@yielded/auth 0.1.0-beta.1

package/dist/password/methods/preparedModels.d.mts

@@ -0,0 +1,1295 @@
+import { AuthenticationEvidence } from "../../sessions/models.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { PasswordMethodConfigurationError, PasswordUnavailable } from "./errors.mjs";
+import { PasswordAction } from "./models.mjs";
+import { DateTime, Effect, Redacted, Schema } from "effect";
+//#region src/password/methods/preparedModels.d.ts
+declare const PasswordPreparedIntentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+type PasswordPreparedIntentId = typeof PasswordPreparedIntentId.Type;
+declare const PasswordPreparedCredential: Schema.RedactedFromValue<Schema.String>;
+type PasswordPreparedCredential = typeof PasswordPreparedCredential.Type;
+declare const PasswordPreparedVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordPreparedVersion">;
+type PasswordPreparedVersion = typeof PasswordPreparedVersion.Type;
+declare const PasswordPreparedConfiguration: Schema.Struct<{
+  readonly generation: Schema.Int;
+  readonly lifetimeMillis: Schema.Int;
+  readonly preparationLifetimeMillis: Schema.Int;
+  readonly retentionMillis: Schema.Int;
+  readonly maximumPendingPerSubject: Schema.Int;
+  readonly admission: Schema.Struct<{
+    readonly identifier: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly subject: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly action: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+  }>;
+}>;
+type PasswordPreparedConfiguration = typeof PasswordPreparedConfiguration.Type;
+declare const validatePasswordPreparedConfiguration: (input: {
+  readonly generation: number;
+  readonly lifetimeMillis: number;
+  readonly preparationLifetimeMillis: number;
+  readonly retentionMillis: number;
+  readonly maximumPendingPerSubject: number;
+  readonly admission: {
+    readonly identifier: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly subject: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly action: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+  };
+}) => Effect.Effect<{
+  readonly generation: number;
+  readonly lifetimeMillis: number;
+  readonly preparationLifetimeMillis: number;
+  readonly retentionMillis: number;
+  readonly maximumPendingPerSubject: number;
+  readonly admission: {
+    readonly identifier: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly subject: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly action: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+  };
+}, PasswordMethodConfigurationError, never>;
+declare const PasswordPreparedRequirement: Schema.Struct<{
+  readonly maximumAgeMillis: Schema.Int;
+  readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+    readonly userVerified: Schema.Boolean;
+    readonly phishingResistant: Schema.Boolean;
+    readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    readonly minimumCredentials: Schema.Int;
+  }>>;
+}>;
+type PasswordPreparedRequirement = typeof PasswordPreparedRequirement.Type;
+declare const BoundedChallenge: Schema.Struct<{
+  readonly action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+  readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+  readonly moduleId: Schema.NonEmptyString;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly targetCredentialId: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>;
+declare const PasswordPreparedReset: Schema.Struct<{
+  readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+  readonly binding: Schema.Union<readonly [Schema.TaggedStruct<"Identifier", {
+    readonly flowId: Schema.String;
+    readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+      readonly namespace: Schema.NonEmptyString;
+      readonly value: Schema.NonEmptyString;
+    }>>;
+  }>, Schema.TaggedStruct<"Subject", {
+    readonly flowId: Schema.String;
+    readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+      readonly namespace: Schema.NonEmptyString;
+      readonly value: Schema.NonEmptyString;
+    }>>;
+  }>, Schema.TaggedStruct<"IdentifierChange", {
+    readonly flowId: Schema.String;
+    readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+      readonly namespace: Schema.NonEmptyString;
+      readonly value: Schema.NonEmptyString;
+    }>>;
+  }>]>;
+}>;
+type PasswordPreparedReset = typeof PasswordPreparedReset.Type;
+declare const PasswordPreparedReservation: Schema.TaggedStruct<"Preparing", {
+  moduleId: Schema.NonEmptyString;
+  generation: Schema.Int;
+  intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+  version: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordPreparedVersion">;
+  commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+  action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+  revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  credential: Schema.optionalKey<Schema.Struct<{
+    readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+    readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+    readonly identifierVerifiedAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly moduleId: Schema.NonEmptyString;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly verifierVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+      readonly namespace: Schema.NonEmptyString;
+      readonly value: Schema.NonEmptyString;
+    }>>;
+    readonly identifierBindingRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  }>>;
+  capturedRequirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+  reset: Schema.optionalKey<Schema.Struct<{
+    readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+    readonly binding: Schema.Union<readonly [Schema.TaggedStruct<"Identifier", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>, Schema.TaggedStruct<"Subject", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>, Schema.TaggedStruct<"IdentifierChange", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>]>;
+  }>>;
+  invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+  createdAtMillis: Schema.Int;
+  preparationExpiresAtMillis: Schema.Int;
+  retainUntilMillis: Schema.Int;
+}>;
+type PasswordPreparedReservation = typeof PasswordPreparedReservation.Type;
+declare const PasswordPreparedReady: Schema.TaggedStruct<"Ready", {
+  readonly moduleId: Schema.NonEmptyString;
+  readonly generation: Schema.Int;
+  readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+  readonly version: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordPreparedVersion">;
+  readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+  readonly action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly credential: Schema.optionalKey<Schema.Struct<{
+    readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+    readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+    readonly identifierVerifiedAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly moduleId: Schema.NonEmptyString;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly verifierVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+      readonly namespace: Schema.NonEmptyString;
+      readonly value: Schema.NonEmptyString;
+    }>>;
+    readonly identifierBindingRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  }>>;
+  readonly capturedRequirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+  readonly reset: Schema.optionalKey<Schema.Struct<{
+    readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+    readonly binding: Schema.Union<readonly [Schema.TaggedStruct<"Identifier", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>, Schema.TaggedStruct<"Subject", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>, Schema.TaggedStruct<"IdentifierChange", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>]>;
+  }>>;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+  readonly createdAtMillis: Schema.Int;
+  readonly preparationExpiresAtMillis: Schema.Int;
+  readonly retainUntilMillis: Schema.Int;
+  readonly replacement: Schema.Struct<{
+    readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+    readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+  }>;
+  readonly challenge: Schema.Struct<{
+    readonly action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+    readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly moduleId: Schema.NonEmptyString;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly targetCredentialId: Schema.optionalKey<Schema.NonEmptyString>;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>;
+  readonly baseEvidence: Schema.optionalKey<Schema.Struct<{
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      readonly method: Schema.NonEmptyString;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    }>>;
+  }>>;
+  readonly digest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly issuedAtMillis: Schema.Int;
+  readonly expiresAtMillis: Schema.Int;
+}>;
+type PasswordPreparedReady = typeof PasswordPreparedReady.Type;
+declare const PasswordPreparedResult: Schema.Union<readonly [Schema.TaggedStruct<"Prepared", {
+  readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+  readonly expiresAtMillis: Schema.Int;
+}>, Schema.TaggedStruct<"AlreadyExists", {}>]>;
+type PasswordPreparedResult = typeof PasswordPreparedResult.Type;
+interface PasswordPreparedContext {
+  readonly intentId: PasswordPreparedIntentId;
+  readonly action: PasswordAction;
+  readonly challenge: typeof BoundedChallenge.Type;
+  readonly capturedRequirement: PasswordPreparedRequirement;
+  readonly baseEvidence?: AuthenticationEvidence;
+  readonly expiresAtMillis: number;
+}
+/** Explicit private persistence codec: encodes the Redacted PHC verifier, never a
+ * plaintext password. Do not log this value or expose it through an operation. */
+declare const PasswordPreparedReadyJson: Schema.fromJsonString<Schema.TaggedStruct<"Ready", {
+  readonly moduleId: Schema.NonEmptyString;
+  readonly generation: Schema.Int;
+  readonly intentId: Schema.brand<Schema.String, "effect-auth/PasswordPreparedIntentId">;
+  readonly version: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordPreparedVersion">;
+  readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+  readonly action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly credential: Schema.optionalKey<Schema.Struct<{
+    readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+    readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+    readonly identifierVerifiedAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly moduleId: Schema.NonEmptyString;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly verifierVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+      readonly namespace: Schema.NonEmptyString;
+      readonly value: Schema.NonEmptyString;
+    }>>;
+    readonly identifierBindingRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  }>>;
+  readonly capturedRequirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+  readonly reset: Schema.optionalKey<Schema.Struct<{
+    readonly continuationId: Schema.brand<Schema.String, "effect-auth/ProofContinuationId">;
+    readonly binding: Schema.Union<readonly [Schema.TaggedStruct<"Identifier", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>, Schema.TaggedStruct<"Subject", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>, Schema.TaggedStruct<"IdentifierChange", {
+      readonly flowId: Schema.String;
+      readonly contextDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly identifier: Schema.compose<typeof LoginIdentifier, Schema.Struct<{
+        readonly namespace: Schema.NonEmptyString;
+        readonly value: Schema.NonEmptyString;
+      }>>;
+    }>]>;
+  }>>;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+  readonly createdAtMillis: Schema.Int;
+  readonly preparationExpiresAtMillis: Schema.Int;
+  readonly retainUntilMillis: Schema.Int;
+  readonly replacement: Schema.Struct<{
+    readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+    readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+  }>;
+  readonly challenge: Schema.Struct<{
+    readonly action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+    readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+    readonly moduleId: Schema.NonEmptyString;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly targetCredentialId: Schema.optionalKey<Schema.NonEmptyString>;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>;
+  readonly baseEvidence: Schema.optionalKey<Schema.Struct<{
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      readonly method: Schema.NonEmptyString;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    }>>;
+  }>>;
+  readonly digest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly issuedAtMillis: Schema.Int;
+  readonly expiresAtMillis: Schema.Int;
+}>>;
+declare const encodePasswordPreparedReady: (value: {
+  readonly _tag: "Ready";
+  readonly moduleId: string;
+  readonly generation: number;
+  readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+  readonly version: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedVersion">;
+  readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+  readonly action: "add-password" | "change-password" | "reset-password";
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly credential?: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+    readonly identifierVerifiedAtMillis?: number | undefined;
+    readonly moduleId: string;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly credentialId: string;
+    readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly identifier: LoginIdentifier;
+    readonly identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  } | undefined;
+  readonly capturedRequirement: {
+    readonly maximumAgeMillis: number;
+    readonly alternatives: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }[]];
+  };
+  readonly reset?: {
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly binding: {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    };
+  } | undefined;
+  readonly invalidation: {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  };
+  readonly createdAtMillis: number;
+  readonly preparationExpiresAtMillis: number;
+  readonly retainUntilMillis: number;
+  readonly replacement: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+  };
+  readonly challenge: {
+    readonly action: "add-password" | "change-password" | "reset-password";
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly moduleId: string;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly targetCredentialId?: string | undefined;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  };
+  readonly baseEvidence?: {
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly proofs: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }[]];
+  } | undefined;
+  readonly digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly issuedAtMillis: number;
+  readonly expiresAtMillis: number;
+}) => Effect.Effect<string, PasswordUnavailable, never>;
+declare const decodePasswordPreparedReady: (value: string) => Effect.Effect<{
+  _tag: "Ready";
+  moduleId: string;
+  generation: number;
+  intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+  version: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedVersion">;
+  commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+  action: "add-password" | "change-password" | "reset-password";
+  credential?: Readonly<{
+    moduleId: string;
+    credentialId: string;
+    credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    normalization: "NFC" | "none";
+    identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    identifierVerifiedAtMillis?: number | undefined;
+    revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    identifier: Readonly<LoginIdentifier>;
+  }> | undefined;
+  reset?: {
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly binding: {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    };
+  } | undefined;
+  invalidation: {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  };
+  createdAtMillis: number;
+  preparationExpiresAtMillis: number;
+  retainUntilMillis: number;
+  replacement: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+  };
+  baseEvidence?: Readonly<{
+    flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    revision: Readonly<{
+      subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      credentials: readonly Readonly<{
+        credentialId: string;
+        revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }>[];
+    }>;
+    proofs: readonly [Readonly<{
+      method: string;
+      credentialId: string;
+      userVerified: boolean;
+      phishingResistant: boolean;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+      verifiedAt: DateTime.Utc;
+    }>, ...Readonly<{
+      method: string;
+      credentialId: string;
+      userVerified: boolean;
+      phishingResistant: boolean;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+      verifiedAt: DateTime.Utc;
+    }>[]];
+  }> | undefined;
+  digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  issuedAtMillis: number;
+  expiresAtMillis: number;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  challenge: {
+    action: "add-password" | "change-password" | "reset-password";
+    commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    moduleId: string;
+    targetCredentialId?: string | undefined;
+    bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+  };
+  capturedRequirement: Readonly<{
+    maximumAgeMillis: number;
+    alternatives: readonly [Readonly<{
+      userVerified: boolean;
+      phishingResistant: boolean;
+      minimumCredentials: number;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }>, ...Readonly<{
+      userVerified: boolean;
+      phishingResistant: boolean;
+      minimumCredentials: number;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }>[]];
+  }>;
+}, PasswordUnavailable, never>;
+declare const snapshotPasswordPreparedReservation: (input: {
+  readonly _tag: "Preparing";
+  readonly moduleId: string;
+  readonly generation: number;
+  readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+  readonly version: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedVersion">;
+  readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+  readonly action: "add-password" | "change-password" | "reset-password";
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly credential?: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+    readonly identifierVerifiedAtMillis?: number | undefined;
+    readonly moduleId: string;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly credentialId: string;
+    readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly identifier: LoginIdentifier;
+    readonly identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  } | undefined;
+  readonly capturedRequirement: {
+    readonly maximumAgeMillis: number;
+    readonly alternatives: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }[]];
+  };
+  readonly reset?: {
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly binding: {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    };
+  } | undefined;
+  readonly invalidation: {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  };
+  readonly createdAtMillis: number;
+  readonly preparationExpiresAtMillis: number;
+  readonly retainUntilMillis: number;
+}) => Effect.Effect<{
+  _tag: "Preparing";
+  moduleId: string;
+  generation: number;
+  intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+  version: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedVersion">;
+  commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+  action: "add-password" | "change-password" | "reset-password";
+  credential?: Readonly<{
+    moduleId: string;
+    credentialId: string;
+    credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    normalization: "NFC" | "none";
+    identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    identifierVerifiedAtMillis?: number | undefined;
+    revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    identifier: Readonly<LoginIdentifier>;
+  }> | undefined;
+  reset?: {
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly binding: {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    };
+  } | undefined;
+  invalidation: {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  };
+  createdAtMillis: number;
+  preparationExpiresAtMillis: number;
+  retainUntilMillis: number;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  capturedRequirement: Readonly<{
+    maximumAgeMillis: number;
+    alternatives: readonly [Readonly<{
+      userVerified: boolean;
+      phishingResistant: boolean;
+      minimumCredentials: number;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }>, ...Readonly<{
+      userVerified: boolean;
+      phishingResistant: boolean;
+      minimumCredentials: number;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }>[]];
+  }>;
+}, PasswordUnavailable, never>;
+declare const snapshotPasswordPreparedReady: (input: {
+  readonly _tag: "Ready";
+  readonly moduleId: string;
+  readonly generation: number;
+  readonly intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+  readonly version: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedVersion">;
+  readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+  readonly action: "add-password" | "change-password" | "reset-password";
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly credential?: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+    readonly identifierVerifiedAtMillis?: number | undefined;
+    readonly moduleId: string;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly credentialId: string;
+    readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly identifier: LoginIdentifier;
+    readonly identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  } | undefined;
+  readonly capturedRequirement: {
+    readonly maximumAgeMillis: number;
+    readonly alternatives: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }[]];
+  };
+  readonly reset?: {
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly binding: {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    };
+  } | undefined;
+  readonly invalidation: {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  };
+  readonly createdAtMillis: number;
+  readonly preparationExpiresAtMillis: number;
+  readonly retainUntilMillis: number;
+  readonly replacement: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+  };
+  readonly challenge: {
+    readonly action: "add-password" | "change-password" | "reset-password";
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    readonly moduleId: string;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly targetCredentialId?: string | undefined;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  };
+  readonly baseEvidence?: {
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly proofs: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }[]];
+  } | undefined;
+  readonly digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly issuedAtMillis: number;
+  readonly expiresAtMillis: number;
+}) => Effect.Effect<{
+  _tag: "Ready";
+  moduleId: string;
+  generation: number;
+  intentId: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedIntentId">;
+  version: string & import("effect/Brand").Brand<"effect-auth/PasswordPreparedVersion">;
+  commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+  action: "add-password" | "change-password" | "reset-password";
+  credential?: Readonly<{
+    moduleId: string;
+    credentialId: string;
+    credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    normalization: "NFC" | "none";
+    identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    identifierVerifiedAtMillis?: number | undefined;
+    revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    identifier: Readonly<LoginIdentifier>;
+  }> | undefined;
+  reset?: {
+    readonly continuationId: string & import("effect/Brand").Brand<"effect-auth/ProofContinuationId">;
+    readonly binding: {
+      readonly _tag: "Identifier";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "Subject";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    } | {
+      readonly _tag: "IdentifierChange";
+      readonly flowId: string;
+      readonly contextDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly identifier: LoginIdentifier;
+    };
+  } | undefined;
+  invalidation: {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  };
+  createdAtMillis: number;
+  preparationExpiresAtMillis: number;
+  retainUntilMillis: number;
+  replacement: {
+    readonly verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+    readonly normalization: "NFC" | "none";
+  };
+  baseEvidence?: Readonly<{
+    flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    revision: Readonly<{
+      subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      credentials: readonly Readonly<{
+        credentialId: string;
+        revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }>[];
+    }>;
+    proofs: readonly [Readonly<{
+      method: string;
+      credentialId: string;
+      userVerified: boolean;
+      phishingResistant: boolean;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+      verifiedAt: DateTime.Utc;
+    }>, ...Readonly<{
+      method: string;
+      credentialId: string;
+      userVerified: boolean;
+      phishingResistant: boolean;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+      verifiedAt: DateTime.Utc;
+    }>[]];
+  }> | undefined;
+  digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  issuedAtMillis: number;
+  expiresAtMillis: number;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  challenge: {
+    action: "add-password" | "change-password" | "reset-password";
+    commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+    moduleId: string;
+    targetCredentialId?: string | undefined;
+    bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+  };
+  capturedRequirement: Readonly<{
+    maximumAgeMillis: number;
+    alternatives: readonly [Readonly<{
+      userVerified: boolean;
+      phishingResistant: boolean;
+      minimumCredentials: number;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }>, ...Readonly<{
+      userVerified: boolean;
+      phishingResistant: boolean;
+      minimumCredentials: number;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }>[]];
+  }>;
+}, PasswordUnavailable, never>;
+//#endregion
+export { PasswordPreparedConfiguration, PasswordPreparedContext, PasswordPreparedCredential, PasswordPreparedIntentId, PasswordPreparedReady, PasswordPreparedReadyJson, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordPreparedResult, PasswordPreparedVersion, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, validatePasswordPreparedConfiguration };
+//# sourceMappingURL=preparedModels.d.mts.map