@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/passkey-native.d.mts

@@ -0,0 +1,835 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { NativeSqlTables, SqlTable, sqlMapping } from "./native-sql-table.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, SqlCommitExecutor, SqlCommitOwnerError } from "./sql-commit.mjs";
+import { PasskeyNativeMapping, PasskeyNativeRead, PasskeyNativeRow } from "./passkey-native-state.mjs";
+import { Crypto, Effect, Schema } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/Passkey";
+import { SqlError } from "effect/sql/SqlError";
+//#region src/internal/passkey-native.d.ts
+export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mapping: PasskeyNativeMapping) => Effect.Effect<{
+  batch: boolean;
+  state: {
+    sql: import("effect/sql/SqlClient").SqlClient;
+    tables: NativeSqlTables;
+    subject: SqlTable;
+    credential: SqlTable;
+    factor: SqlTable;
+    now: import("effect/sql/Statement").Fragment;
+    storedNow: import("effect/sql/Statement").Fragment;
+    millis: (expression: import("effect/sql/Statement").Fragment) => import("effect/sql/Statement").Fragment;
+    active: (table: "subject" | "credential" | "authority") => import("effect/sql/Statement").Fragment;
+    native: (id: M.PasskeyCredential["revision"]["subjectId"]) => unknown;
+    sameId: (nativeId: unknown, value: unknown) => boolean;
+    revision: (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    decodeCredential: (row: Readonly<Record<string, unknown>>, current: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    }, subjectRow: Readonly<Record<string, unknown>>) => Effect.Effect<{
+      readonly requirement: {
+        readonly alternatives: readonly [{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }, ...{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }[]];
+        readonly maximumAgeMillis: number;
+      };
+      readonly credentialId: string;
+      readonly rpId: string;
+      readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+      readonly publicKey: string;
+      readonly algorithm: -257 | -7;
+      readonly profile: {
+        readonly profileId: string;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly active: boolean;
+      readonly primarySignIn: boolean;
+      readonly enrollmentUserVerified: boolean;
+      readonly backupEligible: boolean;
+      readonly backupState: boolean;
+      readonly counter: number;
+    } | undefined, PersistenceMappingError, never>;
+    readAuthority: (nativeId: unknown, lock: boolean, credentialId?: string | undefined) => Effect.Effect<{
+      row: Record<string, unknown>;
+      credential: Record<string, unknown> | undefined;
+      revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      nowMillis: number;
+    } | undefined, Schema.SchemaError | SqlError, never>;
+    lookup: (rpId: string, protocolCredentialId: string) => Effect.Effect<{
+      readonly requirement: {
+        readonly alternatives: readonly [{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }, ...{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }[]];
+        readonly maximumAgeMillis: number;
+      };
+      readonly credentialId: string;
+      readonly rpId: string;
+      readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+      readonly publicKey: string;
+      readonly algorithm: -257 | -7;
+      readonly profile: {
+        readonly profileId: string;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly active: boolean;
+      readonly primarySignIn: boolean;
+      readonly enrollmentUserVerified: boolean;
+      readonly backupEligible: boolean;
+      readonly backupState: boolean;
+      readonly counter: number;
+    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | Schema.SchemaError | SqlError, Crypto.Crypto>;
+    joinedSubject: SqlTable;
+    joinedFactor: SqlTable;
+    joinedCredential: SqlTable;
+    selected: (kind: "subject" | "authority" | "credential", alias: string) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+    mapped: typeof sqlMapping;
+    mapping: PasskeyNativeMapping;
+    ceremony: {
+      sql: import("effect/sql/SqlClient").SqlClient;
+      flow: SqlTable;
+      now: import("effect/sql/Statement").Fragment;
+      millis: (expression: import("effect/sql/Statement").Fragment) => import("effect/sql/Statement").Fragment;
+      exact: (key: string, value: unknown) => import("effect/sql/Statement").Fragment;
+      module: (moduleId: string) => import("effect/sql/Statement").Fragment;
+      validModule: (moduleId: string) => boolean;
+      access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
+      insert: (ceremony: M.PasskeyCeremony, extra?: Readonly<Record<string, unknown>>) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+      consume: (input: M.PasskeyAccess, ceremony: M.PasskeyCeremony, condition?: import("effect/sql/Statement").Fragment) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+      absent: (input: M.PasskeyAccess) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+      context: (input: {
+        readonly moduleId: string;
+        readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: number;
+      }) => Effect.Effect<{
+        readonly moduleId: string;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+        readonly profile: {
+          readonly profileId: string;
+          readonly rpId: string;
+          readonly rpName: string;
+          readonly origins: readonly [string, ...string[]];
+          readonly developmentLocalhost: boolean;
+          readonly residentKey: "discouraged" | "preferred" | "required";
+          readonly userVerification: "preferred" | "required";
+          readonly primarySignIn: boolean;
+          readonly attestation: "none";
+          readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+        };
+        readonly challenge: string;
+        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: number;
+        readonly issuedAtMillis: number;
+        readonly expiresAtMillis: number;
+        readonly allowedCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+        readonly context: {
+          readonly _tag: "SignIn";
+        } | {
+          readonly _tag: "Registration";
+          readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+          readonly name: string;
+          readonly displayName: string;
+        } | {
+          readonly _tag: "Enrollment";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+          readonly name: string;
+          readonly authorization: {
+            readonly challenge: {
+              readonly moduleId: string;
+              readonly action: "enroll-begin" | "remove";
+              readonly commandId: string;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            };
+            readonly evidence: {
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+              readonly proofs: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly verifiedAt: import("effect/DateTime").Utc;
+                readonly method: string;
+                readonly credentialId: string;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly verifiedAt: import("effect/DateTime").Utc;
+                readonly method: string;
+                readonly credentialId: string;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              }[]];
+            };
+            readonly requirement: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+          };
+        } | {
+          readonly _tag: "Pending";
+          readonly target: {
+            readonly moduleId: string;
+            readonly kind: string;
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly requirement?: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+            readonly expiresAtMillis: number;
+          };
+        } | {
+          readonly _tag: "StepUp";
+          readonly target: {
+            readonly moduleId: string;
+            readonly kind: string;
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly requirement?: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+            readonly expiresAtMillis: number;
+          };
+        } | {
+          readonly _tag: "Action";
+          readonly target: {
+            readonly moduleId: string;
+            readonly kind: string;
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly requirement?: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+            readonly expiresAtMillis: number;
+          };
+        };
+      } | undefined, Schema.SchemaError | SqlError, never>;
+      cleanup: (moduleId: string, limit: number, batch?: boolean) => Effect.Effect<{
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, Schema.SchemaError | SqlCommitOwnerError | SqlError, CurrentSqlCommit | import("effect/sql/SqlClient").SqlClient>;
+      stage: (statement: import("effect/sql/Statement").Fragment, count: number) => Effect.Effect<void, SqlCommitOwnerError, CurrentSqlCommit>;
+      change: (statement: import("effect/sql/Statement").Fragment) => Effect.Effect<number, Schema.SchemaError | SqlError, never>;
+    };
+    flow: SqlTable;
+    access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
+  };
+  executor: SqlCommitExecutor<M.PasskeyUnavailable>;
+  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>> | Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>, SqlBatchCommit>>;
+  advisory: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<R, Crypto.Crypto>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>>;
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: M.PasskeyCeremony;
+    }, prepare: M.PreparePasskeyCommit<M.PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly context: (input: M.PasskeyAccess) => Effect.Effect<M.PasskeyCeremony | undefined, M.PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: M.PasskeyAccess;
+      readonly ceremony: M.PasskeyCeremony;
+      readonly credential: M.PasskeyCredential;
+      readonly assertion: M.PasskeyAssertionVerified;
+    }, prepare: M.PreparePasskeyCommit<M.PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: M.PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+  };
+  passkeyCredentials: {
+    readonly listForSubject: (input: {
+      readonly moduleId: string;
+      readonly rpId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+    }) => Effect.Effect<M.PasskeyEnrollmentSnapshot | undefined, M.PasskeyUnavailable>;
+    readonly lookup: (input: {
+      readonly rpId: string;
+      readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
+    }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
+  };
+}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping: PasskeyNativeMapping) => Effect.Effect<{
+  batch: boolean;
+  state: {
+    sql: import("effect/sql/SqlClient").SqlClient;
+    tables: NativeSqlTables;
+    subject: SqlTable;
+    credential: SqlTable;
+    factor: SqlTable;
+    now: import("effect/sql/Statement").Fragment;
+    storedNow: import("effect/sql/Statement").Fragment;
+    millis: (expression: import("effect/sql/Statement").Fragment) => import("effect/sql/Statement").Fragment;
+    active: (table: "subject" | "credential" | "authority") => import("effect/sql/Statement").Fragment;
+    native: (id: M.PasskeyCredential["revision"]["subjectId"]) => unknown;
+    sameId: (nativeId: unknown, value: unknown) => boolean;
+    revision: (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    decodeCredential: (row: Readonly<Record<string, unknown>>, current: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    }, subjectRow: Readonly<Record<string, unknown>>) => Effect.Effect<{
+      readonly requirement: {
+        readonly alternatives: readonly [{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }, ...{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }[]];
+        readonly maximumAgeMillis: number;
+      };
+      readonly credentialId: string;
+      readonly rpId: string;
+      readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+      readonly publicKey: string;
+      readonly algorithm: -257 | -7;
+      readonly profile: {
+        readonly profileId: string;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly active: boolean;
+      readonly primarySignIn: boolean;
+      readonly enrollmentUserVerified: boolean;
+      readonly backupEligible: boolean;
+      readonly backupState: boolean;
+      readonly counter: number;
+    } | undefined, PersistenceMappingError, never>;
+    readAuthority: (nativeId: unknown, lock: boolean, credentialId?: string | undefined) => Effect.Effect<{
+      row: Record<string, unknown>;
+      credential: Record<string, unknown> | undefined;
+      revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      nowMillis: number;
+    } | undefined, Schema.SchemaError | SqlError, never>;
+    lookup: (rpId: string, protocolCredentialId: string) => Effect.Effect<{
+      readonly requirement: {
+        readonly alternatives: readonly [{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }, ...{
+          readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+          readonly userVerified: boolean;
+          readonly phishingResistant: boolean;
+          readonly minimumCredentials: number;
+        }[]];
+        readonly maximumAgeMillis: number;
+      };
+      readonly credentialId: string;
+      readonly rpId: string;
+      readonly protocolCredentialId: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+      readonly publicKey: string;
+      readonly algorithm: -257 | -7;
+      readonly profile: {
+        readonly profileId: string;
+        readonly rpId: string;
+        readonly rpName: string;
+        readonly origins: readonly [string, ...string[]];
+        readonly developmentLocalhost: boolean;
+        readonly residentKey: "discouraged" | "preferred" | "required";
+        readonly userVerification: "preferred" | "required";
+        readonly primarySignIn: boolean;
+        readonly attestation: "none";
+        readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+      };
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly active: boolean;
+      readonly primarySignIn: boolean;
+      readonly enrollmentUserVerified: boolean;
+      readonly backupEligible: boolean;
+      readonly backupState: boolean;
+      readonly counter: number;
+    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | Schema.SchemaError | SqlError, Crypto.Crypto>;
+    joinedSubject: SqlTable;
+    joinedFactor: SqlTable;
+    joinedCredential: SqlTable;
+    selected: (kind: "subject" | "authority" | "credential", alias: string) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+    mapped: typeof sqlMapping;
+    mapping: PasskeyNativeMapping;
+    ceremony: {
+      sql: import("effect/sql/SqlClient").SqlClient;
+      flow: SqlTable;
+      now: import("effect/sql/Statement").Fragment;
+      millis: (expression: import("effect/sql/Statement").Fragment) => import("effect/sql/Statement").Fragment;
+      exact: (key: string, value: unknown) => import("effect/sql/Statement").Fragment;
+      module: (moduleId: string) => import("effect/sql/Statement").Fragment;
+      validModule: (moduleId: string) => boolean;
+      access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
+      insert: (ceremony: M.PasskeyCeremony, extra?: Readonly<Record<string, unknown>>) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+      consume: (input: M.PasskeyAccess, ceremony: M.PasskeyCeremony, condition?: import("effect/sql/Statement").Fragment) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+      absent: (input: M.PasskeyAccess) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
+      context: (input: {
+        readonly moduleId: string;
+        readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: number;
+      }) => Effect.Effect<{
+        readonly moduleId: string;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly purpose: "action" | "enrollment" | "pending" | "registration" | "sign-in" | "step-up";
+        readonly profile: {
+          readonly profileId: string;
+          readonly rpId: string;
+          readonly rpName: string;
+          readonly origins: readonly [string, ...string[]];
+          readonly developmentLocalhost: boolean;
+          readonly residentKey: "discouraged" | "preferred" | "required";
+          readonly userVerification: "preferred" | "required";
+          readonly primarySignIn: boolean;
+          readonly attestation: "none";
+          readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+        };
+        readonly challenge: string;
+        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: number;
+        readonly issuedAtMillis: number;
+        readonly expiresAtMillis: number;
+        readonly allowedCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+        readonly context: {
+          readonly _tag: "SignIn";
+        } | {
+          readonly _tag: "Registration";
+          readonly fingerprint: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+          readonly name: string;
+          readonly displayName: string;
+        } | {
+          readonly _tag: "Enrollment";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly userHandle: string & import("effect/Brand").Brand<"effect-auth/PasskeyUserHandle">;
+          readonly name: string;
+          readonly authorization: {
+            readonly challenge: {
+              readonly moduleId: string;
+              readonly action: "enroll-begin" | "remove";
+              readonly commandId: string;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            };
+            readonly evidence: {
+              readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+              readonly proofs: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly verifiedAt: import("effect/DateTime").Utc;
+                readonly method: string;
+                readonly credentialId: string;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly verifiedAt: import("effect/DateTime").Utc;
+                readonly method: string;
+                readonly credentialId: string;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+              }[]];
+            };
+            readonly requirement: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+          };
+        } | {
+          readonly _tag: "Pending";
+          readonly target: {
+            readonly moduleId: string;
+            readonly kind: string;
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly requirement?: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+            readonly expiresAtMillis: number;
+          };
+        } | {
+          readonly _tag: "StepUp";
+          readonly target: {
+            readonly moduleId: string;
+            readonly kind: string;
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly requirement?: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+            readonly expiresAtMillis: number;
+          };
+        } | {
+          readonly _tag: "Action";
+          readonly target: {
+            readonly moduleId: string;
+            readonly kind: string;
+            readonly commandId: string;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+            readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly requirement?: {
+              readonly maximumAgeMillis: number;
+              readonly alternatives: readonly [{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }, ...{
+                readonly userVerified: boolean;
+                readonly phishingResistant: boolean;
+                readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+                readonly minimumCredentials: number;
+              }[]];
+            };
+            readonly expiresAtMillis: number;
+          };
+        };
+      } | undefined, Schema.SchemaError | SqlError, never>;
+      cleanup: (moduleId: string, limit: number, batch?: boolean) => Effect.Effect<{
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, Schema.SchemaError | SqlCommitOwnerError | SqlError, CurrentSqlCommit | import("effect/sql/SqlClient").SqlClient>;
+      stage: (statement: import("effect/sql/Statement").Fragment, count: number) => Effect.Effect<void, SqlCommitOwnerError, CurrentSqlCommit>;
+      change: (statement: import("effect/sql/Statement").Fragment) => Effect.Effect<number, Schema.SchemaError | SqlError, never>;
+    };
+    flow: SqlTable;
+    access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
+  };
+  executor: SqlCommitExecutor<M.PasskeyUnavailable>;
+  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>> | Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>, SqlBatchCommit>>;
+  advisory: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<R, Crypto.Crypto>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>>;
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: M.PasskeyCeremony;
+    }, prepare: M.PreparePasskeyCommit<M.PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly context: (input: M.PasskeyAccess) => Effect.Effect<M.PasskeyCeremony | undefined, M.PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: M.PasskeyAccess;
+      readonly ceremony: M.PasskeyCeremony;
+      readonly credential: M.PasskeyCredential;
+      readonly assertion: M.PasskeyAssertionVerified;
+    }, prepare: M.PreparePasskeyCommit<M.PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: M.PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+  };
+  passkeyCredentials: {
+    readonly listForSubject: (input: {
+      readonly moduleId: string;
+      readonly rpId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+    }) => Effect.Effect<M.PasskeyEnrollmentSnapshot | undefined, M.PasskeyUnavailable>;
+    readonly lookup: (input: {
+      readonly rpId: string;
+      readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
+    }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
+  };
+}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | SqlBatchCommit | import("effect/sql/SqlClient").SqlClient>;
+export type NativePasskeyServices = Effect.Success<ReturnType<typeof makeNativePasskeyServices>>;
+export declare const makeNativePasskeyCredentialServices: (tables: NativeSqlTables, mapping: PasskeyNativeRead) => Effect.Effect<{
+  passkeyCredentials: {
+    readonly listForSubject: (input: {
+      readonly moduleId: string;
+      readonly rpId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+    }) => Effect.Effect<M.PasskeyEnrollmentSnapshot | undefined, M.PasskeyUnavailable>;
+    readonly lookup: (input: {
+      readonly rpId: string;
+      readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
+    }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
+  };
+}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+//#endregion
+//# sourceMappingURL=passkey-native.d.mts.map