@yielded/auth 0.1.0-beta.1

package/dist/sessions/module.d.mts

@@ -0,0 +1,1091 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { AssuranceRequirement, AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthOperationResult } from "../operations/credentials.mjs";
+import { AuthOperation, OperationHandler } from "../operations/operation.mjs";
+import { AuthenticationEvidence, PendingConsumption, SessionCapabilities, SessionId, SessionInspection } from "./models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConfigurationError, SessionConflict, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "./errors.mjs";
+import { AuthenticationAuthority } from "./AuthenticationAuthority.mjs";
+import { PendingAuthentication, PendingAuthenticationContext } from "./PendingAuthentication.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { SessionSigningKeyring } from "./crypto.mjs";
+import "../Operations.mjs";
+import { SessionPolicy } from "./policy.mjs";
+import { SessionRepository, SignedSessionValidity, StatefulSessionPersistence } from "./persistence.mjs";
+import { SessionStepUpPersistence, SessionStepUpProfile, SessionStepUpProfileId, SessionStepUpSource } from "./SessionStepUpPersistence.mjs";
+import "../Auth.mjs";
+import { Context, Crypto, DateTime, Effect, Layer, Redacted, Schema, Scope, Types } from "effect";
+//#region src/sessions/module.d.ts
+interface ModuleService<Id extends string, Kind extends string, Claims> {
+  readonly moduleId: Id;
+  readonly kind: Kind;
+  readonly claims: Types.Invariant<Claims>;
+}
+/** Stable module IDs isolate service keys and signed/digested credential namespaces. */
+type CompletionLayer<Id extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>, R = never> = Layer.Layer<ModuleService<Id, "completion", Claims["Type"]>, SessionConfigurationError, ModuleService<Id, "strategy", Claims["Type"]> | Crypto.Crypto | AuthenticationAuthority | Exclude<Claims["DecodingServices"], Scope.Scope> | Exclude<Claims["EncodingServices"], Scope.Scope> | Exclude<R, Scope.Scope>>;
+declare const makeSessionModule: <const Id extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, claims: Claims) => Readonly<{
+  moduleId: Id;
+  claims: Claims;
+  /** Stateful sessions and authentication completion with portable defaults. */
+  layer: (policy: SessionPolicy) => Layer.Layer<ModuleService<Id, "completion", Claims["Type"]> | ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>, SessionConfigurationError, AuthenticationAuthority | ModuleService<Id, "persistence", Claims["Type"]> | ModuleService<Id, "repository", Claims["Type"]> | Exclude<Exclude<Claims["DecodingServices"], Scope.Scope>, Crypto.Crypto | LifecycleHooks | SubtleCrypto> | Exclude<Exclude<Claims["EncodingServices"], Scope.Scope>, Crypto.Crypto | LifecycleHooks | SubtleCrypto> | Exclude<Exclude<Exclude<Claims["DecodingServices"], Scope.Scope>, ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>>, Crypto.Crypto | LifecycleHooks | SubtleCrypto> | Exclude<Exclude<Exclude<Claims["EncodingServices"], Scope.Scope>, ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>>, Crypto.Crypto | LifecycleHooks | SubtleCrypto>>;
+  Session: Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>;
+  CompletionResult: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>;
+  SessionStrategy: Context.Service<ModuleService<Id, "strategy", Claims["Type"]>, {
+    readonly policy: SessionPolicy;
+    readonly capabilities: SessionCapabilities;
+    /** @effect-expect-leaking AuthenticationAuthority -- fresh issuance alone needs identity authority; verification does not. */
+    readonly prepareEstablish: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly claims: Claims["Type"];
+      readonly pending?: PendingConsumption;
+    }) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication, AuthenticationAuthority>;
+    /** Trusted method-only authentication source. Never expose through a public RPC. */
+    readonly inspectForStepUp: (credential: Redacted.Redacted<string>) => Effect.Effect<SessionStepUpSource<Claims["Type"]>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly inspect: (credential: Redacted.Redacted<string>) => Effect.Effect<SessionInspection<Claims["Type"]>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly verify: (credential: Redacted.Redacted<string>) => Effect.Effect<{
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly prepareRenew: (credential: Redacted.Redacted<string>) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication, never>;
+    readonly signOut: (credential: Redacted.Redacted<string>) => Effect.Effect<AuthOperationResult<SessionSignOutUnavailable | {
+      readonly clearCredential: true;
+      readonly invalidation: "already-invalid" | "client-only" | "revoked";
+    }>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly list: (input: Parameters<SessionRepository["list"]>[0]) => Effect.Effect<Effect.Success<ReturnType<SessionRepository["list"]>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly revoke: (session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }, sessionId: SessionId) => Effect.Effect<void, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly revokeAll: (session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }) => Effect.Effect<void, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+  }>;
+  SessionStepUp: Context.Service<ModuleService<Id, "step-up", Claims["Type"]>, {
+    readonly prepareBegin: (input: {
+      readonly sourceCredential: Redacted.Redacted<string>;
+      readonly profileId: SessionStepUpProfileId;
+    }) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+      readonly _tag: "StepUpPending";
+      readonly profileId: string & import("effect/Brand").Brand<"effect-auth/SessionStepUpProfileId">;
+      readonly expiresAt: DateTime.Utc;
+    }>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication, never>;
+    readonly context: (credential: Redacted.Redacted<string>) => Effect.Effect<PendingAuthenticationContext, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly rejectCredential: (credential: Redacted.Redacted<string>) => Effect.Effect<PreparedCommit<{
+      readonly _tag: "Rejected";
+    }>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    readonly prepareComplete: (input: {
+      readonly sourceCredential: Redacted.Redacted<string>;
+      readonly stepUpCredential: Redacted.Redacted<string>;
+      readonly additional: AuthenticationEvidence;
+    }) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication, never>;
+  }>;
+  SessionStepUpPersistence: Context.Service<ModuleService<Id, "step-up-persistence", Claims["Type"]>, SessionStepUpPersistence<Claims["Type"]>>;
+  stepUpLayer: (configured: ReadonlyArray<SessionStepUpProfile>) => Layer.Layer<ModuleService<Id, "step-up", Claims["Type"]>, SessionConfigurationError | SessionUnavailable, AuthenticationAuthority | Crypto.Crypto | LifecycleHooks | ModuleService<Id, "step-up-persistence", Claims["Type"]> | ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>>;
+  stepUpHandlersLayer: Layer.Layer<OperationHandler<`${Id}/session/step-up/begin`, {
+    readonly sourceCredential: Redacted.Redacted<string>;
+    readonly profileId: string & import("effect/Brand").Brand<"effect-auth/SessionStepUpProfileId">;
+  }, {
+    readonly _tag: "StepUpPending";
+    readonly profileId: string & import("effect/Brand").Brand<"effect-auth/SessionStepUpProfileId">;
+    readonly expiresAt: DateTime.Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/step-up/complete`, {
+    readonly sourceCredential: Redacted.Redacted<string>;
+    readonly stepUpCredential: Redacted.Redacted<string>;
+    readonly additional: {
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly proofs: readonly [{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: DateTime.Utc;
+      }, ...{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: DateTime.Utc;
+      }[]];
+    };
+  }, {
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly assurance: AuthenticationAssurance;
+    readonly issuedAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly claims: Claims["Type"];
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/step-up/reject`, {
+    readonly stepUpCredential: Redacted.Redacted<string>;
+  }, {
+    readonly _tag: "Rejected";
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>, never, ModuleService<Id, "step-up", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>>;
+  stepUpOperations: Readonly<{
+    Begin: AuthOperation<`${Id}/session/step-up/begin`, Schema.Struct<{
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+    }>, Schema.TaggedStruct<"StepUpPending", {
+      readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+      }>;
+      readonly exposure: "public";
+      readonly success: Schema.TaggedStruct<"StepUpPending", {
+        readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/session/step-up/complete`, Schema.Struct<{
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly additional: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly additional: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+      }>;
+      readonly exposure: "internal";
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Reject: AuthOperation<`${Id}/session/step-up/reject`, Schema.Struct<{
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly exposure: "internal";
+      readonly success: Schema.TaggedStruct<"Rejected", {}>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "non-idempotent";
+    }>;
+  }>;
+  stepUpGroup: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/step-up/begin`, Schema.Struct<{
+    readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+  }>, Schema.TaggedStruct<"StepUpPending", {
+    readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/step-up/complete`, Schema.Struct<{
+    readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly additional: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/step-up/reject`, Schema.Struct<{
+    readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  AuthenticationCompletion: Context.Service<ModuleService<Id, "completion", Claims["Type"]>, {
+    readonly prepare: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly claims: Claims["Type"];
+      readonly pending?: PendingConsumption;
+    }) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    }>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication, never>;
+    /** Internal-only lookup authenticated by the private pending bearer. No claims
+     * or normal session authority; final preparePending still rechecks/consumes. */
+    readonly pendingContext: (credential: Redacted.Redacted<string>) => Effect.Effect<PendingAuthenticationContext, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    /** Charge a rejected additional factor without caller-supplied binding data.
+     * Read the returned receipt before reporting the rejection to its caller. */
+    readonly rejectPendingCredential: (credential: Redacted.Redacted<string>) => Effect.Effect<PreparedCommit<{
+      readonly _tag: "Rejected";
+    }>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+    /** Only method implementations call this after independently verifying the next proof. */
+    readonly preparePending: (input: {
+      readonly credential: Redacted.Redacted<string>;
+      readonly additional: AuthenticationEvidence;
+    }) => Effect.Effect<PreparedCommit<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    }>>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication, never>;
+    readonly rejectPending: (input: {
+      readonly credential: Redacted.Redacted<string>;
+      readonly bindingDigest: TokenDigest;
+    }) => Effect.Effect<PreparedCommit<{
+      readonly _tag: "Rejected";
+    }>, HookDenied | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>;
+  }>;
+  StatefulSessionPersistence: Context.Service<ModuleService<Id, "persistence", Claims["Type"]>, StatefulSessionPersistence<Claims["Type"]>>;
+  SessionRepository: Context.Service<ModuleService<Id, "repository", Claims["Type"]>, SessionRepository>;
+  SignedSessionValidity: Context.Service<ModuleService<Id, "validity", Claims["Type"]>, SignedSessionValidity>;
+  PendingAuthentication: Context.Service<ModuleService<Id, "pending", Claims["Type"]>, PendingAuthentication<Claims["Type"]>>;
+  statefulLayer: (configured: SessionPolicy) => Layer.Layer<ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>, SessionConfigurationError, Crypto.Crypto | LifecycleHooks | ModuleService<Id, "persistence", Claims["Type"]> | ModuleService<Id, "repository", Claims["Type"]> | Exclude<Claims["DecodingServices"], Scope.Scope> | Exclude<Claims["EncodingServices"], Scope.Scope>>;
+  statelessLayer: (policy: SessionPolicy, keyring: SessionSigningKeyring) => Layer.Layer<ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>, SessionConfigurationError, Crypto.Crypto | LifecycleHooks | SubtleCrypto | Exclude<Exclude<Claims["DecodingServices"], Scope.Scope>, ModuleService<Id, "validity", Claims["Type"]>> | Exclude<Exclude<Claims["EncodingServices"], Scope.Scope>, ModuleService<Id, "validity", Claims["Type"]>>>;
+  stateAssistedLayer: (policy: SessionPolicy, keyring: SessionSigningKeyring) => Layer.Layer<ModuleService<Id, "step-up-planner", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>, SessionConfigurationError, Crypto.Crypto | LifecycleHooks | ModuleService<Id, "validity", Claims["Type"]> | SubtleCrypto | Exclude<Exclude<Claims["DecodingServices"], Scope.Scope>, ModuleService<Id, "validity", Claims["Type"]>> | Exclude<Exclude<Claims["EncodingServices"], Scope.Scope>, ModuleService<Id, "validity", Claims["Type"]>>>;
+  completionLayer: {
+    (): CompletionLayer<Id, Claims>;
+    (configuration: {
+      readonly pendingLifetimeMillis: number;
+      readonly attemptLimit: number;
+    }): CompletionLayer<Id, Claims, ModuleService<Id, "pending", Claims["Type"]>>;
+  };
+  capabilitiesHandlerLayer: Layer.Layer<OperationHandler<`${Id}/session/capabilities`, void, {
+    readonly mode: "state-assisted" | "stateful" | "stateless";
+    readonly listing: boolean;
+    readonly perSessionRevocation: boolean;
+    readonly subjectInvalidation: "absolute-expiry" | "immediate";
+    readonly renewal: "replayable" | "single-winner";
+    readonly positiveCacheMillis: 0;
+  }, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported>, never, ModuleService<Id, "strategy", Claims["Type"]>>;
+  sessionHandlersLayer: Layer.Layer<OperationHandler<`${Id}/session/renew`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, {
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly assurance: AuthenticationAssurance;
+    readonly issuedAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly claims: Claims["Type"];
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/sign-out`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, SessionSignOutUnavailable | {
+    readonly clearCredential: true;
+    readonly invalidation: "already-invalid" | "client-only" | "revoked";
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/verify`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, {
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly assurance: AuthenticationAssurance;
+    readonly issuedAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly claims: Claims["Type"];
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>, never, ModuleService<Id, "strategy", Claims["Type"]>>;
+  handlersLayer: (management: AssuranceRequirement) => Layer.Layer<OperationHandler<`${Id}/session/capabilities`, void, {
+    readonly mode: "state-assisted" | "stateful" | "stateless";
+    readonly listing: boolean;
+    readonly perSessionRevocation: boolean;
+    readonly subjectInvalidation: "absolute-expiry" | "immediate";
+    readonly renewal: "replayable" | "single-winner";
+    readonly positiveCacheMillis: 0;
+  }, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/session/complete`, {
+    readonly evidence: {
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly proofs: readonly [{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: DateTime.Utc;
+      }, ...{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: DateTime.Utc;
+      }[]];
+    };
+    readonly claims: Claims["Type"];
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: DateTime.Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/complete-pending`, {
+    readonly credential: Redacted.Redacted<string>;
+    readonly additional: {
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly proofs: readonly [{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: DateTime.Utc;
+      }, ...{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: DateTime.Utc;
+      }[]];
+    };
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: DateTime.Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/list`, {
+    readonly credential: Redacted.Redacted<string>;
+    readonly cursor?: string | undefined;
+    readonly limit: number;
+  }, {
+    readonly sessions: readonly {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+    }[];
+    readonly nextCursor?: string | undefined;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/reject-pending`, {
+    readonly credential: Redacted.Redacted<string>;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  }, {
+    readonly _tag: "Rejected";
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/renew`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, {
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly assurance: AuthenticationAssurance;
+    readonly issuedAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly claims: Claims["Type"];
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/revoke`, {
+    readonly credential: Redacted.Redacted<string>;
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+  }, void, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/revoke-all`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, {
+    readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+    readonly existingSessions: "immediate" | "original-absolute-expiry";
+    readonly maximumExposureMillis: number;
+    readonly oldAuthenticationEvidence: "rejected";
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/sign-out`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, SessionSignOutUnavailable | {
+    readonly clearCredential: true;
+    readonly invalidation: "already-invalid" | "client-only" | "revoked";
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication> | OperationHandler<`${Id}/session/verify`, {
+    readonly credential: Redacted.Redacted<string>;
+  }, {
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly assurance: AuthenticationAssurance;
+    readonly issuedAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly claims: Claims["Type"];
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PendingAuthenticationInvalid | SessionCapabilityUnsupported | SessionConflict | SessionInvalid | SessionRenewalTooEarly | SessionSignOutUnavailable | SessionStepUpInvalid | SessionUnavailable | StaleAuthentication>, never, ModuleService<Id, "completion", Claims["Type"]> | ModuleService<Id, "strategy", Claims["Type"]>>;
+  operations: {
+    Complete: AuthOperation<`${Id}/session/complete`, Schema.Struct<{
+      readonly evidence: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly evidence: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    CompletePending: AuthOperation<`${Id}/session/complete-pending`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly additional: Schema.Struct<{
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+          readonly method: Schema.NonEmptyString;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+          readonly userVerified: Schema.Boolean;
+          readonly phishingResistant: Schema.Boolean;
+          readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly additional: Schema.Struct<{
+          readonly revision: Schema.Struct<{
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly credentials: Schema.$Array<Schema.Struct<{
+              readonly credentialId: Schema.NonEmptyString;
+              readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            }>>;
+          }>;
+          readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+          readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+            readonly method: Schema.NonEmptyString;
+            readonly credentialId: Schema.NonEmptyString;
+            readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+            readonly userVerified: Schema.Boolean;
+            readonly phishingResistant: Schema.Boolean;
+            readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+          }>>;
+        }>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RejectPending: AuthOperation<`${Id}/session/reject-pending`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      }>;
+      readonly success: Schema.TaggedStruct<"Rejected", {}>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "system";
+      readonly replay: "non-idempotent";
+    }>;
+    Capabilities: AuthOperation<`${Id}/session/capabilities`, Schema.Void, Schema.Struct<{
+      readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+      readonly listing: Schema.Boolean;
+      readonly perSessionRevocation: Schema.Boolean;
+      readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+      readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+      readonly positiveCacheMillis: Schema.Literal<0>;
+    }>, Schema.Never, never, {
+      readonly payload: Schema.Void;
+      readonly success: Schema.Struct<{
+        readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+        readonly listing: Schema.Boolean;
+        readonly perSessionRevocation: Schema.Boolean;
+        readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+        readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+        readonly positiveCacheMillis: Schema.Literal<0>;
+      }>;
+      readonly error: Schema.Never;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "read-only";
+    }>;
+    Verify: AuthOperation<`${Id}/session/verify`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly replay: "read-only";
+    }>;
+    Renew: AuthOperation<`${Id}/session/renew`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    SignOut: AuthOperation<`${Id}/session/sign-out`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.Struct<{
+      readonly clearCredential: Schema.Literal<true>;
+      readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+    }>, typeof SessionSignOutUnavailable]>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.Struct<{
+        readonly clearCredential: Schema.Literal<true>;
+        readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+      }>, typeof SessionSignOutUnavailable]>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "any";
+      readonly replay: "idempotent";
+      readonly credentials: true;
+    }>;
+    List: AuthOperation<`${Id}/session/list`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly cursor: Schema.optionalKey<Schema.String>;
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly sessions: Schema.$Array<Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+      readonly nextCursor: Schema.optionalKey<Schema.String>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly cursor: Schema.optionalKey<Schema.String>;
+        readonly limit: Schema.Int;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessions: Schema.$Array<Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        }>>;
+        readonly nextCursor: Schema.optionalKey<Schema.String>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "read-only";
+    }>;
+    Revoke: AuthOperation<`${Id}/session/revoke`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      }>;
+      readonly success: Schema.Void;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "idempotent";
+    }>;
+    RevokeAll: AuthOperation<`${Id}/session/revoke-all`, Schema.Struct<{
+      readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>;
+      readonly access: "authenticated";
+      readonly replay: "non-idempotent";
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/capabilities`, Schema.Void, Schema.Struct<{
+    readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+    readonly listing: Schema.Boolean;
+    readonly perSessionRevocation: Schema.Boolean;
+    readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+    readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+    readonly positiveCacheMillis: Schema.Literal<0>;
+  }>, Schema.Union<readonly [Schema.Never, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/complete`, Schema.Struct<{
+    readonly evidence: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/complete-pending`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly additional: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/list`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly cursor: Schema.optionalKey<Schema.String>;
+    readonly limit: Schema.Int;
+  }>, Schema.Struct<{
+    readonly sessions: Schema.$Array<Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly nextCursor: Schema.optionalKey<Schema.String>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/reject-pending`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>, Schema.TaggedStruct<"Rejected", {}>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/renew`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/revoke`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+  }>, Schema.Void, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/revoke-all`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/sign-out`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Union<readonly [Schema.Struct<{
+    readonly clearCredential: Schema.Literal<true>;
+    readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+  }>, typeof SessionSignOutUnavailable]>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/session/verify`, Schema.Struct<{
+    readonly credential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+//#endregion
+export { CompletionLayer, ModuleService, makeSessionModule };
+//# sourceMappingURL=module.d.mts.map