@yielded/auth-persistence 0.1.0-beta.18 → 0.1.0-beta.20

package/dist/internal/passkey-kernel.d.mts

@@ -20,12 +20,12 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     equal: (table: object, values: Row) => SqlFragment;
     copiedRow: (row: Row) => Row;
     matchesNativeRow: (table: object, row: Row, key: Row) => boolean;
-    nonce: () => string;
-    key: (kind: string, fields: ReadonlyArray<string>) => string;
-    credentialKey: (rpId: string, id: string) => string;
-    handleKey: (rpId: string, handle: string) => string;
-    subjectScope: (subjectId: string) => string;
-    targetScope: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => string | null;
+    nonce: import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    key: (kind: string, fields: readonly string[]) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    credentialKey: (rpId: string, id: string) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    handleKey: (rpId: string, handle: string) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    subjectScope: (subjectId: string) => import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    targetScope: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => import("effect/Effect").Effect<null, never, never> | import("effect/Effect").Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     policyStorage: {
       encode: (value: {
         readonly generation: number;
@@ -734,7 +734,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       };
     } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
     readPolicyGuards: (mapping: any) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    discoverSubject: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<(string & import("effect/Brand").Brand<"effect-auth/SubjectId">) | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    discoverSubject: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<(string & import("effect/Brand").Brand<"effect-auth/SubjectId">) | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     readRevision: (mapping: any, subject: SubjectRead, ids?: readonly string[] | undefined) => import("effect/Effect").Effect<{
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
@@ -781,7 +781,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly maximumCounter: number;
       };
       row: Row;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     lookupCredential: (mapping: any, rpId: string, protocolCredentialId: string) => import("effect/Effect").Effect<{
       readonly credentialId: string;
       readonly rpId: string;
@@ -817,7 +817,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly backupState: boolean;
       readonly counter: number;
       readonly maximumCounter: number;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     captureEnrollmentContext: (mapping: any, input: {
       readonly moduleId: string;
       readonly rpId: string;
@@ -836,17 +836,473 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly type: "public-key";
         readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
       }[];
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   admission: {
     chargeRetentionMillis: number;
-    chargeScopes: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => {
+    chargeScopes: (ceremony: {
+      readonly moduleId: string;
+      readonly generation: number;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+      readonly profile: {
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly challenge: string;
+      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly issuedAtMillis: number;
+      readonly expiresAtMillis: number;
+      readonly retentionUntilMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly allowedCredentials: readonly {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+      readonly context: {
+        readonly _tag: "SignIn";
+      } | {
+        readonly _tag: "Registration";
+        readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly displayName: string;
+      } | {
+        readonly _tag: "Enrollment";
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly authorization: {
+          readonly challenge: {
+            readonly moduleId: string;
+            readonly action: "enroll-begin" | "enroll-complete" | "remove";
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          };
+          readonly evidence: {
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly proofs: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }[]];
+          };
+          readonly requirement: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+        };
+      } | {
+        readonly _tag: "Pending";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "StepUp";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "Action";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      };
+    }, subjectId?: string | undefined) => import("effect/Effect").Effect<{
       kind: PasskeyChargeKind;
       scope: string;
-    }[];
+    }[], import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     lockAdmission: (mapping: any) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    admissionCondition: (mapping: any, policies: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyMethodPolicy>, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId: string | undefined, added: ReadonlyArray<PasskeyChargeKind>, newFlow: boolean, resolvedSubject: boolean) => SqlFragment;
-    guardAdmission: (mapping: any, policies: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyMethodPolicy>, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, never, CurrentPasskeyTransaction>;
+    admissionCondition: (mapping: any, policies: readonly {
+      readonly generation: number;
+      readonly profiles: readonly [{
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      }, ...{
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      }[]];
+      readonly lifetimeMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly retentionMillis: number;
+      readonly maximumPending: number;
+      readonly maximumPendingPerSubject: number;
+      readonly admission: {
+        readonly global: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly subject: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+        readonly target: {
+          readonly limit: number;
+          readonly windowMillis: number;
+        };
+      };
+    }[], ceremony: {
+      readonly moduleId: string;
+      readonly generation: number;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+      readonly profile: {
+        readonly profileId: string;
+        readonly generation: number;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly challenge: string;
+      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly issuedAtMillis: number;
+      readonly expiresAtMillis: number;
+      readonly retentionUntilMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly allowedCredentials: readonly {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+      readonly context: {
+        readonly _tag: "SignIn";
+      } | {
+        readonly _tag: "Registration";
+        readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly displayName: string;
+      } | {
+        readonly _tag: "Enrollment";
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+        readonly name: string;
+        readonly authorization: {
+          readonly challenge: {
+            readonly moduleId: string;
+            readonly action: "enroll-begin" | "enroll-complete" | "remove";
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          };
+          readonly evidence: {
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly proofs: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly verifiedAt: import("effect/DateTime").Utc;
+              readonly method: string;
+              readonly credentialId: string;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+            }[]];
+          };
+          readonly requirement: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+        };
+      } | {
+        readonly _tag: "Pending";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "StepUp";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      } | {
+        readonly _tag: "Action";
+        readonly target: {
+          readonly moduleId: string;
+          readonly kind: string;
+          readonly commandId: string;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly requirement?: {
+            readonly maximumAgeMillis: number;
+            readonly alternatives: readonly [{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }, ...{
+              readonly userVerified: boolean;
+              readonly phishingResistant: boolean;
+              readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              readonly minimumCredentials: number;
+            }[]];
+          };
+          readonly expiresAtMillis: number;
+        };
+      };
+    }, subjectId: string | undefined, added: readonly PasskeyChargeKind[], newFlow: boolean, resolvedSubject: boolean) => import("effect/Effect").Effect<SqlFragment, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    guardAdmission: (mapping: any, policies: ReadonlyArray<import("@yielded/auth/Passkey").PasskeyMethodPolicy>, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     readCharges: (mapping: any, ceremony: {
       readonly moduleId: string;
       readonly generation: number;
@@ -1098,8 +1554,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly windowMillis: number;
         };
       };
-    }, subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    guardChargeSet: (mapping: any, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, never, CurrentPasskeyTransaction>;
+    }, subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
+    guardChargeSet: (mapping: any, ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, subjectId?: string) => import("effect/Effect").Effect<void, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     insertCharges: (mapping: any, ceremony: {
       readonly moduleId: string;
       readonly generation: number;
@@ -1351,7 +1807,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly windowMillis: number;
         };
       };
-    }, kinds: readonly PasskeyChargeKind[], subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, kinds: readonly PasskeyChargeKind[], subjectId?: string | undefined) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   registrationCustody: {
     releaseRegistrationCustody: (mapping: any, ceremony: {
@@ -1559,7 +2015,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly expiresAtMillis: number;
         };
       };
-    }) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     scrubRegistrationIntent: (mapping: any, ceremony: {
       readonly moduleId: string;
       readonly generation: number;
@@ -2540,7 +2996,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly counter: number;
         readonly maximumCounter: number;
       };
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     terminalFlow: (mapping: any, read: FlowRead, state: "Ambiguous" | "Rejected" | "Verified") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
     issueAssertion: (mapping: any, ceremony: {
       readonly moduleId: string;
@@ -3004,7 +3460,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           };
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     contextAssertion: (mapping: any, access: {
       readonly moduleId: string;
       readonly generation: number;
@@ -3218,7 +3674,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly expiresAtMillis: number;
         };
       };
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     claimAssertion: (mapping: any, input: {
       readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
@@ -3441,7 +3897,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly claimedAtMillis: number;
         readonly claimExpiresAtMillis: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     exactClaim: (read: FlowRead, claim: import("@yielded/auth/Passkey").PasskeyClaim) => boolean;
     settleAssertion: (mapping: any, claim: {
       readonly ceremony: {
@@ -3686,7 +4142,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
         }[]];
       };
-    }, dialect: "mysql" | "pg" | "sqlite") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, dialect: "mysql" | "pg" | "sqlite") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     cleanupCeremonies: (mapping: any, input: {
       readonly moduleId: string;
       readonly nowMillis: number;
@@ -3695,7 +4151,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       terminalized: number;
       removed: number;
       hasMore: boolean;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   registrationCeremony: {
     contextRegistration: (mapping: any, access: {
@@ -3911,7 +4367,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly expiresAtMillis: number;
         };
       };
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     claimRegistration: (mapping: any, input: {
       readonly access: import("@yielded/auth/Passkey").PasskeyAccess;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
@@ -4133,7 +4589,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly claimedAtMillis: number;
         readonly claimExpiresAtMillis: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     settleRegistration: (mapping: any, claim: {
       readonly ceremony: {
         readonly moduleId: string;
@@ -4344,29 +4800,29 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly claimId: string;
       readonly claimedAtMillis: number;
       readonly claimExpiresAtMillis: number;
-    }, outcome: "Ambiguous" | "Rejected") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, outcome: "Ambiguous" | "Rejected") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   target: {
     sqlClientPasskeyStandaloneGuard: (transactionService: Parameters<<Failure>(unavailable: () => Failure, transactionService: import("effect/sql/SqlClient").SqlClient["transactionService"] | undefined) => import("effect/Effect").Effect<void, Failure, never>>[1]) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, never>;
-    makePasskeyExecution: (configuration: PasskeyTargetConfiguration, mapping: unknown) => import("effect/Effect").Effect<PasskeyExecution, import("@yielded/auth/Passkey").PasskeyConfigurationError, import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makePasskeyExecution: (configuration: PasskeyTargetConfiguration, mapping: unknown) => import("effect/Effect").Effect<PasskeyExecution, import("@yielded/auth/Passkey").PasskeyConfigurationError, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     capturedService: <S>(service: S, schemas: Record<string, import("effect/Schema").Codec<any, any, never, never>>, execute: PasskeyExecution) => S;
     prepareValue: <Value, A>(value: Value, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<Value, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, never, CurrentPasskeyTransaction>;
     observationalContext: <A, E, R>(operation: import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, E, CurrentPasskeyTransaction | Exclude<R, CurrentPasskeyTransaction>>;
     makePasskeyPersistence: (mapping: any, execute: PasskeyExecution, configuration: PasskeyTargetConfiguration, registration?: boolean, enrollment?: boolean) => import("@yielded/auth/Passkey").PasskeyPersistence["Service"];
     capturedMapping: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, kind: "read" | "context" | "assertion" | "registration", configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<M, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup>;
-    makeTargetPasskeyCredentials: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
-    makeTargetPasskeyEnrollmentContext: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
-    makeTargetPasskeyPersistence: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetPasskeyRegistration: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyCredentials: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase | import("effect/Crypto").Crypto>;
+    makeTargetPasskeyEnrollmentContext: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase | import("effect/Crypto").Crypto>;
+    makeTargetPasskeyPersistence: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    makeTargetPasskeyRegistration: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
   };
   writeState: {
     jsonStorage: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S) => {
       encode: (value: S["Type"]) => string;
       decode: (text: unknown) => S["Type"];
     };
-    digest: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S, value: S["Type"]) => string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    digest: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S, value: S["Type"]) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     currentSubject: (mapping: any, subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => import("effect/Effect").Effect<{
       subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       nativeId: any;
@@ -4423,15 +4879,15 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly backupState: boolean;
       readonly counter: number;
       readonly maximumCounter: number;
-    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    } | undefined, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     managementPolicy: (mapping: any, subject: WriteSubject) => {
       readonly maximumCredentials: number;
       readonly maximumEvidenceAgeMillis: number;
       readonly requireImmediateInvalidation: boolean;
     };
     metadataAllowed: (mapping: any, subject: WriteSubject) => import("effect/Effect").Effect<boolean, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
-    enrollmentDigest: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    removeDigest: (moduleId: string, commandId: string, credential: import("@yielded/auth/Passkey").PasskeyCredential) => string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    enrollmentDigest: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+    removeDigest: (moduleId: string, commandId: string, credential: import("@yielded/auth/Passkey").PasskeyCredential) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
     authorizeAction: (mapping: any, subject: WriteSubject, authorization: {
       readonly challenge: {
         readonly moduleId: string;
@@ -4526,7 +4982,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly existingSessions: "immediate" | "original-absolute-expiry";
       readonly maximumExposureMillis: number;
       readonly oldAuthenticationEvidence: "rejected";
-    }) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     validRegistration: (ceremony: import("@yielded/auth/Passkey").PasskeyCeremony, verified: {
       readonly algorithm: number;
       readonly userVerified: boolean;
@@ -4745,7 +5201,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly primarySignIn: boolean;
       readonly createdAtMillis: number;
       readonly lastUsedAtMillis?: number;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   enrollment: {
     enrollmentHandle: (mapping: any, subject: WriteSubject, ceremony: {
@@ -4953,7 +5409,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly expiresAtMillis: number;
         };
       };
-    }, create: boolean) => import("effect/Effect").Effect<any, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, create: boolean) => import("effect/Effect").Effect<any, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     issueEnrollment: (mapping: any, input: {
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
@@ -5170,7 +5626,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           };
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     completeEnrollment: (mapping: any, input: {
       readonly claim: import("@yielded/auth/Passkey").PasskeyClaim;
       readonly verified: import("@yielded/auth/Passkey").PasskeyRegistrationVerified;
@@ -5178,8 +5634,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly management: import("@yielded/auth/Passkey").PasskeyManagementPolicy;
       readonly nowMillis: number;
     }) => import("effect/Effect").Effect<{
-      credential?: never;
       readonly _tag: "Rejected";
+      readonly credential?: never;
     } | {
       readonly _tag: "Enrolled";
       readonly credential: {
@@ -5189,7 +5645,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly createdAtMillis: number;
         readonly lastUsedAtMillis?: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   management: {
     listCredentials: (mapping: any, input: {
@@ -5206,7 +5662,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly lastUsedAtMillis?: number;
       }[];
       cursor?: string;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     renameCredential: (mapping: any, input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -5239,7 +5695,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly lastUsedAtMillis?: number;
       };
       readonly replayed: false;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     inspectRemove: (mapping: any, input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -5250,7 +5706,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly _tag: "Rejected";
       readonly decision?: never;
     } | {
-      credential?: never;
+      readonly credential?: never;
       readonly _tag: "Replay";
       readonly result: {
         readonly credentialId: string;
@@ -5301,7 +5757,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly counter: number;
         readonly maximumCounter: number;
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     removeCredential: (mapping: any, input: {
       readonly moduleId: string;
       readonly commandId: string;
@@ -5342,7 +5798,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           readonly oldAuthenticationEvidence: "rejected";
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   registrationWrite: {
     inspectRegistration: (mapping: any, registration: any) => import("effect/Effect").Effect<{
@@ -5350,7 +5806,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       name: string;
       displayName: string;
       eligible: boolean;
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     issueRegistration: (mapping: any, input: {
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly policy: import("@yielded/auth/Passkey").PasskeyMethodPolicy;
@@ -5566,7 +6022,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
           };
         };
       };
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     completeRegistration: (mapping: any, input: {
       readonly claim: import("@yielded/auth/Passkey").PasskeyClaim;
       readonly verified: import("@yielded/auth/Passkey").PasskeyRegistrationVerified;
@@ -5575,14 +6031,14 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "RegistrationAccepted";
-    }, import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
+    }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
   };
   writeTarget: {
     passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
-    makeTargetPasskeyManagement: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyManagement: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
+    coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase | import("effect/Crypto").Crypto>;
   };
 };
 //#endregion