@yielded/auth 0.1.0-beta.1

package/dist/sessions/contract.d.mts

@@ -0,0 +1,663 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthOperation } from "../operations/operation.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConflict, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "./errors.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import { Schema } from "effect";
+//#region src/sessions/contract.d.ts
+/** Canonical session contracts without installing session authority or strategy Layers. */
+declare const makeSessionContract: <const Id extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, claims: Claims) => Readonly<{
+  moduleId: Id;
+  Session: Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>;
+  CompletionResult: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>;
+  operations: {
+    Complete: AuthOperation<`${Id}/session/complete`, Schema.Struct<{
+      readonly evidence: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly evidence: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    CompletePending: AuthOperation<`${Id}/session/complete-pending`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly additional: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly additional: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RejectPending: AuthOperation<`${Id}/session/reject-pending`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      }>;
+      readonly success: Schema.TaggedStruct<"Rejected", {}>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "non-idempotent";
+    }>;
+    Capabilities: AuthOperation<`${Id}/session/capabilities`, Schema.Void, Schema.Struct<{
+      readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+      readonly listing: Schema.Boolean;
+      readonly perSessionRevocation: Schema.Boolean;
+      readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+      readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+      readonly positiveCacheMillis: Schema.Literal<0>;
+    }>, Schema.Never, never, {
+      readonly payload: Schema.Void;
+      readonly success: Schema.Struct<{
+        readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+        readonly listing: Schema.Boolean;
+        readonly perSessionRevocation: Schema.Boolean;
+        readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+        readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+        readonly positiveCacheMillis: Schema.Literal<0>;
+      }>;
+      readonly error: Schema.Never;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "read-only";
+    }>;
+    Verify: AuthOperation<`${Id}/session/verify`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly replay: "read-only";
+    }>;
+    Renew: AuthOperation<`${Id}/session/renew`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    SignOut: AuthOperation<`${Id}/session/sign-out`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.Struct<{
+      readonly clearCredential: Schema.Literal<true>;
+      readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+    }>, typeof SessionSignOutUnavailable]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.Struct<{
+        readonly clearCredential: Schema.Literal<true>;
+        readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+      }>, typeof SessionSignOutUnavailable]>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly replay: "idempotent";
+      readonly credentials: true;
+    }>;
+    List: AuthOperation<`${Id}/session/list`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly cursor: Schema.optionalKey<Schema.String>;
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly sessions: Schema.$Array<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+      readonly nextCursor: Schema.optionalKey<Schema.String>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly cursor: Schema.optionalKey<Schema.String>;
+        readonly limit: Schema.Int;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessions: Schema.$Array<Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+        readonly nextCursor: Schema.optionalKey<Schema.String>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "read-only";
+    }>;
+    Revoke: AuthOperation<`${Id}/session/revoke`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      }>;
+      readonly success: Schema.Void;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "idempotent";
+    }>;
+    RevokeAll: AuthOperation<`${Id}/session/revoke-all`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "non-idempotent";
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/capabilities`, Schema.Void, Schema.Struct<{
+    readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+    readonly listing: Schema.Boolean;
+    readonly perSessionRevocation: Schema.Boolean;
+    readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+    readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+    readonly positiveCacheMillis: Schema.Literal<0>;
+  }>, Schema.Union<readonly [Schema.Never, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/complete`, Schema.Struct<{
+    readonly evidence: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/complete-pending`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly additional: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/list`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly cursor: Schema.optionalKey<Schema.String>;
+    readonly limit: Schema.Int;
+  }>, Schema.Struct<{
+    readonly sessions: Schema.$Array<Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly nextCursor: Schema.optionalKey<Schema.String>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/reject-pending`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/renew`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/revoke`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+  }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/revoke-all`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/sign-out`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Union<readonly [Schema.Struct<{
+    readonly clearCredential: Schema.Literal<true>;
+    readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+  }>, typeof SessionSignOutUnavailable]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/verify`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  stepUpOperations: Readonly<{
+    Begin: AuthOperation<`${Id}/session/step-up/begin`, Schema.Struct<{
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+    }>, Schema.TaggedStruct<"StepUpPending", {
+      readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+      }>;
+      readonly exposure: "public";
+      readonly success: Schema.TaggedStruct<"StepUpPending", {
+        readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/session/step-up/complete`, Schema.Struct<{
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly additional: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly additional: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+      }>;
+      readonly exposure: "internal";
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Reject: AuthOperation<`${Id}/session/step-up/reject`, Schema.Struct<{
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly exposure: "internal";
+      readonly success: Schema.TaggedStruct<"Rejected", {}>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "non-idempotent";
+    }>;
+  }>;
+  stepUpGroup: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/step-up/begin`, Schema.Struct<{
+    readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+  }>, Schema.TaggedStruct<"StepUpPending", {
+    readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/step-up/complete`, Schema.Struct<{
+    readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly additional: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/step-up/reject`, Schema.Struct<{
+    readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+//#endregion
+export { makeSessionContract };
+//# sourceMappingURL=contract.d.mts.map