@yielded/auth 0.1.0-beta.1

package/dist/PasskeyContract.d.mts

@@ -0,0 +1,641 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "./operations/errors.mjs";
+import { AuthOperation } from "./operations/operation.mjs";
+import { LastSignInMethod } from "./identity/models.mjs";
+import { HookDenied } from "./hooks/models.mjs";
+import "./Operations.mjs";
+import "./Hooks.mjs";
+import "./Auth.mjs";
+import { PasskeyActionRequired, PasskeyMethodUnsupported, PasskeyRejected, PasskeyUnavailable } from "./passkey/errors.mjs";
+import "./Passkey.mjs";
+import { Schema } from "effect";
+//#region src/PasskeyContract.d.ts
+/** Canonical passkey contracts without a verifier, storage, or authority Layers. */
+declare const makePasskeyContract: <const Id extends string, Session extends Schema.Codec<unknown, unknown, unknown, unknown>, Completion extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, sessions: {
+  readonly Session: Session;
+  readonly CompletionResult: Completion;
+}) => Readonly<{
+  operations: {
+    Begin: AuthOperation<`${Id}/passkey/sign-in/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.Int;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        readonly allowCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rpId: Schema.String;
+          readonly timeout: Schema.Int;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          readonly allowCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/passkey/sign-in/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Completion, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Completion;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Cleanup: AuthOperation<`${Id}/passkey/cleanup`, Schema.Struct<{
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly terminalized: Schema.Natural;
+      readonly removed: Schema.Natural;
+      readonly hasMore: Schema.Boolean;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly limit: Schema.Int;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly terminalized: Schema.Natural;
+        readonly removed: Schema.Natural;
+        readonly hasMore: Schema.Boolean;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly access: "system";
+      readonly exposure: "internal";
+      readonly replay: "non-idempotent";
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/cleanup`, Schema.Struct<{
+    readonly limit: Schema.Int;
+  }>, Schema.Struct<{
+    readonly terminalized: Schema.Natural;
+    readonly removed: Schema.Natural;
+    readonly hasMore: Schema.Boolean;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/sign-in/begin`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+  }>, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly options: Schema.Struct<{
+      readonly challenge: Schema.String;
+      readonly rpId: Schema.String;
+      readonly timeout: Schema.Int;
+      readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+      readonly allowCredentials: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/sign-in/complete`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Completion, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+declare const makePasskeyRegistrationContract: <const Id extends string, Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, codec: Registration) => Readonly<{
+  BeginInput: Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+    readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+  }>;
+  RegistrationCodec: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+  operations: {
+    Begin: AuthOperation<`${Id}/passkey/registration/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rp: Schema.Struct<{
+          readonly id: Schema.String;
+          readonly name: Schema.NonEmptyString;
+        }>;
+        readonly user: Schema.Struct<{
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+          readonly name: Schema.NonEmptyString;
+          readonly displayName: Schema.NonEmptyString;
+        }>;
+        readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly alg: Schema.Literals<readonly [-7, -257]>;
+        }>>;
+        readonly timeout: Schema.Int;
+        readonly attestation: Schema.Literal<"none">;
+        readonly authenticatorSelection: Schema.Struct<{
+          readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        }>;
+        readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rp: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly name: Schema.NonEmptyString;
+          }>;
+          readonly user: Schema.Struct<{
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+            readonly name: Schema.NonEmptyString;
+            readonly displayName: Schema.NonEmptyString;
+          }>;
+          readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly alg: Schema.Literals<readonly [-7, -257]>;
+          }>>;
+          readonly timeout: Schema.Int;
+          readonly attestation: Schema.Literal<"none">;
+          readonly authenticatorSelection: Schema.Struct<{
+            readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          }>;
+          readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/passkey/registration/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+      readonly reference: Schema.String;
+    }>]>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+        readonly reference: Schema.String;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/registration/begin`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+    readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+  }>, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly options: Schema.Struct<{
+      readonly challenge: Schema.String;
+      readonly rp: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.NonEmptyString;
+      }>;
+      readonly user: Schema.Struct<{
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+        readonly name: Schema.NonEmptyString;
+        readonly displayName: Schema.NonEmptyString;
+      }>;
+      readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly alg: Schema.Literals<readonly [-7, -257]>;
+      }>>;
+      readonly timeout: Schema.Int;
+      readonly attestation: Schema.Literal<"none">;
+      readonly authenticatorSelection: Schema.Struct<{
+        readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+      }>;
+      readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/registration/complete`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+    readonly reference: Schema.String;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+declare const makePasskeyManagementContract: <const Id extends string>(moduleId: Id) => Readonly<{
+  BeginInput: Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+    readonly name: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>;
+  CompleteInput: Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>;
+  ListInput: Schema.Struct<{
+    readonly cursor: Schema.optionalKey<Schema.String>;
+    readonly limit: Schema.Int;
+  }>;
+  RenameInput: Schema.Struct<{
+    readonly commandId: Schema.String;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly name: Schema.NonEmptyString;
+  }>;
+  RemoveInput: Schema.Struct<{
+    readonly commandId: Schema.String;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>;
+  Failure: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>;
+  listResult: Schema.Struct<{
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly name: Schema.NonEmptyString;
+      readonly primarySignIn: Schema.Boolean;
+      readonly createdAtMillis: Schema.Int;
+      readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+    }>>;
+    readonly cursor: Schema.optionalKey<Schema.String>;
+  }>;
+  operations: {
+    Begin: AuthOperation<`${Id}/passkey/enrollment/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly name: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rp: Schema.Struct<{
+          readonly id: Schema.String;
+          readonly name: Schema.NonEmptyString;
+        }>;
+        readonly user: Schema.Struct<{
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+          readonly name: Schema.NonEmptyString;
+          readonly displayName: Schema.NonEmptyString;
+        }>;
+        readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly alg: Schema.Literals<readonly [-7, -257]>;
+        }>>;
+        readonly timeout: Schema.Int;
+        readonly attestation: Schema.Literal<"none">;
+        readonly authenticatorSelection: Schema.Struct<{
+          readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        }>;
+        readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly name: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rp: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly name: Schema.NonEmptyString;
+          }>;
+          readonly user: Schema.Struct<{
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+            readonly name: Schema.NonEmptyString;
+            readonly displayName: Schema.NonEmptyString;
+          }>;
+          readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly alg: Schema.Literals<readonly [-7, -257]>;
+          }>>;
+          readonly timeout: Schema.Int;
+          readonly attestation: Schema.Literal<"none">;
+          readonly authenticatorSelection: Schema.Struct<{
+            readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          }>;
+          readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/passkey/enrollment/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly credential: Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+        readonly primarySignIn: Schema.Boolean;
+        readonly createdAtMillis: Schema.Int;
+        readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+      }>;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly credential: Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+          readonly primarySignIn: Schema.Boolean;
+          readonly createdAtMillis: Schema.Int;
+          readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+        }>;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    List: AuthOperation<`${Id}/passkey/list`, Schema.Struct<{
+      readonly cursor: Schema.optionalKey<Schema.String>;
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+        readonly primarySignIn: Schema.Boolean;
+        readonly createdAtMillis: Schema.Int;
+        readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+      }>>;
+      readonly cursor: Schema.optionalKey<Schema.String>;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly cursor: Schema.optionalKey<Schema.String>;
+        readonly limit: Schema.Int;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+          readonly primarySignIn: Schema.Boolean;
+          readonly createdAtMillis: Schema.Int;
+          readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+        }>>;
+        readonly cursor: Schema.optionalKey<Schema.String>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "read-only";
+    }>;
+    Rename: AuthOperation<`${Id}/passkey/rename`, Schema.Struct<{
+      readonly commandId: Schema.String;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly name: Schema.NonEmptyString;
+    }>, Schema.Struct<{
+      readonly credential: Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+        readonly primarySignIn: Schema.Boolean;
+        readonly createdAtMillis: Schema.Int;
+        readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+      }>;
+      readonly replayed: Schema.Boolean;
+    }>, Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.String;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly name: Schema.NonEmptyString;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly credential: Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly name: Schema.NonEmptyString;
+          readonly primarySignIn: Schema.Boolean;
+          readonly createdAtMillis: Schema.Int;
+          readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+        }>;
+        readonly replayed: Schema.Boolean;
+      }>;
+      readonly error: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "idempotent";
+    }>;
+    Remove: AuthOperation<`${Id}/passkey/remove`, Schema.Struct<{
+      readonly commandId: Schema.String;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly replayed: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.String;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly replayed: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "idempotent";
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/enrollment/begin`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+    readonly name: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly options: Schema.Struct<{
+      readonly challenge: Schema.String;
+      readonly rp: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.NonEmptyString;
+      }>;
+      readonly user: Schema.Struct<{
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyUserHandle">;
+        readonly name: Schema.NonEmptyString;
+        readonly displayName: Schema.NonEmptyString;
+      }>;
+      readonly pubKeyCredParams: Schema.NonEmptyArray<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly alg: Schema.Literals<readonly [-7, -257]>;
+      }>>;
+      readonly timeout: Schema.Int;
+      readonly attestation: Schema.Literal<"none">;
+      readonly authenticatorSelection: Schema.Struct<{
+        readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+      }>;
+      readonly excludeCredentials: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/enrollment/complete`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly credential: Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly name: Schema.NonEmptyString;
+      readonly primarySignIn: Schema.Boolean;
+      readonly createdAtMillis: Schema.Int;
+      readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+    }>;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/list`, Schema.Struct<{
+    readonly cursor: Schema.optionalKey<Schema.String>;
+    readonly limit: Schema.Int;
+  }>, Schema.Struct<{
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly name: Schema.NonEmptyString;
+      readonly primarySignIn: Schema.Boolean;
+      readonly createdAtMillis: Schema.Int;
+      readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+    }>>;
+    readonly cursor: Schema.optionalKey<Schema.String>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/remove`, Schema.Struct<{
+    readonly commandId: Schema.String;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly credentialId: Schema.NonEmptyString;
+    readonly replayed: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, typeof LastSignInMethod]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/rename`, Schema.Struct<{
+    readonly commandId: Schema.String;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly name: Schema.NonEmptyString;
+  }>, Schema.Struct<{
+    readonly credential: Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly name: Schema.NonEmptyString;
+      readonly primarySignIn: Schema.Boolean;
+      readonly createdAtMillis: Schema.Int;
+      readonly lastUsedAtMillis: Schema.optionalKey<Schema.Int>;
+    }>;
+    readonly replayed: Schema.Boolean;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+//#endregion
+export { makePasskeyContract, makePasskeyManagementContract, makePasskeyRegistrationContract };
+//# sourceMappingURL=PasskeyContract.d.mts.map