@yielded/auth 0.1.0-beta.1

package/dist/password/methods/module.d.mts

@@ -0,0 +1,3567 @@
+import { SubjectId } from "../../Schema.mjs";
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../../operations/errors.mjs";
+import { AuthInvocation, AuthenticationAssurance } from "../../operations/context.mjs";
+import { AuthCredentialCommandCollector, AuthOperationResult, AuthRevealCommandCollectorService } from "../../operations/credentials.mjs";
+import { AuthOperation, CredentialCollectorProvenance, OperationHandler, RevealCollectorProvenance } from "../../operations/operation.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { HookDenied } from "../../hooks/models.mjs";
+import { LifecycleHooks } from "../../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../../sessions/AuthenticationAuthority.mjs";
+import { SubtleCrypto } from "../../WebCrypto.mjs";
+import "../../Operations.mjs";
+import { SessionApiError } from "../../auth/session.mjs";
+import { AuthRequest } from "../../auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "../../auth/AuthConfigurationError.mjs";
+import "../../Auth.mjs";
+import { ModuleService, makeSessionModule } from "../../sessions/module.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError } from "../errors.mjs";
+import { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { ProofCleanupResult, ProofCompletionDecision, ProofContinuation, ProofId, ProofRequestReceipt } from "../../proofs/models.mjs";
+import { PasswordCredentialSnapshot, PasswordReplacement } from "./models.mjs";
+import { ProofCapabilityUnsupported, ProofConfigurationError, ProofIngressDenied, ProofInvalid, ProofRequestConflict, ProofUnavailable } from "../../proofs/errors.mjs";
+import { EmailProofDelivery } from "../../proofs/EmailProofDelivery.mjs";
+import { ProofPolicy } from "../../proofs/policy.mjs";
+import { ProofPersistence } from "../../proofs/ProofPersistence.mjs";
+import { PreparedProofDispatch, ProofIssuePlan } from "../../proofs/dispatch.mjs";
+import { ProofCompletionPlan } from "../../proofs/completion.mjs";
+import { ProofKeyring, ProofSecretPolicy } from "../../proofs/crypto.mjs";
+import { SmsProofDelivery } from "../../proofs/SmsProofDelivery.mjs";
+import { ProofModule } from "../../proofs/module.mjs";
+import "../../Proofs.mjs";
+import { CompromisedPasswords } from "../CompromisedPasswords.mjs";
+import { NewPasswordCheck } from "../NewPasswordCheck.mjs";
+import { PasswordHashing } from "../PasswordHashing.mjs";
+import { PasswordActionEvidence } from "./PasswordActionEvidence.mjs";
+import { PasswordMethodPolicy } from "./policy.mjs";
+import { PasswordPersistence, PreparePasswordCommit } from "./PasswordPersistence.mjs";
+import { PasswordPreparedConfiguration, PasswordPreparedContext } from "./preparedModels.mjs";
+import { PasswordPreparedPersistence } from "./PasswordPreparedPersistence.mjs";
+import { PasswordPreparedAuthorization, PasswordPreparedCompletionPlan, ServiceId } from "./prepared.mjs";
+import { PasswordSignInOptions, makePasswordSignIn } from "./signIn.mjs";
+import { Context, Crypto, Effect, Layer, Redacted, Schema, Types } from "effect";
+//#region src/password/methods/module.d.ts
+interface MethodService<Id extends string, Kind extends string> {
+  readonly moduleId: Id;
+  readonly kind: Kind;
+}
+type PasswordRegistrationDecision = {
+  readonly _tag: "Created";
+  readonly subjectId: SubjectId;
+} | {
+  readonly _tag: "Suppressed";
+} | {
+  readonly _tag: "Pending";
+  readonly reference: string;
+};
+declare const Status: Schema.Struct<{
+  readonly hasPassword: Schema.Boolean;
+}>;
+declare const Cleanup: Schema.Struct<{
+  readonly removed: Schema.Natural;
+  readonly hasMore: Schema.Boolean;
+}>;
+/** Public email/password method. Trusted claims/provisioning/action capabilities
+ * are explicit; no product account model, implicit login or MFA bypass is supplied.
+ */
+declare const makePasswordWithManagement: <const Id extends string, const SessionModuleId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>, Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, input: {
+  readonly sessions: ReturnType<typeof makeSessionModule<SessionModuleId, Claims>>;
+  readonly registration: Registration;
+  readonly policy: PasswordMethodPolicy;
+  readonly reset: {
+    readonly template: string;
+    readonly secret: ProofSecretPolicy;
+    readonly policy: ProofPolicy;
+    readonly keys?: ProofKeyring;
+  };
+}) => Readonly<{
+  strategy: Readonly<{
+    completion: boolean;
+    make: Effect.Effect<{
+      readonly signIn: (input: Omit<{
+        readonly email: string;
+        readonly password: string;
+        readonly flowId: string;
+      }, "flowId">) => Effect.Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: import("effect/DateTime").Utc;
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly register: (input: {
+        readonly requestId: string;
+        readonly email: string;
+        readonly newPassword: string;
+        readonly registration: Registration["Encoded"];
+      }) => Effect.Effect<{
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest | Exclude<Exclude<Registration["DecodingServices"], CredentialCollectorProvenance | RevealCollectorProvenance>, Crypto.Crypto | OperationHandler<`${Id}/add-password`, {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }, {
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/change-password`, {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+        readonly currentPassword: Redacted.Redacted<string>;
+      }, {
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/cleanup`, {
+        readonly limit: number;
+      }, {
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/complete-reset`, {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly credential: Redacted.Redacted<string>;
+      }, {
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/register`, {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly newPassword: Redacted.Redacted<string>;
+        readonly registration: Registration["Type"];
+      }, {
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/request-reset`, {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly locale: string;
+      }, {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/sign-in`, {
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly password: Redacted.Redacted<string>;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      }, {
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: import("effect/DateTime").Utc;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/status`, void, {
+        readonly hasPassword: boolean;
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/verify-reset`, {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+        readonly secret: Redacted.Redacted<string>;
+      }, {
+        readonly continuation: {
+          readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: number;
+        };
+      }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | SubtleCrypto | (AuthCredentialCommandCollector | AuthRevealCommandCollectorService)>>;
+      readonly addPassword: (input: {
+        readonly commandId: string;
+        readonly newPassword: string;
+        readonly actionProof?: string | undefined;
+      }) => Effect.Effect<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly changePassword: (input: {
+        readonly commandId: string;
+        readonly newPassword: string;
+        readonly actionProof?: string | undefined;
+        readonly currentPassword: string;
+      }) => Effect.Effect<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly requestReset: (input: {
+        readonly flowId: string;
+        readonly email: string;
+        readonly requestId: string;
+        readonly locale: string;
+      }) => Effect.Effect<{
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly verifyReset: (input: {
+        readonly flowId: string;
+        readonly email: string;
+        readonly reference: {
+          readonly proofId: string;
+          readonly purpose: string;
+          readonly keyId: string;
+        };
+        readonly secret: string;
+      }) => Effect.Effect<{
+        readonly continuation: {
+          readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: number;
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly completeReset: (input: {
+        readonly commandId: string;
+        readonly newPassword: string;
+        readonly actionProof?: string | undefined;
+        readonly flowId: string;
+        readonly email: string;
+        readonly continuationId: string;
+        readonly credential: string;
+      }) => Effect.Effect<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+      readonly passwordStatus: (input?: void | undefined) => Effect.Effect<{
+        readonly hasPassword: boolean;
+      }, NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+    }, AuthConfigurationError | PasswordConfigurationError | PasswordMethodConfigurationError | ProofConfigurationError, AuthenticationAuthority | CompromisedPasswords | Layer.CurrentMemoMap | EmailProofDelivery | ModuleService<SessionModuleId, "completion", Claims["Type"]> | ModuleService<SessionModuleId, "strategy", Claims["Type"]> | PasswordActionEvidence | PasswordPersistence | ProofPersistence | import("effect/Scope").Scope | Exclude<Exclude<Exclude<Exclude<Registration["DecodingServices"], import("effect/Scope").Scope>, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>>, LifecycleHooks | NewPasswordCheck | PasswordHashing>, Crypto.Crypto | SubtleCrypto> | Exclude<Exclude<Exclude<Exclude<Registration["EncodingServices"], import("effect/Scope").Scope>, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>>, LifecycleHooks | NewPasswordCheck | PasswordHashing>, Crypto.Crypto | SubtleCrypto> | (MethodService<Id, "claims"> & {
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }) | (MethodService<Id, "registration"> & {
+      readonly registration: Types.Invariant<Registration["Type"]>;
+    })>;
+  }>;
+  prepared: (configuration: PasswordPreparedConfiguration) => Readonly<{
+    PasswordPrepared: Context.Service<ServiceId<Id, "prepared"> & {
+      readonly reset: Types.Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    }, {
+      readonly beginAdd: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: Redacted.Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Prepared";
+        readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: number;
+      } | {
+        readonly _tag: "AlreadyExists";
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly beginChange: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: Redacted.Redacted<string>;
+        readonly currentPassword: Redacted.Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Prepared";
+        readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: number;
+      } | {
+        readonly _tag: "AlreadyExists";
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly beginReset: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+        readonly newPassword: Redacted.Redacted<string>;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+        readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly continuationCredential: Redacted.Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Prepared";
+        readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: number;
+      } | {
+        readonly _tag: "AlreadyExists";
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly context: (invocation: AuthInvocation, credential: Redacted.Redacted<string>) => Effect.Effect<PasswordPreparedContext, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+      readonly resetContext: (invocation: AuthInvocation, input: {
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly continuationCredential: Redacted.Redacted<string>;
+      }) => Effect.Effect<PasswordPreparedContext, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly planComplete: (invocation: AuthInvocation, input: {
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: Redacted.Redacted<string>;
+      }) => Effect.Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly planResetComplete: (invocation: AuthInvocation, input: {
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: Redacted.Redacted<string>;
+      }) => Effect.Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly planCompleteAuthorized: (invocation: AuthInvocation, input: {
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: Redacted.Redacted<string>;
+      }, authorization: PasswordPreparedAuthorization) => Effect.Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+      readonly planResetCompleteAuthorized: (invocation: AuthInvocation, input: {
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      } & {
+        readonly continuationCredential?: Redacted.Redacted<string>;
+      }, authorization: PasswordPreparedAuthorization) => Effect.Effect<PasswordPreparedCompletionPlan<ServiceId<Id, "prepared-persistence">>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+      readonly cancel: (invocation: AuthInvocation, credential: Redacted.Redacted<string>) => Effect.Effect<PreparedCommit<AuthOperationResult<void>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+      readonly cleanup: (limit: number) => Effect.Effect<PreparedCommit<{
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, never>;
+    }>;
+    PasswordPreparedPersistence: Context.Service<ServiceId<Id, "prepared-persistence">, PasswordPreparedPersistence>;
+    layer: Layer.Layer<ServiceId<Id, "prepared"> & {
+      readonly reset: Types.Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    }, PasswordMethodConfigurationError, AuthenticationAuthority | Crypto.Crypto | LifecycleHooks | ModuleService<SessionModuleId, "strategy", Claims["Type"]> | NewPasswordCheck | PasswordActionEvidence | PasswordHashing | PasswordPersistence | ServiceId<Id, "prepared-persistence">>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/prepared/add/begin`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: Redacted.Redacted<string>;
+    }, {
+      readonly _tag: "Prepared";
+      readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: number;
+    } | {
+      readonly _tag: "AlreadyExists";
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/add/complete`, {
+      readonly intentCredential: Redacted.Redacted<string>;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/cancel`, {
+      readonly intentCredential: Redacted.Redacted<string>;
+    }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/change/begin`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: Redacted.Redacted<string>;
+      readonly currentPassword: Redacted.Redacted<string>;
+    }, {
+      readonly _tag: "Prepared";
+      readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: number;
+    } | {
+      readonly _tag: "AlreadyExists";
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/change/complete`, {
+      readonly intentCredential: Redacted.Redacted<string>;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/cleanup`, {
+      readonly limit: number;
+    }, {
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, ServiceId<Id, "prepared-persistence"> | (ServiceId<Id, "prepared"> & {
+      readonly reset: Types.Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    })>;
+    resetHandlersLayer: Layer.Layer<OperationHandler<`${Id}/prepared/reset/begin`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: Redacted.Redacted<string>;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly continuationCredential: Redacted.Redacted<string>;
+    }, {
+      readonly _tag: "Prepared";
+      readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: number;
+    } | {
+      readonly _tag: "AlreadyExists";
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/prepared/reset/complete`, {
+      readonly intentCredential: Redacted.Redacted<string>;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+      readonly continuationCredential: Redacted.Redacted<string>;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }> | ServiceId<Id, "prepared-persistence"> | (ServiceId<Id, "prepared"> & {
+      readonly reset: Types.Invariant<ProofModule<`${Id}/reset`, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }>>;
+    })>;
+    operations: {
+      BeginAdd: AuthOperation<`${Id}/prepared/add/begin`, Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+        readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: Schema.Int;
+      }>, Schema.TaggedStruct<"AlreadyExists", {}>]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+          readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+          readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+          readonly expiresAtMillis: Schema.Int;
+        }>, Schema.TaggedStruct<"AlreadyExists", {}>]>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      BeginChange: AuthOperation<`${Id}/prepared/change/begin`, Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+        readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: Schema.Int;
+      }>, Schema.TaggedStruct<"AlreadyExists", {}>]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+          readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+          readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+          readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+          readonly expiresAtMillis: Schema.Int;
+        }>, Schema.TaggedStruct<"AlreadyExists", {}>]>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      CompleteAdd: AuthOperation<`${Id}/prepared/add/complete`, Schema.Struct<{
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      }>, Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      CompleteChange: AuthOperation<`${Id}/prepared/change/complete`, Schema.Struct<{
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      }>, Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Cancel: AuthOperation<`${Id}/prepared/cancel`, Schema.Struct<{
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.Void, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.Void;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      Cleanup: AuthOperation<`${Id}/prepared/cleanup`, Schema.Struct<{
+        readonly limit: Schema.Int;
+      }>, Schema.Struct<{
+        readonly removed: Schema.Natural;
+        readonly hasMore: Schema.Boolean;
+      }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly limit: Schema.Int;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly removed: Schema.Natural;
+          readonly hasMore: Schema.Boolean;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+    };
+    resetOperations: {
+      BeginReset: AuthOperation<`${Id}/prepared/reset/begin`, Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+        readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+        readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: Schema.Int;
+      }>, Schema.TaggedStruct<"AlreadyExists", {}>]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+          readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+          readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+          readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+          readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+          readonly expiresAtMillis: Schema.Int;
+        }>, Schema.TaggedStruct<"AlreadyExists", {}>]>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+      CompleteReset: AuthOperation<`${Id}/prepared/reset/complete`, Schema.Struct<{
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+          readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    };
+    resetGroup: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/reset/begin`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+      readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+      readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: Schema.Int;
+    }>, Schema.TaggedStruct<"AlreadyExists", {}>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/reset/complete`, Schema.Struct<{
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/add/begin`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+      readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: Schema.Int;
+    }>, Schema.TaggedStruct<"AlreadyExists", {}>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/add/complete`, Schema.Struct<{
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/cancel`, Schema.Struct<{
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/change/begin`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+      readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+      readonly expiresAtMillis: Schema.Int;
+    }>, Schema.TaggedStruct<"AlreadyExists", {}>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/change/complete`, Schema.Struct<{
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/prepared/cleanup`, Schema.Struct<{
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly removed: Schema.Natural;
+      readonly hasMore: Schema.Boolean;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    schemas: {
+      BeginAddInput: Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      BeginChangeInput: Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      BeginResetInput: Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+        readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      CompleteInput: Schema.Struct<{
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      }>;
+      CompleteResetInput: Schema.Struct<{
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        readonly continuationCredential: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      Result: Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+        readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+        readonly expiresAtMillis: Schema.Int;
+      }>, Schema.TaggedStruct<"AlreadyExists", {}>]>;
+    };
+  }>;
+  Passwords: Context.Service<MethodService<Id, "method"> & {
+    readonly claims: Types.Invariant<Claims["Type"]>;
+    readonly registration: Types.Invariant<Registration["Type"]>;
+  }, {
+    readonly planRegister: (input: {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly newPassword: Redacted.Redacted<string>;
+      readonly registration: Registration["Type"];
+    }) => Effect.Effect<{
+      readonly commit: Effect.Effect<PreparedCommit<{
+        readonly _tag: "RegistrationAccepted";
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+      }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, MethodService<Id, "registration"> & {
+        readonly registration: Types.Invariant<Registration["Type"]>;
+      }>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly signIn: (input: {
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly password: Redacted.Redacted<string>;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: import("effect/DateTime").Utc;
+        readonly expiresAt: import("effect/DateTime").Utc;
+        readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: import("effect/DateTime").Utc;
+    }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly planAdd: (invocation: AuthInvocation, input: {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: Redacted.Redacted<string>;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }) => Effect.Effect<{
+      readonly commit: Effect.Effect<PreparedCommit<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Rejected";
+      }>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, PasswordPersistence>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly planChange: (invocation: AuthInvocation, input: {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: Redacted.Redacted<string>;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+      readonly currentPassword: Redacted.Redacted<string>;
+    }) => Effect.Effect<{
+      readonly commit: Effect.Effect<PreparedCommit<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Rejected";
+      }>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, PasswordPersistence>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly requestReset: (input: {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly locale: string;
+    }) => Effect.Effect<ProofRequestReceipt, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly verifyReset: (input: {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+      readonly secret: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly continuation: ProofContinuation;
+    }>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly planReset: (invocation: AuthInvocation, input: {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+      readonly newPassword: Redacted.Redacted<string>;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly credential: Redacted.Redacted<string>;
+    }) => Effect.Effect<{
+      readonly commit: Effect.Effect<PreparedCommit<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Rejected";
+      }>>, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable, PasswordPersistence>;
+    }, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly status: (invocation: AuthInvocation) => Effect.Effect<typeof Status.Type, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+    readonly cleanup: (limit: number) => Effect.Effect<typeof Cleanup.Type, HookDenied | NewPasswordRejected | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>;
+  }>;
+  RegistrationAuthority: Context.Service<MethodService<Id, "registration"> & {
+    readonly registration: Types.Invariant<Registration["Type"]>;
+  }, {
+    /** Join application provisioning + unverified identifier + create-if-absent
+     * password under one owner, or persist a protected recovery intent and Pending.
+     * Request binding includes exact private credential intent; public requestId
+     * alone cannot adopt another request's subject. Never upsert an existing login.
+     * Every retry has a fresh salt: verifier equality cannot prove password equality.
+     * Retain the original protected intent; replays never replace it or expose its
+     * subject. Return uniform Accepted/Pending metadata or suppress the replay.
+     * A pending reference is non-authorizing and cannot resume/adopt that intent.
+     */
+    readonly register: <A>(input: {
+      readonly moduleId: string;
+      readonly requestId: string;
+      readonly identifier: LoginIdentifier;
+      readonly registration: Registration["Type"];
+      readonly replacement: PasswordReplacement;
+    }, prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  }>;
+  ClaimsForPassword: Context.Service<MethodService<Id, "claims"> & {
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }, {
+    readonly resolve: (credential: PasswordCredentialSnapshot) => Effect.Effect<Claims["Type"], PasswordUnavailable>;
+  }>;
+  layer: Layer.Layer<MethodService<Id, "method"> & {
+    readonly claims: Types.Invariant<Claims["Type"]>;
+    readonly registration: Types.Invariant<Registration["Type"]>;
+  }, PasswordMethodConfigurationError, AuthenticationAuthority | Crypto.Crypto | LifecycleHooks | ModuleService<SessionModuleId, "completion", Claims["Type"]> | ModuleService<SessionModuleId, "strategy", Claims["Type"]> | NewPasswordCheck | PasswordActionEvidence | PasswordHashing | PasswordPersistence | ProofModule<`${Id}/reset`, {
+    readonly _tag: "Identifier";
+    readonly flowId: string;
+    readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly identifier: LoginIdentifier;
+  } | {
+    readonly _tag: "Subject";
+    readonly flowId: string;
+    readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly identifier: LoginIdentifier;
+  } | {
+    readonly _tag: "IdentifierChange";
+    readonly flowId: string;
+    readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly identifier: LoginIdentifier;
+  }> | Exclude<Registration["DecodingServices"], import("effect/Scope").Scope> | Exclude<Registration["EncodingServices"], import("effect/Scope").Scope> | (MethodService<Id, "claims"> & {
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  })>;
+  handlersLayer: Layer.Layer<OperationHandler<`${Id}/add-password`, {
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly newPassword: Redacted.Redacted<string>;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/change-password`, {
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly newPassword: Redacted.Redacted<string>;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+    readonly currentPassword: Redacted.Redacted<string>;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/cleanup`, {
+    readonly limit: number;
+  }, {
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/complete-reset`, {
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly newPassword: Redacted.Redacted<string>;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly credential: Redacted.Redacted<string>;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/register`, {
+    readonly requestId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly newPassword: Redacted.Redacted<string>;
+    readonly registration: Registration["Type"];
+  }, {
+    readonly _tag: "RegistrationAccepted";
+  } | {
+    readonly _tag: "ProvisioningPending";
+    readonly reference: string;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/request-reset`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+    readonly locale: string;
+  }, {
+    readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+    readonly reference: {
+      readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+      readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+      readonly keyId: string;
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/sign-in`, {
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly password: Redacted.Redacted<string>;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: import("effect/DateTime").Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/status`, void, {
+    readonly hasPassword: boolean;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/verify-reset`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly reference: {
+      readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+      readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+      readonly keyId: string;
+    };
+    readonly secret: Redacted.Redacted<string>;
+  }, {
+    readonly continuation: {
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+      readonly expiresAtMillis: number;
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, PasswordPersistence | (MethodService<Id, "method"> & {
+    readonly claims: Types.Invariant<Claims["Type"]>;
+    readonly registration: Types.Invariant<Registration["Type"]>;
+  }) | (MethodService<Id, "registration"> & {
+    readonly registration: Types.Invariant<Registration["Type"]>;
+  })>;
+  operations: {
+    Register: AuthOperation<`${Id}/register`, Schema.Struct<{
+      readonly requestId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+      readonly reference: Schema.NonEmptyString;
+    }>]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly requestId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+        readonly reference: Schema.NonEmptyString;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "idempotent";
+    }>;
+    SignIn: AuthOperation<`${Id}/sign-in`, Schema.Struct<{
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly password: Schema.RedactedFromValue<Schema.String>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly password: Schema.RedactedFromValue<Schema.String>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    AddPassword: AuthOperation<`${Id}/add-password`, Schema.Struct<{
+      commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      newPassword: Schema.RedactedFromValue<Schema.String>;
+      actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        newPassword: Schema.RedactedFromValue<Schema.String>;
+        actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    ChangePassword: AuthOperation<`${Id}/change-password`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RequestReset: AuthOperation<`${Id}/request-reset`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+      readonly locale: Schema.NonEmptyString;
+    }>, Schema.Struct<{
+      readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+      readonly reference: Schema.Struct<{
+        readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly keyId: Schema.String;
+      }>;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+        readonly locale: Schema.NonEmptyString;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+        readonly reference: Schema.Struct<{
+          readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly keyId: Schema.String;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "idempotent";
+    }>;
+    VerifyReset: AuthOperation<`${Id}/verify-reset`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly reference: Schema.Struct<{
+        readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly keyId: Schema.String;
+      }>;
+      readonly secret: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly continuation: Schema.Struct<{
+        readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly expiresAtMillis: Schema.Int;
+      }>;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly reference: Schema.Struct<{
+          readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly keyId: Schema.String;
+        }>;
+        readonly secret: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly continuation: Schema.Struct<{
+          readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: Schema.Int;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    CompleteReset: AuthOperation<`${Id}/complete-reset`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+      readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+      readonly credential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+        readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+        readonly credential: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    PasswordStatus: AuthOperation<`${Id}/status`, Schema.Void, Schema.Struct<{
+      readonly hasPassword: Schema.Boolean;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Void;
+      readonly success: Schema.Struct<{
+        readonly hasPassword: Schema.Boolean;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly exposure: "public";
+      readonly replay: "read-only";
+    }>;
+    CleanupAttempts: AuthOperation<`${Id}/cleanup`, Schema.Struct<{
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly removed: Schema.Natural;
+      readonly hasMore: Schema.Boolean;
+    }>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly limit: Schema.Int;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly removed: Schema.Natural;
+        readonly hasMore: Schema.Boolean;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "idempotent";
+    }>;
+  };
+  reset: Readonly<{
+    Proofs: Context.Service<ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>, {
+      readonly planIssue: (input: {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly locale: string;
+        readonly eligible: boolean;
+      } & {
+        readonly supersedes?: ProofId;
+      }) => Effect.Effect<ProofIssuePlan, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly prepareIssue: (input: {
+        readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly locale: string;
+        readonly eligible: boolean;
+      } & {
+        readonly supersedes?: ProofId;
+      }) => Effect.Effect<PreparedCommit<PreparedProofDispatch>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly prepareAttempt: (input: {
+        readonly reference: {
+          readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly keyId: string;
+        };
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly credential: Redacted.Redacted<string>;
+      }) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+        readonly _tag: "Accepted";
+        readonly continuation: {
+          readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+          readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: number;
+        };
+      }> | {
+        readonly value: {
+          readonly _tag: "Rejected";
+        };
+        readonly credentialCommands: readonly [];
+      }>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable, never>;
+      readonly planComplete: (input: {
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly credential: Redacted.Redacted<string>;
+      }) => Effect.Effect<ProofCompletionPlan, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly prepareComplete: (input: {
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly binding: {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        };
+        readonly credential: Redacted.Redacted<string>;
+      }) => Effect.Effect<PreparedCommit<ProofCompletionDecision>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly cancel: (binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }) => Effect.Effect<PreparedCommit<void>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+      readonly cleanup: (limit: number) => Effect.Effect<PreparedCommit<ProofCleanupResult>, HookDenied | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>;
+    }>;
+    emailLayer: Layer.Layer<ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>, ProofConfigurationError, Crypto.Crypto | EmailProofDelivery | LifecycleHooks | ProofPersistence | SubtleCrypto>;
+    smsLayer: Layer.Layer<ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>, ProofConfigurationError, Crypto.Crypto | LifecycleHooks | ProofPersistence | SmsProofDelivery | SubtleCrypto>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/reset/attempt`, {
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly credential: Redacted.Redacted<string>;
+    }, {
+      readonly _tag: "Accepted";
+      readonly continuation: {
+        readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly expiresAtMillis: number;
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/cancel`, {
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+    }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/cleanup`, {
+      readonly limit: number;
+    }, {
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/complete`, {
+      readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly credential: Redacted.Redacted<string>;
+    }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/request`, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly locale: string;
+      readonly eligible: boolean;
+    }, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable> | OperationHandler<`${Id}/reset/resend`, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly binding: {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      };
+      readonly locale: string;
+      readonly eligible: boolean;
+      readonly supersedes: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+    }, {
+      readonly requestId: string & import("effect/Brand").Brand<"effect-auth/ProofRequestId">;
+      readonly reference: {
+        readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+        readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+        readonly keyId: string;
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | ProofCapabilityUnsupported | ProofIngressDenied | ProofInvalid | ProofRequestConflict | ProofUnavailable>, never, ProofModule<`${Id}/reset`, {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    }>>;
+    operations: {
+      Request: AuthOperation<`${Id}/reset/request`, Schema.Struct<{
+        readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+        readonly binding: Schema.Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly locale: Schema.String;
+        readonly eligible: Schema.Boolean;
+      }>, Schema.Struct<{
+        readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+        readonly reference: Schema.Struct<{
+          readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly keyId: Schema.String;
+        }>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+          readonly binding: Schema.Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly locale: Schema.String;
+          readonly eligible: Schema.Boolean;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+          readonly reference: Schema.Struct<{
+            readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+            readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+            readonly keyId: Schema.String;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+      Resend: AuthOperation<`${Id}/reset/resend`, Schema.Struct<{
+        readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+        readonly binding: Schema.Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly locale: Schema.String;
+        readonly eligible: Schema.Boolean;
+        readonly supersedes: Schema.brand<Schema.String, "effect-auth/ProofId">;
+      }>, Schema.Struct<{
+        readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+        readonly reference: Schema.Struct<{
+          readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly keyId: Schema.String;
+        }>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+          readonly binding: Schema.Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly locale: Schema.String;
+          readonly eligible: Schema.Boolean;
+          readonly supersedes: Schema.brand<Schema.String, "effect-auth/ProofId">;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+          readonly reference: Schema.Struct<{
+            readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+            readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+            readonly keyId: Schema.String;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+      Attempt: AuthOperation<`${Id}/reset/attempt`, Schema.Struct<{
+        readonly reference: Schema.Struct<{
+          readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly keyId: Schema.String;
+        }>;
+        readonly binding: Schema.Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly credential: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.TaggedStruct<"Accepted", {
+        readonly continuation: Schema.Struct<{
+          readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+          readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+          readonly expiresAtMillis: Schema.Int;
+        }>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly reference: Schema.Struct<{
+            readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+            readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+            readonly keyId: Schema.String;
+          }>;
+          readonly binding: Schema.Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly credential: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.TaggedStruct<"Accepted", {
+          readonly continuation: Schema.Struct<{
+            readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+            readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+            readonly expiresAtMillis: Schema.Int;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/reset/complete`, Schema.Struct<{
+        readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+        readonly binding: Schema.Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+        readonly credential: Schema.RedactedFromValue<Schema.String>;
+      }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+          readonly binding: Schema.Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+          readonly credential: Schema.RedactedFromValue<Schema.String>;
+        }>;
+        readonly success: Schema.Void;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Cancel: AuthOperation<`${Id}/reset/cancel`, Schema.Struct<{
+        readonly binding: Schema.Codec<{
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly identifier: LoginIdentifier;
+        }, {
+          readonly _tag: "Identifier";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "Subject";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        } | {
+          readonly _tag: "IdentifierChange";
+          readonly flowId: string;
+          readonly contextDigest: string;
+          readonly revision: {
+            readonly subjectId: string;
+            readonly securityRevision: string;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string;
+            }[];
+          };
+          readonly identifier: {
+            readonly namespace: string;
+            readonly value: string;
+          };
+        }, never, never>;
+      }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly binding: Schema.Codec<{
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly identifier: LoginIdentifier;
+          }, {
+            readonly _tag: "Identifier";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "Subject";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          } | {
+            readonly _tag: "IdentifierChange";
+            readonly flowId: string;
+            readonly contextDigest: string;
+            readonly revision: {
+              readonly subjectId: string;
+              readonly securityRevision: string;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string;
+              }[];
+            };
+            readonly identifier: {
+              readonly namespace: string;
+              readonly value: string;
+            };
+          }, never, never>;
+        }>;
+        readonly success: Schema.Void;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+      Cleanup: AuthOperation<`${Id}/reset/cleanup`, Schema.Struct<{
+        readonly limit: Schema.Int;
+      }>, Schema.Struct<{
+        readonly removed: Schema.Natural;
+        readonly hasMore: Schema.Boolean;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly limit: Schema.Int;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly removed: Schema.Natural;
+          readonly hasMore: Schema.Boolean;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>;
+        readonly access: "system";
+        readonly replay: "idempotent";
+      }>;
+    };
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/attempt`, Schema.Struct<{
+      readonly reference: Schema.Struct<{
+        readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly keyId: Schema.String;
+      }>;
+      readonly binding: Schema.Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly credential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.TaggedStruct<"Accepted", {
+      readonly continuation: Schema.Struct<{
+        readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly expiresAtMillis: Schema.Int;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/cancel`, Schema.Struct<{
+      readonly binding: Schema.Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+    }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/cleanup`, Schema.Struct<{
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly removed: Schema.Natural;
+      readonly hasMore: Schema.Boolean;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/complete`, Schema.Struct<{
+      readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+      readonly binding: Schema.Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly credential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/request`, Schema.Struct<{
+      readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+      readonly binding: Schema.Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly locale: Schema.String;
+      readonly eligible: Schema.Boolean;
+    }>, Schema.Struct<{
+      readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+      readonly reference: Schema.Struct<{
+        readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly keyId: Schema.String;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/reset/resend`, Schema.Struct<{
+      readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+      readonly binding: Schema.Codec<{
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly identifier: LoginIdentifier;
+      }, {
+        readonly _tag: "Identifier";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "Subject";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      } | {
+        readonly _tag: "IdentifierChange";
+        readonly flowId: string;
+        readonly contextDigest: string;
+        readonly revision: {
+          readonly subjectId: string;
+          readonly securityRevision: string;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string;
+          }[];
+        };
+        readonly identifier: {
+          readonly namespace: string;
+          readonly value: string;
+        };
+      }, never, never>;
+      readonly locale: Schema.String;
+      readonly eligible: Schema.Boolean;
+      readonly supersedes: Schema.brand<Schema.String, "effect-auth/ProofId">;
+    }>, Schema.Struct<{
+      readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+      readonly reference: Schema.Struct<{
+        readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+        readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+        readonly keyId: Schema.String;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof ProofInvalid, typeof ProofUnavailable, typeof ProofRequestConflict, typeof ProofCapabilityUnsupported, typeof ProofIngressDenied]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  }>;
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/add-password`, Schema.Struct<{
+    commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+    newPassword: Schema.RedactedFromValue<Schema.String>;
+    actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+  }>, Schema.Struct<{
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/change-password`, Schema.Struct<{
+    readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    readonly currentPassword: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/cleanup`, Schema.Struct<{
+    readonly limit: Schema.Int;
+  }>, Schema.Struct<{
+    readonly removed: Schema.Natural;
+    readonly hasMore: Schema.Boolean;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/complete-reset`, Schema.Struct<{
+    readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+    readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+    readonly credential: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/register`, Schema.Struct<{
+    readonly requestId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+    readonly newPassword: Schema.RedactedFromValue<Schema.String>;
+    readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+    readonly reference: Schema.NonEmptyString;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/request-reset`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+    readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+    readonly locale: Schema.NonEmptyString;
+  }>, Schema.Struct<{
+    readonly requestId: Schema.brand<Schema.String, "effect-auth/ProofRequestId">;
+    readonly reference: Schema.Struct<{
+      readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+      readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+      readonly keyId: Schema.String;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/sign-in`, Schema.Struct<{
+    readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+    readonly password: Schema.RedactedFromValue<Schema.String>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/status`, Schema.Void, Schema.Struct<{
+    readonly hasPassword: Schema.Boolean;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/verify-reset`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+    readonly reference: Schema.Struct<{
+      readonly proofId: Schema.brand<Schema.String, "effect-auth/ProofId">;
+      readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+      readonly keyId: Schema.String;
+    }>;
+    readonly secret: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly continuation: Schema.Struct<{
+      readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+      readonly purpose: Schema.brand<Schema.String, "effect-auth/ProofPurpose">;
+      readonly expiresAtMillis: Schema.Int;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+declare function makePasswordMethod<const Id extends string, const SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>, Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, options: Parameters<typeof makePasswordWithManagement<Id, SessionId, Claims, Registration>>[1]): ReturnType<typeof makePasswordWithManagement<Id, SessionId, Claims, Registration>>;
+declare function makePasswordMethod<const Id extends string, const SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, options: PasswordSignInOptions<SessionId, Claims>): ReturnType<typeof makePasswordSignIn<Id, SessionId, Claims>>;
+//#endregion
+export { MethodService, PasswordRegistrationDecision, makePasswordMethod };
+//# sourceMappingURL=module.d.mts.map