@yielded/auth 0.1.0-beta.1

package/dist/totp/module.d.mts

@@ -0,0 +1,737 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { AuthInvocation, AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthOperationResult } from "../operations/credentials.mjs";
+import { AuthOperation, OperationHandler } from "../operations/operation.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import "../Operations.mjs";
+import "../Hooks.mjs";
+import { SessionApiError } from "../auth/session.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "../auth/AuthConfigurationError.mjs";
+import "../Auth.mjs";
+import { ModuleService, makeSessionModule } from "../sessions/module.mjs";
+import { TotpPolicy } from "./models.mjs";
+import { TotpActionRequired, TotpConfigurationError, TotpRejected, TotpUnavailable } from "./errors.mjs";
+import { TotpPersistence } from "./TotpPersistence.mjs";
+import { TotpActionEvidence } from "./TotpActionEvidence.mjs";
+import { TotpSecretKeys } from "./TotpSecretKeys.mjs";
+import { Context, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/totp/module.d.ts
+declare const makeTotpModule: <const Id extends string, const SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, options: TotpPolicy, sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>) => Readonly<{
+  Totp: Context.Service<{
+    readonly moduleId: Id;
+    readonly kind: "totp";
+  }, {
+    beginEnrollment: (invocation: AuthInvocation, original: {
+      readonly commandId: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+      readonly accountName: string;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly enrollmentId: string;
+      readonly expiresAtMillis: number;
+    }>, HookDenied | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable, never>;
+    confirmEnrollment: (invocation: AuthInvocation, original: {
+      readonly commandId: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+      readonly enrollmentId: string;
+      readonly code: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly enabled: boolean;
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }>, HookDenied | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable, never>;
+    disable: (invocation: AuthInvocation, original: {
+      readonly commandId: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }) => Effect.Effect<{
+      enabled: boolean;
+      invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, HookDenied | TotpActionRequired | TotpRejected | TotpUnavailable, never>;
+    regenerateRecoveryCodes: (invocation: AuthInvocation, original: {
+      readonly commandId: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly enabled: boolean;
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }>, HookDenied | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable, never>;
+    verifyPending: (invocation: AuthInvocation, original: {
+      readonly pendingCredential: Redacted.Redacted<string>;
+      readonly code: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    }>, HookDenied | TotpRejected | TotpUnavailable, never>;
+    verifyStepUp: (invocation: AuthInvocation, original: {
+      readonly stepUpCredential: Redacted.Redacted<string>;
+      readonly sourceCredential: Redacted.Redacted<string>;
+      readonly code: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    }>, HookDenied | TotpRejected | TotpUnavailable, never>;
+    recoverPending: (invocation: AuthInvocation, original: {
+      readonly pendingCredential: Redacted.Redacted<string>;
+      readonly code: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    }>, HookDenied | TotpRejected | TotpUnavailable, never>;
+    recoverLostFactor: (invocation: AuthInvocation, original: {
+      readonly pendingCredential: Redacted.Redacted<string>;
+      readonly code: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly outcome: "reauthentication-required";
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }>, HookDenied | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable, never>;
+  }>;
+  layer: Layer.Layer<{
+    readonly moduleId: Id;
+    readonly kind: "totp";
+  }, TotpConfigurationError, AuthenticationAuthority | LifecycleHooks | ModuleService<SessionId, "completion", Claims["Type"]> | ModuleService<SessionId, "step-up", Claims["Type"]> | ModuleService<SessionId, "strategy", Claims["Type"]> | TotpActionEvidence | TotpPersistence | TotpSecretKeys>;
+  handlersLayer: Layer.Layer<OperationHandler<`${Id}/totp/confirm`, {
+    readonly commandId: string;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+    readonly enrollmentId: string;
+    readonly code: Redacted.Redacted<string>;
+  }, {
+    readonly enabled: boolean;
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/disable`, {
+    readonly commandId: string;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+  }, {
+    readonly enabled: boolean;
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/enroll`, {
+    readonly commandId: string;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+    readonly accountName: string;
+  }, {
+    readonly enrollmentId: string;
+    readonly expiresAtMillis: number;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/pending`, {
+    readonly pendingCredential: Redacted.Redacted<string>;
+    readonly code: Redacted.Redacted<string>;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: DateTime.Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/recovery/pending`, {
+    readonly pendingCredential: Redacted.Redacted<string>;
+    readonly code: Redacted.Redacted<string>;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: DateTime.Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/recovery/regenerate`, {
+    readonly commandId: string;
+    readonly actionProof?: Redacted.Redacted<string> | undefined;
+  }, {
+    readonly enabled: boolean;
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/recovery/reset`, {
+    readonly pendingCredential: Redacted.Redacted<string>;
+    readonly code: Redacted.Redacted<string>;
+  }, {
+    readonly outcome: "reauthentication-required";
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable> | OperationHandler<`${Id}/totp/step-up`, {
+    readonly stepUpCredential: Redacted.Redacted<string>;
+    readonly sourceCredential: Redacted.Redacted<string>;
+    readonly code: Redacted.Redacted<string>;
+  }, {
+    readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly assurance: AuthenticationAssurance;
+    readonly issuedAt: DateTime.Utc;
+    readonly expiresAt: DateTime.Utc;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly claims: Claims["Type"];
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable>, never, {
+    readonly moduleId: Id;
+    readonly kind: "totp";
+  }>;
+  operations: {
+    Begin: AuthOperation<`${Id}/totp/enroll`, Schema.Struct<{
+      readonly commandId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      readonly accountName: Schema.NonEmptyString;
+    }>, Schema.Struct<{
+      readonly enrollmentId: Schema.NonEmptyString;
+      readonly expiresAtMillis: Schema.Natural;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        readonly accountName: Schema.NonEmptyString;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enrollmentId: Schema.NonEmptyString;
+        readonly expiresAtMillis: Schema.Natural;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+      readonly reveals: readonly ["totp-enrollment"];
+    }>;
+    Confirm: AuthOperation<`${Id}/totp/confirm`, Schema.Struct<{
+      readonly commandId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      readonly enrollmentId: Schema.NonEmptyString;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly enabled: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        readonly enrollmentId: Schema.NonEmptyString;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enabled: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+      readonly reveals: readonly ["recovery-codes"];
+    }>;
+    Disable: AuthOperation<`${Id}/totp/disable`, Schema.Struct<{
+      commandId: Schema.NonEmptyString;
+      actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly enabled: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        commandId: Schema.NonEmptyString;
+        actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enabled: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+    }>;
+    Regenerate: AuthOperation<`${Id}/totp/recovery/regenerate`, Schema.Struct<{
+      commandId: Schema.NonEmptyString;
+      actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly enabled: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        commandId: Schema.NonEmptyString;
+        actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enabled: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+      readonly reveals: readonly ["recovery-codes"];
+    }>;
+    VerifyPending: AuthOperation<`${Id}/totp/pending`, Schema.Struct<{
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    VerifyStepUp: AuthOperation<`${Id}/totp/step-up`, Schema.Struct<{
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RecoverPending: AuthOperation<`${Id}/totp/recovery/pending`, Schema.Struct<{
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RecoverLostFactor: AuthOperation<`${Id}/totp/recovery/reset`, Schema.Struct<{
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly outcome: Schema.Literal<"reauthentication-required">;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly outcome: Schema.Literal<"reauthentication-required">;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/confirm`, Schema.Struct<{
+    readonly commandId: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    readonly enrollmentId: Schema.NonEmptyString;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly enabled: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/disable`, Schema.Struct<{
+    commandId: Schema.NonEmptyString;
+    actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly enabled: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/enroll`, Schema.Struct<{
+    readonly commandId: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    readonly accountName: Schema.NonEmptyString;
+  }>, Schema.Struct<{
+    readonly enrollmentId: Schema.NonEmptyString;
+    readonly expiresAtMillis: Schema.Natural;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/pending`, Schema.Struct<{
+    readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/recovery/pending`, Schema.Struct<{
+    readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/recovery/regenerate`, Schema.Struct<{
+    commandId: Schema.NonEmptyString;
+    actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly enabled: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/recovery/reset`, Schema.Struct<{
+    readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly outcome: Schema.Literal<"reauthentication-required">;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/step-up`, Schema.Struct<{
+    readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly assurance: typeof AuthenticationAssurance;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+    readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  strategy: Readonly<{
+    completion: boolean;
+    make: Effect.Effect<{
+      readonly beginEnrollment: (input: {
+        readonly commandId: string;
+        readonly actionProof?: string | undefined;
+        readonly accountName: string;
+      }) => Effect.Effect<{
+        readonly enrollmentId: string;
+        readonly expiresAtMillis: number;
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly confirmEnrollment: (input: {
+        readonly commandId: string;
+        readonly actionProof?: string | undefined;
+        readonly enrollmentId: string;
+        readonly code: string;
+      }) => Effect.Effect<{
+        readonly enabled: boolean;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly disable: (input: {
+        readonly commandId: string;
+        readonly actionProof?: string | undefined;
+      }) => Effect.Effect<{
+        readonly enabled: boolean;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly regenerateRecoveryCodes: (input: {
+        readonly commandId: string;
+        readonly actionProof?: string | undefined;
+      }) => Effect.Effect<{
+        readonly enabled: boolean;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly verifyPending: (input: {
+        readonly pendingCredential: string;
+        readonly code: string;
+      }) => Effect.Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: DateTime.Utc;
+          readonly expiresAt: DateTime.Utc;
+          readonly absoluteExpiresAt: DateTime.Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: DateTime.Utc;
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly verifyStepUp: (input: {
+        readonly stepUpCredential: string;
+        readonly sourceCredential: string;
+        readonly code: string;
+      }) => Effect.Effect<{
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly recoverPending: (input: {
+        readonly pendingCredential: string;
+        readonly code: string;
+      }) => Effect.Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: DateTime.Utc;
+          readonly expiresAt: DateTime.Utc;
+          readonly absoluteExpiresAt: DateTime.Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: DateTime.Utc;
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+      readonly recoverLostFactor: (input: {
+        readonly pendingCredential: string;
+        readonly code: string;
+      }) => Effect.Effect<{
+        readonly outcome: "reauthentication-required";
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }, TotpActionRequired | TotpConfigurationError | TotpRejected | TotpUnavailable | SessionApiError, AuthRequest>;
+    }, AuthConfigurationError | TotpConfigurationError, AuthenticationAuthority | Layer.CurrentMemoMap | LifecycleHooks | ModuleService<SessionId, "completion", Claims["Type"]> | ModuleService<SessionId, "step-up", Claims["Type"]> | ModuleService<SessionId, "strategy", Claims["Type"]> | import("effect/Scope").Scope | TotpActionEvidence | TotpPersistence | TotpSecretKeys>;
+  }>;
+}>;
+//#endregion
+export { makeTotpModule };
+//# sourceMappingURL=module.d.mts.map