@yielded/auth 0.1.0-beta.1

package/dist/password/methods/definition.d.mts

@@ -0,0 +1,3813 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../../operations/errors.mjs";
+import { AuthInvocation, AuthenticationAssurance } from "../../operations/context.mjs";
+import { AuthCredentialCommandCollector, AuthOperationResult, AuthRevealCommandCollectorService } from "../../operations/credentials.mjs";
+import { AuthOperation, CredentialCollectorProvenance, OperationHandler, RevealCollectorProvenance } from "../../operations/operation.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { HookDenied } from "../../hooks/models.mjs";
+import { LifecycleHooks } from "../../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../../sessions/AuthenticationAuthority.mjs";
+import { SubtleCrypto } from "../../WebCrypto.mjs";
+import "../../Operations.mjs";
+import "../../Hooks.mjs";
+import { SessionApiError } from "../../auth/session.mjs";
+import { AuthRequest } from "../../auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "../../auth/AuthConfigurationError.mjs";
+import { BindingOf, ClaimsCodec, StrategyBinding, StrategyDefinition, StrategyTypeLambda } from "../../auth/definition.mjs";
+import "../../Auth.mjs";
+import { ModuleService } from "../../sessions/module.mjs";
+import "../../Sessions.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError } from "../errors.mjs";
+import { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { ProofCleanupResult, ProofCompletionDecision, ProofContinuation, ProofId, ProofRequestReceipt } from "../../proofs/models.mjs";
+import { PasswordCredentialSnapshot, PasswordReplacement } from "./models.mjs";
+import { ProofCapabilityUnsupported, ProofConfigurationError, ProofIngressDenied, ProofInvalid, ProofRequestConflict, ProofUnavailable } from "../../proofs/errors.mjs";
+import { EmailProofDelivery } from "../../proofs/EmailProofDelivery.mjs";
+import { ProofPolicy } from "../../proofs/policy.mjs";
+import { ProofPersistence } from "../../proofs/ProofPersistence.mjs";
+import { PreparedProofDispatch, ProofIssuePlan } from "../../proofs/dispatch.mjs";
+import { ProofCompletionPlan } from "../../proofs/completion.mjs";
+import "../../Identity.mjs";
+import { ProofKeyring, ProofSecretPolicy } from "../../proofs/crypto.mjs";
+import { SmsProofDelivery } from "../../proofs/SmsProofDelivery.mjs";
+import { ProofModule } from "../../proofs/module.mjs";
+import "../../Proofs.mjs";
+import { CompromisedPasswords } from "../CompromisedPasswords.mjs";
+import { NewPasswordCheck } from "../NewPasswordCheck.mjs";
+import { PasswordHashing } from "../PasswordHashing.mjs";
+import { PasswordActionEvidence } from "./PasswordActionEvidence.mjs";
+import { PasswordMethodPolicy } from "./policy.mjs";
+import { PasswordPersistence, PreparePasswordCommit } from "./PasswordPersistence.mjs";
+import { PasswordPreparedConfiguration, PasswordPreparedContext } from "./preparedModels.mjs";
+import { PasswordPreparedPersistence } from "./PasswordPreparedPersistence.mjs";
+import { PasswordPreparedAuthorization, PasswordPreparedCompletionPlan, ServiceId } from "./prepared.mjs";
+import { MethodService, PasswordRegistrationDecision } from "./module.mjs";
+//#region src/password/methods/definition.d.ts
+interface PasswordOptions<Namespace extends string | undefined = undefined> {
+  readonly namespace?: Namespace;
+  readonly policy?: PasswordMethodPolicy;
+}
+interface PasswordManagementOptions<Registration extends ClaimsCodec, Namespace extends string | undefined = undefined> extends PasswordOptions<Namespace> {
+  readonly registration: Registration;
+  readonly policy: PasswordMethodPolicy;
+  readonly reset: {
+    readonly template: string;
+    readonly secret: ProofSecretPolicy;
+    readonly policy: ProofPolicy;
+    readonly keys?: ProofKeyring;
+  };
+}
+declare const captureSignIn: <const Namespace extends string | undefined = undefined>(_namespace: Namespace, input: PasswordOptions<Namespace>) => {
+  options: Readonly<{
+    namespace?: Namespace | undefined;
+    policy: {
+      readonly attempts: {
+        readonly identifier: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly subject: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly action: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly maximumPending: number;
+        readonly attemptLifetimeMillis: number;
+      };
+      readonly maximumEvidenceAgeMillis: number;
+      readonly requireImmediateInvalidation: boolean;
+    } | undefined;
+  }>;
+};
+declare const bindSignIn: <const Namespace extends string | undefined, Claims extends ClaimsCodec, const Id extends string, const SessionId extends string>(binding: StrategyBinding<Claims, Id, SessionId>, captured: ReturnType<typeof captureSignIn<Namespace>>) => Readonly<{
+  ClaimsForPassword: import("effect/Context").Service<{
+    readonly moduleId: Id;
+    readonly kind: "claims";
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+  }, {
+    readonly resolve: (credential: PasswordCredentialSnapshot) => import("effect/Effect").Effect<Claims["Type"], PasswordUnavailable, never>;
+  }>;
+  layer: import("effect/Layer").Layer<OperationHandler<`${Id}/sign-in`, {
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly password: import("effect/Redacted").Redacted<string>;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: import("effect/DateTime").Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, PasswordConfigurationError | PasswordMethodConfigurationError, AuthenticationAuthority | ModuleService<SessionId, "completion", Claims["Type"]> | PasswordPersistence | {
+    readonly moduleId: Id;
+    readonly kind: "claims";
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+  }>;
+  handlersLayer: import("effect/Layer").Layer<OperationHandler<`${Id}/sign-in`, {
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly password: import("effect/Redacted").Redacted<string>;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: import("effect/DateTime").Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, PasswordMethodConfigurationError, AuthenticationAuthority | import("effect/Crypto").Crypto | ModuleService<SessionId, "completion", Claims["Type"]> | PasswordHashing | PasswordPersistence | {
+    readonly moduleId: Id;
+    readonly kind: "claims";
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+  }>;
+  operations: {
+    SignIn: AuthOperation<`${Id}/sign-in`, import("effect/Schema").Struct<{
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly password: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Authenticated", {
+      readonly session: import("effect/Schema").Struct<{
+        readonly sessionId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: import("effect/Schema").DateTimeUtcFromMillis;
+        readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+        readonly claims: import("effect/Schema").Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, import("effect/Schema").TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+    }>]>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly password: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      }>;
+      readonly success: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Authenticated", {
+        readonly session: import("effect/Schema").Struct<{
+          readonly sessionId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: import("effect/Schema").DateTimeUtcFromMillis;
+          readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+          readonly claims: import("effect/Schema").Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, import("effect/Schema").TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordMethodUnsupported, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/sign-in`, import("effect/Schema").Struct<{
+    readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+    readonly password: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Authenticated", {
+    readonly session: import("effect/Schema").Struct<{
+      readonly sessionId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: import("effect/Schema").DateTimeUtcFromMillis;
+      readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+      readonly claims: import("effect/Schema").Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, import("effect/Schema").TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+  }>]>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordMethodUnsupported, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  strategy: Readonly<{
+    completion: boolean;
+    make: import("effect/Effect").Effect<{
+      readonly signIn: (input: Omit<{
+        readonly email: string;
+        readonly password: string;
+        readonly flowId: string;
+      }, "flowId">) => import("effect/Effect").Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: import("effect/DateTime").Utc;
+      }, PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+    }, AuthConfigurationError | PasswordConfigurationError | PasswordMethodConfigurationError, AuthenticationAuthority | import("effect/Layer").CurrentMemoMap | ModuleService<SessionId, "completion", Claims["Type"]> | PasswordPersistence | import("effect/Scope").Scope | {
+      readonly moduleId: Id;
+      readonly kind: "claims";
+      readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+    }>;
+  }>;
+}>;
+interface SignInStrategy<Namespace extends string | undefined = undefined> extends StrategyTypeLambda {
+  readonly type: ReturnType<typeof bindSignIn<Namespace, BindingOf<this>["claims"], BindingOf<this>["namespace"], BindingOf<this>["sessionNamespace"]>>;
+}
+declare const signIn: <const Namespace extends string | undefined = undefined>(namespace: Namespace, input: PasswordOptions<Namespace>) => Readonly<StrategyDefinition<SignInStrategy<Namespace>, Namespace>>;
+declare const captureManagement: <Registration extends ClaimsCodec, const Namespace extends string | undefined = undefined>(_namespace: Namespace, input: PasswordManagementOptions<Registration, Namespace>) => {
+  options: Readonly<{
+    namespace?: Namespace | undefined;
+    registration: Registration;
+    policy: {
+      readonly attempts: {
+        readonly identifier: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly subject: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly action: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly maximumPending: number;
+        readonly attemptLifetimeMillis: number;
+      };
+      readonly maximumEvidenceAgeMillis: number;
+      readonly requireImmediateInvalidation: boolean;
+    };
+    reset: Readonly<{
+      readonly template: string;
+      readonly secret: ProofSecretPolicy;
+      readonly policy: ProofPolicy;
+      readonly keys?: ProofKeyring;
+    } & {
+      secret: Readonly<{
+        _tag: "Token";
+      } | {
+        _tag: "NumericCode";
+        digits: number;
+      }>;
+      policy: Readonly<{
+        lifetimeMillis: number;
+        continuationLifetimeMillis: number;
+        maximumFailedAttempts: number;
+        maximumDeliveryAttempts: number;
+        deliveryClaimMillis: number;
+        deliveryRetryMillis: number;
+        requestRetentionMillis: number;
+        abuse: Readonly<{
+          resendCooldownMillis: number;
+          issues: Readonly<{
+            limit: number;
+            windowMillis: number;
+          }>;
+          attempts: Readonly<{
+            limit: number;
+            windowMillis: number;
+          }>;
+          subjectIssues: Readonly<{
+            limit: number;
+            windowMillis: number;
+          }>;
+          subjectAttempts: Readonly<{
+            limit: number;
+            windowMillis: number;
+          }>;
+          actionIssues: Readonly<{
+            limit: number;
+            windowMillis: number;
+          }>;
+          actionAttempts: Readonly<{
+            limit: number;
+            windowMillis: number;
+          }>;
+        }>;
+      }>;
+      keys: Readonly<{
+        activeKeyId: string;
+        keys: readonly any[];
+      }> | undefined;
+    }>;
+  }>;
+};
+declare const bindManagement: <Registration extends ClaimsCodec, const Namespace extends string | undefined, Claims extends ClaimsCodec, const Id extends string, const SessionId extends string>(binding: StrategyBinding<Claims, Id, SessionId>, captured: ReturnType<typeof captureManagement<Registration, Namespace>>) => Readonly<{
+  strategy: Readonly<{
+    completion: boolean;
+    make: import("effect/Effect").Effect<{
+      readonly signIn: (input: Omit<{
+        readonly email: string;
+        readonly password: string;
+        readonly flowId: string;
+      }, "flowId">) => import("effect/Effect").Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: import("effect/DateTime").Utc;
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly register: (input: {
+        readonly requestId: string;
+        readonly email: string;
+        readonly newPassword: string;
+        readonly registration: Registration["Encoded"];
+      }) => import("effect/Effect").Effect<{
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest | Exclude<Exclude<Registration["DecodingServices"], CredentialCollectorProvenance | RevealCollectorProvenance>, import("effect/Crypto").Crypto | OperationHandler<`${Id}/add-password`, {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      }, {
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/change-password`, {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+        readonly currentPassword: import("effect/Redacted").Redacted<string>;
+      }, {
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/cleanup`, {
+        readonly limit: number;
+      }, {
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/complete-reset`, {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly credential: import("effect/Redacted").Redacted<string>;
+      }, {
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/register`, {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+        readonly registration: Registration["Type"];
+      }, {
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/request-reset`, {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly locale: string;
+      }, {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/sign-in`, {
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly password: import("effect/Redacted").Redacted<string>;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      }, {
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: import("effect/DateTime").Utc;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/status`, void, {
+        readonly hasPassword: boolean;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/verify-reset`, {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+        readonly secret: import("effect/Redacted").Redacted<string>;
+      }, {
+        readonly continuation: {
+          readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: number;
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | SubtleCrypto | (AuthCredentialCommandCollector | AuthRevealCommandCollectorService)>>;
+      readonly addPassword: (input: {
+        readonly commandId: string;
+        readonly newPassword: string;
+        readonly actionProof?: string | undefined;
+      }) => import("effect/Effect").Effect<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly changePassword: (input: {
+        readonly commandId: string;
+        readonly newPassword: string;
+        readonly actionProof?: string | undefined;
+        readonly currentPassword: string;
+      }) => import("effect/Effect").Effect<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly requestReset: (input: {
+        readonly flowId: string;
+        readonly email: string;
+        readonly requestId: string;
+        readonly locale: string;
+      }) => import("effect/Effect").Effect<{
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly verifyReset: (input: {
+        readonly flowId: string;
+        readonly email: string;
+        readonly reference: {
+          readonly proofId: string;
+          readonly purpose: string;
+          readonly keyId: string;
+        };
+        readonly secret: string;
+      }) => import("effect/Effect").Effect<{
+        readonly continuation: {
+          readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: number;
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly completeReset: (input: {
+        readonly commandId: string;
+        readonly newPassword: string;
+        readonly actionProof?: string | undefined;
+        readonly flowId: string;
+        readonly email: string;
+        readonly continuationId: string;
+        readonly credential: string;
+      }) => import("effect/Effect").Effect<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly passwordStatus: (input?: void | undefined) => import("effect/Effect").Effect<{
+        readonly hasPassword: boolean;
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+    }, AuthConfigurationError | PasswordConfigurationError | PasswordMethodConfigurationError | ProofConfigurationError, AuthenticationAuthority | CompromisedPasswords | import("effect/Layer").CurrentMemoMap | EmailProofDelivery | ModuleService<SessionId, "completion", Claims["Type"]> | ModuleService<SessionId, "strategy", Claims["Type"]> | PasswordActionEvidence | PasswordPersistence | ProofPersistence | import("effect/Scope").Scope | Exclude<Exclude<Exclude<Exclude<Registration["DecodingServices"], import("effect/Scope").Scope>, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>>, LifecycleHooks | NewPasswordCheck | PasswordHashing>, import("effect/Crypto").Crypto | SubtleCrypto> | Exclude<Exclude<Exclude<Exclude<Registration["EncodingServices"], import("effect/Scope").Scope>, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>>, LifecycleHooks | NewPasswordCheck | PasswordHashing>, import("effect/Crypto").Crypto | SubtleCrypto> | (MethodService<Id, "claims"> & {
+      readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+    }) | (MethodService<Id, "registration"> & {
+      readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+    })>;
+  }>;
+  prepared: (configuration: PasswordPreparedConfiguration) => Readonly<{
+    PasswordPrepared: import("effect/Context").Service<ServiceId<Id, "prepared"> & {
+      readonly reset: import("effect/Types").Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    }, {
+      readonly beginAdd: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<AuthOperationResult<{
+        readonly _tag: "Prepared";
+        readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: number;
+      } | {
+        readonly _tag: "AlreadyExists";
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly beginChange: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+        readonly currentPassword: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<AuthOperationResult<{
+        readonly _tag: "Prepared";
+        readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: number;
+      } | {
+        readonly _tag: "AlreadyExists";
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly beginReset: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Redacted").Redacted<string>;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly continuationCredential: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<AuthOperationResult<{
+        readonly _tag: "Prepared";
+        readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: number;
+      } | {
+        readonly _tag: "AlreadyExists";
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly context: (invocation: AuthInvocation, credential: import("effect/Redacted").Redacted<string>) => import("effect/Effect").Effect<PasswordPreparedContext, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+      readonly resetContext: (invocation: AuthInvocation, input: {
+        readonly intentCredential: import("effect/Redacted").Redacted<string>;
+        readonly continuationCredential: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<PasswordPreparedContext, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly planComplete: (invocation: AuthInvocation, input: {
+        readonly intentCredential: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly planResetComplete: (invocation: AuthInvocation, input: {
+        readonly intentCredential: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly planCompleteAuthorized: (invocation: AuthInvocation, input: {
+        readonly intentCredential: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: import("effect/Redacted").Redacted<string>;
+      }, authorization: PasswordPreparedAuthorization) => import("effect/Effect").Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly planResetCompleteAuthorized: (invocation: AuthInvocation, input: {
+        readonly intentCredential: import("effect/Redacted").Redacted<string>;
+        readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: import("effect/Redacted").Redacted<string>;
+      }, authorization: PasswordPreparedAuthorization) => import("effect/Effect").Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly cancel: (invocation: AuthInvocation, credential: import("effect/Redacted").Redacted<string>) => import("effect/Effect").Effect<PreparedCommit<AuthOperationResult<void>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+      readonly cleanup: (limit: number) => import("effect/Effect").Effect<PreparedCommit<{
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    }>;
+    PasswordPreparedPersistence: import("effect/Context").Service<ServiceId<Id, "prepared-persistence">, PasswordPreparedPersistence>;
+    layer: import("effect/Layer").Layer<ServiceId<Id, "prepared"> & {
+      readonly reset: import("effect/Types").Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    }, PasswordMethodConfigurationError, AuthenticationAuthority | import("effect/Crypto").Crypto | LifecycleHooks | ModuleService<SessionId, "strategy", Claims["Type"]> | NewPasswordCheck | PasswordActionEvidence | PasswordHashing | PasswordPersistence | ServiceId<Id, "prepared-persistence">>;
+    handlersLayer: import("effect/Layer").Layer<OperationHandler<`${Id}/prepared/add/begin`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly _tag: "Prepared";
+      readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: number;
+    } | {
+      readonly _tag: "AlreadyExists";
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/add/complete`, {
+      readonly intentCredential: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/cancel`, {
+      readonly intentCredential: import("effect/Redacted").Redacted<string>;
+    }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/change/begin`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+      readonly currentPassword: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly _tag: "Prepared";
+      readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: number;
+    } | {
+      readonly _tag: "AlreadyExists";
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/change/complete`, {
+      readonly intentCredential: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/cleanup`, {
+      readonly limit: number;
+    }, {
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, ServiceId<Id, "prepared-persistence"> | (ServiceId<Id, "prepared"> & {
+      readonly reset: import("effect/Types").Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    })>;
+    resetHandlersLayer: import("effect/Layer").Layer<OperationHandler<`${Id}/prepared/reset/begin`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly continuationCredential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly _tag: "Prepared";
+      readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: number;
+    } | {
+      readonly _tag: "AlreadyExists";
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/reset/complete`, {
+      readonly intentCredential: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      readonly continuationCredential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }> | ServiceId<Id, "prepared-persistence"> | (ServiceId<Id, "prepared"> & {
+      readonly reset: import("effect/Types").Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    })>;
+    operations: {
+      BeginAdd: AuthOperation<`${Id}/prepared/add/begin`, import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+        readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: import("effect/Schema").Int;
+      }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+          readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+          readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+          readonly expiresAtMillis: import("effect/Schema").Int;
+        }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      BeginChange: AuthOperation<`${Id}/prepared/change/begin`, import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+        readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: import("effect/Schema").Int;
+      }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+          readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+          readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+          readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+          readonly expiresAtMillis: import("effect/Schema").Int;
+        }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      CompleteAdd: AuthOperation<`${Id}/prepared/add/complete`, import("effect/Schema").Struct<{
+        readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      }>, import("effect/Schema").Struct<{
+        readonly invalidation: import("effect/Schema").Struct<{
+          readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: import("effect/Schema").Natural;
+          readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+        }>;
+      }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+          readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly invalidation: import("effect/Schema").Struct<{
+            readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: import("effect/Schema").Natural;
+            readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      CompleteChange: AuthOperation<`${Id}/prepared/change/complete`, import("effect/Schema").Struct<{
+        readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      }>, import("effect/Schema").Struct<{
+        readonly invalidation: import("effect/Schema").Struct<{
+          readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: import("effect/Schema").Natural;
+          readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+        }>;
+      }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+          readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly invalidation: import("effect/Schema").Struct<{
+            readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: import("effect/Schema").Natural;
+            readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Cancel: AuthOperation<`${Id}/prepared/cancel`, import("effect/Schema").Struct<{
+        readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").Void, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").Void;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      Cleanup: AuthOperation<`${Id}/prepared/cleanup`, import("effect/Schema").Struct<{
+        readonly limit: import("effect/Schema").Int;
+      }>, import("effect/Schema").Struct<{
+        readonly removed: import("effect/Schema").Natural;
+        readonly hasMore: import("effect/Schema").Boolean;
+      }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly limit: import("effect/Schema").Int;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly removed: import("effect/Schema").Natural;
+          readonly hasMore: import("effect/Schema").Boolean;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+    };
+    resetOperations: {
+      BeginReset: AuthOperation<`${Id}/prepared/reset/begin`, import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+        readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+        readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: import("effect/Schema").Int;
+      }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+          readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+          readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+          readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+          readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+          readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+          readonly expiresAtMillis: import("effect/Schema").Int;
+        }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      CompleteReset: AuthOperation<`${Id}/prepared/reset/complete`, import("effect/Schema").Struct<{
+        readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+        readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").Struct<{
+        readonly invalidation: import("effect/Schema").Struct<{
+          readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: import("effect/Schema").Natural;
+          readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+        }>;
+      }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+          readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+          readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly invalidation: import("effect/Schema").Struct<{
+            readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: import("effect/Schema").Natural;
+            readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    };
+    resetGroup: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/reset/begin`, import("effect/Schema").Struct<{
+      readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+      readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+      readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: import("effect/Schema").Int;
+    }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/reset/complete`, import("effect/Schema").Struct<{
+      readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+      readonly invalidation: import("effect/Schema").Struct<{
+        readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: import("effect/Schema").Natural;
+        readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+      }>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/add/begin`, import("effect/Schema").Struct<{
+      readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+      readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: import("effect/Schema").Int;
+    }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/add/complete`, import("effect/Schema").Struct<{
+      readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+    }>, import("effect/Schema").Struct<{
+      readonly invalidation: import("effect/Schema").Struct<{
+        readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: import("effect/Schema").Natural;
+        readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+      }>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/cancel`, import("effect/Schema").Struct<{
+      readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Void, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/change/begin`, import("effect/Schema").Struct<{
+      readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+      readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: import("effect/Schema").Int;
+    }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/change/complete`, import("effect/Schema").Struct<{
+      readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+    }>, import("effect/Schema").Struct<{
+      readonly invalidation: import("effect/Schema").Struct<{
+        readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: import("effect/Schema").Natural;
+        readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+      }>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/cleanup`, import("effect/Schema").Struct<{
+      readonly limit: import("effect/Schema").Int;
+    }>, import("effect/Schema").Struct<{
+      readonly removed: import("effect/Schema").Natural;
+      readonly hasMore: import("effect/Schema").Boolean;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    schemas: {
+      BeginAddInput: import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      BeginChangeInput: import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      BeginResetInput: import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+        readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      CompleteInput: import("effect/Schema").Struct<{
+        readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      }>;
+      CompleteResetInput: import("effect/Schema").Struct<{
+        readonly intentCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+        readonly continuationCredential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      Result: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Prepared", {
+        readonly intentId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: import("effect/Schema").Int;
+      }>, import("effect/Schema").TaggedStruct<"AlreadyExists", {}>]>;
+    };
+  }>;
+  Passwords: import("effect/Context").Service<MethodService<Id, "method"> & {
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+    readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+  }, {
+    readonly planRegister: (input: {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+      readonly registration: Registration["Type"];
+    }) => import("effect/Effect").Effect<{
+      readonly commit: import("effect/Effect").Effect<PreparedCommit<{
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, MethodService<Id, "registration"> & {
+        readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+      }>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    readonly signIn: (input: {
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly password: import("effect/Redacted").Redacted<string>;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    }) => import("effect/Effect").Effect<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: import("effect/DateTime").Utc;
+        readonly expiresAt: import("effect/DateTime").Utc;
+        readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: import("effect/DateTime").Utc;
+    }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    readonly planAdd: (invocation: AuthInvocation, input: {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    }) => import("effect/Effect").Effect<{
+      readonly commit: import("effect/Effect").Effect<PreparedCommit<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Rejected";
+      }>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, PasswordPersistence>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    readonly planChange: (invocation: AuthInvocation, input: {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      readonly currentPassword: import("effect/Redacted").Redacted<string>;
+    }) => import("effect/Effect").Effect<{
+      readonly commit: import("effect/Effect").Effect<PreparedCommit<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Rejected";
+      }>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, PasswordPersistence>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    readonly requestReset: (input: {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly locale: string;
+    }) => import("effect/Effect").Effect<ProofRequestReceipt, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly verifyReset: (input: {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+      readonly secret: import("effect/Redacted").Redacted<string>;
+    }) => import("effect/Effect").Effect<AuthOperationResult<{
+      readonly continuation: ProofContinuation;
+    }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    readonly planReset: (invocation: AuthInvocation, input: {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Redacted").Redacted<string>;
+      readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly credential: import("effect/Redacted").Redacted<string>;
+    }) => import("effect/Effect").Effect<{
+      readonly commit: import("effect/Effect").Effect<PreparedCommit<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Rejected";
+      }>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, PasswordPersistence>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    readonly status: (invocation: AuthInvocation) => import("effect/Effect").Effect<{
+      readonly hasPassword: boolean;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly cleanup: (limit: number) => import("effect/Effect").Effect<{
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+  }>;
+  RegistrationAuthority: import("effect/Context").Service<MethodService<Id, "registration"> & {
+    readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+  }, {
+    readonly register: <A>(input: {
+      readonly moduleId: string;
+      readonly requestId: string;
+      readonly identifier: LoginIdentifier;
+      readonly registration: Registration["Type"];
+      readonly replacement: PasswordReplacement;
+    }, prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>) => import("effect/Effect").Effect<PreparedCommit<A>, PasswordUnavailable, never>;
+  }>;
+  ClaimsForPassword: import("effect/Context").Service<MethodService<Id, "claims"> & {
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+  }, {
+    readonly resolve: (credential: PasswordCredentialSnapshot) => import("effect/Effect").Effect<Claims["Type"], PasswordUnavailable, never>;
+  }>;
+  layer: import("effect/Layer").Layer<MethodService<Id, "method"> & {
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+    readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+  }, PasswordMethodConfigurationError, AuthenticationAuthority | import("effect/Crypto").Crypto | LifecycleHooks | ModuleService<SessionId, "completion", Claims["Type"]> | ModuleService<SessionId, "strategy", Claims["Type"]> | NewPasswordCheck | PasswordActionEvidence | PasswordHashing | PasswordPersistence | ProofModule<`${Id}/reset`, {
+    readonly _tag: "Identifier";
+    readonly flowId: string;
+    readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly identifier: LoginIdentifier;
+  } | {
+    readonly _tag: "Subject";
+    readonly flowId: string;
+    readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly identifier: LoginIdentifier;
+  } | {
+    readonly _tag: "IdentifierChange";
+    readonly flowId: string;
+    readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly identifier: LoginIdentifier;
+  }> | Exclude<Registration["DecodingServices"], import("effect/Scope").Scope> | Exclude<Registration["EncodingServices"], import("effect/Scope").Scope> | (MethodService<Id, "claims"> & {
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+  })>;
+  handlersLayer: import("effect/Layer").Layer<OperationHandler<`${Id}/add-password`, {
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly newPassword: import("effect/Redacted").Redacted<string>;
+    readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/change-password`, {
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly newPassword: import("effect/Redacted").Redacted<string>;
+    readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    readonly currentPassword: import("effect/Redacted").Redacted<string>;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/cleanup`, {
+    readonly limit: number;
+  }, {
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/complete-reset`, {
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly newPassword: import("effect/Redacted").Redacted<string>;
+    readonly actionProof?: import("effect/Redacted").Redacted<string> | undefined;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly credential: import("effect/Redacted").Redacted<string>;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/register`, {
+    readonly requestId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly newPassword: import("effect/Redacted").Redacted<string>;
+    readonly registration: Registration["Type"];
+  }, {
+    readonly _tag: "RegistrationAccepted";
+  } | {
+    readonly _tag: "ProvisioningPending";
+    readonly reference: string;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/request-reset`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+    readonly locale: string;
+  }, {
+    readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+    readonly reference: {
+      readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+      readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+      readonly keyId: string;
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/sign-in`, {
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly password: import("effect/Redacted").Redacted<string>;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: import("effect/DateTime").Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/status`, void, {
+    readonly hasPassword: boolean;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/verify-reset`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly reference: {
+      readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+      readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+      readonly keyId: string;
+    };
+    readonly secret: import("effect/Redacted").Redacted<string>;
+  }, {
+    readonly continuation: {
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+      readonly expiresAtMillis: number;
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, PasswordPersistence | (MethodService<Id, "method"> & {
+    readonly claims: import("effect/Types").Invariant<Claims["Type"]>;
+    readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+  }) | (MethodService<Id, "registration"> & {
+    readonly registration: import("effect/Types").Invariant<Registration["Type"]>;
+  })>;
+  operations: {
+    Register: AuthOperation<`${Id}/register`, import("effect/Schema").Struct<{
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly registration: import("effect/Schema").Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"RegistrationAccepted", {}>, import("effect/Schema").TaggedStruct<"ProvisioningPending", {
+      readonly reference: import("effect/Schema").NonEmptyString;
+    }>]>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly registration: import("effect/Schema").Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+      }>;
+      readonly success: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"RegistrationAccepted", {}>, import("effect/Schema").TaggedStruct<"ProvisioningPending", {
+        readonly reference: import("effect/Schema").NonEmptyString;
+      }>]>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "idempotent";
+    }>;
+    SignIn: AuthOperation<`${Id}/sign-in`, import("effect/Schema").Struct<{
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly password: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Authenticated", {
+      readonly session: import("effect/Schema").Struct<{
+        readonly sessionId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: import("effect/Schema").DateTimeUtcFromMillis;
+        readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+        readonly claims: import("effect/Schema").Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, import("effect/Schema").TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+    }>]>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly password: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      }>;
+      readonly success: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Authenticated", {
+        readonly session: import("effect/Schema").Struct<{
+          readonly sessionId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: import("effect/Schema").DateTimeUtcFromMillis;
+          readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+          readonly claims: import("effect/Schema").Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, import("effect/Schema").TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    AddPassword: AuthOperation<`${Id}/add-password`, import("effect/Schema").Struct<{
+      commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+    }>, import("effect/Schema").Struct<{
+      readonly invalidation: import("effect/Schema").Struct<{
+        readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: import("effect/Schema").Natural;
+        readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+      }>;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      }>;
+      readonly success: import("effect/Schema").Struct<{
+        readonly invalidation: import("effect/Schema").Struct<{
+          readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: import("effect/Schema").Natural;
+          readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    ChangePassword: AuthOperation<`${Id}/change-password`, import("effect/Schema").Struct<{
+      readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+      readonly invalidation: import("effect/Schema").Struct<{
+        readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: import("effect/Schema").Natural;
+        readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+      }>;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+        readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      readonly success: import("effect/Schema").Struct<{
+        readonly invalidation: import("effect/Schema").Struct<{
+          readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: import("effect/Schema").Natural;
+          readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RequestReset: AuthOperation<`${Id}/request-reset`, import("effect/Schema").Struct<{
+      readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+      readonly locale: import("effect/Schema").NonEmptyString;
+    }>, import("effect/Schema").Struct<{
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+      readonly reference: import("effect/Schema").Struct<{
+        readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly keyId: import("effect/Schema").String;
+      }>;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+        readonly locale: import("effect/Schema").NonEmptyString;
+      }>;
+      readonly success: import("effect/Schema").Struct<{
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+        readonly reference: import("effect/Schema").Struct<{
+          readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly keyId: import("effect/Schema").String;
+        }>;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "idempotent";
+    }>;
+    VerifyReset: AuthOperation<`${Id}/verify-reset`, import("effect/Schema").Struct<{
+      readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly reference: import("effect/Schema").Struct<{
+        readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly keyId: import("effect/Schema").String;
+      }>;
+      readonly secret: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+      readonly continuation: import("effect/Schema").Struct<{
+        readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly expiresAtMillis: import("effect/Schema").Int;
+      }>;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly reference: import("effect/Schema").Struct<{
+          readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly keyId: import("effect/Schema").String;
+        }>;
+        readonly secret: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      readonly success: import("effect/Schema").Struct<{
+        readonly continuation: import("effect/Schema").Struct<{
+          readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: import("effect/Schema").Int;
+        }>;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    CompleteReset: AuthOperation<`${Id}/complete-reset`, import("effect/Schema").Struct<{
+      readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+      readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+      readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+      readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+      readonly invalidation: import("effect/Schema").Struct<{
+        readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: import("effect/Schema").Natural;
+        readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+      }>;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+        readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+        readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+        readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>;
+      readonly success: import("effect/Schema").Struct<{
+        readonly invalidation: import("effect/Schema").Struct<{
+          readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: import("effect/Schema").Natural;
+          readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    PasswordStatus: AuthOperation<`${Id}/status`, import("effect/Schema").Void, import("effect/Schema").Struct<{
+      readonly hasPassword: import("effect/Schema").Boolean;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Void;
+      readonly success: import("effect/Schema").Struct<{
+        readonly hasPassword: import("effect/Schema").Boolean;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly exposure: "public";
+      readonly replay: "read-only";
+    }>;
+    CleanupAttempts: AuthOperation<`${Id}/cleanup`, import("effect/Schema").Struct<{
+      readonly limit: import("effect/Schema").Int;
+    }>, import("effect/Schema").Struct<{
+      readonly removed: import("effect/Schema").Natural;
+      readonly hasMore: import("effect/Schema").Boolean;
+    }>, import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: import("effect/Schema").Struct<{
+        readonly limit: import("effect/Schema").Int;
+      }>;
+      readonly success: import("effect/Schema").Struct<{
+        readonly removed: import("effect/Schema").Natural;
+        readonly hasMore: import("effect/Schema").Boolean;
+      }>;
+      readonly error: import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "idempotent";
+    }>;
+  };
+  reset: Readonly<{
+    Proofs: import("effect/Context").Service<ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>, {
+      readonly planIssue: (input: {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly locale: string;
+        readonly eligible: boolean;
+      } & {
+        readonly supersedes?: ProofId;
+      }) => import("effect/Effect").Effect<ProofIssuePlan, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly prepareIssue: (input: {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly locale: string;
+        readonly eligible: boolean;
+      } & {
+        readonly supersedes?: ProofId;
+      }) => import("effect/Effect").Effect<PreparedCommit<PreparedProofDispatch>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly prepareAttempt: (input: {
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly credential: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<PreparedCommit<AuthOperationResult<{
+        readonly _tag: "Accepted";
+        readonly continuation: {
+          readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: number;
+        };
+      }> | {
+        readonly value: {
+          readonly _tag: "Rejected";
+        };
+        readonly credentialCommands: readonly [];
+      }>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable, never>;
+      readonly planComplete: (input: {
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly credential: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<ProofCompletionPlan, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly prepareComplete: (input: {
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly credential: import("effect/Redacted").Redacted<string>;
+      }) => import("effect/Effect").Effect<PreparedCommit<ProofCompletionDecision>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly cancel: (binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }) => import("effect/Effect").Effect<PreparedCommit<void>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly cleanup: (limit: number) => import("effect/Effect").Effect<PreparedCommit<ProofCleanupResult>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+    }>;
+    emailLayer: import("effect/Layer").Layer<ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>, ProofConfigurationError, import("effect/Crypto").Crypto | EmailProofDelivery | LifecycleHooks | ProofPersistence | SubtleCrypto>;
+    smsLayer: import("effect/Layer").Layer<ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>, ProofConfigurationError, import("effect/Crypto").Crypto | LifecycleHooks | ProofPersistence | SmsProofDelivery | SubtleCrypto>;
+    handlersLayer: import("effect/Layer").Layer<OperationHandler<`${Id}/reset/attempt`, {
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly credential: import("effect/Redacted").Redacted<string>;
+    }, {
+      readonly _tag: "Accepted";
+      readonly continuation: {
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly expiresAtMillis: number;
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/cancel`, {
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+    }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/cleanup`, {
+      readonly limit: number;
+    }, {
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/complete`, {
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly credential: import("effect/Redacted").Redacted<string>;
+    }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/request`, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly locale: string;
+      readonly eligible: boolean;
+    }, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/resend`, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly locale: string;
+      readonly eligible: boolean;
+      readonly supersedes: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+    }, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>, never, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>>;
+    operations: {
+      Request: AuthOperation<`${Id}/reset/request`, import("effect/Schema").Struct<{
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+        readonly binding: import("effect/Schema").Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly locale: import("effect/Schema").String;
+        readonly eligible: import("effect/Schema").Boolean;
+      }>, import("effect/Schema").Struct<{
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+        readonly reference: import("effect/Schema").Struct<{
+          readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly keyId: import("effect/Schema").String;
+        }>;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+          readonly binding: import("effect/Schema").Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly locale: import("effect/Schema").String;
+          readonly eligible: import("effect/Schema").Boolean;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+          readonly reference: import("effect/Schema").Struct<{
+            readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+            readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+            readonly keyId: import("effect/Schema").String;
+          }>;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+      Resend: AuthOperation<`${Id}/reset/resend`, import("effect/Schema").Struct<{
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+        readonly binding: import("effect/Schema").Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly locale: import("effect/Schema").String;
+        readonly eligible: import("effect/Schema").Boolean;
+        readonly supersedes: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+      }>, import("effect/Schema").Struct<{
+        readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+        readonly reference: import("effect/Schema").Struct<{
+          readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly keyId: import("effect/Schema").String;
+        }>;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+          readonly binding: import("effect/Schema").Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly locale: import("effect/Schema").String;
+          readonly eligible: import("effect/Schema").Boolean;
+          readonly supersedes: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+          readonly reference: import("effect/Schema").Struct<{
+            readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+            readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+            readonly keyId: import("effect/Schema").String;
+          }>;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+      Attempt: AuthOperation<`${Id}/reset/attempt`, import("effect/Schema").Struct<{
+        readonly reference: import("effect/Schema").Struct<{
+          readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly keyId: import("effect/Schema").String;
+        }>;
+        readonly binding: import("effect/Schema").Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").TaggedStruct<"Accepted", {
+        readonly continuation: import("effect/Schema").Struct<{
+          readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+          readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: import("effect/Schema").Int;
+        }>;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly reference: import("effect/Schema").Struct<{
+            readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+            readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+            readonly keyId: import("effect/Schema").String;
+          }>;
+          readonly binding: import("effect/Schema").Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").TaggedStruct<"Accepted", {
+          readonly continuation: import("effect/Schema").Struct<{
+            readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+            readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+            readonly expiresAtMillis: import("effect/Schema").Int;
+          }>;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/reset/complete`, import("effect/Schema").Struct<{
+        readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+        readonly binding: import("effect/Schema").Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+      }>, import("effect/Schema").Void, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+          readonly binding: import("effect/Schema").Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+        }>;
+        readonly success: import("effect/Schema").Void;
+        readonly error: import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Cancel: AuthOperation<`${Id}/reset/cancel`, import("effect/Schema").Struct<{
+        readonly binding: import("effect/Schema").Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+      }>, import("effect/Schema").Void, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly binding: import("effect/Schema").Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+        }>;
+        readonly success: import("effect/Schema").Void;
+        readonly error: import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+      Cleanup: AuthOperation<`${Id}/reset/cleanup`, import("effect/Schema").Struct<{
+        readonly limit: import("effect/Schema").Int;
+      }>, import("effect/Schema").Struct<{
+        readonly removed: import("effect/Schema").Natural;
+        readonly hasMore: import("effect/Schema").Boolean;
+      }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: import("effect/Schema").Struct<{
+          readonly limit: import("effect/Schema").Int;
+        }>;
+        readonly success: import("effect/Schema").Struct<{
+          readonly removed: import("effect/Schema").Natural;
+          readonly hasMore: import("effect/Schema").Boolean;
+        }>;
+        readonly error: import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+    };
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/attempt`, import("effect/Schema").Struct<{
+      readonly reference: import("effect/Schema").Struct<{
+        readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly keyId: import("effect/Schema").String;
+      }>;
+      readonly binding: import("effect/Schema").Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").TaggedStruct<"Accepted", {
+      readonly continuation: import("effect/Schema").Struct<{
+        readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly expiresAtMillis: import("effect/Schema").Int;
+      }>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/cancel`, import("effect/Schema").Struct<{
+      readonly binding: import("effect/Schema").Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+    }>, import("effect/Schema").Void, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/cleanup`, import("effect/Schema").Struct<{
+      readonly limit: import("effect/Schema").Int;
+    }>, import("effect/Schema").Struct<{
+      readonly removed: import("effect/Schema").Natural;
+      readonly hasMore: import("effect/Schema").Boolean;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/complete`, import("effect/Schema").Struct<{
+      readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+      readonly binding: import("effect/Schema").Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    }>, import("effect/Schema").Void, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/request`, import("effect/Schema").Struct<{
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+      readonly binding: import("effect/Schema").Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly locale: import("effect/Schema").String;
+      readonly eligible: import("effect/Schema").Boolean;
+    }>, import("effect/Schema").Struct<{
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+      readonly reference: import("effect/Schema").Struct<{
+        readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly keyId: import("effect/Schema").String;
+      }>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/resend`, import("effect/Schema").Struct<{
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+      readonly binding: import("effect/Schema").Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly locale: import("effect/Schema").String;
+      readonly eligible: import("effect/Schema").Boolean;
+      readonly supersedes: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+    }>, import("effect/Schema").Struct<{
+      readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+      readonly reference: import("effect/Schema").Struct<{
+        readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+        readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+        readonly keyId: import("effect/Schema").String;
+      }>;
+    }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  }>;
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/add-password`, import("effect/Schema").Struct<{
+    commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+    newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+  }>, import("effect/Schema").Struct<{
+    readonly invalidation: import("effect/Schema").Struct<{
+      readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: import("effect/Schema").Natural;
+      readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+    }>;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/change-password`, import("effect/Schema").Struct<{
+    readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+    readonly currentPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+  }>, import("effect/Schema").Struct<{
+    readonly invalidation: import("effect/Schema").Struct<{
+      readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: import("effect/Schema").Natural;
+      readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+    }>;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/cleanup`, import("effect/Schema").Struct<{
+    readonly limit: import("effect/Schema").Int;
+  }>, import("effect/Schema").Struct<{
+    readonly removed: import("effect/Schema").Natural;
+    readonly hasMore: import("effect/Schema").Boolean;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/complete-reset`, import("effect/Schema").Struct<{
+    readonly commandId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    readonly actionProof: import("effect/Schema").optionalKey<import("effect/Schema").RedactedFromValue<import("effect/Schema").String>>;
+    readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+    readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+    readonly credential: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+  }>, import("effect/Schema").Struct<{
+    readonly invalidation: import("effect/Schema").Struct<{
+      readonly trigger: import("effect/Schema").Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: import("effect/Schema").Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: import("effect/Schema").Natural;
+      readonly oldAuthenticationEvidence: import("effect/Schema").Literal<"rejected">;
+    }>;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/register`, import("effect/Schema").Struct<{
+    readonly requestId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+    readonly newPassword: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    readonly registration: import("effect/Schema").Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"RegistrationAccepted", {}>, import("effect/Schema").TaggedStruct<"ProvisioningPending", {
+    readonly reference: import("effect/Schema").NonEmptyString;
+  }>]>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/request-reset`, import("effect/Schema").Struct<{
+    readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+    readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+    readonly locale: import("effect/Schema").NonEmptyString;
+  }>, import("effect/Schema").Struct<{
+    readonly requestId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofRequestId">;
+    readonly reference: import("effect/Schema").Struct<{
+      readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+      readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+      readonly keyId: import("effect/Schema").String;
+    }>;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/sign-in`, import("effect/Schema").Struct<{
+    readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+    readonly password: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+    readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Authenticated", {
+    readonly session: import("effect/Schema").Struct<{
+      readonly sessionId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: import("effect/Schema").DateTimeUtcFromMillis;
+      readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+      readonly claims: import("effect/Schema").Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, import("effect/Schema").TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: import("effect/Schema").DateTimeUtcFromMillis;
+  }>]>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/status`, import("effect/Schema").Void, import("effect/Schema").Struct<{
+    readonly hasPassword: import("effect/Schema").Boolean;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/verify-reset`, import("effect/Schema").Struct<{
+    readonly flowId: import("effect/Schema").brand<import("effect/Schema").NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly email: import("effect/Schema").compose<import("effect/Schema").decodeTo<import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/Email">, import("effect/Schema").String, never, never>, import("effect/Schema").String>;
+    readonly reference: import("effect/Schema").Struct<{
+      readonly proofId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofId">;
+      readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+      readonly keyId: import("effect/Schema").String;
+    }>;
+    readonly secret: import("effect/Schema").RedactedFromValue<import("effect/Schema").String>;
+  }>, import("effect/Schema").Struct<{
+    readonly continuation: import("effect/Schema").Struct<{
+      readonly continuationId: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofContinuationId">;
+      readonly purpose: import("effect/Schema").brand<import("effect/Schema").String, "effect-auth/ProofPurpose">;
+      readonly expiresAtMillis: import("effect/Schema").Int;
+    }>;
+  }>, import("effect/Schema").Union<readonly [import("effect/Schema").Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, import("effect/Schema").Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+interface ManagementStrategy<Registration extends ClaimsCodec, Namespace extends string | undefined = undefined> extends StrategyTypeLambda {
+  readonly type: ReturnType<typeof bindManagement<Registration, Namespace, BindingOf<this>["claims"], BindingOf<this>["namespace"], BindingOf<this>["sessionNamespace"]>>;
+}
+declare const management: <Registration extends ClaimsCodec, const Namespace extends string | undefined = undefined>(namespace: Namespace, input: PasswordManagementOptions<Registration, Namespace>) => Readonly<StrategyDefinition<ManagementStrategy<Registration, Namespace>, Namespace>>;
+declare function make<Registration extends ClaimsCodec, const Namespace extends string>(options: PasswordManagementOptions<Registration, Namespace> & {
+  readonly namespace: Namespace;
+}): ReturnType<typeof management<Registration, Namespace>>;
+declare function make<Registration extends ClaimsCodec, const Namespace extends string | undefined = undefined>(options: PasswordManagementOptions<Registration, Namespace>): ReturnType<typeof management<Registration, Namespace | undefined>>;
+declare function make<const Namespace extends string>(options: PasswordOptions<Namespace> & {
+  readonly namespace: Namespace;
+}): ReturnType<typeof signIn<Namespace>>;
+declare function make<const Namespace extends string | undefined = undefined>(options?: PasswordOptions<Namespace>): ReturnType<typeof signIn<Namespace | undefined>>;
+//#endregion
+export { ManagementStrategy, PasswordManagementOptions, PasswordOptions, SignInStrategy, make };
+//# sourceMappingURL=definition.d.mts.map