@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/SqliteNode.d.mts

@@ -1,26 +1,25 @@
-import { DrizzleTableModel } from "./drizzle/table-model.mjs";
 import { EmailAddressMapping, EmailRegistrationMapping, EmailSignInMapping } from "./drizzle/email-model.mjs";
-import { PasswordRegistrationMapping } from "./drizzle/password-model.mjs";
-import { ExternalIdentityTables, IdentityTables, SubjectProvisioningTables } from "./drizzle/model.mjs";
+import { PasswordPersistenceMapping, PasswordRegistrationMapping } from "./drizzle/password-model.mjs";
 import { ProofPersistenceMapping } from "./drizzle/proof-model.mjs";
-import { PasswordPreparedPersistenceMapping, PasswordPreparedProofMapping } from "./drizzle/password-prepared-model.mjs";
-import { AuthenticationAuthorityMapping, PendingAuthenticationMapping, SignedSessionValidityMapping, StatefulSessionMapping } from "./drizzle/session-model.mjs";
-import { PasskeyCredentialMapping, PasskeyEnrollmentContextMapping, PasskeyPersistenceMapping } from "./drizzle/passkey-model.mjs";
+import { ExternalIdentityTables, IdentityTables, SubjectProvisioningTables } from "./drizzle/model.mjs";
+import { AuthenticationAuthorityMapping, PendingAuthenticationMapping, SessionCleanupMapping, SignedSessionValidityMapping, StatefulSessionMapping } from "./drizzle/session-model.mjs";
+import { PasskeyCredentialMapping, PasskeyPersistenceMapping } from "./drizzle/passkey-model.mjs";
 import { SessionStepUpMapping } from "./drizzle/step-up-model.mjs";
 import { OAuthAccountsMapping, OAuthRegistrationIntentMapping, OAuthRegistrationMapping, OAuthSignInMapping } from "./drizzle/oauth-model.mjs";
 import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "./drizzle/oauth-connected-model.mjs";
 import { PasskeyRegistrationCeremonyMapping } from "./drizzle/passkey-registration-ceremony-model.mjs";
-import { EmailRegistrationAuthority } from "./drizzle/email-registration.mjs";
-import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
-import { TotpMapping, TotpMappingSource, TotpPersistenceServices } from "./drizzle/totp-model.mjs";
+import { NativeDatabase } from "./drizzle/native-database.mjs";
+import { D1BatchStatements } from "./drizzle/D1BatchStatements.mjs";
+import { OAuthCoordinatorError } from "./drizzle/oauth-target.mjs";
+import { TotpMapping } from "./drizzle/totp-model.mjs";
 import { PasskeyManagementMapping, PasskeyRegistrationMapping } from "./drizzle/passkey-write-model.mjs";
-import { PhoneMapping, PhoneMappingSource, PhonePersistenceServices } from "./drizzle/phone-model.mjs";
+import { PasskeyCoordinatorError } from "./drizzle/passkey/target.mjs";
+import { PhoneMapping } from "./drizzle/phone-model.mjs";
 import "./index.mjs";
-import { OAuthProxyPersistence } from "./internal/drizzle-sqlite-oauth-proxy.mjs";
+import { NativeDriverTransaction } from "./drizzle/driver-types.mjs";
 import { SuppliedService } from "./drizzle/SuppliedService.mjs";
-import { TotpCoordinatorError } from "./drizzle/totp-target.mjs";
-import { PhoneCoordinatorError } from "./drizzle/phone-target.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { OAuthProxyPersistence } from "./internal/drizzle-sqlite-oauth-proxy.mjs";
+import "./D1.mjs";
 import { Context, Effect, Layer } from "effect";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { EffectSQLiteNodeDatabase } from "drizzle-orm/effect-sqlite-node";
@@ -30,251 +29,83 @@ declare const Database_base: Context.ServiceClass<Database, "effect-auth/persist
 export declare class Database extends Database_base {}
 /** Construct Drizzle from the driver's SQL-client Layer. */
 export declare const databaseLayer: Layer.Layer<Database, never, import("@effect/sql-sqlite-node/SqliteClient").SqliteClient>;
-export declare const coordinateEmailAddress: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
-    readonly proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>;
+export declare const makeEmailSignInServices: <S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N>(mapping: EmailSignInMapping<S, I, C, AC, N>) => Effect.Effect<{
+  readonly emailSignInTargets: import("@yielded/auth/Email").EmailSignInTargets["Service"];
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailAddressServices: <S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN>(mapping: EmailAddressMapping<S, I, C, AC, N>, proofMapping?: ProofPersistenceMapping<Proof, PS, PN> | undefined) => Effect.Effect<{
+  readonly emailAddressPersistence: import("@yielded/auth/Email").EmailAddressPersistence["Service"];
+}, import("@yielded/auth/Email").EmailUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, N>, proofs: ProofPersistenceMapping<Proof, PS, PN>) => Effect.Effect<{
+  readonly registrationAuthority: import("@yielded/auth-persistence/Adapter").EmailRegistrationAuthority<Registration>;
+}, import("@yielded/auth/Email").EmailUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateEmailAddress: {
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, A, E, R, DE, DR>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Email").EmailUnavailable | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Email").EmailAddressPersistence>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
-    readonly proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Email").EmailUnavailable | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Email").EmailAddressPersistence>>;
+  } & {
+    readonly proofMapping?: ProofPersistenceMapping<Proof, PS, PN>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Email").EmailUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Email").EmailAddressPersistence>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<Database>>, TxShape>;
+  } & {
+    readonly proofMapping?: ProofPersistenceMapping<Proof, PS, PN>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Email").EmailUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Email").EmailAddressPersistence>>;
 }, coordinateEmailRegistration: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
-    readonly proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>;
-    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+  <TargetId, Registration, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, A, E, R, DE, DR>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, N>;
+    readonly proofMapping: ProofPersistenceMapping<Proof, PS, PN>;
+    readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").EmailRegistrationAuthority<Registration>>;
     readonly transaction?: never;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Email").EmailUnavailable | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
-    readonly proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>;
-    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Email").EmailUnavailable | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
-}, makeEmailAddressServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
-  emailAddressPersistence: {
-    readonly target: (input: {
-      readonly moduleId: string;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly target: import("@yielded/auth/Identity").LoginIdentifier;
-      readonly sourceCredentialId?: string;
-    }) => Effect.Effect<import("@yielded/auth/Email").EmailAddressTarget, import("@yielded/auth/Email").EmailUnavailable>;
-    readonly checkCompletion: (input: import("@yielded/auth/Proofs").ProofCompletionInput) => Effect.Effect<boolean, import("@yielded/auth/Email").EmailUnavailable>;
-    readonly verifyWithProof: <A>(input: import("@yielded/auth/Email").EmailAddressMutation, prepare: import("@yielded/auth/Email").PrepareEmailCommit<import("@yielded/auth/Email").EmailAddressDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Email").EmailUnavailable>;
-    readonly changeWithProof: <A>(input: import("@yielded/auth/Email").EmailAddressMutation, prepare: import("@yielded/auth/Email").PrepareEmailCommit<import("@yielded/auth/Email").EmailAddressDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Email").EmailUnavailable>;
-    readonly cleanup: <A>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Email").PrepareEmailCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Email").EmailUnavailable>;
-  };
-}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
-  registrationAuthority: EmailRegistrationAuthority<Registration>;
-}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
-  emailSignInTargets: {
-    readonly lookup: (input: {
-      readonly moduleId: string;
-      readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
-    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, import("@yielded/auth/Email").EmailUnavailable>;
-  };
-}, import("@yielded/auth/Email").EmailUnavailable, Database>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Email").EmailUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
+  <TargetId, Registration, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, N>;
+    readonly proofMapping: ProofPersistenceMapping<Proof, PS, PN>;
+    readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").EmailRegistrationAuthority<Registration>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<Database>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Email").EmailUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
+};
 export declare const coordinatePasswordPersistence: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
-    readonly proofMapping?: PM;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, A, E, R, DE, DR>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: PasswordPersistenceMapping<S, I, C, AC, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Password").PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Password").PasswordPersistence>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
-    readonly proofMapping?: PM;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Password").PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Password").PasswordPersistence>>;
+  } & {
+    readonly proofMapping?: ProofPersistenceMapping<Proof, PS, PN>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Password").PasswordUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Password").PasswordPersistence>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: PasswordPersistenceMapping<S, I, C, AC, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<Database>>, TxShape>;
+  } & {
+    readonly proofMapping?: ProofPersistenceMapping<Proof, PS, PN>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Password").PasswordUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Password").PasswordPersistence>>;
 }, coordinatePasswordRegistration: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+  <TargetId, Registration, Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, A, E, R, DE, DR>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, N>;
     readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>>;
     readonly transaction?: never;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Password").PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Password").PasswordUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
+  <TargetId, Registration, Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, N>;
     readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Password").PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
-}, makePasswordPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
-  passwordPersistence: {
-    readonly findCredential: (input: {
-      readonly moduleId: string;
-      readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
-      readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly rehashIfCurrent: (input: {
-      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
-      readonly nextVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-    }) => Effect.Effect<void, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly readForSubject: (input: {
-      readonly moduleId: string;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly recoveryTarget: (input: {
-      readonly moduleId: string;
-      readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
-    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly addIfAbsent: <A>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly replaceIfCurrent: <A>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly checkReset: (input: import("@yielded/auth/Proofs").ProofCompletionInput) => Effect.Effect<boolean, import("@yielded/auth/Password").PasswordUnavailable>;
-    readonly resetWithProof: <A>(input: import("@yielded/auth/Password").PasswordMutationInput & {
-      readonly completion: import("@yielded/auth/Proofs").ProofCompletionPlan;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Password").PasswordUnavailable>;
-  };
-}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
-  registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
-}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<Database>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Password").PasswordUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
+}, makePasswordPersistenceServices: <S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N, Proof extends import("drizzle-orm").Table, PS extends import("drizzle-orm").Table, PN>(mapping: PasswordPersistenceMapping<S, I, C, AC, N>, proofMapping?: ProofPersistenceMapping<Proof, PS, PN> | undefined) => Effect.Effect<{
+  readonly passwordPersistence: import("@yielded/auth/Password").PasswordPersistence["Service"];
+}, import("@yielded/auth/Password").PasswordUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends import("drizzle-orm").Table, I extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, AC extends import("drizzle-orm").Table, N>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, N>) => Effect.Effect<{
+  readonly registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
+}, import("@yielded/auth/Password").PasswordUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateProofPersistence: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<Rq>, DrizzleTableModel<S>, DrizzleTableModel<G>, DrizzleTableModel<Cn>, DrizzleTableModel<Rs>, DrizzleTableModel<Aev>, DrizzleTableModel<F>, DrizzleTableModel<C>, DrizzleTableModel<Sub>, DrizzleTableModel<I>, DrizzleTableModel<Cr>, NativeId, import("drizzle-orm").SQL<unknown>>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Proofs").ProofUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Proofs").ProofPersistence>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<Rq>, DrizzleTableModel<S>, DrizzleTableModel<G>, DrizzleTableModel<Cn>, DrizzleTableModel<Rs>, DrizzleTableModel<Aev>, DrizzleTableModel<F>, DrizzleTableModel<C>, DrizzleTableModel<Sub>, DrizzleTableModel<I>, DrizzleTableModel<Cr>, NativeId, import("drizzle-orm").SQL<unknown>>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Proofs").ProofUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Proofs").ProofPersistence>>;
-}, makeProofPersistenceServices: <Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, A extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId>(mapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<Rq>, DrizzleTableModel<S>, DrizzleTableModel<G>, DrizzleTableModel<Cn>, DrizzleTableModel<Rs>, DrizzleTableModel<A>, DrizzleTableModel<F>, DrizzleTableModel<C>, DrizzleTableModel<Sub>, DrizzleTableModel<I>, DrizzleTableModel<Cr>, NativeId, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
-  proofPersistence: {
-    readonly issue: <A_1>(input: {
-      readonly record: import("@yielded/auth/Proofs").ProofRecord;
-      readonly policy: import("@yielded/auth/Proofs").ProofPolicy;
-      readonly eligible: boolean;
-      readonly supersedes?: import("@yielded/auth/Proofs").ProofId;
-    }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofIssueDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofRequestConflict | import("@yielded/auth/Proofs").ProofUnavailable>;
-    readonly attempt: <A_1>(input: {
-      readonly moduleId: string;
-      readonly purpose: import("@yielded/auth/Proofs").ProofPurpose;
-      readonly proofId: import("@yielded/auth/Proofs").ProofId;
-      readonly binding: import("@yielded/auth/Proofs").ProofBinding;
-      readonly candidate?: import("@yielded/auth/Proofs").ProofDigest;
-      readonly continuationId: import("@yielded/auth/Proofs").ProofContinuationId;
-      readonly continuationDigest: import("@yielded/auth/Schema").TokenDigest;
-      readonly nowMillis: number;
-      readonly policy: import("@yielded/auth/Proofs").ProofPolicy;
-    }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofAttemptDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
-    readonly complete: <A_1>(input: import("@yielded/auth/Proofs").ProofCompletionInput, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofCompletionDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
-    readonly claimDelivery: <A_1>(input: {
-      readonly moduleId: string;
-      readonly proofId: import("@yielded/auth/Proofs").ProofId;
-      readonly version: import("@yielded/auth/Proofs").ProofVersion;
-      readonly deliveryId: import("@yielded/auth/Proofs").ProofDeliveryId;
-      readonly nowMillis: number;
-      readonly policy: import("@yielded/auth/Proofs").ProofPolicy;
-      readonly allowAmbiguousRetry: boolean;
-    }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofDeliveryClaim, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
-    readonly settleDelivery: <A_1>(input: {
-      readonly moduleId: string;
-      readonly proofId: import("@yielded/auth/Proofs").ProofId;
-      readonly version: import("@yielded/auth/Proofs").ProofVersion;
-      readonly deliveryId: import("@yielded/auth/Proofs").ProofDeliveryId;
-      readonly claimVersion: import("@yielded/auth/Proofs").ProofVersion;
-      readonly outcome: import("@yielded/auth/Proofs").ProofDeliveryOutcome;
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<void, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
-    readonly cancel: <A_1>(input: {
-      readonly moduleId: string;
-      readonly purpose: import("@yielded/auth/Proofs").ProofPurpose;
-      readonly binding: import("@yielded/auth/Proofs").ProofBinding;
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<void, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
-    readonly cleanup: <A_1>(input: {
-      readonly moduleId: string;
-      readonly nowMillis: number;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofCleanupResult, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
-  };
-}, import("@yielded/auth/Proofs").ProofUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
-export declare const coordinateAuthenticationAuthority: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Sessions").AuthenticationAuthority>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Sessions").AuthenticationAuthority>>;
-}, coordinatePendingAuthentication: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;
-    readonly target: SuppliedService<TargetId, import("@yielded/auth/Sessions").PendingAuthentication<Claims>>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;
-    readonly target: SuppliedService<TargetId, import("@yielded/auth/Sessions").PendingAuthentication<Claims>>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
-}, coordinateSignedSessionValidity: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;
-    readonly target: SuppliedService<TargetId, import("@yielded/auth/Sessions").SignedSessionValidity>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;
-    readonly target: SuppliedService<TargetId, import("@yielded/auth/Sessions").SignedSessionValidity>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
-}, coordinateStatefulSessions: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, PersistenceId, RepositoryId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: StatefulSessionMapping<NoInfer<Claims>, S, C, Session, F, P, NativeId, NativeSessionId>;
-    readonly persistence: SuppliedService<PersistenceId, import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>>;
-    readonly repository: SuppliedService<RepositoryId, import("@yielded/auth/Sessions").SessionRepository>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, PersistenceId | RepositoryId>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, PersistenceId, RepositoryId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: StatefulSessionMapping<NoInfer<Claims>, S, C, Session, F, P, NativeId, NativeSessionId>;
-    readonly persistence: SuppliedService<PersistenceId, import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>>;
-    readonly repository: SuppliedService<RepositoryId, import("@yielded/auth/Sessions").SessionRepository>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, PersistenceId | RepositoryId | TxId>>;
-}, makeAuthenticationAuthorityServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId>(mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>) => Effect.Effect<{
-  authenticationAuthority: {
-    readonly capture: (subjectId: import("@yielded/auth/Schema").SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationCapture, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").SessionUnavailable>;
-    readonly requirements: (evidence: import("@yielded/auth/Sessions").AuthenticationEvidence) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").SessionUnavailable>;
-    readonly approve: <A>(input: {
-      readonly evidence: import("@yielded/auth/Sessions").AuthenticationEvidence;
-      readonly now: import("effect/DateTime").Utc;
-      readonly expiresAt: import("effect/DateTime").Utc;
-      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
-      readonly pending?: import("@yielded/auth/Sessions").PendingConsumption;
-    }, prepare: import("@yielded/auth/Sessions").PrepareSessionCommit<void, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").PendingAuthenticationInvalid | import("@yielded/auth/Sessions").SessionUnavailable>;
-  };
-}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
-  pendingAuthentication: import("@yielded/auth/Sessions").PendingAuthentication<Claims>;
-}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
-  sessionStepUpPersistence: import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>;
-}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
-    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Proof extends import("drizzle-orm").Table, Subject extends import("drizzle-orm").Table, NativeId, A, E, R, DE, DR>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: ProofPersistenceMapping<Proof, Subject, NativeId>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
-    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
-}, makeSignedSessionValidityServices: <S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>) => Effect.Effect<{
-  signedSessionValidity: import("@yielded/auth/Sessions").SignedSessionValidity;
-}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
-  readonly statefulSessionPersistence: import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>;
-  readonly sessionRepository: import("@yielded/auth/Sessions").SessionRepository;
-}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
-export declare const commitMode: "interactive";
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Proofs").ProofUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Proofs").ProofPersistence>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Proof extends import("drizzle-orm").Table, Subject extends import("drizzle-orm").Table, NativeId, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: ProofPersistenceMapping<Proof, Subject, NativeId>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<Database>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Proofs").ProofUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Proofs").ProofPersistence>>;
+}, makeProofPersistenceServices: <Proof extends import("drizzle-orm").Table, Subject extends import("drizzle-orm").Table, NativeId>(mapping: ProofPersistenceMapping<Proof, Subject, NativeId>) => Effect.Effect<{
+  readonly proofPersistence: import("@yielded/auth/Proofs").ProofPersistence["Service"];
+}, import("@yielded/auth/Proofs").ProofUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
-    readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
+    readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").SubjectProvisioned, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
@@ -282,7 +113,7 @@ export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Iden
 }, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
   readonly subjectProvisioner: {
-    readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
+    readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").SubjectProvisioned, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
 }, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
@@ -290,22 +121,6 @@ export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTab
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
 }, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
-export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
-  passwordPreparedPersistence: import("@yielded/auth/Password").PasswordPreparedPersistence;
-}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
-    readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
-    readonly target: SuppliedService<TargetId, import("@yielded/auth/Password").PasswordPreparedPersistence>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Password").PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
-    readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
-    readonly target: SuppliedService<TargetId, import("@yielded/auth/Password").PasswordPreparedPersistence>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
-  }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Password").PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
-};
 export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
@@ -316,260 +131,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, TA extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, U extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N>(mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>) => Effect.Effect<{
-  oauthAccountsPersistence: {
-    readonly capture: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<import("@yielded/auth/OAuth").OAuthAccountRevision | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly issue: <A>(input: {
-      readonly flow: import("@yielded/auth/OAuth").OAuthLinkPendingFlow;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Issued";
-      readonly flow: {
-        readonly context: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly generation: number;
-          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly access?: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingExpiresAtMillis: number;
-          readonly issuedAtMillis: number;
-          readonly expiresAtMillis: number;
-          readonly claimLifetimeMillis: number;
-          readonly namespace: "effect-auth/oauth-link-context/v1";
-          readonly revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-          readonly maximumEvidenceAgeMillis: number;
-        };
-        readonly sealed: {
-          readonly format: "oauth-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-        readonly retentionUntilMillis: number;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly preflight: (input: import("@yielded/auth/OAuth").OAuthLinkAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthLinkPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly claim: <A>(input: {
-      readonly access: import("@yielded/auth/OAuth").OAuthLinkAccess;
-      readonly flow: import("@yielded/auth/OAuth").OAuthLinkPendingFlow;
-      readonly claimId: import("@yielded/auth/OAuth").OAuthLinkClaim["claimId"];
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Claimed";
-      readonly claim: {
-        readonly flow: {
-          readonly context: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly generation: number;
-            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-            readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-            readonly access?: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-            readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-            readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-            readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-            readonly requestBindingExpiresAtMillis: number;
-            readonly issuedAtMillis: number;
-            readonly expiresAtMillis: number;
-            readonly claimLifetimeMillis: number;
-            readonly namespace: "effect-auth/oauth-link-context/v1";
-            readonly revision: {
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly credentials: readonly {
-                readonly credentialId: string;
-                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              }[];
-            };
-            readonly maximumEvidenceAgeMillis: number;
-          };
-          readonly sealed: {
-            readonly format: "oauth-xchacha20poly1305-v1";
-            readonly keyId: string;
-            readonly nonce: string;
-            readonly ciphertext: import("effect/Redacted").Redacted<string>;
-          };
-          readonly retentionUntilMillis: number;
-        };
-        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-        readonly claimedAtMillis: number;
-        readonly claimExpiresAtMillis: number;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthLinkClaim;
-      readonly outcome: import("@yielded/auth/OAuth").OAuthLinkOutcome;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-      readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Linked";
-      readonly credential: {
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly credentialId: string;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-      };
-      readonly changed: boolean;
-    } | {
-      readonly _tag: "Conflict";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly inspectUnlink: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly credentialId: string;
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Target";
-      readonly credential: {
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly credentialId: string;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-      };
-    } | {
-      readonly _tag: "Replay";
-      readonly result: {
-        readonly _tag: "Unlinked";
-        readonly credentialId: string;
-        readonly invalidation: {
-          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
-          readonly maximumExposureMillis: number;
-          readonly oldAuthenticationEvidence: "rejected";
-        };
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly unlink: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly credential: import("@yielded/auth/OAuth").OAuthCredentialSnapshot;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-      readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
-      readonly nowMillis: number;
-      readonly retentionUntilMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Unlinked";
-      readonly result: {
-        readonly _tag: "Unlinked";
-        readonly credentialId: string;
-        readonly invalidation: {
-          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
-          readonly maximumExposureMillis: number;
-          readonly oldAuthenticationEvidence: "rejected";
-        };
-      };
-      readonly replayed: boolean;
-    } | {
-      readonly _tag: "LastSignInMethod";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly terminalized: number;
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  };
+}>, N>(mapping: OAuthAccountsMapping<S, O, C, AC, F, N>) => Effect.Effect<{
+  readonly oauthAccountsPersistence: import("@yielded/auth/OAuth").OAuthAccountsPersistence["Service"];
 }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
@@ -581,60 +144,13 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, N>(mapping: OAuthSignInMapping<S, O, C, AC, F, N>) => Effect.Effect<{
-  oauthSignInPersistence: {
-    readonly issue: <A>(input: import("@yielded/auth/OAuth").OAuthPendingFlow, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly claim: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly generation: number;
-      readonly flowId: import("@yielded/auth/Operations").RequestBindingFlowId;
-      readonly provider: import("@yielded/auth/OAuth").OAuthProviderKey;
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly stateDigest: import("@yielded/auth/Schema").TokenDigest;
-      readonly requestBindingVerifier: import("@yielded/auth/Schema").TokenDigest;
-      readonly requestBindingExpiresAtMillis: number;
-      readonly responseIssuer?: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthClaimDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
-      readonly outcome: {
-        readonly _tag: "Verified";
-        readonly identity: import("@yielded/auth/OAuth").OAuthVerifiedExternalIdentity;
-      } | {
-        readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
-      };
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthSettlementDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly terminalized: number;
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  };
-}, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, C extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, AC extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, F extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, TA extends AnySQLiteTable<{
+  readonly oauthSignInPersistence: import("@yielded/auth/OAuth").OAuthSignInPersistence["Service"];
+}, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <O extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, I extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, N>(mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>) => Effect.Effect<{
-  oauthRegistrationIntents: {
-    readonly settle: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
-      readonly identity: import("@yielded/auth/OAuth").OAuthVerifiedExternalIdentity;
-      readonly intent?: import("@yielded/auth/OAuth").OAuthRegistrationIntent;
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  };
+}>, N>(mapping: OAuthRegistrationIntentMapping<O, I, N>) => Effect.Effect<{
+  readonly oauthRegistrationIntents: import("@yielded/auth/OAuth").OAuthRegistrationIntents["Service"];
 }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
@@ -643,14 +159,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, AC extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, TA extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, I extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, R extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
-  registrationAuthority: import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>;
+}>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, I, N>) => Effect.Effect<{
+  readonly registrationAuthority: import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>;
 }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -660,17 +172,13 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, TA extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, I extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Rq extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;
+    readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, I, N>;
     readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -679,19 +187,15 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, TA extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, I extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Rq extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;
+    readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, I, N>;
     readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
 }, coordinateOAuthSignIn: {
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -706,7 +210,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -722,46 +226,26 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
 }, coordinateOAuthRegistrationIntents: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, AC extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, F extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, TA extends AnySQLiteTable<{
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, O extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, I extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;
+    readonly mapping: OAuthRegistrationIntentMapping<O, I, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, AC extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, F extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, TA extends AnySQLiteTable<{
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, O extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, I extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;
+    readonly mapping: OAuthRegistrationIntentMapping<O, I, N>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
 }, coordinateOAuthAccounts: {
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -773,14 +257,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, TA extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, U extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;
+    readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -791,1210 +271,92 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, TA extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, U extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;
+    readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, N>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
 }, makeOAuthConnectedServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, AC extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, T extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, G extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, C extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, UA extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, DC extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, N, J extends AnySQLiteTable<{
   dialect: "sqlite";
-}> = never>(mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>) => Effect.Effect<{
-  oauthConnectedPersistence: {
-    readonly claimSignIn: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
-      readonly configuration: import("@yielded/auth/OAuth").OAuthConnectedConfiguration;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthSignInAccessClaim, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly inspectSignIn: (input: {
-      readonly reservation: import("@yielded/auth/OAuth").OAuthSignInAccessClaim;
-      readonly credential: import("@yielded/auth/OAuth").OAuthCredentialSnapshot;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    }) => Effect.Effect<import("@yielded/auth/OAuth").OAuthSignInAccessInspection, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly settleSignIn: <A>(input: {
-      readonly reservation: import("@yielded/auth/OAuth").OAuthSignInAccessClaim;
-      readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Connected";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: import("effect/Schema").Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    } | {
-      readonly _tag: "Busy";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly capture: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    }) => Effect.Effect<{
-      readonly revision: import("@yielded/auth/OAuth").OAuthAccountRevision;
-      readonly target?: import("@yielded/auth/OAuth").OAuthConnectedTarget;
-    } | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly issue: <A>(input: {
-      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Issued";
-      readonly flow: {
-        readonly context: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly generation: number;
-          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly access?: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingExpiresAtMillis: number;
-          readonly issuedAtMillis: number;
-          readonly expiresAtMillis: number;
-          readonly claimLifetimeMillis: number;
-          readonly namespace: "effect-auth/oauth-connected-context/v1";
-          readonly revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly reconnect?: {
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly configuration: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-            };
-          };
-          readonly maximumEvidenceAgeMillis: number;
-        };
-        readonly sealed: {
-          readonly format: "oauth-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-        readonly retentionUntilMillis: number;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly prepare: <A>(input: {
-      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Issued";
-      readonly flow: {
-        readonly context: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly generation: number;
-          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly access?: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingExpiresAtMillis: number;
-          readonly issuedAtMillis: number;
-          readonly expiresAtMillis: number;
-          readonly claimLifetimeMillis: number;
-          readonly namespace: "effect-auth/oauth-connected-context/v1";
-          readonly revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly reconnect?: {
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly configuration: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-            };
-          };
-          readonly maximumEvidenceAgeMillis: number;
-        };
-        readonly sealed: {
-          readonly format: "oauth-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-        readonly retentionUntilMillis: number;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly claim: <A>(input: {
-      readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
-      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Claimed";
-      readonly claim: {
-        readonly flow: {
-          readonly context: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly generation: number;
-            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-            readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-            readonly access?: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-            readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-            readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-            readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-            readonly requestBindingExpiresAtMillis: number;
-            readonly issuedAtMillis: number;
-            readonly expiresAtMillis: number;
-            readonly claimLifetimeMillis: number;
-            readonly namespace: "effect-auth/oauth-connected-context/v1";
-            readonly revision: {
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly credentials: readonly {
-                readonly credentialId: string;
-                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              }[];
-            };
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly reconnect?: {
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-            };
-            readonly maximumEvidenceAgeMillis: number;
-          };
-          readonly sealed: {
-            readonly format: "oauth-xchacha20poly1305-v1";
-            readonly keyId: string;
-            readonly nonce: string;
-            readonly ciphertext: import("effect/Redacted").Redacted<string>;
-          };
-          readonly retentionUntilMillis: number;
-        };
-        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-        readonly claimedAtMillis: number;
-        readonly claimExpiresAtMillis: number;
-        readonly order: string;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly inspectGrant: (input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Target";
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Quarantine";
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
-      readonly outcome: import("@yielded/auth/OAuth").OAuthConnectedOutcome;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-      readonly nowMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Connected";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: import("effect/Schema").Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    } | {
-      readonly _tag: "Busy";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly list: (input: {
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-      readonly limit: number;
-      readonly cursor?: string;
-    }) => Effect.Effect<{
-      readonly items: readonly {
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
-        readonly scopes: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: import("effect/Schema").Json;
-          };
-        };
-        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-      }[];
-      readonly cursor?: string;
-    }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly inspectDisconnect: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Target";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: import("effect/Schema").Json;
-              };
-            };
-          };
-        };
-        readonly sealed?: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-    } | {
-      readonly _tag: "Replay";
-      readonly result: {
-        readonly _tag: "Disconnected";
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-        readonly affectedGrantCount: number;
-        readonly replayed: boolean;
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly disconnect: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly grant: import("@yielded/auth/OAuth").OAuthConnectedDisconnectGrant;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-      readonly revocation?: import("@yielded/auth/OAuth").OAuthConnectedRevocationJob;
-      readonly retentionUntilMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Disconnected";
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-      readonly affectedGrantCount: number;
-      readonly replayed: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly inspectAccess: (input: {
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
-    } | {
-      readonly _tag: "Target";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: import("effect/Schema").Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly claimRefresh: <A>(input: {
-      readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly nextTokenVersion: import("@yielded/auth/OAuth").OAuthConnectedRefreshClaim["nextTokenVersion"];
-      readonly lifetimeMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    } | {
-      readonly _tag: "Claimed";
-      readonly claim: {
-        readonly grant: {
-          readonly context: {
-            readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-            readonly exchangeOrder: string;
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly configuration: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-            };
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly metadata: {
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly accessExpiresAtMillis?: number;
-              readonly refreshExpiresAtMillis?: number;
-              readonly useUntilMillis: number;
-              readonly refreshUseUntilMillis?: number;
-              readonly obtainedAtMillis: number;
-              readonly profile?: {
-                readonly displayName?: string;
-                readonly handle?: string;
-                readonly avatarUrl?: string;
-                readonly profileUrl?: string;
-                readonly email?: string;
-                readonly emailVerified?: boolean;
-                readonly providerData?: {
-                  readonly [x: string]: import("effect/Schema").Json;
-                };
-              };
-            };
-          };
-          readonly sealed: {
-            readonly format: "oauth-connected-xchacha20poly1305-v1";
-            readonly keyId: string;
-            readonly nonce: string;
-            readonly ciphertext: import("effect/Redacted").Redacted<string>;
-          };
-        };
-        readonly order: string;
-        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-        readonly claimedAtMillis: number;
-        readonly claimExpiresAtMillis: number;
-        readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly settleRefresh: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthConnectedRefreshClaim;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-      readonly outcome: import("@yielded/auth/OAuth").OAuthConnectedRefreshOutcome;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    } | {
-      readonly _tag: "Refreshed";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: import("effect/Schema").Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly admitUse: <A>(input: {
-      readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-      readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly lifetimeMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    } | {
-      readonly _tag: "Admitted";
-      readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly admittedAtMillis: number;
-      readonly expiresAtMillis: number;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly terminalized: number;
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-  };
-}, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
+}> = never>(mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J>) => Effect.Effect<{
+  readonly oauthConnectedPersistence: import("@yielded/auth/OAuth").OAuthConnectedPersistence["Service"];
+}, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <O extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, G extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, C extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, J extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, N>(mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>) => Effect.Effect<{
-  oauthConnectedRevocations: {
-    readonly claim: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly lifetimeMillis: number;
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly _tag: "Claimed";
-      readonly claim: {
-        readonly job: {
-          readonly context: {
-            readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
-            readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-            readonly token: {
-              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-              readonly exchangeOrder: string;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly metadata: {
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly accessExpiresAtMillis?: number;
-                readonly refreshExpiresAtMillis?: number;
-                readonly useUntilMillis: number;
-                readonly refreshUseUntilMillis?: number;
-                readonly obtainedAtMillis: number;
-                readonly profile?: {
-                  readonly displayName?: string;
-                  readonly handle?: string;
-                  readonly avatarUrl?: string;
-                  readonly profileUrl?: string;
-                  readonly email?: string;
-                  readonly emailVerified?: boolean;
-                  readonly providerData?: {
-                    readonly [x: string]: import("effect/Schema").Json;
-                  };
-                };
-              };
-            };
-          };
-          readonly sealed: {
-            readonly format: "oauth-connected-xchacha20poly1305-v1";
-            readonly keyId: string;
-            readonly nonce: string;
-            readonly ciphertext: import("effect/Redacted").Redacted<string>;
-          };
-        };
-        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-        readonly claimedAtMillis: number;
-        readonly claimExpiresAtMillis: number;
-      };
-    } | {
-      readonly _tag: "Empty";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthConnectedRevocationClaim;
-      readonly outcome: "Confirmed" | "Unknown";
-    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-      readonly settled: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  };
-}, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}>, N>(mapping: OAuthConnectedRevocationMapping<O, F, J, N>) => Effect.Effect<{
+  readonly oauthConnectedRevocations: import("@yielded/auth/OAuth").OAuthConnectedRevocations["Service"];
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, T extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, G extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, UA extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, DC extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, J extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>;
+    readonly mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
   <D extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, T extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, G extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, UA extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, DC extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, J extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>;
+    readonly mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J>;
     readonly transaction: SuppliedService<TxId, NoInfer<D extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<D["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
 }, coordinateOAuthConnectedRevocations: {
-  <D extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, T extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
+  <D extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, O extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, G extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, J extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>;
+    readonly mapping: OAuthConnectedRevocationMapping<O, F, J, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
-  <D extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, T extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
+  <D extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, O extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, G extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, J extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>;
+    readonly mapping: OAuthConnectedRevocationMapping<O, F, J, N>;
     readonly transaction: SuppliedService<TxId, NoInfer<D extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<D["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
 };
 export declare const makePasskeyCredentialServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -2002,225 +364,252 @@ export declare const makePasskeyCredentialServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N>, RSetup>) => Effect.Effect<import("@yielded/auth-persistence/Adapter").PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | Exclude<RSetup, NativeDatabase>>, makePasskeyPersistenceServices: <S extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, C extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, F extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, M extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Flow extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Admission extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Charge extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, Admission, Charge, N>, RSetup>) => Effect.Effect<import("@yielded/auth-persistence/Adapter").PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, makePasskeyEnrollmentContextServices: <S extends AnySQLiteTable<{
+}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, N>, RSetup>) => Effect.Effect<{
+  passkeyCredentials: {
+    readonly listForSubject: (input: {
+      readonly moduleId: string;
+      readonly rpId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+    }) => Effect.Effect<import("@yielded/auth/Passkey").PasskeyEnrollmentSnapshot | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly lookup: (input: {
+      readonly rpId: string;
+      readonly protocolCredentialId: import("@yielded/auth/Passkey").PasskeyProtocolCredentialId;
+    }) => Effect.Effect<import("@yielded/auth/Passkey").PasskeyCredential | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+  };
+}, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | Exclude<RSetup, NativeDatabase>>, makePasskeyPersistenceServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, C extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, M extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N>, RSetup>) => Effect.Effect<import("@yielded/auth-persistence/Adapter").PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | Exclude<RSetup, NativeDatabase>>, makePasskeyRegistrationCeremonyServices: <M extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, Flow extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, Admission extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Charge extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Intent extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
+}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, N>, Flow, N>, RSetup>) => Effect.Effect<{
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly context: (input: import("@yielded/auth/Passkey").PasskeyAccess) => Effect.Effect<import("@yielded/auth/Passkey").PasskeyCeremony | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredential;
+      readonly assertion: import("@yielded/auth/Passkey").PasskeyAssertionVerified;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+  };
+}, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, makePasskeyRegistrationCeremonyServices: <Flow extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H>, RSetup>) => Effect.Effect<import("@yielded/auth-persistence/Adapter").PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, coordinatePasskeyPersistence: {
+}>, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<Flow>, RSetup>) => Effect.Effect<{
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly context: (input: import("@yielded/auth/Passkey").PasskeyAccess) => Effect.Effect<import("@yielded/auth/Passkey").PasskeyCeremony | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredential;
+      readonly assertion: import("@yielded/auth/Passkey").PasskeyAssertionVerified;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+  };
+  capabilities: {
+    purposes: readonly ["registration"];
+    issue: "registration-authority";
+    assertionConsumption: false;
+  };
+}, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, coordinatePasskeyPersistence: {
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, C extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, Admission, Charge, N>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, N>, Flow, N>, RSetup>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Passkey").PasskeyPersistence>>;
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, C extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, Admission, Charge, N>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, N>, Flow, N>, RSetup>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
 }, coordinatePasskeyRegistrationCeremony: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Flow extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Intent extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<Flow>, RSetup>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Passkey").PasskeyPersistence>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Flow extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Intent extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<Flow>, RSetup>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
 }, makePasskeyManagementServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, C extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, M extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, Flow extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, Admission extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Charge extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Command extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N>, RSetup>) => Effect.Effect<import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, makePasskeyRegistrationServices: <S extends AnySQLiteTable<{
+}>, N, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyManagementMapping<S, C, F, Flow, N>, RSetup>) => Effect.Effect<{
+  passkeyManagementPersistence: {
+    readonly list: (input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly cursor?: string;
+      readonly limit: number;
+    }) => Effect.Effect<{
+      readonly credentials: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyCredentialSummary>;
+      readonly cursor?: string;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly completeEnrollment: <A>(input: {
+      readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+      readonly verified: import("@yielded/auth/Passkey").PasskeyRegistrationVerified;
+      readonly management: import("@yielded/auth/Passkey").PasskeyManagementPolicy;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<{
+      readonly _tag: "Enrolled";
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredentialSummary;
+    } | {
+      readonly _tag: "Rejected";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly inspectRemove: (input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly credentialId: string;
+    }) => Effect.Effect<{
+      readonly _tag: "Target";
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredential;
+    } | {
+      readonly _tag: "Rejected";
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly remove: <A>(input: {
+      readonly moduleId: string;
+      readonly commandId: string;
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredential;
+      readonly authorization: import("@yielded/auth/Passkey").PasskeyActionAuthorization;
+      readonly management: import("@yielded/auth/Passkey").PasskeyManagementPolicy;
+      readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<{
+      readonly _tag: "Removed";
+      readonly result: {
+        readonly credentialId: string;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      };
+    } | {
+      readonly _tag: "Rejected" | "LastSignInMethod";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly rename: <A>(input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly commandId: string;
+      readonly credentialId: string;
+      readonly name: string;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<{
+      readonly _tag: "Renamed";
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredentialSummary;
+    } | {
+      readonly _tag: "Rejected";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+  };
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly context: (input: import("@yielded/auth/Passkey").PasskeyAccess) => Effect.Effect<import("@yielded/auth/Passkey").PasskeyCeremony | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredential;
+      readonly assertion: import("@yielded/auth/Passkey").PasskeyAssertionVerified;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+  };
+}, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, makePasskeyRegistrationServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, C extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, F extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, O extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, H extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, M extends AnySQLiteTable<{
-  dialect: "sqlite";
 }>, Flow extends AnySQLiteTable<{
   dialect: "sqlite";
-}>, Admission extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Charge extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, Intent extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, Value, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value>, RSetup>) => Effect.Effect<import("@yielded/auth-persistence/Adapter").PasskeyRegistrationServices<Value>, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, coordinatePasskeyManagement: {
+}>, N, Value, RSetup = never>(mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, Flow, N, Value>, RSetup>) => Effect.Effect<{
+  passkeyRegistrationAuthority: import("@yielded/auth-persistence/Adapter").PasskeyRegistrationWriter<Value>;
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly context: (input: import("@yielded/auth/Passkey").PasskeyAccess) => Effect.Effect<import("@yielded/auth/Passkey").PasskeyCeremony | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
+      readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
+      readonly credential: import("@yielded/auth/Passkey").PasskeyCredential;
+      readonly assertion: import("@yielded/auth/Passkey").PasskeyAssertionVerified;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Passkey").PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Passkey").PasskeyUnavailable>;
+  };
+}, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, coordinatePasskeyManagement: {
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, C extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Command extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyManagementMapping<S, C, F, Flow, N>, RSetup>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Passkey").PasskeyManagementPersistence | import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Passkey").PasskeyManagementPersistence | import("@yielded/auth/Passkey").PasskeyPersistence>>;
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, C extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Command extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyManagementMapping<S, C, F, Flow, N>, RSetup>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Passkey").PasskeyManagementPersistence | import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Passkey").PasskeyManagementPersistence | import("@yielded/auth/Passkey").PasskeyPersistence>>;
 }, coordinatePasskeyRegistration: {
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -2228,123 +617,127 @@ export declare const makePasskeyCredentialServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Intent extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, Value, A, E, R, AuthorityId, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, Flow, N, Value>, RSetup>;
     readonly authority: Context.Key<AuthorityId, import("@yielded/auth-persistence/Adapter").PasskeyRegistrationWriter<Value>>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, AuthorityId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, AuthorityId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
   <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, C extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, F extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, O extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, H extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, M extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, Flow extends AnySQLiteTable<{
     dialect: "sqlite";
-  }>, Admission extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Charge extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, Intent extends AnySQLiteTable<{
-    dialect: "sqlite";
   }>, N, Value, A, E, R, AuthorityId, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value>, RSetup>;
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, Flow, N, Value>, RSetup>;
     readonly authority: Context.Key<AuthorityId, import("@yielded/auth-persistence/Adapter").PasskeyRegistrationWriter<Value>>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, AuthorityId | TxId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
-};
-export declare const makeTotpPersistenceServices: <S extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, F extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, C extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, RSetup = never>(mapping: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>) => Effect.Effect<TotpPersistenceServices, import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/Totp").TotpConfigurationError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, coordinateTotpPersistence: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, F extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>;
-    readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | TotpCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Totp").TotpPersistence>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, F extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
-      readonly transaction: (...args: any[]) => any;
-    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | TotpCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Totp").TotpPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, AuthorityId | TxId | import("@yielded/auth/Passkey").PasskeyPersistence>>;
 };
-export declare const makePhonePersistenceServices: <S extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, I extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, F extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, C extends AnySQLiteTable<{
-  dialect: "sqlite";
-}>, N, RSetup = never>(mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>) => Effect.Effect<PhonePersistenceServices, import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/PhoneOtp").PhoneConfigurationError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RSetup, NativeDatabase>>, coordinatePhonePersistence: {
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, I extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, F extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>;
+export declare const makePhonePersistenceServices: <Subject extends import("drizzle-orm").Table, Identifier extends import("drizzle-orm").Table, Credential extends import("drizzle-orm").Table, Proof extends import("drizzle-orm").Table, NativeId>(mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>) => Effect.Effect<{
+  readonly phonePersistence: import("@yielded/auth/PhoneOtp").PhonePersistence["Service"];
+  readonly phoneSignInTargets: import("@yielded/auth/PhoneOtp").PhoneSignInTargets["Service"];
+}, import("@yielded/auth/PhoneOtp").PhoneConfigurationError | import("@yielded/auth/PhoneOtp").PhoneOtpUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePhonePersistence: {
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Subject extends import("drizzle-orm").Table, Identifier extends import("drizzle-orm").Table, Credential extends import("drizzle-orm").Table, Proof extends import("drizzle-orm").Table, NativeId, A, E, R, DE, DR>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PhoneCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/PhoneOtp").PhoneAdmission | import("@yielded/auth/PhoneOtp").PhonePersistence | import("@yielded/auth/PhoneOtp").PhoneSignInTargets>>;
-  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, I extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, F extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, C extends AnySQLiteTable<{
-    dialect: "sqlite";
-  }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>;
-    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
-      readonly transaction: (...args: any[]) => any;
-    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | PhoneCoordinatorError<E>, DatabaseRequirements | RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/PhoneOtp").PhoneAdmission | import("@yielded/auth/PhoneOtp").PhonePersistence | import("@yielded/auth/PhoneOtp").PhoneSignInTargets>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/PhoneOtp").PhoneConfigurationError | import("@yielded/auth/PhoneOtp").PhoneOtpUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/PhoneOtp").PhonePersistence | import("@yielded/auth/PhoneOtp").PhoneSignInTargets>>;
+  <Database extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Subject extends import("drizzle-orm").Table, Identifier extends import("drizzle-orm").Table, Credential extends import("drizzle-orm").Table, Proof extends import("drizzle-orm").Table, NativeId, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<Database, DE, DR>, options: {
+    readonly mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<Database>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/PhoneOtp").PhoneConfigurationError | import("@yielded/auth/PhoneOtp").PhoneOtpUnavailable, DR | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/PhoneOtp").PhonePersistence | import("@yielded/auth/PhoneOtp").PhoneSignInTargets>>;
 };
 export declare const AuthPersistence: {
   make: <C extends import("@yielded/auth-persistence/Adapter").ClaimsCodec, const Id extends string, const A extends import("@yielded/auth-persistence/Adapter").Definition<C, Id>>(auth: A & import("@yielded/auth-persistence/Adapter").Definition<C, Id>) => import("@yielded/auth-persistence/Adapter").BoundPersistence<import("drizzle-orm/sqlite-core").SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>, import("@effect/sql-sqlite-node/SqliteClient").SqliteClient, C, Id, A>;
   migrationsLayer: (options: import("drizzle-orm/migrator").MigrationConfig) => Layer.Layer<never, import("drizzle-orm/effect-core").EffectDrizzleQueryError | import("drizzle-orm/effect-core").MigratorInitError | import("@yielded/auth-persistence/Adapter").PersistenceConfigurationError | import("effect/sql/SqlError").SqlError, import("@effect/sql-sqlite-node/SqliteClient").SqliteClient>;
 };
+export declare const coordinateAuthenticationAuthority: {
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, A, E, R, DE, DR>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, P, N>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Sessions").AuthenticationAuthority>>;
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, P, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Sessions").AuthenticationAuthority>>;
+}, coordinatePendingAuthentication: {
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, A, E, R, DE, DR>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, N>;
+    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").PendingAuthentication<Claims>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id>>;
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, N>;
+    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").PendingAuthentication<Claims>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
+}, coordinateSignedSessionValidity: {
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, S extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS, A, E, R, DE, DR>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: SignedSessionValidityMapping<S, T, N, NS>;
+    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SignedSessionValidity>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id>>;
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, S extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: SignedSessionValidityMapping<S, T, N, NS>;
+    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SignedSessionValidity>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
+}, coordinateStatefulSessions: {
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, RepositoryId, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, Session extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, NS, A, E, R, DE, DR>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: StatefulSessionMapping<NoInfer<Claims>, S, C, Session, P, N, NS>;
+    readonly persistence: SuppliedService<Id, import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>>;
+    readonly repository: SuppliedService<RepositoryId, import("@yielded/auth/Sessions").SessionRepository>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | RepositoryId>>;
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, RepositoryId, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, Session extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, NS, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: StatefulSessionMapping<NoInfer<Claims>, S, C, Session, P, N, NS>;
+    readonly persistence: SuppliedService<Id, import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>>;
+    readonly repository: SuppliedService<RepositoryId, import("@yielded/auth/Sessions").SessionRepository>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | RepositoryId | TxId>>;
+}, makeAuthenticationAuthorityServices: <Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N>(mapping: AuthenticationAuthorityMapping<Claims, S, C, P, N>) => Effect.Effect<{
+  readonly authenticationAuthority: import("@yielded/auth/Sessions").AuthenticationAuthority["Service"];
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N>(mapping: PendingAuthenticationMapping<Claims, S, C, P, N>) => Effect.Effect<{
+  readonly pendingAuthentication: import("@yielded/auth/Sessions").PendingAuthentication<Claims>;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSignedSessionValidityServices: <S extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS>(mapping: SignedSessionValidityMapping<S, T, N, NS>) => Effect.Effect<{
+  readonly signedSessionValidity: import("@yielded/auth/Sessions").SignedSessionValidity;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, Session extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, N, NS>(mapping: StatefulSessionMapping<Claims, S, C, Session, P, N, NS>) => Effect.Effect<{
+  readonly statefulSessionPersistence: import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>;
+  readonly sessionRepository: import("@yielded/auth/Sessions").SessionRepository;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, Session extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS, Id>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, P, Session, T, N, NS>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
+  sessionStepUpPersistence: import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, Session extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS, A, E, R, DE, DR>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, P, Session, T, N, NS>;
+    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id>>;
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, Id, Claims, S extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, P extends import("drizzle-orm").Table, Session extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS, A, E, R, DE, DR, TxId, TxShape>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, P, Session, T, N, NS>;
+    readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth/Sessions").SessionUnavailable, DR | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
+}, makeSessionCleanupServices: <P extends import("drizzle-orm").Table, T extends import("drizzle-orm").Table, N, NS>(mapping: SessionCleanupMapping<P, T, N, NS>) => Effect.Effect<{
+  readonly sessionCleanup: import("@yielded/auth/Sessions").SessionCleanup;
+}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+export declare const makeTotpPersistenceServices: <S extends import("drizzle-orm").Table, F extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, N, P extends import("drizzle-orm").Table = import("drizzle-orm").Table<import("drizzle-orm").TableConfig<import("drizzle-orm").Columns>>, RS = never>(source: import("@yielded/auth-persistence/Adapter").TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>) => Effect.Effect<{
+  readonly totpPersistence: import("@yielded/auth/Totp").TotpPersistence["Service"];
+}, import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/Totp").TotpConfigurationError, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<RS, NativeDatabase>>, coordinateTotpPersistence: {
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, F extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, N, P extends import("drizzle-orm").Table, A, E, R, DE, DR, RS = never>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: import("@yielded/auth-persistence/Adapter").TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/Totp").TotpConfigurationError | import("@yielded/auth/Totp").TotpUnavailable, DR | RS | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, D1BatchStatements | import("@yielded/auth/Totp").TotpPersistence>>;
+  <DB extends EffectSQLiteNodeDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends import("drizzle-orm").Table, F extends import("drizzle-orm").Table, C extends import("drizzle-orm").Table, N, P extends import("drizzle-orm").Table, A, E, R, DE, DR, TxId, TxShape, RS = never>(acquire: Effect.Effect<DB, DE, DR>, options: {
+    readonly mapping: import("@yielded/auth-persistence/Adapter").TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;
+    readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DE | E | import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/Totp").TotpConfigurationError | import("@yielded/auth/Totp").TotpUnavailable, DR | RS | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | D1BatchStatements | import("@yielded/auth/Totp").TotpPersistence>>;
+};
 //#endregion
-export { OAuthProxyPersistence, passwordPreparedPersistenceLayer };
+export { OAuthProxyPersistence };
 //# sourceMappingURL=SqliteNode.d.mts.map