@yielded/auth-persistence 0.1.0-beta.17 → 0.1.0-beta.19

package/dist/internal/passkey-kernel.d.mts

@@ -20,12 +20,12 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     equal: (table: object, values: Row) => SqlFragment;
     copiedRow: (row: Row) => Row;
     matchesNativeRow: (table: object, row: Row, key: Row) => boolean;
-    nonce: () => string;
-    key: (kind: string, fields: ReadonlyArray<string>) => string;
-    credentialKey: (rpId: string, id: string) => string;
-    handleKey: (rpId: string, handle: string) => string;
-    subjectScope: (subjectId: string) => string;
-    targetScope: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => string | null;
+    nonce: import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    key: (kind: string, fields: readonly string[]) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    credentialKey: (rpId: string, id: string) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    handleKey: (rpId: string, handle: string) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    subjectScope: (subjectId: string) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    targetScope: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => import("effect/Effect").Effect<null, never, never> | import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     policyStorage: {
       encode: (value: {
         readonly generation: number;
@@ -260,7 +260,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -292,7 +292,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -324,7 +324,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
@@ -466,7 +466,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -498,7 +498,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -530,7 +530,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
@@ -728,125 +728,581 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly windowMillis: number;
         };
         readonly target: {
-          readonly limit: number;
-          readonly windowMillis: number;
-        };
-      };
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    readPolicyGuards: (mapping: any) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    discoverSubject: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<(string & import("effect/Brand").Brand<"effect-auth/SubjectId">) | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    readRevision: (mapping: any, subject: SubjectRead, ids?: readonly string[] | undefined) => import("effect/Effect").Effect<{
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    readCredential: (mapping: any, subject: SubjectRead, rpId: string, protocolCredentialId: string, ids?: readonly string[] | undefined) => import("effect/Effect").Effect<{
-      credential: {
-        readonly credentialId: string;
-        readonly rpId: string;
-        readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
-        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
-        readonly publicKey: string;
-        readonly algorithm: -257 | -7;
-        readonly profile: {
-          readonly profileId: string;
-          readonly generation: number;
-          readonly rpId: string;
-          readonly rpName: string;
-          readonly origins: readonly [string, ...string[]];
-          readonly developmentLocalhost: boolean;
-          readonly residentKey: "discouraged" | "preferred" | "required";
-          readonly userVerification: "preferred" | "required";
-          readonly primarySignIn: boolean;
-          readonly attestation: "none";
-          readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+      };
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    readPolicyGuards: (mapping: any) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    discoverSubject: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<(string & import("effect/Brand").Brand<"effect-auth/SubjectId">) | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
+    readRevision: (mapping: any, subject: SubjectRead, ids?: readonly string[] | undefined) => import("effect/Effect").Effect<{
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    readCredential: (mapping: any, subject: SubjectRead, rpId: string, protocolCredentialId: string, ids?: readonly string[] | undefined) => import("effect/Effect").Effect<{
+      credential: {
+        readonly credentialId: string;
+        readonly rpId: string;
+        readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly publicKey: string;
+        readonly algorithm: -257 | -7;
+        readonly profile: {
+          readonly profileId: string;
+          readonly generation: number;
+          readonly rpId: string;
+          readonly rpName: string;
+          readonly origins: readonly [string, ...string[]];
+          readonly developmentLocalhost: boolean;
+          readonly residentKey: "discouraged" | "preferred" | "required";
+          readonly userVerification: "preferred" | "required";
+          readonly primarySignIn: boolean;
+          readonly attestation: "none";
+          readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+        };
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly active: boolean;
+        readonly primarySignIn: boolean;
+        readonly enrollmentUserVerified: boolean;
+        readonly backupEligible: boolean;
+        readonly backupState: boolean;
+        readonly counter: number;
+        readonly maximumCounter: number;
+      };
+      row: Row;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
+    lookupCredential: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<{
+      readonly credentialId: string;
+      readonly rpId: string;
+      readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+      readonly publicKey: string;
+      readonly algorithm: -257 | -7;
+      readonly profile: {
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly active: boolean;
+      readonly primarySignIn: boolean;
+      readonly enrollmentUserVerified: boolean;
+      readonly backupEligible: boolean;
+      readonly backupState: boolean;
+      readonly counter: number;
+      readonly maximumCounter: number;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
+    captureEnrollmentContext: (mapping: any, input: {
+      readonly moduleId: string;
+      readonly rpId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+    }) => import("effect/Effect").Effect<{
+      revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      userHandle?: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+      credentials: {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
+  };
+  admission: {
+    chargeRetentionMillis: number;
+    chargeScopes: (ceremony: {
+      readonly moduleId: string;
+      readonly generation: number;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+      readonly profile: {
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly challenge: string;
+      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly issuedAtMillis: number;
+      readonly expiresAtMillis: number;
+      readonly retentionUntilMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly allowedCredentials: readonly {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+      readonly context: {
+        readonly _tag: "SignIn";
+      } | {
+        readonly _tag: "Registration";
+        readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly displayName: string;
+      } | {
+        readonly _tag: "Enrollment";
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly authorization: {
+          readonly challenge: {
+            readonly moduleId: string;
+            readonly action: "enroll-begin" | "enroll-complete" | "remove";
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          };
+          readonly evidence: {
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly proofs: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }[]];
+          };
+          readonly requirement: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+        };
+      } | {
+        readonly _tag: "Pending";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "StepUp";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "Action";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      };
+    }, subjectId?: string | undefined) => import("effect/Effect").Effect<{
+      kind: PasskeyChargeKind;
+      scope: string;
+    }[], import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    lockAdmission: (mapping: any) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    admissionCondition: (mapping: any, policies: readonly {
+      readonly generation: number;
+      readonly profiles: readonly [{
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      }, ...{
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      }[]];
+      readonly lifetimeMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly retentionMillis: number;
+      readonly maximumPending: number;
+      readonly maximumPendingPerSubject: number;
+      readonly admission: {
+        readonly global: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly subject: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly target: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+      };
+    }[], ceremony: {
+      readonly moduleId: string;
+      readonly generation: number;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+      readonly profile: {
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly challenge: string;
+      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly issuedAtMillis: number;
+      readonly expiresAtMillis: number;
+      readonly retentionUntilMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly allowedCredentials: readonly {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+      readonly context: {
+        readonly _tag: "SignIn";
+      } | {
+        readonly _tag: "Registration";
+        readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly displayName: string;
+      } | {
+        readonly _tag: "Enrollment";
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly authorization: {
+          readonly challenge: {
+            readonly moduleId: string;
+            readonly action: "enroll-begin" | "enroll-complete" | "remove";
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          };
+          readonly evidence: {
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly proofs: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }[]];
+          };
+          readonly requirement: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+        };
+      } | {
+        readonly _tag: "Pending";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "StepUp";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
         };
-        readonly revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
+      } | {
+        readonly _tag: "Action";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
         };
-        readonly active: boolean;
-        readonly primarySignIn: boolean;
-        readonly enrollmentUserVerified: boolean;
-        readonly backupEligible: boolean;
-        readonly backupState: boolean;
-        readonly counter: number;
-        readonly maximumCounter: number;
-      };
-      row: Row;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    lookupCredential: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<{
-      readonly credentialId: string;
-      readonly rpId: string;
-      readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
-      readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
-      readonly publicKey: string;
-      readonly algorithm: -257 | -7;
-      readonly profile: {
-        readonly profileId: string;
-        readonly generation: number;
-        readonly rpId: string;
-        readonly rpName: string;
-        readonly origins: readonly [string, ...string[]];
-        readonly developmentLocalhost: boolean;
-        readonly residentKey: "discouraged" | "preferred" | "required";
-        readonly userVerification: "preferred" | "required";
-        readonly primarySignIn: boolean;
-        readonly attestation: "none";
-        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
-      };
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
       };
-      readonly active: boolean;
-      readonly primarySignIn: boolean;
-      readonly enrollmentUserVerified: boolean;
-      readonly backupEligible: boolean;
-      readonly backupState: boolean;
-      readonly counter: number;
-      readonly maximumCounter: number;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    captureEnrollmentContext: (mapping: any, input: {
-      readonly moduleId: string;
-      readonly rpId: string;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-    }) => import("effect/Effect").Effect<{
-      revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      userHandle?: (string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">) | undefined;
-      credentials: {
-        readonly type: "public-key";
-        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
-      }[];
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-  };
-  admission: {
-    chargeRetentionMillis: number;
-    chargeScopes: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => {
-      kind: PasskeyChargeKind;
-      scope: string;
-    }[];
-    lockAdmission: (mapping: any) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    admissionCondition: (mapping: any, policies: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyMethodPolicy>, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId: string | undefined, added: ReadonlyArray<PasskeyChargeKind>, newFlow: boolean, resolvedSubject: boolean) => SqlFragment;
-    guardAdmission: (mapping: any, policies: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyMethodPolicy>, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, never, CurrentPasskeyTransaction>;
+    }, subjectId: string | undefined, added: readonly PasskeyChargeKind[], newFlow: boolean, resolvedSubject: boolean) => import("effect/Effect").Effect<SqlFragment, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    guardAdmission: (mapping: any, policies: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyMethodPolicy>, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     readCharges: (mapping: any, ceremony: {
       readonly moduleId: string;
       readonly generation: number;
@@ -984,7 +1440,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1016,7 +1472,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1048,7 +1504,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
@@ -1098,8 +1554,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly windowMillis: number;
         };
       };
-    }, subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    guardChargeSet: (mapping: any, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, never, CurrentPasskeyTransaction>;
+    }, subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
+    guardChargeSet: (mapping: any, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     insertCharges: (mapping: any, ceremony: {
       readonly moduleId: string;
       readonly generation: number;
@@ -1237,7 +1693,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1269,7 +1725,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1301,7 +1757,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
@@ -1351,7 +1807,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly windowMillis: number;
         };
       };
-    }, kinds: readonly PasskeyChargeKind[], subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, kinds: readonly PasskeyChargeKind[], subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   registrationCustody: {
     releaseRegistrationCustody: (mapping: any, ceremony: {
@@ -1491,7 +1947,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1523,7 +1979,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1555,11 +2011,11 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
-    }) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     scrubRegistrationIntent: (mapping: any, ceremony: {
       readonly moduleId: string;
       readonly generation: number;
@@ -1697,7 +2153,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1729,7 +2185,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -1761,7 +2217,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
@@ -1920,7 +2376,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -1952,7 +2408,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -1984,7 +2440,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
@@ -2176,7 +2632,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -2208,7 +2664,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -2240,7 +2696,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
@@ -2431,7 +2887,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           } | {
@@ -2463,7 +2919,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           } | {
@@ -2495,7 +2951,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           };
@@ -2503,7 +2959,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly claimId: string;
         readonly claimedAtMillis: number;
         readonly claimExpiresAtMillis: number;
-      } | undefined;
+      };
       credential?: {
         readonly credentialId: string;
         readonly rpId: string;
@@ -2539,8 +2995,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly backupState: boolean;
         readonly counter: number;
         readonly maximumCounter: number;
-      } | undefined;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+      };
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     terminalFlow: (mapping: any, read: FlowRead, state: "Ambiguous" | "Rejected" | "Verified") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
     issueAssertion: (mapping: any, ceremony: {
       readonly moduleId: string;
@@ -2679,7 +3135,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -2711,7 +3167,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -2743,7 +3199,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
@@ -2795,7 +3251,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       };
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
-      readonly ceremony?: undefined;
+      readonly ceremony?: never;
     } | {
       readonly _tag: "Issued";
       readonly ceremony: {
@@ -2935,7 +3391,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -2967,7 +3423,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -2999,12 +3455,12 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     contextAssertion: (mapping: any, access: {
       readonly moduleId: string;
       readonly generation: number;
@@ -3150,7 +3606,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -3182,7 +3638,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -3214,11 +3670,11 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     claimAssertion: (mapping: any, input: {
       readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
@@ -3227,7 +3683,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly credential?: import("@yielded/auth/Passkey").PasskeyCredential;
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
-      readonly claim?: undefined;
+      readonly claim?: never;
     } | {
       readonly _tag: "Claimed";
       readonly claim: {
@@ -3368,7 +3824,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           } | {
@@ -3400,7 +3856,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           } | {
@@ -3432,7 +3888,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           };
@@ -3441,7 +3897,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly claimedAtMillis: number;
         readonly claimExpiresAtMillis: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     exactClaim: (read: FlowRead, claim: import("@yielded/auth/Passkey").PasskeyClaim) => boolean;
     settleAssertion: (mapping: any, claim: {
       readonly ceremony: {
@@ -3581,7 +4037,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -3613,7 +4069,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -3645,7 +4101,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
@@ -3686,7 +4142,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
         }[]];
       };
-    }, dialect: "mysql" | "pg" | "sqlite") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, dialect: "mysql" | "pg" | "sqlite") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     cleanupCeremonies: (mapping: any, input: {
       readonly moduleId: string;
       readonly nowMillis: number;
@@ -3695,7 +4151,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       terminalized: number;
       removed: number;
       hasMore: boolean;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   registrationCeremony: {
     contextRegistration: (mapping: any, access: {
@@ -3843,7 +4299,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -3875,7 +4331,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -3907,18 +4363,18 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     claimRegistration: (mapping: any, input: {
       readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly claimId: string;
     }) => import("effect/Effect").Effect<{
-      readonly claim?: undefined;
+      readonly claim?: never;
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Claimed";
@@ -4060,7 +4516,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           } | {
@@ -4092,7 +4548,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           } | {
@@ -4124,7 +4580,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                   readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                   readonly minimumCredentials: number;
                 }[]];
-              } | undefined;
+              };
               readonly expiresAtMillis: number;
             };
           };
@@ -4133,7 +4589,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly claimedAtMillis: number;
         readonly claimExpiresAtMillis: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     settleRegistration: (mapping: any, claim: {
       readonly ceremony: {
         readonly moduleId: string;
@@ -4272,7 +4728,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -4304,7 +4760,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -4336,7 +4792,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
@@ -4344,29 +4800,29 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly claimId: string;
       readonly claimedAtMillis: number;
       readonly claimExpiresAtMillis: number;
-    }, outcome: "Ambiguous" | "Rejected") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, outcome: "Ambiguous" | "Rejected") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   target: {
     sqlClientPasskeyStandaloneGuard: (transactionService: Parameters<<Failure>(unavailable: () => Failure, transactionService: import("effect/sql/SqlClient").SqlClient["transactionService"] | undefined) => import("effect/Effect").Effect<void, Failure, never>>[1]) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, never>;
-    makePasskeyExecution: (configuration: PasskeyTargetConfiguration, mapping: unknown) => import("effect/Effect").Effect<PasskeyExecution, import("@yielded/auth/Passkey").PasskeyConfigurationError, import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makePasskeyExecution: (configuration: PasskeyTargetConfiguration, mapping: unknown) => import("effect/Effect").Effect<PasskeyExecution, import("@yielded/auth/Passkey").PasskeyConfigurationError, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     capturedService: <S>(service: S, schemas: Record<string, import("effect/Schema").Codec<any, any, never, never>>, execute: PasskeyExecution) => S;
     prepareValue: <Value, A>(value: Value, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<Value, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, never, CurrentPasskeyTransaction>;
     observationalContext: <A, E, R>(operation: import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, E, CurrentPasskeyTransaction | Exclude<R, CurrentPasskeyTransaction>>;
     makePasskeyPersistence: (mapping: any, execute: PasskeyExecution, configuration: PasskeyTargetConfiguration, registration?: boolean, enrollment?: boolean) => import("@yielded/auth/Passkey").PasskeyPersistence["Service"];
     capturedMapping: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, kind: "read" | "context" | "assertion" | "registration", configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<M, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup>;
-    makeTargetPasskeyCredentials: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
-    makeTargetPasskeyEnrollmentContext: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
-    makeTargetPasskeyPersistence: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetPasskeyRegistration: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyCredentials: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase | import("effect/Crypto").Crypto>;
+    makeTargetPasskeyEnrollmentContext: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase | import("effect/Crypto").Crypto>;
+    makeTargetPasskeyPersistence: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    makeTargetPasskeyRegistration: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
   };
   writeState: {
     jsonStorage: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S) => {
       encode: (value: S["Type"]) => string;
       decode: (text: unknown) => S["Type"];
     };
-    digest: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S, value: S["Type"]) => string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    digest: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S, value: S["Type"]) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     currentSubject: (mapping: any, subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => import("effect/Effect").Effect<{
       subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       nativeId: any;
@@ -4386,7 +4842,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly name: string;
       readonly primarySignIn: boolean;
       readonly createdAtMillis: number;
-      readonly lastUsedAtMillis?: number | undefined;
+      readonly lastUsedAtMillis?: number;
     };
     ownedCredential: (mapping: any, subject: WriteSubject, row: any) => import("effect/Effect").Effect<{
       readonly credentialId: string;
@@ -4423,15 +4879,15 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly backupState: boolean;
       readonly counter: number;
       readonly maximumCounter: number;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     managementPolicy: (mapping: any, subject: WriteSubject) => {
       readonly maximumCredentials: number;
       readonly maximumEvidenceAgeMillis: number;
       readonly requireImmediateInvalidation: boolean;
     };
     metadataAllowed: (mapping: any, subject: WriteSubject) => import("effect/Effect").Effect<boolean, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    enrollmentDigest: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    removeDigest: (moduleId: string, commandId: string, credential: import("@yielded/auth/Passkey").PasskeyCredential) => string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    enrollmentDigest: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    removeDigest: (moduleId: string, commandId: string, credential: import("@yielded/auth/Passkey").PasskeyCredential) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     authorizeAction: (mapping: any, subject: WriteSubject, authorization: {
       readonly challenge: {
         readonly moduleId: string;
@@ -4526,7 +4982,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly existingSessions: "immediate" | "original-absolute-expiry";
       readonly maximumExposureMillis: number;
       readonly oldAuthenticationEvidence: "rejected";
-    }) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     validRegistration: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, verified: {
       readonly algorithm: number;
       readonly userVerified: boolean;
@@ -4671,7 +5127,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -4703,7 +5159,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -4735,7 +5191,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
@@ -4744,8 +5200,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly name: string;
       readonly primarySignIn: boolean;
       readonly createdAtMillis: number;
-      readonly lastUsedAtMillis?: number | undefined;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+      readonly lastUsedAtMillis?: number;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   enrollment: {
     enrollmentHandle: (mapping: any, subject: WriteSubject, ceremony: {
@@ -4885,7 +5341,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -4917,7 +5373,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       } | {
@@ -4949,11 +5405,11 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
               readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
               readonly minimumCredentials: number;
             }[]];
-          } | undefined;
+          };
           readonly expiresAtMillis: number;
         };
       };
-    }, create: boolean) => import("effect/Effect").Effect<any, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, create: boolean) => import("effect/Effect").Effect<any, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     issueEnrollment: (mapping: any, input: {
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
@@ -4961,7 +5417,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly authorization: import("@yielded/auth/Passkey").PasskeyActionAuthorization;
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
-      readonly ceremony?: undefined;
+      readonly ceremony?: never;
     } | {
       readonly _tag: "Issued";
       readonly ceremony: {
@@ -5101,7 +5557,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -5133,7 +5589,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -5165,12 +5621,12 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     completeEnrollment: (mapping: any, input: {
       readonly claim: import("@yielded/auth/Passkey").PasskeyClaim;
       readonly verified: import("@yielded/auth/Passkey").PasskeyRegistrationVerified;
@@ -5178,8 +5634,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly management: import("@yielded/auth/Passkey").PasskeyManagementPolicy;
       readonly nowMillis: number;
     }) => import("effect/Effect").Effect<{
-      credential?: undefined;
       readonly _tag: "Rejected";
+      readonly credential?: never;
     } | {
       readonly _tag: "Enrolled";
       readonly credential: {
@@ -5187,9 +5643,9 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly name: string;
         readonly primarySignIn: boolean;
         readonly createdAtMillis: number;
-        readonly lastUsedAtMillis?: number | undefined;
+        readonly lastUsedAtMillis?: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   management: {
     listCredentials: (mapping: any, input: {
@@ -5203,10 +5659,10 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly name: string;
         readonly primarySignIn: boolean;
         readonly createdAtMillis: number;
-        readonly lastUsedAtMillis?: number | undefined;
+        readonly lastUsedAtMillis?: number;
       }[];
-      cursor?: string | undefined;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+      cursor?: string;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     renameCredential: (mapping: any, input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -5216,9 +5672,9 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly nowMillis: number;
       readonly retentionUntilMillis: number;
     }) => import("effect/Effect").Effect<{
-      readonly observation?: undefined;
+      readonly observation?: never;
       readonly _tag: "Rejected";
-      readonly decision?: undefined;
+      readonly decision?: never;
     } | {
       _tag: "Renamed";
       credential: {
@@ -5226,7 +5682,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly name: string;
         readonly primarySignIn: boolean;
         readonly createdAtMillis: number;
-        readonly lastUsedAtMillis?: number | undefined;
+        readonly lastUsedAtMillis?: number;
       };
       replayed: boolean;
     } | {
@@ -5236,21 +5692,21 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly name: string;
         readonly primarySignIn: boolean;
         readonly createdAtMillis: number;
-        readonly lastUsedAtMillis?: number | undefined;
+        readonly lastUsedAtMillis?: number;
       };
       readonly replayed: false;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     inspectRemove: (mapping: any, input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
       readonly commandId: string;
       readonly credentialId: string;
     }) => import("effect/Effect").Effect<{
-      readonly observation?: undefined;
+      readonly observation?: never;
       readonly _tag: "Rejected";
-      readonly decision?: undefined;
+      readonly decision?: never;
     } | {
-      credential?: undefined;
+      readonly credential?: never;
       readonly _tag: "Replay";
       readonly result: {
         readonly credentialId: string;
@@ -5263,7 +5719,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly replayed: true;
       };
     } | {
-      readonly result?: undefined;
+      readonly result?: never;
       readonly _tag: "Target";
       readonly credential: {
         readonly credentialId: string;
@@ -5301,7 +5757,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly counter: number;
         readonly maximumCounter: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     removeCredential: (mapping: any, input: {
       readonly moduleId: string;
       readonly commandId: string;
@@ -5312,9 +5768,9 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly nowMillis: number;
       readonly retentionUntilMillis: number;
     }) => import("effect/Effect").Effect<{
-      readonly observation?: undefined;
+      readonly observation?: never;
       readonly _tag: "Rejected";
-      readonly decision?: undefined;
+      readonly decision?: never;
     } | {
       readonly _tag: "Removed";
       readonly result: {
@@ -5328,7 +5784,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly replayed: true;
       };
     } | {
-      readonly result?: undefined;
+      readonly result?: never;
       readonly _tag: "LastSignInMethod";
     } | {
       readonly _tag: "Removed";
@@ -5342,7 +5798,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly oldAuthenticationEvidence: "rejected";
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   registrationWrite: {
     inspectRegistration: (mapping: any, registration: any) => import("effect/Effect").Effect<{
@@ -5350,14 +5806,14 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       name: string;
       displayName: string;
       eligible: boolean;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     issueRegistration: (mapping: any, input: {
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
       readonly registration: any;
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
-      readonly ceremony?: undefined;
+      readonly ceremony?: never;
     } | {
       readonly _tag: "Issued";
       readonly ceremony: {
@@ -5497,7 +5953,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -5529,7 +5985,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         } | {
@@ -5561,12 +6017,12 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
                 readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
                 readonly minimumCredentials: number;
               }[]];
-            } | undefined;
+            };
             readonly expiresAtMillis: number;
           };
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     completeRegistration: (mapping: any, input: {
       readonly claim: import("@yielded/auth/Passkey").PasskeyClaim;
       readonly verified: import("@yielded/auth/Passkey").PasskeyRegistrationVerified;
@@ -5575,14 +6031,14 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "RegistrationAccepted";
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   writeTarget: {
     passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
-    makeTargetPasskeyManagement: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyManagement: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
   };
 };
 //#endregion