@yielded/auth 0.1.0-beta.1

package/dist/operations/actions.d.mts

@@ -0,0 +1,947 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "./errors.mjs";
+import { AuthInvocation, AuthenticationAssurance } from "./context.mjs";
+import { AuthRevealKind } from "./reveals.mjs";
+import { CredentialSlot } from "./credentials.mjs";
+import { AuthOperation, OperationReplay } from "./operation.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConflict, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "../sessions/errors.mjs";
+import "../Sessions.mjs";
+import { makeSessionContract } from "../sessions/contract.mjs";
+import { Effect, Schema } from "effect";
+import { Rpc } from "effect/unstable/rpc";
+//#region src/operations/actions.d.ts
+/** Public action data is shared by local, HTTP and reactive callers. Private
+ * request fields are supplied by the server when the implementation executes. */
+interface ActionOptions<Payload extends Schema.Top, Success extends Schema.Top, Failure extends Schema.Top, Mode extends "query" | "mutation" = "query" | "mutation"> {
+  readonly payload: Payload;
+  readonly success: Success;
+  readonly error: Failure;
+  readonly mode: Mode;
+  readonly replay?: OperationReplay;
+  readonly credentials?: boolean;
+  readonly reveals?: ReadonlyArray<AuthRevealKind>;
+  readonly method?: string;
+  readonly strategy?: string;
+  readonly requestFields?: Readonly<Record<string, CredentialSlot>>;
+  readonly subject?: {
+    fromSuccess(value: Success["Type"]): string | null | undefined;
+  };
+}
+/** Define the schema and behavior of one public method, independently of its
+ * implementation. Inputs use the schema's encoded form, matching operation.invoke. */
+declare const action: <Payload extends Schema.Top, Success extends Schema.Top, Failure extends Schema.Top, const Mode extends "query" | "mutation", const Method extends string | undefined = undefined, const Strategy extends string | undefined = undefined>(options: ActionOptions<Payload, Success, Failure, Mode> & {
+  readonly method?: Method;
+  readonly strategy?: Strategy;
+}) => Readonly<{
+  payload: Payload;
+  success: Success;
+  error: Failure;
+  mode: Mode;
+  replay?: OperationReplay;
+  credentials?: boolean;
+  subject?: {
+    fromSuccess(value: Success["Type"]): string | null | undefined;
+  } | undefined;
+  method: (string & Method) | undefined;
+  strategy: (string & Strategy) | undefined;
+  requestFields: Readonly<{
+    [x: string]: CredentialSlot;
+  }>;
+  reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+}>;
+type ActionDefinition = ActionOptions<Schema.Top, Schema.Top, Schema.Top>;
+type ActionDefinitions = Readonly<Record<string, ActionDefinition>>;
+/** Reuse a pure operation contract for a named action. Request credential fields
+ * are removed from the public schema and restored only by the local request adapter. */
+declare const fromOperation: <Fields extends Schema.Struct.Fields, Success extends Schema.Top, Failure extends Schema.Top, const RequestFields extends Readonly<Record<string, CredentialSlot>> = Record<never, never>, const Mode extends "query" | "mutation" = "mutation", const Method extends string | undefined = undefined, const Strategy extends string | undefined = undefined>(operation: {
+  readonly rpc: {
+    readonly payloadSchema: Schema.Struct<Fields>;
+    readonly successSchema: Success;
+    readonly errorSchema: Failure;
+  };
+  readonly exposure: "public" | "internal";
+  readonly replay: OperationReplay;
+  readonly credentials: boolean;
+  readonly reveals: ReadonlyArray<AuthRevealKind>;
+}, options?: {
+  readonly method?: Method;
+  readonly strategy?: Strategy;
+  readonly requestFields?: RequestFields & Record<Exclude<keyof RequestFields, Extract<keyof Fields, string>>, never>;
+  readonly mode?: Mode;
+  readonly subject?: {
+    fromSuccess(value: Success["Type"]): string | null | undefined;
+  };
+}) => Readonly<{
+  payload: Schema.Struct<Omit<Fields, keyof RequestFields>>;
+  success: Success;
+  error: Failure;
+  mode: Mode;
+  replay?: OperationReplay;
+  credentials?: boolean;
+  subject?: {
+    fromSuccess(value: Success["Type"]): string | null | undefined;
+  } | undefined;
+  method: (string & Method) | undefined;
+  strategy: (string & Strategy) | undefined;
+  requestFields: Readonly<{
+    [x: string]: CredentialSlot;
+  }>;
+  reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+}>;
+declare const bindAction: <const Name extends string, Payload extends Schema.Top, Success extends Schema.Top, Failure extends Schema.Top, Mode extends "query" | "mutation">(namespace: string, basePath: `/${string}`, name: Name, definition: ActionOptions<Payload, Success, Failure, Mode>) => Readonly<{
+  route: Readonly<{
+    operation: AuthOperation<`${string}/api/${Name}`, Payload, Success, Schema.Union<readonly [Failure, Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Payload;
+      readonly success: Success;
+      readonly error: Schema.Union<readonly [Failure, Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: OperationReplay;
+      readonly credentials?: true | undefined;
+      readonly reveals?: readonly ("recovery-codes" | "totp-enrollment")[] | undefined;
+    }>;
+    path: `/${string}/${Name}`;
+    method: "GET" | "POST";
+    credentials: Readonly<{}>;
+    reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+  }>;
+  mode: Mode;
+  method: string;
+  strategy: string | undefined;
+  requestFields: Readonly<{
+    [x: string]: CredentialSlot;
+  }>;
+  subject: {
+    fromSuccess(value: Success["Type"]): string | null | undefined;
+  } | undefined;
+}>;
+interface AnyAuthAction {
+  readonly route: {
+    readonly operation: {
+      readonly rpc: Rpc.AnyWithProps;
+      readonly exposure: "public" | "internal";
+      readonly replay: OperationReplay;
+      readonly credentials: boolean;
+      readonly reveals: ReadonlyArray<AuthRevealKind>;
+      readonly invokeUnknown: (invocation: AuthInvocation, input: unknown) => Effect.Effect<unknown, unknown, unknown>;
+    };
+    readonly path: `/${string}`;
+    readonly method: "POST" | "GET";
+    readonly credentials: Readonly<Record<never, never>>;
+    readonly reveals: ReadonlyArray<AuthRevealKind>;
+  };
+  readonly mode: "query" | "mutation";
+  readonly method: string;
+  readonly strategy: string | undefined;
+  readonly requestFields: Readonly<Record<string, CredentialSlot>>;
+  readonly subject?: {
+    fromSuccess(value: unknown): string | null | undefined;
+  } | undefined;
+}
+type AuthActions = Readonly<Record<string, AnyAuthAction>>;
+type Target<Definition, Key extends "method" | "strategy", Default> = Key extends keyof Definition ? Exclude<Definition[Key], undefined> | (undefined extends Definition[Key] ? Default : never) : Default;
+type BoundActions<Definitions extends ActionDefinitions> = { readonly [Name in keyof Definitions]: Definitions[Name] extends ActionOptions<infer P, infer S, infer E, infer M> ? Omit<ReturnType<typeof bindAction<Extract<Name, string>, P, S, E, M>>, "method" | "strategy"> & {
+  readonly method: Target<Definitions[Name], "method", Extract<Name, string>>;
+  readonly strategy: Target<Definitions[Name], "strategy", undefined>;
+} : never; };
+/** A browser-safe contract. The action callback only receives schemas; it never
+ * receives server configuration, keys, persistence or service implementations. */
+declare const make: <const Id extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>, const Additional extends ActionDefinitions = {}>(namespace: Id, options: {
+  readonly claims: Claims;
+  readonly basePath?: `/${string}`;
+  readonly actions?: (schemas: ReturnType<typeof makeSessionContract<`${Id}/sessions`, Claims>>) => Additional;
+}) => Readonly<{
+  namespace: Id;
+  claims: Claims;
+  sessions: Readonly<{
+    moduleId: `${Id}/sessions`;
+    Session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+    CompletionResult: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>;
+    operations: {
+      Complete: AuthOperation<`${Id}/sessions/session/complete`, Schema.Struct<{
+        readonly evidence: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly evidence: Schema.Struct<{
+            readonly revision: Schema.Struct<{
+              readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+              readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+              readonly credentials: Schema.$Array<Schema.Struct<{
+                readonly credentialId: Schema.NonEmptyString;
+                readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+              }>>;
+            }>;
+            readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+            readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+              readonly method: Schema.NonEmptyString;
+              readonly credentialId: Schema.NonEmptyString;
+              readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+              readonly userVerified: Schema.Boolean;
+              readonly phishingResistant: Schema.Boolean;
+              readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+            }>>;
+          }>;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+          readonly session: Schema.Struct<{
+            readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly assurance: typeof AuthenticationAssurance;
+            readonly issuedAt: Schema.DateTimeUtcFromMillis;
+            readonly expiresAt: Schema.DateTimeUtcFromMillis;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+            readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+          }>;
+        }>, Schema.TaggedStruct<"PendingAuthentication", {
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        }>]>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "non-idempotent";
+        readonly credentials: true;
+      }>;
+      CompletePending: AuthOperation<`${Id}/sessions/session/complete-pending`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly additional: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly additional: Schema.Struct<{
+            readonly revision: Schema.Struct<{
+              readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+              readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+              readonly credentials: Schema.$Array<Schema.Struct<{
+                readonly credentialId: Schema.NonEmptyString;
+                readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+              }>>;
+            }>;
+            readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+            readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+              readonly method: Schema.NonEmptyString;
+              readonly credentialId: Schema.NonEmptyString;
+              readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+              readonly userVerified: Schema.Boolean;
+              readonly phishingResistant: Schema.Boolean;
+              readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+            }>>;
+          }>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+          readonly session: Schema.Struct<{
+            readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly assurance: typeof AuthenticationAssurance;
+            readonly issuedAt: Schema.DateTimeUtcFromMillis;
+            readonly expiresAt: Schema.DateTimeUtcFromMillis;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+            readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+          }>;
+        }>, Schema.TaggedStruct<"PendingAuthentication", {
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        }>]>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      RejectPending: AuthOperation<`${Id}/sessions/session/reject-pending`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        }>;
+        readonly success: Schema.TaggedStruct<"Rejected", {}>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "non-idempotent";
+      }>;
+      Capabilities: AuthOperation<`${Id}/sessions/session/capabilities`, Schema.Void, Schema.Struct<{
+        readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+        readonly listing: Schema.Boolean;
+        readonly perSessionRevocation: Schema.Boolean;
+        readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+        readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+        readonly positiveCacheMillis: Schema.Literal<0>;
+      }>, Schema.Never, never, {
+        readonly payload: Schema.Void;
+        readonly success: Schema.Struct<{
+          readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+          readonly listing: Schema.Boolean;
+          readonly perSessionRevocation: Schema.Boolean;
+          readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+          readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+          readonly positiveCacheMillis: Schema.Literal<0>;
+        }>;
+        readonly error: Schema.Never;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "read-only";
+      }>;
+      Verify: AuthOperation<`${Id}/sessions/session/verify`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "any";
+        readonly replay: "read-only";
+      }>;
+      Renew: AuthOperation<`${Id}/sessions/session/renew`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "any";
+        readonly replay: "non-idempotent";
+        readonly credentials: true;
+      }>;
+      SignOut: AuthOperation<`${Id}/sessions/session/sign-out`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Union<readonly [Schema.Struct<{
+        readonly clearCredential: Schema.Literal<true>;
+        readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+      }>, typeof SessionSignOutUnavailable]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.Struct<{
+          readonly clearCredential: Schema.Literal<true>;
+          readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+        }>, typeof SessionSignOutUnavailable]>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "any";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      List: AuthOperation<`${Id}/sessions/session/list`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly cursor: Schema.optionalKey<Schema.String>;
+        readonly limit: Schema.Int;
+      }>, Schema.Struct<{
+        readonly sessions: Schema.$Array<Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+        readonly nextCursor: Schema.optionalKey<Schema.String>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly cursor: Schema.optionalKey<Schema.String>;
+          readonly limit: Schema.Int;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly sessions: Schema.$Array<Schema.Struct<{
+            readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly assurance: typeof AuthenticationAssurance;
+            readonly issuedAt: Schema.DateTimeUtcFromMillis;
+            readonly expiresAt: Schema.DateTimeUtcFromMillis;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+          readonly nextCursor: Schema.optionalKey<Schema.String>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly replay: "read-only";
+      }>;
+      Revoke: AuthOperation<`${Id}/sessions/session/revoke`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        }>;
+        readonly success: Schema.Void;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly replay: "idempotent";
+      }>;
+      RevokeAll: AuthOperation<`${Id}/sessions/session/revoke-all`, Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly replay: "non-idempotent";
+      }>;
+    };
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<Rpc.Rpc<`${Id}/sessions/session/capabilities`, Schema.Void, Schema.Struct<{
+      readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+      readonly listing: Schema.Boolean;
+      readonly perSessionRevocation: Schema.Boolean;
+      readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+      readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+      readonly positiveCacheMillis: Schema.Literal<0>;
+    }>, Schema.Union<readonly [Schema.Never, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/complete`, Schema.Struct<{
+      readonly evidence: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/complete-pending`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly additional: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/list`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly cursor: Schema.optionalKey<Schema.String>;
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly sessions: Schema.$Array<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+      readonly nextCursor: Schema.optionalKey<Schema.String>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/reject-pending`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/renew`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/revoke`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/revoke-all`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/sign-out`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.Struct<{
+      readonly clearCredential: Schema.Literal<true>;
+      readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+    }>, typeof SessionSignOutUnavailable]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/verify`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    stepUpOperations: Readonly<{
+      Begin: AuthOperation<`${Id}/sessions/session/step-up/begin`, Schema.Struct<{
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+      }>, Schema.TaggedStruct<"StepUpPending", {
+        readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+        }>;
+        readonly exposure: "public";
+        readonly success: Schema.TaggedStruct<"StepUpPending", {
+          readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly replay: "non-idempotent";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/sessions/session/step-up/complete`, Schema.Struct<{
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly additional: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+      }>, Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly additional: Schema.Struct<{
+            readonly revision: Schema.Struct<{
+              readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+              readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+              readonly credentials: Schema.$Array<Schema.Struct<{
+                readonly credentialId: Schema.NonEmptyString;
+                readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+              }>>;
+            }>;
+            readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+            readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+              readonly method: Schema.NonEmptyString;
+              readonly credentialId: Schema.NonEmptyString;
+              readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+              readonly userVerified: Schema.Boolean;
+              readonly phishingResistant: Schema.Boolean;
+              readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+            }>>;
+          }>;
+        }>;
+        readonly exposure: "internal";
+        readonly success: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Reject: AuthOperation<`${Id}/sessions/session/step-up/reject`, Schema.Struct<{
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly exposure: "internal";
+        readonly success: Schema.TaggedStruct<"Rejected", {}>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "non-idempotent";
+      }>;
+    }>;
+    stepUpGroup: import("effect/unstable/rpc/RpcGroup").RpcGroup<Rpc.Rpc<`${Id}/sessions/session/step-up/begin`, Schema.Struct<{
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+    }>, Schema.TaggedStruct<"StepUpPending", {
+      readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/step-up/complete`, Schema.Struct<{
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly additional: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | Rpc.Rpc<`${Id}/sessions/session/step-up/reject`, Schema.Struct<{
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  }>;
+  actions: BoundActions<{
+    getSession: Readonly<{
+      payload: Schema.Void;
+      success: Schema.NullOr<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>>;
+      error: Schema.Never;
+      mode: "query";
+      replay?: OperationReplay;
+      credentials?: boolean;
+      subject?: {
+        fromSuccess(value: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        } | null): string | null | undefined;
+      } | undefined;
+      method: undefined;
+      strategy: undefined;
+      requestFields: Readonly<{
+        [x: string]: CredentialSlot;
+      }>;
+      reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+    }>;
+    requireSession: Readonly<{
+      payload: Schema.Void;
+      success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      error: Schema.Never;
+      mode: "query";
+      replay?: OperationReplay;
+      credentials?: boolean;
+      subject?: {
+        fromSuccess(value: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        }): string | null | undefined;
+      } | undefined;
+      method: undefined;
+      strategy: undefined;
+      requestFields: Readonly<{
+        [x: string]: CredentialSlot;
+      }>;
+      reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+    }>;
+    signOut: Readonly<{
+      payload: Schema.Void;
+      success: Schema.Union<readonly [Schema.Struct<{
+        readonly clearCredential: Schema.Literal<true>;
+        readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+      }>, typeof SessionSignOutUnavailable]>;
+      error: Schema.Never;
+      mode: "mutation";
+      replay?: OperationReplay;
+      credentials?: boolean;
+      subject?: {
+        fromSuccess(value: SessionSignOutUnavailable | {
+          readonly clearCredential: true;
+          readonly invalidation: "already-invalid" | "client-only" | "revoked";
+        }): string | null | undefined;
+      } | undefined;
+      method: undefined;
+      strategy: undefined;
+      requestFields: Readonly<{
+        [x: string]: CredentialSlot;
+      }>;
+      reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+    }>;
+    renewSession: Readonly<{
+      payload: Schema.Void;
+      success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      error: Schema.Never;
+      mode: "mutation";
+      replay?: OperationReplay;
+      credentials?: boolean;
+      subject?: {
+        fromSuccess(value: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        }): string | null | undefined;
+      } | undefined;
+      method: undefined;
+      strategy: undefined;
+      requestFields: Readonly<{
+        [x: string]: CredentialSlot;
+      }>;
+      reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+    }>;
+  } & Additional>;
+}>;
+interface AnyAuthContract {
+  readonly namespace: string;
+  readonly claims: Schema.Codec<unknown, unknown, unknown, unknown>;
+  readonly actions: AuthActions;
+}
+type ActionInput<A extends AnyAuthAction> = A["route"]["operation"]["rpc"]["payloadSchema"]["Encoded"];
+type ActionSuccess<A extends AnyAuthAction> = A["route"]["operation"]["rpc"]["successSchema"]["Type"];
+type ActionError<A extends AnyAuthAction> = A["route"]["operation"]["rpc"]["errorSchema"]["Type"];
+//#endregion
+export { ActionDefinition, ActionDefinitions, ActionError, ActionInput, ActionOptions, ActionSuccess, AnyAuthAction, AnyAuthContract, AuthActions, BoundActions, action, fromOperation, make };
+//# sourceMappingURL=actions.d.mts.map