@yielded/auth 0.1.0-beta.1

package/dist/passkey/module.d.mts

@@ -0,0 +1,2132 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { AuthInvocation, AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthCredentialCommandCollector, AuthOperationResult, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { AuthOperation, CredentialCollectorProvenance, OperationHandler, RevealCollectorProvenance } from "../operations/operation.mjs";
+import { AuthenticationEvidence } from "../sessions/models.mjs";
+import { LastSignInMethod } from "../identity/models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { RequestBindingConfig } from "../operations/RequestBindingConfig.mjs";
+import { RequestBindingFlowId, RequestBindingPublic } from "../operations/requestBindingModels.mjs";
+import { BindingModule, RequestBindingConfiguration, RequestBindingConfigurationError, RequestBindingInvalid, RequestBindingUnavailable, VerifiedRequestBinding } from "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Hooks.mjs";
+import { SessionApiError } from "../auth/session.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "../auth/AuthConfigurationError.mjs";
+import "../Auth.mjs";
+import { ModuleService, makeSessionModule } from "../sessions/module.mjs";
+import "../Sessions.mjs";
+import "../Identity.mjs";
+import { PasskeyAuthenticationStarted, PasskeyBegin, PasskeyCeremony, PasskeyClaim, PasskeyCleanupResult, PasskeyComplete, PasskeyCredential, PasskeyRegistrationComplete, PasskeyRegistrationResult, PasskeyRegistrationStarted, PasskeyRegistrationVerified, PasskeyTarget } from "./models.mjs";
+import { PasskeyActionRequired, PasskeyConfigurationError, PasskeyFailure, PasskeyMethodUnsupported, PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyCredentials } from "./PasskeyCredentials.mjs";
+import { PasskeyEnrollmentContext } from "./PasskeyEnrollmentContext.mjs";
+import { PasskeyManagementPolicy, PasskeyMethodPolicy } from "./policy.mjs";
+import { PasskeyPersistence, PreparePasskeyCommit } from "./PasskeyPersistence.mjs";
+import { PasskeyManagementPersistence } from "./PasskeyManagementPersistence.mjs";
+import { PasskeyActionEvidence } from "./PasskeyActionEvidence.mjs";
+import { PasskeyProtocol } from "./PasskeyProtocol.mjs";
+import { Context, DateTime, Effect, Layer, Schema, Types } from "effect";
+//#region src/passkey/module.d.ts
+type PasskeyConfiguration = {
+  readonly policy: PasskeyMethodPolicy;
+  readonly relyingParty?: never;
+} | {
+  readonly policy?: never;
+  readonly relyingParty: {
+    readonly id: string;
+    readonly name: string;
+    readonly origins: readonly string[];
+    readonly developmentLocalhost?: boolean;
+  };
+};
+/** Descriptors capture policy data once; invalid policies remain typed Effect failures. */
+declare const capturePasskeyConfiguration: (options: PasskeyConfiguration) => Effect.Effect<{
+  readonly generation: number;
+  readonly profiles: readonly [{
+    readonly profileId: string;
+    readonly generation: number;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly origins: readonly [string, ...string[]];
+    readonly developmentLocalhost: boolean;
+    readonly residentKey: "discouraged" | "preferred" | "required";
+    readonly userVerification: "preferred" | "required";
+    readonly primarySignIn: boolean;
+    readonly attestation: "none";
+    readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+  }, ...{
+    readonly profileId: string;
+    readonly generation: number;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly origins: readonly [string, ...string[]];
+    readonly developmentLocalhost: boolean;
+    readonly residentKey: "discouraged" | "preferred" | "required";
+    readonly userVerification: "preferred" | "required";
+    readonly primarySignIn: boolean;
+    readonly attestation: "none";
+    readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+  }[]];
+  readonly lifetimeMillis: number;
+  readonly claimLifetimeMillis: number;
+  readonly retentionMillis: number;
+  readonly maximumPending: number;
+  readonly maximumPendingPerSubject: number;
+  readonly admission: {
+    readonly global: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly subject: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly target: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+  };
+}, PasskeyConfigurationError, never>;
+declare const makePasskeyMethod: <const Id extends string, const SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, options: {
+  readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;
+} & PasskeyConfiguration, configuredSource?: ReturnType<typeof capturePasskeyConfiguration>) => Readonly<{
+  strategy: Readonly<{
+    completion: boolean;
+    make: Effect.Effect<{
+      readonly signIn: (input: {
+        readonly flowId: string;
+        readonly commandId: string;
+        readonly profileId: string;
+      }) => Effect.Effect<{
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: number;
+        readonly options: {
+          readonly challenge: string;
+          readonly rpId: string;
+          readonly timeout: number;
+          readonly userVerification: "preferred" | "required";
+          readonly allowCredentials: readonly {
+            readonly type: "public-key";
+            readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+          }[];
+        };
+      }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+      readonly completeSignIn: (input: {
+        readonly flowId: string;
+        readonly bindingCredential: string;
+        readonly response: string;
+      }) => Effect.Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: DateTime.Utc;
+          readonly expiresAt: DateTime.Utc;
+          readonly absoluteExpiresAt: DateTime.Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: DateTime.Utc;
+      }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+    }, AuthConfigurationError | PasskeyConfigurationError | RequestBindingConfigurationError, AuthenticationAuthority | Layer.CurrentMemoMap | ModuleService<SessionId, "completion", Claims["Type"]> | PasskeyCredentials | PasskeyPersistence | PasskeyProtocol | RequestBindingConfig | import("effect/Scope").Scope | {
+      readonly moduleId: Id;
+      readonly kind: "passkey-claims";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    } | Exclude<Exclude<Exclude<Exclude<Claims["DecodingServices"], import("effect/Scope").Scope>, BindingModule<Id, "passkey-sign-in">>, LifecycleHooks>, import("effect/Crypto").Crypto | SubtleCrypto> | Exclude<Exclude<Exclude<Exclude<Claims["EncodingServices"], import("effect/Scope").Scope>, BindingModule<Id, "passkey-sign-in">>, LifecycleHooks>, import("effect/Crypto").Crypto | SubtleCrypto>>;
+  }>;
+  Passkeys: Context.Service<{
+    readonly moduleId: Id;
+    readonly kind: "passkeys";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }, {
+    readonly begin: (invocation: AuthInvocation, input: PasskeyBegin) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+    readonly complete: (invocation: AuthInvocation, input: PasskeyComplete) => Effect.Effect<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    }>, PasskeyFailure>;
+    readonly cleanup: (invocation: AuthInvocation, limit: number) => Effect.Effect<PasskeyCleanupResult, PasskeyFailure>;
+  }>;
+  ClaimsForPasskey: Context.Service<{
+    readonly moduleId: Id;
+    readonly kind: "passkey-claims";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }, {
+    readonly resolve: (credential: PasskeyCredential) => Effect.Effect<Claims["Type"], PasskeyUnavailable>;
+  }>;
+  binding: Readonly<{
+    RequestBinding: Context.Service<BindingModule<Id, "passkey-sign-in">, {
+      readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+      readonly verify: (flowId: RequestBindingFlowId, credential: import("effect/Redacted").Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+    }>;
+    signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-sign-in">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | SubtleCrypto>;
+    layer: Layer.Layer<BindingModule<Id, "passkey-sign-in">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
+  }>;
+  layer: Layer.Layer<{
+    readonly moduleId: Id;
+    readonly kind: "passkeys";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }, PasskeyConfigurationError, AuthenticationAuthority | BindingModule<Id, "passkey-sign-in"> | import("effect/Crypto").Crypto | LifecycleHooks | ModuleService<SessionId, "completion", Claims["Type"]> | PasskeyCredentials | PasskeyPersistence | PasskeyProtocol | {
+    readonly moduleId: Id;
+    readonly kind: "passkey-claims";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  } | Exclude<Claims["DecodingServices"], import("effect/Scope").Scope> | Exclude<Claims["EncodingServices"], import("effect/Scope").Scope>>;
+  handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/cleanup`, {
+    readonly limit: number;
+  }, {
+    readonly terminalized: number;
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/sign-in/begin`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string;
+    readonly profileId: string;
+  }, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: number;
+    readonly options: {
+      readonly challenge: string;
+      readonly rpId: string;
+      readonly timeout: number;
+      readonly userVerification: "preferred" | "required";
+      readonly allowCredentials: readonly {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/sign-in/complete`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+    readonly response: import("effect/Redacted").Redacted<string>;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: DateTime.Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable>, never, {
+    readonly moduleId: Id;
+    readonly kind: "passkeys";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }>;
+  operations: Readonly<{
+    Begin: AuthOperation<`${Id}/passkey/sign-in/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.Int;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        readonly allowCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rpId: Schema.String;
+          readonly timeout: Schema.Int;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          readonly allowCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/passkey/sign-in/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Cleanup: AuthOperation<`${Id}/passkey/cleanup`, Schema.Struct<{
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly terminalized: Schema.Natural;
+      readonly removed: Schema.Natural;
+      readonly hasMore: Schema.Boolean;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly limit: Schema.Int;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly terminalized: Schema.Natural;
+        readonly removed: Schema.Natural;
+        readonly hasMore: Schema.Boolean;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly access: "system";
+      readonly exposure: "internal";
+      readonly replay: "non-idempotent";
+    }>;
+  }>;
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/cleanup`, Schema.Struct<{
+    readonly limit: Schema.Int;
+  }>, Schema.Struct<{
+    readonly terminalized: Schema.Natural;
+    readonly removed: Schema.Natural;
+    readonly hasMore: Schema.Boolean;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/sign-in/begin`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+  }>, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly options: Schema.Struct<{
+      readonly challenge: Schema.String;
+      readonly rpId: Schema.String;
+      readonly timeout: Schema.Int;
+      readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+      readonly allowCredentials: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/sign-in/complete`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  registration: <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(codec: Registration) => Readonly<{
+    RegistrationAuthority: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-registration-authority";
+      readonly registration: Types.Invariant<Registration>;
+    }, {
+      readonly inspect: (registration: Registration["Type"]) => Effect.Effect<{
+        readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly eligible: boolean;
+        readonly name: string;
+        readonly displayName: string;
+      }, PasskeyUnavailable>;
+      readonly issueRegistration: <A>(input: {
+        readonly ceremony: PasskeyCeremony;
+        readonly policy: PasskeyMethodPolicy;
+        readonly registration: Registration["Type"];
+      }, prepare: PreparePasskeyCommit<{
+        readonly _tag: "Rejected";
+      } | {
+        readonly _tag: "Issued";
+        readonly ceremony: {
+          readonly moduleId: string;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string;
+          readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+          readonly profile: {
+            readonly profileId: string;
+            readonly generation: number;
+            readonly rpId: string;
+            readonly rpName: string;
+            readonly origins: readonly [string, ...string[]];
+            readonly developmentLocalhost: boolean;
+            readonly residentKey: "discouraged" | "preferred" | "required";
+            readonly userVerification: "preferred" | "required";
+            readonly primarySignIn: boolean;
+            readonly attestation: "none";
+            readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+          };
+          readonly challenge: string;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly retentionUntilMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly allowedCredentials: readonly {
+            readonly type: "public-key";
+            readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+          }[];
+          readonly context: {
+            readonly _tag: "SignIn";
+          } | {
+            readonly _tag: "Registration";
+            readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+            readonly name: string;
+            readonly displayName: string;
+          } | {
+            readonly _tag: "Enrollment";
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+            readonly name: string;
+            readonly authorization: {
+              readonly challenge: {
+                readonly moduleId: string;
+                readonly action: "enroll-begin" | "enroll-complete" | "remove";
+                readonly commandId: string;
+                readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+                readonly revision: {
+                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly credentials: readonly {
+                    readonly credentialId: string;
+                    readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  }[];
+                };
+                readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              };
+              readonly evidence: {
+                readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+                readonly revision: {
+                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly credentials: readonly {
+                    readonly credentialId: string;
+                    readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  }[];
+                };
+                readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+                readonly proofs: readonly [{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly verifiedAt: DateTime.Utc;
+                  readonly method: string;
+                  readonly credentialId: string;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                }, ...{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly verifiedAt: DateTime.Utc;
+                  readonly method: string;
+                  readonly credentialId: string;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                }[]];
+              };
+              readonly requirement: {
+                readonly maximumAgeMillis: number;
+                readonly alternatives: readonly [{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }, ...{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }[]];
+              };
+            };
+          } | {
+            readonly _tag: "Pending";
+            readonly target: {
+              readonly moduleId: string;
+              readonly kind: string;
+              readonly commandId: string;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly requirement?: {
+                readonly maximumAgeMillis: number;
+                readonly alternatives: readonly [{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }, ...{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }[]];
+              } | undefined;
+              readonly expiresAtMillis: number;
+            };
+          } | {
+            readonly _tag: "StepUp";
+            readonly target: {
+              readonly moduleId: string;
+              readonly kind: string;
+              readonly commandId: string;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly requirement?: {
+                readonly maximumAgeMillis: number;
+                readonly alternatives: readonly [{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }, ...{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }[]];
+              } | undefined;
+              readonly expiresAtMillis: number;
+            };
+          } | {
+            readonly _tag: "Action";
+            readonly target: {
+              readonly moduleId: string;
+              readonly kind: string;
+              readonly commandId: string;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly requirement?: {
+                readonly maximumAgeMillis: number;
+                readonly alternatives: readonly [{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }, ...{
+                  readonly userVerified: boolean;
+                  readonly phishingResistant: boolean;
+                  readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                  readonly minimumCredentials: number;
+                }[]];
+              } | undefined;
+              readonly expiresAtMillis: number;
+            };
+          };
+        };
+      }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable, never>;
+      readonly completeRegistration: <A>(input: {
+        readonly claim: PasskeyClaim;
+        readonly verified: PasskeyRegistrationVerified;
+        readonly nowMillis: number;
+      }, prepare: PreparePasskeyCommit<{
+        readonly _tag: "Rejected";
+      } | {
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable, never>;
+    }>;
+    Registrations: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-registration";
+      readonly registration: Types.Invariant<Registration>;
+    }, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly profileId: string;
+        readonly registration: Registration["Type"];
+      }) => Effect.Effect<AuthOperationResult<PasskeyRegistrationStarted>, PasskeyFailure>;
+      readonly complete: (invocation: AuthInvocation, input: PasskeyRegistrationComplete) => Effect.Effect<AuthOperationResult<PasskeyRegistrationResult>, PasskeyFailure>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "passkey-registration">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: import("effect/Redacted").Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-registration">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "passkey-registration">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-registration";
+      readonly registration: Types.Invariant<Registration>;
+    }, PasskeyConfigurationError, BindingModule<Id, "passkey-registration"> | import("effect/Crypto").Crypto | LifecycleHooks | PasskeyPersistence | PasskeyProtocol | {
+      readonly moduleId: Id;
+      readonly kind: "passkey-registration-authority";
+      readonly registration: Types.Invariant<Registration>;
+    } | Exclude<Registration["DecodingServices"], import("effect/Scope").Scope> | Exclude<Registration["EncodingServices"], import("effect/Scope").Scope>>;
+    operations: Readonly<{
+      Begin: AuthOperation<`${Id}/passkey/registration/begin`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+      }>, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rp: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly name: Schema.NonEmptyString;
+          }>;
+          readonly user: Schema.Struct<{
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+            readonly name: Schema.NonEmptyString;
+            readonly displayName: Schema.NonEmptyString;
+          }>;
+          readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly alg: Schema.Literals<readonly [-7, -257]>;
+          }>>;
+          readonly timeout: Schema.Int;
+          readonly attestation: Schema.Literal<"none">;
+          readonly authenticatorSelection: Schema.Struct<{
+            readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          }>;
+          readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.String;
+          readonly profileId: Schema.String;
+          readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: Schema.Int;
+          readonly options: Schema.Struct<{
+            readonly challenge: Schema.String;
+            readonly rp: Schema.Struct<{
+              readonly id: Schema.String;
+              readonly name: Schema.NonEmptyString;
+            }>;
+            readonly user: Schema.Struct<{
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+              readonly name: Schema.NonEmptyString;
+              readonly displayName: Schema.NonEmptyString;
+            }>;
+            readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly alg: Schema.Literals<readonly [-7, -257]>;
+            }>>;
+            readonly timeout: Schema.Int;
+            readonly attestation: Schema.Literal<"none">;
+            readonly authenticatorSelection: Schema.Struct<{
+              readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+              readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+            }>;
+            readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+            }>>;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "any";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/passkey/registration/complete`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+        readonly reference: Schema.String;
+      }>]>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+          readonly reference: Schema.String;
+        }>]>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "any";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    }>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/registration/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rp: Schema.Struct<{
+          readonly id: Schema.String;
+          readonly name: Schema.NonEmptyString;
+        }>;
+        readonly user: Schema.Struct<{
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+          readonly name: Schema.NonEmptyString;
+          readonly displayName: Schema.NonEmptyString;
+        }>;
+        readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly alg: Schema.Literals<readonly [-7, -257]>;
+        }>>;
+        readonly timeout: Schema.Int;
+        readonly attestation: Schema.Literal<"none">;
+        readonly authenticatorSelection: Schema.Struct<{
+          readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        }>;
+        readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/registration/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+      readonly reference: Schema.String;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/registration/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly profileId: string;
+      readonly registration: Registration["Type"];
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: number;
+      readonly options: {
+        readonly challenge: string;
+        readonly rp: {
+          readonly id: string;
+          readonly name: string;
+        };
+        readonly user: {
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+          readonly name: string;
+          readonly displayName: string;
+        };
+        readonly pubKeyCredParams: readonly [{
+          readonly type: "public-key";
+          readonly alg: -257 | -7;
+        }, ...{
+          readonly type: "public-key";
+          readonly alg: -257 | -7;
+        }[]];
+        readonly timeout: number;
+        readonly attestation: "none";
+        readonly authenticatorSelection: {
+          readonly residentKey: "discouraged" | "preferred" | "required";
+          readonly userVerification: "preferred" | "required";
+        };
+        readonly excludeCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/registration/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+      readonly response: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly _tag: "RegistrationAccepted";
+    } | {
+      readonly _tag: "ProvisioningPending";
+      readonly reference: string;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable>, never, {
+      readonly moduleId: Id;
+      readonly kind: "passkey-registration";
+      readonly registration: Types.Invariant<Registration>;
+    }>;
+    strategy: Readonly<{
+      completion: false;
+      make: Effect.Effect<{
+        readonly register: (input: {
+          readonly flowId: string;
+          readonly commandId: string;
+          readonly profileId: string;
+          readonly registration: Registration["Encoded"];
+        }) => Effect.Effect<{
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: number;
+          readonly options: {
+            readonly challenge: string;
+            readonly rp: {
+              readonly id: string;
+              readonly name: string;
+            };
+            readonly user: {
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+              readonly name: string;
+              readonly displayName: string;
+            };
+            readonly pubKeyCredParams: readonly [{
+              readonly type: "public-key";
+              readonly alg: -257 | -7;
+            }, ...{
+              readonly type: "public-key";
+              readonly alg: -257 | -7;
+            }[]];
+            readonly timeout: number;
+            readonly attestation: "none";
+            readonly authenticatorSelection: {
+              readonly residentKey: "discouraged" | "preferred" | "required";
+              readonly userVerification: "preferred" | "required";
+            };
+            readonly excludeCredentials: readonly {
+              readonly type: "public-key";
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+            }[];
+          };
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest | Exclude<Exclude<Registration["DecodingServices"], CredentialCollectorProvenance | RevealCollectorProvenance>, OperationHandler<`${Id}/passkey/registration/begin`, {
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string;
+          readonly profileId: string;
+          readonly registration: Registration["Type"];
+        }, {
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: number;
+          readonly options: {
+            readonly challenge: string;
+            readonly rp: {
+              readonly id: string;
+              readonly name: string;
+            };
+            readonly user: {
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+              readonly name: string;
+              readonly displayName: string;
+            };
+            readonly pubKeyCredParams: readonly [{
+              readonly type: "public-key";
+              readonly alg: -257 | -7;
+            }, ...{
+              readonly type: "public-key";
+              readonly alg: -257 | -7;
+            }[]];
+            readonly timeout: number;
+            readonly attestation: "none";
+            readonly authenticatorSelection: {
+              readonly residentKey: "discouraged" | "preferred" | "required";
+              readonly userVerification: "preferred" | "required";
+            };
+            readonly excludeCredentials: readonly {
+              readonly type: "public-key";
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+            }[];
+          };
+        }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/registration/complete`, {
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+          readonly response: import("effect/Redacted").Redacted<string>;
+        }, {
+          readonly _tag: "RegistrationAccepted";
+        } | {
+          readonly _tag: "ProvisioningPending";
+          readonly reference: string;
+        }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | (AuthCredentialCommandCollector | AuthRevealCommandCollectorService)>>;
+        readonly completeRegistration: (input: {
+          readonly flowId: string;
+          readonly bindingCredential: string;
+          readonly response: string;
+        }) => Effect.Effect<{
+          readonly _tag: "RegistrationAccepted";
+        } | {
+          readonly _tag: "ProvisioningPending";
+          readonly reference: string;
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+      }, AuthConfigurationError | PasskeyConfigurationError | RequestBindingConfigurationError, Layer.CurrentMemoMap | PasskeyPersistence | PasskeyProtocol | RequestBindingConfig | import("effect/Scope").Scope | {
+        readonly moduleId: Id;
+        readonly kind: "passkey-registration-authority";
+        readonly registration: Types.Invariant<Registration>;
+      } | Exclude<Exclude<Exclude<Exclude<Registration["DecodingServices"], import("effect/Scope").Scope>, BindingModule<Id, "passkey-registration">>, LifecycleHooks>, import("effect/Crypto").Crypto | SubtleCrypto> | Exclude<Exclude<Exclude<Exclude<Registration["EncodingServices"], import("effect/Scope").Scope>, BindingModule<Id, "passkey-registration">>, LifecycleHooks>, import("effect/Crypto").Crypto | SubtleCrypto>>;
+    }>;
+  }>;
+  management: (policy: PasskeyManagementPolicy) => Readonly<{
+    Management: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-management";
+    }, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly profileId: string;
+        readonly name: string;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: number;
+        readonly options: {
+          readonly challenge: string;
+          readonly rp: {
+            readonly id: string;
+            readonly name: string;
+          };
+          readonly user: {
+            readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+            readonly name: string;
+            readonly displayName: string;
+          };
+          readonly pubKeyCredParams: readonly [{
+            readonly type: "public-key";
+            readonly alg: -257 | -7;
+          }, ...{
+            readonly type: "public-key";
+            readonly alg: -257 | -7;
+          }[]];
+          readonly timeout: number;
+          readonly attestation: "none";
+          readonly authenticatorSelection: {
+            readonly residentKey: "discouraged" | "preferred" | "required";
+            readonly userVerification: "preferred" | "required";
+          };
+          readonly excludeCredentials: readonly {
+            readonly type: "public-key";
+            readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+          }[];
+        };
+      }>, PasskeyFailure>;
+      readonly complete: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+        readonly response: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly credential: {
+          readonly credentialId: string;
+          readonly name: string;
+          readonly primarySignIn: boolean;
+          readonly createdAtMillis: number;
+          readonly lastUsedAtMillis?: number | undefined;
+        };
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }>, PasskeyFailure>;
+      readonly list: (invocation: AuthInvocation, input: {
+        readonly cursor?: string | undefined;
+        readonly limit: number;
+      }) => Effect.Effect<{
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly name: string;
+          readonly primarySignIn: boolean;
+          readonly createdAtMillis: number;
+          readonly lastUsedAtMillis?: number | undefined;
+        }[];
+        readonly cursor?: string | undefined;
+      }, PasskeyFailure>;
+      readonly rename: (invocation: AuthInvocation, input: {
+        readonly commandId: string;
+        readonly credentialId: string;
+        readonly name: string;
+      }) => Effect.Effect<{
+        readonly credential: {
+          readonly credentialId: string;
+          readonly name: string;
+          readonly primarySignIn: boolean;
+          readonly createdAtMillis: number;
+          readonly lastUsedAtMillis?: number | undefined;
+        };
+        readonly replayed: boolean;
+      }, HookDenied | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable, never>;
+      readonly remove: (invocation: AuthInvocation, input: {
+        readonly commandId: string;
+        readonly credentialId: string;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      }) => Effect.Effect<{
+        readonly credentialId: string;
+        readonly replayed: boolean;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, HookDenied | LastSignInMethod | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "passkey-enrollment">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: import("effect/Redacted").Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-enrollment">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "passkey-enrollment">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-management";
+    }, PasskeyConfigurationError, BindingModule<Id, "passkey-enrollment"> | import("effect/Crypto").Crypto | LifecycleHooks | ModuleService<SessionId, "strategy", Claims["Type"]> | PasskeyActionEvidence | PasskeyEnrollmentContext | PasskeyManagementPersistence | PasskeyPersistence | PasskeyProtocol>;
+    operations: Readonly<{
+      Begin: AuthOperation<`${Id}/passkey/enrollment/begin`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly name: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rp: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly name: Schema.NonEmptyString;
+          }>;
+          readonly user: Schema.Struct<{
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+            readonly name: Schema.NonEmptyString;
+            readonly displayName: Schema.NonEmptyString;
+          }>;
+          readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly alg: Schema.Literals<readonly [-7, -257]>;
+          }>>;
+          readonly timeout: Schema.Int;
+          readonly attestation: Schema.Literal<"none">;
+          readonly authenticatorSelection: Schema.Struct<{
+            readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          }>;
+          readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.String;
+          readonly profileId: Schema.String;
+          readonly name: Schema.NonEmptyString;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: Schema.Int;
+          readonly options: Schema.Struct<{
+            readonly challenge: Schema.String;
+            readonly rp: Schema.Struct<{
+              readonly id: Schema.String;
+              readonly name: Schema.NonEmptyString;
+            }>;
+            readonly user: Schema.Struct<{
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+              readonly name: Schema.NonEmptyString;
+              readonly displayName: Schema.NonEmptyString;
+            }>;
+            readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly alg: Schema.Literals<readonly [-7, -257]>;
+            }>>;
+            readonly timeout: Schema.Int;
+            readonly attestation: Schema.Literal<"none">;
+            readonly authenticatorSelection: Schema.Struct<{
+              readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+              readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+            }>;
+            readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+            }>>;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/passkey/enrollment/complete`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>, Schema.Struct<{
+        readonly credential: Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+          readonly primarySignIn: Schema.Boolean;
+          readonly createdAtMillis: Schema.Int;
+          readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+        }>;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly credential: Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly name: Schema.NonEmptyString;
+            readonly primarySignIn: Schema.Boolean;
+            readonly createdAtMillis: Schema.Int;
+            readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+          }>;
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      List: AuthOperation<`${Id}/passkey/list`, Schema.Struct<{
+        readonly cursor: Schema.optionalKey<Schema.String>;
+        readonly limit: Schema.Int;
+      }>, Schema.Struct<{
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+          readonly primarySignIn: Schema.Boolean;
+          readonly createdAtMillis: Schema.Int;
+          readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+        }>>;
+        readonly cursor: Schema.optionalKey<Schema.String>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly cursor: Schema.optionalKey<Schema.String>;
+          readonly limit: Schema.Int;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly name: Schema.NonEmptyString;
+            readonly primarySignIn: Schema.Boolean;
+            readonly createdAtMillis: Schema.Int;
+            readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+          }>>;
+          readonly cursor: Schema.optionalKey<Schema.String>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "read-only";
+      }>;
+      Rename: AuthOperation<`${Id}/passkey/rename`, Schema.Struct<{
+        readonly commandId: Schema.String;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+      }>, Schema.Struct<{
+        readonly credential: Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+          readonly primarySignIn: Schema.Boolean;
+          readonly createdAtMillis: Schema.Int;
+          readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+        }>;
+        readonly replayed: Schema.Boolean;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.String;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly credential: Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly name: Schema.NonEmptyString;
+            readonly primarySignIn: Schema.Boolean;
+            readonly createdAtMillis: Schema.Int;
+            readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+          }>;
+          readonly replayed: Schema.Boolean;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "idempotent";
+      }>;
+      Remove: AuthOperation<`${Id}/passkey/remove`, Schema.Struct<{
+        readonly commandId: Schema.String;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>, Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly replayed: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.String;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly replayed: Schema.Boolean;
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "idempotent";
+      }>;
+    }>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/enrollment/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly name: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rp: Schema.Struct<{
+          readonly id: Schema.String;
+          readonly name: Schema.NonEmptyString;
+        }>;
+        readonly user: Schema.Struct<{
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+          readonly name: Schema.NonEmptyString;
+          readonly displayName: Schema.NonEmptyString;
+        }>;
+        readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly alg: Schema.Literals<readonly [-7, -257]>;
+        }>>;
+        readonly timeout: Schema.Int;
+        readonly attestation: Schema.Literal<"none">;
+        readonly authenticatorSelection: Schema.Struct<{
+          readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        }>;
+        readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/enrollment/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly credential: Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+        readonly primarySignIn: Schema.Boolean;
+        readonly createdAtMillis: Schema.Int;
+        readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+      }>;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/list`, Schema.Struct<{
+      readonly cursor: Schema.optionalKey<Schema.String>;
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+        readonly primarySignIn: Schema.Boolean;
+        readonly createdAtMillis: Schema.Int;
+        readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+      }>>;
+      readonly cursor: Schema.optionalKey<Schema.String>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/remove`, Schema.Struct<{
+      readonly commandId: Schema.String;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly replayed: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/rename`, Schema.Struct<{
+      readonly commandId: Schema.String;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly name: Schema.NonEmptyString;
+    }>, Schema.Struct<{
+      readonly credential: Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+        readonly primarySignIn: Schema.Boolean;
+        readonly createdAtMillis: Schema.Int;
+        readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+      }>;
+      readonly replayed: Schema.Boolean;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/enrollment/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly profileId: string;
+      readonly name: string;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: number;
+      readonly options: {
+        readonly challenge: string;
+        readonly rp: {
+          readonly id: string;
+          readonly name: string;
+        };
+        readonly user: {
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+          readonly name: string;
+          readonly displayName: string;
+        };
+        readonly pubKeyCredParams: readonly [{
+          readonly type: "public-key";
+          readonly alg: -257 | -7;
+        }, ...{
+          readonly type: "public-key";
+          readonly alg: -257 | -7;
+        }[]];
+        readonly timeout: number;
+        readonly attestation: "none";
+        readonly authenticatorSelection: {
+          readonly residentKey: "discouraged" | "preferred" | "required";
+          readonly userVerification: "preferred" | "required";
+        };
+        readonly excludeCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/enrollment/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+      readonly response: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    }, {
+      readonly credential: {
+        readonly credentialId: string;
+        readonly name: string;
+        readonly primarySignIn: boolean;
+        readonly createdAtMillis: number;
+        readonly lastUsedAtMillis?: number | undefined;
+      };
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/list`, {
+      readonly cursor?: string | undefined;
+      readonly limit: number;
+    }, {
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly name: string;
+        readonly primarySignIn: boolean;
+        readonly createdAtMillis: number;
+        readonly lastUsedAtMillis?: number | undefined;
+      }[];
+      readonly cursor?: string | undefined;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/remove`, {
+      readonly commandId: string;
+      readonly credentialId: string;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    }, {
+      readonly credentialId: string;
+      readonly replayed: boolean;
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | LastSignInMethod | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/rename`, {
+      readonly commandId: string;
+      readonly credentialId: string;
+      readonly name: string;
+    }, {
+      readonly credential: {
+        readonly credentialId: string;
+        readonly name: string;
+        readonly primarySignIn: boolean;
+        readonly createdAtMillis: number;
+        readonly lastUsedAtMillis?: number | undefined;
+      };
+      readonly replayed: boolean;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable>, never, {
+      readonly moduleId: Id;
+      readonly kind: "passkey-management";
+    }>;
+    strategy: Readonly<{
+      completion: false;
+      make: Effect.Effect<{
+        readonly enrollPasskey: (input: {
+          readonly flowId: string;
+          readonly commandId: string;
+          readonly profileId: string;
+          readonly name: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: number;
+          readonly options: {
+            readonly challenge: string;
+            readonly rp: {
+              readonly id: string;
+              readonly name: string;
+            };
+            readonly user: {
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+              readonly name: string;
+              readonly displayName: string;
+            };
+            readonly pubKeyCredParams: readonly [{
+              readonly type: "public-key";
+              readonly alg: -257 | -7;
+            }, ...{
+              readonly type: "public-key";
+              readonly alg: -257 | -7;
+            }[]];
+            readonly timeout: number;
+            readonly attestation: "none";
+            readonly authenticatorSelection: {
+              readonly residentKey: "discouraged" | "preferred" | "required";
+              readonly userVerification: "preferred" | "required";
+            };
+            readonly excludeCredentials: readonly {
+              readonly type: "public-key";
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+            }[];
+          };
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+        readonly completePasskeyEnrollment: (input: {
+          readonly flowId: string;
+          readonly bindingCredential: string;
+          readonly response: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly credential: {
+            readonly credentialId: string;
+            readonly name: string;
+            readonly primarySignIn: boolean;
+            readonly createdAtMillis: number;
+            readonly lastUsedAtMillis?: number | undefined;
+          };
+          readonly invalidation: {
+            readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+            readonly existingSessions: "immediate" | "original-absolute-expiry";
+            readonly maximumExposureMillis: number;
+            readonly oldAuthenticationEvidence: "rejected";
+          };
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+        readonly listPasskeys: (input: {
+          readonly cursor?: string | undefined;
+          readonly limit: number;
+        }) => Effect.Effect<{
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly name: string;
+            readonly primarySignIn: boolean;
+            readonly createdAtMillis: number;
+            readonly lastUsedAtMillis?: number | undefined;
+          }[];
+          readonly cursor?: string | undefined;
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+        readonly renamePasskey: (input: {
+          readonly commandId: string;
+          readonly credentialId: string;
+          readonly name: string;
+        }) => Effect.Effect<{
+          readonly credential: {
+            readonly credentialId: string;
+            readonly name: string;
+            readonly primarySignIn: boolean;
+            readonly createdAtMillis: number;
+            readonly lastUsedAtMillis?: number | undefined;
+          };
+          readonly replayed: boolean;
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+        readonly removePasskey: (input: {
+          readonly commandId: string;
+          readonly credentialId: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly credentialId: string;
+          readonly replayed: boolean;
+          readonly invalidation: {
+            readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+            readonly existingSessions: "immediate" | "original-absolute-expiry";
+            readonly maximumExposureMillis: number;
+            readonly oldAuthenticationEvidence: "rejected";
+          };
+        }, LastSignInMethod | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+      }, AuthConfigurationError | PasskeyConfigurationError | RequestBindingConfigurationError, Layer.CurrentMemoMap | ModuleService<SessionId, "strategy", Claims["Type"]> | PasskeyActionEvidence | PasskeyEnrollmentContext | PasskeyManagementPersistence | PasskeyPersistence | PasskeyProtocol | RequestBindingConfig | import("effect/Scope").Scope>;
+    }>;
+  }>;
+  pending: Readonly<{
+    Pending: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-pending";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly profileId: string;
+        readonly pendingCredential: import("effect/Redacted").Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+      readonly complete: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+        readonly response: import("effect/Redacted").Redacted<string>;
+        readonly pendingCredential: import("effect/Redacted").Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: DateTime.Utc;
+          readonly expiresAt: DateTime.Utc;
+          readonly absoluteExpiresAt: DateTime.Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: DateTime.Utc;
+      }>, HookDenied | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable, never>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "passkey-pending">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: import("effect/Redacted").Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-pending">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "passkey-pending">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-pending";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }, PasskeyConfigurationError, AuthenticationAuthority | BindingModule<Id, "passkey-pending"> | import("effect/Crypto").Crypto | LifecycleHooks | ModuleService<SessionId, "completion", Claims["Type"]> | PasskeyCredentials | PasskeyEnrollmentContext | PasskeyPersistence | PasskeyProtocol>;
+    operations: Readonly<{
+      Begin: AuthOperation<`${Id}/passkey/pending/begin`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rpId: Schema.String;
+          readonly timeout: Schema.Int;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          readonly allowCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.String;
+          readonly profileId: Schema.String;
+          readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: Schema.Int;
+          readonly options: Schema.Struct<{
+            readonly challenge: Schema.String;
+            readonly rpId: Schema.String;
+            readonly timeout: Schema.Int;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+            readonly allowCredentials: Schema.$Array<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+            }>>;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "any";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/passkey/pending/complete`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+          readonly session: Schema.Struct<{
+            readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly assurance: typeof AuthenticationAssurance;
+            readonly issuedAt: Schema.DateTimeUtcFromMillis;
+            readonly expiresAt: Schema.DateTimeUtcFromMillis;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+            readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+          }>;
+        }>, Schema.TaggedStruct<"PendingAuthentication", {
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        }>]>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "any";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    }>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/pending/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.Int;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        readonly allowCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/pending/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/pending/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly profileId: string;
+      readonly pendingCredential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: number;
+      readonly options: {
+        readonly challenge: string;
+        readonly rpId: string;
+        readonly timeout: number;
+        readonly userVerification: "preferred" | "required";
+        readonly allowCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/pending/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+      readonly response: import("effect/Redacted").Redacted<string>;
+      readonly pendingCredential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable>, never, {
+      readonly moduleId: Id;
+      readonly kind: "passkey-pending";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }>;
+    strategy: Readonly<{
+      completion: boolean;
+      make: Effect.Effect<{
+        readonly beginPending: (input: {
+          readonly flowId: string;
+          readonly commandId: string;
+          readonly profileId: string;
+          readonly pendingCredential: string;
+        }) => Effect.Effect<{
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: number;
+          readonly options: {
+            readonly challenge: string;
+            readonly rpId: string;
+            readonly timeout: number;
+            readonly userVerification: "preferred" | "required";
+            readonly allowCredentials: readonly {
+              readonly type: "public-key";
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+            }[];
+          };
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+        readonly completePending: (input: {
+          readonly flowId: string;
+          readonly bindingCredential: string;
+          readonly response: string;
+          readonly pendingCredential: string;
+        }) => Effect.Effect<{
+          readonly _tag: "Authenticated";
+          readonly session: {
+            readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly assurance: AuthenticationAssurance;
+            readonly issuedAt: DateTime.Utc;
+            readonly expiresAt: DateTime.Utc;
+            readonly absoluteExpiresAt: DateTime.Utc;
+            readonly claims: Claims["Type"];
+          };
+        } | {
+          readonly _tag: "PendingAuthentication";
+          readonly expiresAt: DateTime.Utc;
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+      }, AuthConfigurationError | PasskeyConfigurationError | RequestBindingConfigurationError, AuthenticationAuthority | Layer.CurrentMemoMap | ModuleService<SessionId, "completion", Claims["Type"]> | PasskeyCredentials | PasskeyEnrollmentContext | PasskeyPersistence | PasskeyProtocol | RequestBindingConfig | import("effect/Scope").Scope>;
+    }>;
+  }>;
+  stepUp: Readonly<{
+    StepUp: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-step-up";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly profileId: string;
+        readonly stepUpCredential: import("effect/Redacted").Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+      readonly complete: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+        readonly response: import("effect/Redacted").Redacted<string>;
+        readonly stepUpCredential: import("effect/Redacted").Redacted<string>;
+        readonly sourceCredential: import("effect/Redacted").Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      }>, HookDenied | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable, never>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "passkey-step-up">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: import("effect/Redacted").Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-step-up">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "passkey-step-up">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-step-up";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }, PasskeyConfigurationError, AuthenticationAuthority | BindingModule<Id, "passkey-step-up"> | import("effect/Crypto").Crypto | LifecycleHooks | ModuleService<SessionId, "step-up", Claims["Type"]> | PasskeyCredentials | PasskeyEnrollmentContext | PasskeyPersistence | PasskeyProtocol>;
+    operations: Readonly<{
+      Begin: AuthOperation<`${Id}/passkey/step-up/begin`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rpId: Schema.String;
+          readonly timeout: Schema.Int;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          readonly allowCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.String;
+          readonly profileId: Schema.String;
+          readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: Schema.Int;
+          readonly options: Schema.Struct<{
+            readonly challenge: Schema.String;
+            readonly rpId: Schema.String;
+            readonly timeout: Schema.Int;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+            readonly allowCredentials: Schema.$Array<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+            }>>;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/passkey/step-up/complete`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+        readonly exposure: "public";
+        readonly access: "authenticated";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    }>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/step-up/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.Int;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        readonly allowCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/step-up/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/step-up/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly profileId: string;
+      readonly stepUpCredential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: number;
+      readonly options: {
+        readonly challenge: string;
+        readonly rpId: string;
+        readonly timeout: number;
+        readonly userVerification: "preferred" | "required";
+        readonly allowCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable> | OperationHandler<`${Id}/passkey/step-up/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: import("effect/Redacted").Redacted<string>;
+      readonly response: import("effect/Redacted").Redacted<string>;
+      readonly stepUpCredential: import("effect/Redacted").Redacted<string>;
+      readonly sourceCredential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable>, never, {
+      readonly moduleId: Id;
+      readonly kind: "passkey-step-up";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }>;
+    strategy: Readonly<{
+      completion: false;
+      make: Effect.Effect<{
+        readonly beginStepUp: (input: {
+          readonly flowId: string;
+          readonly commandId: string;
+          readonly profileId: string;
+          readonly stepUpCredential: string;
+        }) => Effect.Effect<{
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: number;
+          readonly options: {
+            readonly challenge: string;
+            readonly rpId: string;
+            readonly timeout: number;
+            readonly userVerification: "preferred" | "required";
+            readonly allowCredentials: readonly {
+              readonly type: "public-key";
+              readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+            }[];
+          };
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+        readonly completeStepUp: (input: {
+          readonly flowId: string;
+          readonly bindingCredential: string;
+          readonly response: string;
+          readonly stepUpCredential: string;
+          readonly sourceCredential: string;
+        }) => Effect.Effect<{
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: DateTime.Utc;
+          readonly expiresAt: DateTime.Utc;
+          readonly absoluteExpiresAt: DateTime.Utc;
+          readonly claims: Claims["Type"];
+        }, PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | SessionApiError, AuthRequest>;
+      }, AuthConfigurationError | PasskeyConfigurationError | RequestBindingConfigurationError, AuthenticationAuthority | Layer.CurrentMemoMap | ModuleService<SessionId, "step-up", Claims["Type"]> | PasskeyCredentials | PasskeyEnrollmentContext | PasskeyPersistence | PasskeyProtocol | RequestBindingConfig | import("effect/Scope").Scope>;
+    }>;
+  }>;
+  actions: Readonly<{
+    PasskeyActionAssertions: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-actions";
+    }, {
+      readonly begin: (input: PasskeyBegin, target: PasskeyTarget) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+      readonly complete: (input: PasskeyComplete, target: PasskeyTarget) => Effect.Effect<{
+        readonly evidence: AuthenticationEvidence;
+        readonly credentialCommands: AuthOperationResult<void>["credentialCommands"];
+      }, HookDenied | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable, never>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "passkey-action">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: import("effect/Redacted").Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-action">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "passkey-action">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-actions";
+    }, PasskeyConfigurationError, AuthenticationAuthority | BindingModule<Id, "passkey-action"> | import("effect/Crypto").Crypto | LifecycleHooks | PasskeyCredentials | PasskeyEnrollmentContext | PasskeyPersistence | PasskeyProtocol>;
+  }>;
+}>;
+//#endregion
+export { capturePasskeyConfiguration, makePasskeyMethod };
+//# sourceMappingURL=module.d.mts.map