+    readonly flowId: Schema.Schema.Type<typeof LoginApprovalApproveBody>["flowId"];
+    readonly approval: LoginApprovalVerifyInput;
+    readonly rememberDevice: boolean;
+}
+export declare const loginApprovalApproveInput: (payload: Schema.Schema.Type<typeof LoginApprovalApproveBody>) => LoginApprovalApproveInput;
+export interface LoginApprovalStatusInput {
+    readonly flowId: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>["flowId"];
+    readonly approvalChallengeId: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>["approvalChallengeId"];
+}
+export declare const loginApprovalStatusInput: (payload: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>) => LoginApprovalStatusInput;
+export interface LoginApprovalFinalizeHttpInput {
+    readonly flowId: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>["flowId"];
+    readonly approvalChallengeId: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>["approvalChallengeId"];
+    readonly rememberDevice: boolean;
+}
+export declare const loginApprovalFinalizeInput: (payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>) => LoginApprovalFinalizeHttpInput;
+export declare const loginNotificationReportInput: (payload: Schema.Schema.Type<typeof LoginNotificationReportBody>) => LoginNotificationReportInput;
+export declare const stepUpAuthenticatedHttpBody: (session: CurrentSessionShape) => {
+    mfaVerifiedAt?: UnixMillis | undefined;
+    type: "authenticated";
+    expiresAt: number;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+} | {
+    claims: SessionClaims;
+    mfaVerifiedAt?: UnixMillis | undefined;
+    type: "authenticated";
+    expiresAt: number;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+};
+export type PasswordSignInHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordSignInBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasswordSignUpHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordSignUpBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasswordResetStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordResetStartBody>;
+};
+export type PasswordResetVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordResetVerifyBody>;
+};
+export type PasswordSetHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordSetBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type PasswordChangeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasswordChangeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type SessionHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type SessionRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof SessionRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type LoginNotificationReportHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginNotificationReportBody>;
+};
+export type SecurityTimelineListHandlerRequest = {
+    readonly query: Schema.Schema.Type<typeof SecurityTimelineListQuery>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TrustedDeviceListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TrustedDeviceRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TrustedDeviceRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type EmailVerificationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof EmailVerificationStartBody>;
+};
+export type EmailVerificationVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof EmailVerificationVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type EmailOtpStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof EmailOtpStartBody>;
+};
+export type EmailOtpVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof EmailOtpVerifyBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type MagicLinkStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof MagicLinkStartBody>;
+};
+export type MagicLinkVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof MagicLinkVerifyBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type OAuthAuthorizationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof OAuthAuthorizationStartBody>;
+};
+export type OAuthAccountUnlinkHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof OAuthAccountUnlinkBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type OAuthLinkConfirmationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof OAuthLinkConfirmationStartBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type OAuthLinkConfirmationInspectHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof OAuthLinkConfirmationInspectBody>;
+};
+export type OAuthLinkConfirmationConfirmHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof OAuthLinkConfirmationConfirmBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasskeyRegistrationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyRegistrationStartBody>;
+};
+export type PasskeyRegistrationFinishHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyRegistrationFinishBody>;
+};
+export type PasskeyAuthenticationStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationStartBody>;
+};
+export type PasskeyAuthenticationFinishHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+};
+export type PasskeyCredentialListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type PasskeyCredentialRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyCredentialRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpEnrollmentStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpEnrollmentStartBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpEnrollmentConfirmHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpEnrollmentConfirmBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpFactorListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type TotpFactorRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpFactorRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeGenerateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeGenerateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RecoveryCodeRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type ApiKeyCreateHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof ApiKeyCreateBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type ApiKeyListHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type ApiKeyRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof ApiKeyRevokeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type RefreshTokenRefreshHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RefreshTokenRefreshBody>;
+};
+export type JwtIntrospectHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof JwtIntrospectBody>;
+};
+export type JwtRevokeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof JwtRevokeBody>;
+};
+export type TotpMfaVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyBody>;
+};
+export type TotpMfaVerifyForFlowHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof TotpMfaVerifyForFlowBody>;
+};
+export type MfaOptionsHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof MfaOptionsBody>;
+};
+export type RecoveryCodeMfaVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyBody>;
+};
+export type RecoveryCodeMfaVerifyForFlowHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof RecoveryCodeMfaVerifyForFlowBody>;
+};
+export type PasskeyMfaStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyMfaStartBody>;
+};
+export type PasskeyMfaVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof PasskeyMfaVerifyBody>;
+};
+export type StepUpOptionsHandlerRequest = {
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type StepUpTotpVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof StepUpTotpVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type StepUpRecoveryCodeVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof StepUpRecoveryCodeVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type StepUpPasskeyStartHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof StepUpPasskeyStartBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type StepUpPasskeyVerifyHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof StepUpPasskeyVerifyBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export interface PasskeyAuthenticationSessionContext {
+    readonly finished: FinishedPasskeyAuthentication;
+    readonly payload: Schema.Schema.Type<typeof PasskeyAuthenticationFinishBody>;
+    readonly request?: HttpServerRequest.HttpServerRequest;
+}
+export type LoginApprovalApproveHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginApprovalApproveBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export type LoginApprovalStatusHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginApprovalReviewStatusBody>;
+};
+export type LoginApprovalFinalizeHandlerRequest = {
+    readonly payload: Schema.Schema.Type<typeof LoginApprovalFinalizeBody>;
+    readonly request: HttpServerRequest.HttpServerRequest;
+};
+export declare const makePasswordSignInHandler: (dependencies: {
+    readonly password: PasswordLoginService;
+    readonly authHttp: AuthHttpService;
+    readonly emailVerificationFlow?: EmailVerificationFlowService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: PasswordSignInHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | import("./Transport.js").PasswordSignInHttpError, never>;
+export declare const makePasswordSignUpHandler: (dependencies: {
+    readonly registration: PasswordRegistrationService;
+    readonly authHttp: AuthHttpService;
+    readonly emailVerificationFlow?: EmailVerificationFlowService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: PasswordSignUpHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | AuthEmailAlreadyRegisteredError | import("./Transport.js").PasswordSignUpHttpError, never>;
+export declare const makePasswordResetStartHandler: (dependencies: {
+    readonly passwordReset: PasswordResetService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: PasswordResetStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthRateLimitedError | AuthInternalError, never>;
+export declare const makePasswordResetVerifyHandler: (dependencies: {
+    readonly passwordReset: PasswordResetService;
+}) => (args_0: PasswordResetVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError, never>;
+export declare const makePasswordSetHandler: (dependencies: {
+    readonly passwordManagement: PasswordManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasswordSetHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makePasswordChangeHandler: (dependencies: {
+    readonly passwordManagement: PasswordManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasswordChangeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeCurrentSessionHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRefreshSessionHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeLogoutHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError, never>;
+export declare const makeListSessionsHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<{
+    sessions: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        longitude?: number | undefined;
+        latitude?: number | undefined;
+        city?: string | undefined;
+        region?: string | undefined;
+        country?: string | undefined;
+        userAgent?: string | undefined;
+        ip?: string | undefined;
+        claims?: SessionClaims | undefined;
+        current: boolean;
+        mfaVerifiedAt?: UnixMillis | undefined;
+        expiresAt: UnixMillis;
+        aal: import("../Sessions.js").AuthAssuranceLevel;
+        amr: readonly AuthMethodReference[];
+        lastSeenAt?: UnixMillis | undefined;
+        sessionId: import("../Identifiers.js").SessionId;
+        userId: UserId;
+        createdAt: UnixMillis;
+        authTime: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRevokeSessionHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: SessionRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRevokeOtherSessionsHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: SessionHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeLoginNotificationReportHandler: (dependencies: {
+    readonly loginNotification?: LoginNotificationService;
+}) => (args_0: LoginNotificationReportHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const securityTimelineEventHttpBody: (event: SecurityTimelineEvent) => {
+    metadata?: Readonly<Record<string, unknown>> | undefined;
+    request?: {
+        userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
+        ipHash?: import("../Identifiers.js").IpHash | undefined;
+    } | undefined;
+    actor?: {
+        type: "anonymous";
+    } | {
+        sessionId?: import("../Identifiers.js").SessionId | undefined;
+        type: "user";
+    } | undefined;
+    eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
+    type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.jwt.introspected" | "auth.jwt.revoked";
+    category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
+    severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
+    occurredAt: UnixMillis;
+    summary: string;
+};
+export declare const makeSecurityTimelineListHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly securityTimeline: SecurityTimelineStoreService;
+}) => (args_0: SecurityTimelineListHandlerRequest) => Effect.Effect<{
+    events: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        request?: {
+            userAgentHash?: import("../Identifiers.js").UserAgentHash | undefined;
+            ipHash?: import("../Identifiers.js").IpHash | undefined;
+        } | undefined;
+        actor?: {
+            type: "anonymous";
+        } | {
+            sessionId?: import("../Identifiers.js").SessionId | undefined;
+            type: "user";
+        } | undefined;
+        eventId: import("../SecurityTimeline.js").SecurityTimelineEventId;
+        type: "auth.login.succeeded" | "auth.login.failed" | "auth.session.revoked" | "auth.policy.denied" | "auth.oauth.account.linked" | "auth.oauth.account.unlinked" | "auth.oauth.link_confirmation.started" | "auth.oauth.link_confirmation.confirmed" | "auth.oauth.provider_token.refreshed" | "auth.oauth.provider_token.revoked" | "auth.passkey.credential.revoked" | "auth.totp.enrollment.started" | "auth.totp.factor.confirmed" | "auth.totp.factor.verified" | "auth.totp.factor.revoked" | "auth.recovery_code.generated" | "auth.recovery_code.verified" | "auth.recovery_code.revoked" | "auth.api_key.created" | "auth.api_key.verified" | "auth.api_key.revoked" | "auth.api_key.verification_failed" | "auth.refresh_token.issued" | "auth.refresh_token.rotated" | "auth.refresh_token.reuse_detected" | "auth.refresh_token.revoked" | "auth.jwt.introspected" | "auth.jwt.revoked";
+        category: import("../SecurityTimeline.js").SecurityTimelineEventCategory;
+        severity: import("../SecurityTimeline.js").SecurityTimelineEventSeverity;
+        occurredAt: UnixMillis;
+        summary: string;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const trustedDeviceHttpBody: (device: TrustedDeviceRecord) => {
+    metadata?: Readonly<Record<string, unknown>> | undefined;
+    deviceId: string;
+    createdAt: UnixMillis;
+    lastSeenAt: UnixMillis;
+    expiresAt: UnixMillis;
+};
+export declare const makeTrustedDeviceListHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly trustedDevices: TrustedDeviceStoreService;
+}) => (args_0: TrustedDeviceListHandlerRequest) => Effect.Effect<{
+    devices: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        deviceId: string;
+        createdAt: UnixMillis;
+        lastSeenAt: UnixMillis;
+        expiresAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTrustedDeviceRevokeHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly trustedDevices: TrustedDeviceStoreService;
+}) => (args_0: TrustedDeviceRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeEmailVerificationStartHandler: (dependencies: {
+    readonly emailVerificationFlow: EmailVerificationFlowService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: EmailVerificationStartHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthRateLimitedError | AuthInternalError, never>;
+export declare const makeEmailVerificationVerifyHandler: (dependencies: {
+    readonly emailVerification: EmailVerificationService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: EmailVerificationVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeEmailOtpStartHandler: (dependencies: {
+    readonly emailOtp: EmailOtpLoginService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: EmailOtpStartHandlerRequest) => Effect.Effect<import("../EmailOtp.js").EmailOtpStarted, AuthRateLimitedError | AuthInternalError, never>;
+export declare const makeEmailOtpVerifyHandler: (dependencies: {
+    readonly emailOtp: EmailOtpLoginService;
+    readonly authHttp: AuthHttpService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: EmailOtpVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Transport.js").PasswordSignInHttpError, never>;
+export declare const makeMagicLinkStartHandler: (dependencies: {
+    readonly magicLink: MagicLinkLoginService;
+    readonly authApiRateLimit?: AuthApiRateLimitService;
+}) => (args_0: MagicLinkStartHandlerRequest) => Effect.Effect<{
+    email: Email;
+    expiresAt: UnixMillis;
+}, AuthRateLimitedError | AuthInternalError, never>;
+export declare const makeMagicLinkVerifyHandler: (dependencies: {
+    readonly magicLink: MagicLinkLoginService;
+    readonly authHttp: AuthHttpService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: MagicLinkVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("./Transport.js").PasswordSignInHttpError, never>;
+export declare const makeOAuthAuthorizationStartHandler: (dependencies: {
+    readonly oauthProviders: OAuthProvidersService;
+    readonly oauthState: OAuthStateService;
+} & OAuthAuthorizationStartHttpOptions) => (args_0: OAuthAuthorizationStartHandlerRequest) => Effect.Effect<{
+    redirectUri: string;
+    scopes: readonly string[];
+    nonce?: import("../OAuth.js").OAuthNonce | undefined;
+    providerId: OAuthProviderId;
+    authorizationUrl: string;
+    state: import("../OAuth.js").OAuthStateToken;
+    challengeId: import("../Identifiers.js").ChallengeId;
+    expiresAt: UnixMillis;
+    codeChallenge: import("../OAuth.js").OAuthCodeChallenge;
+    codeChallengeMethod: "S256";
+}, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeOAuthAccountUnlinkHandler: (dependencies: {
+    readonly oauthAccountUnlinking: OAuthAccountUnlinkingService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & OAuthAccountUnlinkHttpOptions) => (args_0: OAuthAccountUnlinkHandlerRequest) => Effect.Effect<{
+    readonly type: "allow";
+    readonly reason: "owned-account";
+    readonly account: {
+        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+    };
+    readonly remainingAccounts: readonly {
+        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+    }[];
+    readonly unlinked: boolean;
+} | {
+    readonly type: "requires-step-up";
+    readonly reason: "step-up-required";
+    readonly account: {
+        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+    };
+    readonly remainingAccounts: readonly {
+        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+    }[];
+} | {
+    readonly type: "deny-not-found";
+    readonly reason: "provider-account-not-found";
+    readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+    readonly providerAccountId: string;
+} | {
+    readonly type: "deny-not-owner";
+    readonly reason: "provider-account-linked-to-different-user";
+    readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+    readonly providerAccountId: string;
+} | {
+    readonly type: "deny-last-account";
+    readonly reason: "last-linked-account";
+    readonly account: {
+        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+    };
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeOAuthLinkConfirmationStartHandler: (dependencies: {
+    readonly oauthLinkConfirmation: OAuthLinkConfirmationService;
+} & OAuthLinkConfirmationStartHttpOptions) => (args_0: OAuthLinkConfirmationStartHandlerRequest) => Effect.Effect<{
+    readonly challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    readonly userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    readonly identity: {
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+        readonly email?: (string & import("effect/Brand").Brand<"auth/Email">) | undefined;
+        readonly emailVerified?: boolean | undefined;
+    };
+    readonly reason: string;
+    readonly expiresAt: number & import("effect/Brand").Brand<"auth/UnixMillis">;
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeOAuthLinkConfirmationInspectHandler: (dependencies: {
+    readonly oauthLinkConfirmation: OAuthLinkConfirmationService;
+}) => (args_0: OAuthLinkConfirmationInspectHandlerRequest) => Effect.Effect<{
+    readonly challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    readonly userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    readonly identity: {
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+        readonly email?: (string & import("effect/Brand").Brand<"auth/Email">) | undefined;
+        readonly emailVerified?: boolean | undefined;
+    };
+    readonly reason: string;
+    readonly expiresAt: number & import("effect/Brand").Brand<"auth/UnixMillis">;
+}, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeOAuthLinkConfirmationConfirmHandler: (dependencies: {
+    readonly oauthLinkConfirmation: OAuthLinkConfirmationService;
+} & OAuthLinkConfirmationConfirmHttpOptions) => (args_0: OAuthLinkConfirmationConfirmHandlerRequest) => Effect.Effect<{
+    readonly challengeId: string & import("effect/Brand").Brand<"auth/ChallengeId">;
+    readonly userId: string & import("effect/Brand").Brand<"auth/UserId">;
+    readonly identity: {
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+        readonly email?: (string & import("effect/Brand").Brand<"auth/Email">) | undefined;
+        readonly emailVerified?: boolean | undefined;
+    };
+    readonly reason: string;
+    readonly linked: boolean;
+    readonly existingAccount?: {
+        readonly accountId: string & import("effect/Brand").Brand<"auth/OAuthAccountId">;
+        readonly providerId: string & import("effect/Brand").Brand<"auth/OAuthProviderId">;
+        readonly providerAccountId: string;
+    } | undefined;
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makePasskeyRegistrationStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+} & PasskeyRegistrationStartHttpOptions) => (args_0: PasskeyRegistrationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyRegistration, AuthInternalError, never>;
+export declare const makePasskeyRegistrationFinishHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyRegistrationFinishHandlerRequest) => Effect.Effect<{
+    credentialId: PasskeyCredentialId;
+}, AuthBadRequestError | AuthInternalError, never>;
+export declare const makePasskeyAuthenticationStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+} & PasskeyAuthenticationStartHttpOptions) => (args_0: PasskeyAuthenticationStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthInternalError, never>;
+export declare const makePasskeyAuthenticationFinishHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+    readonly sessions: SessionsService;
+    readonly authHttp: AuthHttpService;
+    readonly makeSessionInput: (context: PasskeyAuthenticationSessionContext) => SessionCreateInput;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyAuthenticationFinishHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makePasskeyCredentialListHandler: (dependencies: {
+    readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasskeyCredentialListHandlerRequest) => Effect.Effect<{
+    credentials: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        createdAt: UnixMillis;
+        backedUp?: boolean | undefined;
+        transports?: readonly import("../Passkey.js").PasskeyTransport[] | undefined;
+        credentialId: PasskeyCredentialId;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makePasskeyCredentialRevokeHandler: (dependencies: {
+    readonly passkeyCredentialManagement: PasskeyCredentialManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: PasskeyCredentialRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpEnrollmentStartHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpEnrollmentStartHttpOptions) => (args_0: TotpEnrollmentStartHandlerRequest) => Effect.Effect<{
+    factor: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        confirmedAt?: UnixMillis | undefined;
+        factorId: import("../Identifiers.js").CredentialId;
+        algorithm: TotpAlgorithm;
+        digits: number;
+        period: number;
+        createdAt: UnixMillis;
+    };
+    secret: import("../Totp.js").TotpSecret;
+    uri: string;
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpEnrollmentConfirmHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpCodeHttpOptions) => (args_0: TotpEnrollmentConfirmHandlerRequest) => Effect.Effect<{
+    metadata?: Readonly<Record<string, unknown>> | undefined;
+    revokedAt?: UnixMillis | undefined;
+    lastUsedAt?: UnixMillis | undefined;
+    confirmedAt?: UnixMillis | undefined;
+    factorId: import("../Identifiers.js").CredentialId;
+    algorithm: TotpAlgorithm;
+    digits: number;
+    period: number;
+    createdAt: UnixMillis;
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpVerifyHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpCodeHttpOptions) => (args_0: TotpVerifyHandlerRequest) => Effect.Effect<{
+    delta?: number | undefined;
+    factor?: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        confirmedAt?: UnixMillis | undefined;
+        factorId: import("../Identifiers.js").CredentialId;
+        algorithm: TotpAlgorithm;
+        digits: number;
+        period: number;
+        createdAt: UnixMillis;
+    } | undefined;
+    valid: boolean;
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpFactorListHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: TotpFactorListHandlerRequest) => Effect.Effect<{
+    factors: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        confirmedAt?: UnixMillis | undefined;
+        factorId: import("../Identifiers.js").CredentialId;
+        algorithm: TotpAlgorithm;
+        digits: number;
+        period: number;
+        createdAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeTotpFactorRevokeHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: TotpFactorRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeGenerateHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & RecoveryCodeGenerateHttpOptions) => (args_0: RecoveryCodeGenerateHandlerRequest) => Effect.Effect<{
+    codes: import("../RecoveryCode.js").RecoveryCode[];
+    records: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        usedAt?: UnixMillis | undefined;
+        codeId: import("../Identifiers.js").CredentialId;
+        createdAt: UnixMillis;
+    }[];
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeVerifyHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: RecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
+    code?: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        usedAt?: UnixMillis | undefined;
+        codeId: import("../Identifiers.js").CredentialId;
+        createdAt: UnixMillis;
+    } | undefined;
+    valid: boolean;
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeListHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: RecoveryCodeListHandlerRequest) => Effect.Effect<{
+    codes: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        usedAt?: UnixMillis | undefined;
+        codeId: import("../Identifiers.js").CredentialId;
+        createdAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeRevokeHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: RecoveryCodeRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeApiKeyCreateHandler: (dependencies: {
+    readonly apiKeyManagement: ApiKeyManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: ApiKeyCreateHandlerRequest) => Effect.Effect<{
+    secret: import("../ApiKey.js").ApiKeySecret;
+    key: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        expiresAt?: UnixMillis | undefined;
+        keyId: ApiKeyId;
+        prefix: import("../ApiKey.js").ApiKeyPrefix;
+        scopes: readonly string[];
+        createdAt: UnixMillis;
+    };
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeApiKeyListHandler: (dependencies: {
+    readonly apiKeyManagement: ApiKeyManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: ApiKeyListHandlerRequest) => Effect.Effect<{
+    keys: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        revokedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        expiresAt?: UnixMillis | undefined;
+        keyId: ApiKeyId;
+        prefix: import("../ApiKey.js").ApiKeyPrefix;
+        scopes: readonly string[];
+        createdAt: UnixMillis;
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeApiKeyRevokeHandler: (dependencies: {
+    readonly apiKeyManagement: ApiKeyManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: ApiKeyRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeRefreshTokenRefreshHandler: (dependencies: {
+    readonly refreshTokenManagement: RefreshTokenManagementService;
+    readonly jwtIssuer: JwtIssuerService;
+} & RefreshTokenRefreshHttpOptions) => (args_0: RefreshTokenRefreshHandlerRequest) => Effect.Effect<{
+    refreshToken: string;
+    refreshTokenRecord: {
+        metadata?: Readonly<Record<string, unknown>> | undefined;
+        reuseDetectedAt?: UnixMillis | undefined;
+        revokedAt?: UnixMillis | undefined;
+        replacedById?: import("../RefreshToken.js").RefreshTokenId | undefined;
+        rotatedAt?: UnixMillis | undefined;
+        lastUsedAt?: UnixMillis | undefined;
+        tokenId: import("../RefreshToken.js").RefreshTokenId;
+        familyId: import("../RefreshToken.js").RefreshTokenFamilyId;
+        createdAt: UnixMillis;
+        expiresAt: UnixMillis;
+    };
+    accessTokenExpiresAt?: UnixMillis | undefined;
+    accessToken: import("../Jwt.js").JwtToken;
+}, AuthInvalidCredentialsError | AuthInternalError, never>;
+export declare const makeJwtIntrospectHandler: (dependencies: {
+    readonly jwtRevocation: JwtRevocationService;
+} & JwtIntrospectionHttpOptions) => (args_0: JwtIntrospectHandlerRequest) => Effect.Effect<{
+    readonly active: true;
+    readonly header: {
+        readonly typ: "JWT";
+        readonly alg: "HS256" | "RS256" | "ES256" | "EdDSA";
+        readonly kid: string;
+    };
+    readonly claims: {
+        readonly [x: string]: unknown;
+    };
+    readonly key: {
+        readonly keyId: string;
+        readonly alg: "HS256" | "RS256" | "ES256" | "EdDSA";
+        readonly status: "active" | "retired" | "disabled";
+        readonly createdAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+        readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+        readonly metadata?: {
+            readonly [x: string]: unknown;
+        } | undefined;
+    };
+    readonly revoked: false;
+    readonly jwtId?: string | undefined;
+    readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+} | {
+    readonly active: false;
+    readonly reason: "expired" | "revoked" | "malformed" | "unsupported_alg" | "unknown_key" | "invalid_signature" | "not_yet_valid" | "issuer_mismatch" | "audience_mismatch";
+    readonly jwtId?: string | undefined;
+    readonly expiresAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+    readonly revokedAt?: (number & import("effect/Brand").Brand<"auth/UnixMillis">) | undefined;
+    readonly revokedReason?: string | undefined;
+}, AuthInternalError, never>;
+export declare const makeJwtRevokeHandler: (dependencies: {
+    readonly jwtRevocation: JwtRevocationService;
+}) => (args_0: JwtRevokeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeMfaOptionsHandler: (dependencies: {
+    readonly authFlowState: AuthFlowStateService;
+    readonly totpFactorManagement?: TotpFactorManagementService;
+    readonly recoveryCodeManagement?: RecoveryCodeManagementService;
+    readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
+}) => (args_0: MfaOptionsHandlerRequest) => Effect.Effect<{
+    factors: {
+        readonly type: "totp" | "backup-code" | "passkey";
+    }[];
+}, AuthBadRequestError | AuthInternalError, never>;
+export declare const makeTotpMfaVerifyHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeTotpMfaVerifyForFlowHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+} & TotpCodeHttpOptions) => (args_0: TotpMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeMfaVerifyHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: RecoveryCodeMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeRecoveryCodeMfaVerifyForFlowHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+}) => (args_0: RecoveryCodeMfaVerifyForFlowHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makePasskeyMfaStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+    readonly authFlowState: AuthFlowStateService;
+} & PasskeyAuthenticationStartHttpOptions) => (args_0: PasskeyMfaStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthInternalError, never>;
+export declare const makePasskeyMfaVerifyHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+    readonly authFlow: AuthFlowService;
+    readonly authHttp: AuthHttpService;
+} & PasskeyFinishHttpOptions) => (args_0: PasskeyMfaVerifyHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeStepUpOptionsHandler: (dependencies: {
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+    readonly totpFactorManagement?: TotpFactorManagementService;
+    readonly recoveryCodeManagement?: RecoveryCodeManagementService;
+    readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
+}) => (args_0: StepUpOptionsHandlerRequest) => Effect.Effect<{
+    factors: {
+        readonly type: "totp" | "backup-code" | "passkey";
+    }[];
+}, AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeStepUpTotpVerifyHandler: (dependencies: {
+    readonly totpFactorManagement: TotpFactorManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & TotpCodeHttpOptions) => (args_0: StepUpTotpVerifyHandlerRequest) => Effect.Effect<{
+    mfaVerifiedAt?: UnixMillis | undefined;
+    type: "authenticated";
+    expiresAt: number;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+}, AuthUnauthenticatedError | AuthInvalidCredentialsError | AuthInternalError, never>;
+export declare const makeStepUpRecoveryCodeVerifyHandler: (dependencies: {
+    readonly recoveryCodeManagement: RecoveryCodeManagementService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+}) => (args_0: StepUpRecoveryCodeVerifyHandlerRequest) => Effect.Effect<{
+    mfaVerifiedAt?: UnixMillis | undefined;
+    type: "authenticated";
+    expiresAt: number;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+}, AuthUnauthenticatedError | AuthInvalidCredentialsError | AuthInternalError, never>;
+export declare const makeStepUpPasskeyStartHandler: (dependencies: {
+    readonly passkeyOptions: PasskeyOptionsService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & PasskeyAuthenticationStartHttpOptions) => (args_0: StepUpPasskeyStartHandlerRequest) => Effect.Effect<import("../Passkey.js").StartedPasskeyAuthentication, AuthBadRequestError | AuthUnauthenticatedError | AuthInternalError, never>;
+export declare const makeStepUpPasskeyVerifyHandler: (dependencies: {
+    readonly passkeyVerification: PasskeyVerificationService;
+    readonly sessions: SessionsService;
+    readonly sessionCookie: SessionCookieService;
+} & PasskeyFinishHttpOptions) => (args_0: StepUpPasskeyVerifyHandlerRequest) => Effect.Effect<{
+    mfaVerifiedAt?: UnixMillis | undefined;
+    type: "authenticated";
+    expiresAt: number;
+    aal: import("../Sessions.js").AuthAssuranceLevel;
+    amr: readonly AuthMethodReference[];
+}, AuthBadRequestError | AuthUnauthenticatedError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeLoginApprovalApproveHandler: (dependencies: {
+    readonly loginApproval: LoginApprovalService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+    readonly users: UserStoreService;
+    readonly authHttp: AuthHttpService;
+    readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
+    readonly trustedDevice?: TrustedDeviceService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: LoginApprovalApproveHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeLoginApprovalStatusHandler: (dependencies: {
+    readonly loginApprovalReview?: LoginApprovalReviewService;
+}) => (args_0: LoginApprovalStatusHandlerRequest) => Effect.Effect<{
+    status: import("../LoginApproval.js").LoginApprovalReviewStatus | "expired";
+    expiresAt: UnixMillis;
+}, AuthBadRequestError | AuthPolicyDeniedError | AuthInternalError, never>;
+export declare const makeLoginApprovalFinalizeHandler: (dependencies: {
+    readonly loginApprovalFinalize?: LoginApprovalFinalizeService;
+    readonly authHttp: AuthHttpService;
+    readonly loginApprovalPendingCookie: LoginApprovalPendingCookieService;
+    readonly trustedDevice?: TrustedDeviceService;
+    readonly trustedDeviceCookie?: TrustedDeviceCookieService;
+}) => (args_0: LoginApprovalFinalizeHandlerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthPolicyDeniedError | AuthInternalError, never>;
+declare const PasswordApi_base: HttpApiGroup.HttpApiGroup<"password", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signIn", "POST", "/auth/password/sign-in", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly password: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_mfa">;
+    readonly flowId: Schema.String;
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_email_verification">;
+    readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_passkey_enrollment">;
+    readonly flowId: Schema.String;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"signUp", "POST", "/auth/password/sign-up", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly password: Schema.String;
+    readonly emailVerified: Schema.optional<Schema.Boolean>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_mfa">;
+    readonly flowId: Schema.String;
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_email_verification">;
+    readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_passkey_enrollment">;
+    readonly flowId: Schema.String;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthEmailAlreadyRegisteredError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetStart", "POST", "/auth/password/reset/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"resetVerify", "POST", "/auth/password/reset/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+    readonly password: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"set", "POST", "/auth/password/set", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly password: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"change", "POST", "/auth/password/change", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly currentPassword: Schema.String;
+    readonly newPassword: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class PasswordApi extends PasswordApi_base {
+}
+declare const SessionApi_base: HttpApiGroup.HttpApiGroup<"session", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"current", "GET", "/auth/session", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly userId: Schema.String;
+    readonly sessionId: Schema.String;
+    readonly authTime: Schema.Number;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/sessions", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly sessions: Schema.$Array<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly authTime: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastSeenAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+        readonly amr: Schema.$Array<Schema.String>;
+        readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly current: Schema.Boolean;
+        readonly claims: Schema.optional<Schema.Struct<{
+            readonly emailVerified: Schema.optional<Schema.Boolean>;
+            readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>;
+        readonly ip: Schema.optional<Schema.String>;
+        readonly userAgent: Schema.optional<Schema.String>;
+        readonly country: Schema.optional<Schema.String>;
+        readonly region: Schema.optional<Schema.String>;
+        readonly city: Schema.optional<Schema.String>;
+        readonly latitude: Schema.optional<Schema.Number>;
+        readonly longitude: Schema.optional<Schema.Number>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/session/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly userId: Schema.String;
+    readonly sessionId: Schema.String;
+    readonly authTime: Schema.Number;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"logout", "POST", "/auth/logout", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/sessions/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeOthers", "POST", "/auth/sessions/revoke-others", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthOriginCheckMiddleware, never>, false>;
+export declare class SessionApi extends SessionApi_base {
+}
+declare const EmailVerificationApi_base: HttpApiGroup.HttpApiGroup<"emailVerification", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-verification/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-verification/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+export declare class EmailVerificationApi extends EmailVerificationApi_base {
+}
+declare const EmailOtpApi_base: HttpApiGroup.HttpApiGroup<"emailOtp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/email-otp/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/email-otp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_mfa">;
+    readonly flowId: Schema.String;
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_email_verification">;
+    readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_passkey_enrollment">;
+    readonly flowId: Schema.String;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+export declare class EmailOtpApi extends EmailOtpApi_base {
+}
+declare const MagicLinkApi_base: HttpApiGroup.HttpApiGroup<"magicLink", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"start", "POST", "/auth/magic-link/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly locale: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly email: Schema.brand<Schema.String, "auth/Email">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verify", "POST", "/auth/magic-link/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_mfa">;
+    readonly flowId: Schema.String;
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_email_verification">;
+    readonly flowId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_login_approval">;
+    readonly flowId: Schema.String;
+    readonly approvalChallengeId: Schema.String;
+    readonly channel: Schema.String;
+    readonly sessionBinding: Schema.Literals<readonly ["originating-device", "approval-device", "none"]>;
+    readonly sameDeviceRequired: Schema.Boolean;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires_passkey_enrollment">;
+    readonly flowId: Schema.String;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthRateLimitedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware | AuthRateLimitMiddleware, never>, false>;
+export declare class MagicLinkApi extends MagicLinkApi_base {
+}
+declare const OAuthApi_base: HttpApiGroup.HttpApiGroup<"oauth", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startAuthorization", "POST", "/auth/oauth/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly redirectUri: Schema.optional<Schema.String>;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly authorizationParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly codeVerifier: Schema.optional<Schema.String>;
+    readonly includeNonce: Schema.optional<Schema.Boolean>;
+    readonly nonce: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly authorizationUrl: Schema.String;
+    readonly state: Schema.String;
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly codeChallenge: Schema.String;
+    readonly codeChallengeMethod: Schema.Literal<"S256">;
+    readonly nonce: Schema.optional<Schema.String>;
+    readonly redirectUri: Schema.String;
+    readonly scopes: Schema.$Array<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"unlinkAccount", "POST", "/auth/oauth/unlink", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"allow">;
+    readonly reason: Schema.Literal<"owned-account">;
+    readonly account: Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>;
+    readonly remainingAccounts: Schema.$Array<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+    readonly unlinked: Schema.Boolean;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"requires-step-up">;
+    readonly reason: Schema.Literal<"step-up-required">;
+    readonly account: Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>;
+    readonly remainingAccounts: Schema.$Array<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"deny-not-found">;
+    readonly reason: Schema.Literal<"provider-account-not-found">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"deny-not-owner">;
+    readonly reason: Schema.Literal<"provider-account-linked-to-different-user">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"deny-last-account">;
+    readonly reason: Schema.Literal<"last-linked-account">;
+    readonly account: Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startLinkConfirmation", "POST", "/auth/oauth/link-confirmation/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
+    readonly identity: Schema.optional<Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+    readonly reason: Schema.optional<Schema.String>;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"inspectLinkConfirmation", "POST", "/auth/oauth/link-confirmation/inspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"confirmLinkConfirmation", "POST", "/auth/oauth/link-confirmation/confirm", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly expectedProviderId: Schema.optional<Schema.brand<Schema.String, "auth/OAuthProviderId">>;
+    readonly expectedProviderAccountId: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identity: Schema.Struct<{
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+        readonly email: Schema.optional<Schema.brand<Schema.String, "auth/Email">>;
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+    }>;
+    readonly reason: Schema.String;
+    readonly existingAccount: Schema.optional<Schema.Struct<{
+        readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+        readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+        readonly providerAccountId: Schema.String;
+    }>>;
+    readonly linked: Schema.Boolean;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class OAuthApi extends OAuthApi_base {
+}
+declare const LoginApprovalApi_base: HttpApiGroup.HttpApiGroup<"loginApproval", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"approve", "POST", "/auth/login-approval/approve", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.optional<Schema.String>;
+    readonly rememberDevice: Schema.optional<Schema.Boolean>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "POST", "/auth/login-approval/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly status: Schema.Literals<readonly ["pending", "approved", "denied", "expired"]>;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"finalize", "POST", "/auth/login-approval/finalize", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly approvalChallengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly rememberDevice: Schema.optional<Schema.Boolean>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class LoginApprovalApi extends LoginApprovalApi_base {
+}
+declare const MfaApi_base: HttpApiGroup.HttpApiGroup<"mfa", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "POST", "/auth/mfa/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/mfa/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotpForFlow", "POST", "/auth/mfa/totp/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/mfa/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCodeForFlow", "POST", "/auth/mfa/recovery-code/verify-flow", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/mfa/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly publicKey: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.optional<Schema.Number>;
+        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.String;
+            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>>;
+        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/mfa/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "auth/AuthFlowId">;
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly credential: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly rawId: Schema.optional<Schema.String>;
+        readonly type: Schema.Literal<"public-key">;
+        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly authenticatorAttachment: Schema.optional<Schema.String>;
+        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly userId: Schema.optional<Schema.brand<Schema.String, "auth/UserId">>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class MfaApi extends MfaApi_base {
+}
+declare const StepUpApi_base: HttpApiGroup.HttpApiGroup<"stepUp", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"options", "GET", "/auth/step-up/options", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly factors: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literals<readonly ["totp", "backup-code", "passkey"]>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyTotp", "POST", "/auth/step-up/totp/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyRecoveryCode", "POST", "/auth/step-up/recovery-code/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly code: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"startPasskey", "POST", "/auth/step-up/passkey/start", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly publicKey: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.optional<Schema.Number>;
+        readonly allowCredentials: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.String;
+            readonly transports: Schema.optional<Schema.$Array<Schema.String>>;
+        }>>>;
+        readonly userVerification: Schema.optional<Schema.Literals<readonly ["required", "preferred", "discouraged"]>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"verifyPasskey", "POST", "/auth/step-up/passkey/verify", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly credential: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly rawId: Schema.optional<Schema.String>;
+        readonly type: Schema.Literal<"public-key">;
+        readonly response: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly authenticatorAttachment: Schema.optional<Schema.String>;
+        readonly clientExtensionResults: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly type: Schema.Literal<"authenticated">;
+    readonly expiresAt: Schema.Number;
+    readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly mfaVerifiedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly claims: Schema.optional<Schema.Struct<{
+        readonly emailVerified: Schema.optional<Schema.Boolean>;
+        readonly requirements: Schema.optional<Schema.$Array<Schema.String>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class StepUpApi extends StepUpApi_base {
+}
+declare const ApiKeyApi_base: HttpApiGroup.HttpApiGroup<"apiKey", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createApiKey", "POST", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly secret: Schema.String;
+    readonly key: Schema.Struct<{
+        readonly keyId: Schema.String;
+        readonly prefix: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listApiKeys", "GET", "/auth/api-keys/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keys: Schema.$Array<Schema.Struct<{
+        readonly keyId: Schema.String;
+        readonly prefix: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revokeApiKey", "POST", "/auth/api-keys/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly keyId: Schema.String;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class ApiKeyApi extends ApiKeyApi_base {
+}
+declare const RefreshTokenApi_base: HttpApiGroup.HttpApiGroup<"refreshToken", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"refresh", "POST", "/auth/token/refresh", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly refreshToken: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly accessToken: Schema.String;
+    readonly accessTokenExpiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly refreshToken: Schema.String;
+    readonly refreshTokenRecord: Schema.Struct<{
+        readonly tokenId: Schema.String;
+        readonly familyId: Schema.String;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastUsedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly rotatedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly replacedById: Schema.optional<Schema.String>;
+        readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly reuseDetectedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInvalidCredentialsError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class RefreshTokenApi extends RefreshTokenApi_base {
+}
+declare const JwtApi_base: HttpApiGroup.HttpApiGroup<"jwt", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"introspect", "POST", "/auth/jwt/introspect", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly token: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Union<readonly [Schema.Struct<{
+    readonly active: Schema.Literal<true>;
+    readonly header: Schema.Struct<{
+        readonly typ: Schema.Literal<"JWT">;
+        readonly alg: Schema.Literals<readonly ["HS256", "RS256", "ES256", "EdDSA"]>;
+        readonly kid: Schema.String;
+    }>;
+    readonly claims: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly key: Schema.Struct<{
+        readonly keyId: Schema.String;
+        readonly alg: Schema.Literals<readonly ["HS256", "RS256", "ES256", "EdDSA"]>;
+        readonly status: Schema.Literals<readonly ["active", "retired", "disabled"]>;
+        readonly createdAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly jwtId: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly revoked: Schema.Literal<false>;
+}>, Schema.Struct<{
+    readonly active: Schema.Literal<false>;
+    readonly reason: Schema.Literals<readonly ["malformed", "unsupported_alg", "unknown_key", "invalid_signature", "expired", "not_yet_valid", "issuer_mismatch", "audience_mismatch", "revoked"]>;
+    readonly jwtId: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly revokedReason: Schema.optional<Schema.String>;
+}>]>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/jwt/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthInternalError>, AuthSchemaErrorMiddleware, never>, false>;
+export declare class JwtApi extends JwtApi_base {
+}
+declare const SecurityApi_base: HttpApiGroup.HttpApiGroup<"security", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"reportLogin", "POST", "/auth/security/login/report", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly secret: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthPolicyDeniedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class SecurityApi extends SecurityApi_base {
+}
+declare const SecurityTimelineApi_base: HttpApiGroup.HttpApiGroup<"securityTimeline", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/security/timeline", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
+    readonly limit: Schema.optional<Schema.Number>;
+    readonly beforeOccurredAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly types: Schema.optional<Schema.$Array<Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.jwt.introspected", "auth.jwt.revoked"]>>>;
+    readonly categories: Schema.optional<Schema.$Array<Schema.Literals<readonly ["api_key", "auth", "jwt", "mfa", "oauth", "policy", "refresh_token", "session"]>>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly events: Schema.$Array<Schema.Struct<{
+        readonly eventId: Schema.String;
+        readonly type: Schema.Literals<readonly ["auth.login.succeeded", "auth.login.failed", "auth.session.revoked", "auth.policy.denied", "auth.oauth.account.linked", "auth.oauth.account.unlinked", "auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed", "auth.oauth.provider_token.refreshed", "auth.oauth.provider_token.revoked", "auth.passkey.credential.revoked", "auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified", "auth.totp.factor.revoked", "auth.recovery_code.generated", "auth.recovery_code.verified", "auth.recovery_code.revoked", "auth.api_key.created", "auth.api_key.verified", "auth.api_key.revoked", "auth.api_key.verification_failed", "auth.refresh_token.issued", "auth.refresh_token.rotated", "auth.refresh_token.reuse_detected", "auth.refresh_token.revoked", "auth.jwt.introspected", "auth.jwt.revoked"]>;
+        readonly category: Schema.Literals<readonly ["api_key", "auth", "jwt", "mfa", "oauth", "policy", "refresh_token", "session"]>;
+        readonly severity: Schema.Literals<readonly ["info", "warning", "critical"]>;
+        readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly summary: Schema.String;
+        readonly actor: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"anonymous">;
+        }>, Schema.Struct<{
+            readonly type: Schema.Literal<"user">;
+            readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+        }>]>>;
+        readonly request: Schema.optional<Schema.Struct<{
+            readonly ipHash: Schema.optional<Schema.String>;
+            readonly userAgentHash: Schema.optional<Schema.String>;
+        }>>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class SecurityTimelineApi extends SecurityTimelineApi_base {
+}
+declare const SecurityTimelineHttpApi_base: HttpApi.HttpApi<"SecurityTimelineHttpApi", typeof SecurityTimelineApi>;
+export declare class SecurityTimelineHttpApi extends SecurityTimelineHttpApi_base {
+}
+declare const TrustedDeviceApi_base: HttpApiGroup.HttpApiGroup<"trustedDevice", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/auth/trusted-devices/", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly devices: Schema.$Array<Schema.Struct<{
+        readonly deviceId: Schema.String;
+        readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly lastSeenAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"revoke", "POST", "/auth/trusted-devices/revoke", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
+    readonly deviceId: Schema.String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/unstable/httpapi/HttpApiSchema").NoContent>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof AuthBadRequestError | typeof AuthUnauthenticatedError | typeof AuthInternalError>, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware, never>, false>;
+export declare class TrustedDeviceApi extends TrustedDeviceApi_base {
+}
+declare const TrustedDeviceHttpApi_base: HttpApi.HttpApi<"TrustedDeviceHttpApi", typeof TrustedDeviceApi>;
+export declare class TrustedDeviceHttpApi extends TrustedDeviceHttpApi_base {
+}
+declare const AuthApi_base: HttpApi.HttpApi<"AuthApi", typeof PasswordApi | typeof SessionApi | typeof EmailVerificationApi | typeof EmailOtpApi | typeof MagicLinkApi | typeof LoginApprovalApi | typeof SecurityApi>;
+export declare class AuthApi extends AuthApi_base {
+}
+export declare const PasswordApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "password">, never, Sessions | SessionCookie | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthSchemaErrorMiddleware | AuthHttp | EmailVerificationFlow | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const SessionApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "session">, never, Sessions | SessionCookie | AuthHttp | AuthOriginCheckMiddleware>;
+export declare const EmailVerificationApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailVerification">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | EmailVerificationFlow | EmailVerification | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const EmailOtpApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "emailOtp">, never, EmailOtpLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const MagicLinkApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "magicLink">, never, MagicLinkLogin | AuthSchemaErrorMiddleware | AuthHttp | AuthApiRateLimit | AuthOriginCheckMiddleware | AuthRateLimitMiddleware>;
+export declare const LoginApprovalApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "loginApproval">, never, UserStore | LoginApproval | AuthFlowState | AuthFlow | AuthSchemaErrorMiddleware | AuthHttp | AuthOriginCheckMiddleware>;
+export declare const SecurityApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"AuthApi", "security">, never, AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
+export declare const SecurityTimelineApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"SecurityTimelineHttpApi", "securityTimeline">, never, Sessions | SessionCookie | AuthSchemaErrorMiddleware | SecurityTimelineStore | AuthOriginCheckMiddleware>;
+export declare const SecurityTimelineHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | SecurityTimelineStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const TrustedDeviceApiLive: Layer.Layer<HttpApiGroup.ApiGroup<"TrustedDeviceHttpApi", "trustedDevice">, never, Sessions | SessionCookie | TrustedDeviceStore | AuthSchemaErrorMiddleware | AuthOriginCheckMiddleware>;
+export declare const TrustedDeviceHttpApiLive: Layer.Layer<never, never, Sessions | SessionCookie | TrustedDeviceStore | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AuthHttpApiBareLive: Layer.Layer<never, never, UserStore | Sessions | SessionCookie | LoginApproval | AuthFlowState | AuthFlow | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export declare const AuthHttpApiLive: Layer.Layer<never, never, UserStore | Sessions | SessionCookie | LoginApproval | AuthFlowState | AuthFlow | import("../Privacy.js").Privacy | EmailOtpLogin | MagicLinkLogin | PasswordLogin | PasswordRegistration | PasswordReset | PasswordManagement | AuthHttp | EmailVerificationFlow | EmailVerification | import("../RateLimiter.js").RateLimiter | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/unstable/http/HttpPlatform").HttpPlatform>;
+export { AuthResult };
+//# sourceMappingURL=Api.d.ts.map