@yielded/auth 0.1.0-beta.1

package/dist/DrizzleSqliteDo.d.mts

@@ -0,0 +1,2343 @@
+import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, PendingRegistration, SubjectId, TokenDigest, VerifiedEmail } from "./Schema.mjs";
+import { AuthenticationAssurance } from "./operations/context.mjs";
+import { AuthenticationEvidence, PendingConsumption, SecurityRevision, SessionCredentialVersion, SessionId } from "./sessions/models.mjs";
+import { ExternalIdentity, IdentityConflict, IdentityUnavailable, LoginIdentifier, ProvisioningResult } from "./identity/models.mjs";
+import { HookConfigurationError } from "./hooks/models.mjs";
+import { LifecycleHooks } from "./hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "./hooks/commit.mjs";
+import { PrepareSessionCommit } from "./sessions/commit.mjs";
+import { PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionUnavailable, StaleAuthentication } from "./sessions/errors.mjs";
+import { AuthenticationAuthority } from "./sessions/AuthenticationAuthority.mjs";
+import { PendingAuthentication, PendingAuthenticationRecord } from "./sessions/PendingAuthentication.mjs";
+import { RequestBindingFlowId } from "./operations/requestBindingModels.mjs";
+import "./Operations.mjs";
+import { SessionInvalidationWindow } from "./sessions/invalidation.mjs";
+import { SessionRepository, SignedSessionValidity, StatefulSessionPersistence, StatefulSessionRecord } from "./sessions/persistence.mjs";
+import { SessionStepUpPersistence } from "./sessions/SessionStepUpPersistence.mjs";
+import "./Hooks.mjs";
+import "./Sessions.mjs";
+import { PasswordUnavailable } from "./password/methods/errors.mjs";
+import { AuthStoreError, InvalidRegistration } from "./Errors.mjs";
+import { ConsumeDecision } from "./auth/ConsumeDecision.mjs";
+import { AuthStoreDecisions, ChallengeConsumeDecision } from "./internal/AuthStoreDecisions.mjs";
+import { EmailOtpRejected, IssueChallengeError } from "./AuthStore.mjs";
+import { EmailAddressDecision, EmailCredentialSnapshot } from "./email/models.mjs";
+import { ProofAttemptDecision, ProofBinding, ProofCleanupResult, ProofCompletionDecision, ProofContinuationId, ProofDeliveryId, ProofDeliveryOutcome, ProofId, ProofPurpose, ProofVersion } from "./proofs/models.mjs";
+import { SubjectProvisioningInput } from "./identity/SubjectProvisioner.mjs";
+import { InvalidOAuthState } from "./oauth/errors.mjs";
+import { OAuthProviderKey, OAuthState } from "./oauth/schema.mjs";
+import { AuthStoreTables, AuthTables, DrizzleMappingError, ExternalIdentityTables, IdentityTables, OAuthStateTables, SubjectProvisioningTables } from "./drizzle/model.mjs";
+import { EmailAddressMapping, EmailRegistrationMapping, EmailSignInMapping } from "./drizzle/email-model.mjs";
+import { PasswordAttemptAdmission, PasswordAttemptDecision, PasswordAttemptId, PasswordCredentialSnapshot, PasswordMutationDecision } from "./password/methods/models.mjs";
+import { ProofRequestConflict, ProofUnavailable } from "./proofs/errors.mjs";
+import { ProofPolicy } from "./proofs/policy.mjs";
+import { PrepareProofCommit, ProofCompletionInput, ProofDeliveryClaim, ProofDigest, ProofIssueDecision, ProofPersistence, ProofRecord } from "./proofs/ProofPersistence.mjs";
+import { ProofCompletionPlan } from "./proofs/completion.mjs";
+import "./Identity.mjs";
+import "./Proofs.mjs";
+import { EncodedPasswordHash } from "./password/models.mjs";
+import { PasswordAttemptPolicy } from "./password/methods/policy.mjs";
+import { PasswordMutationInput, PasswordPersistence, PreparePasswordCommit } from "./password/methods/PasswordPersistence.mjs";
+import { PasswordPreparedPersistence } from "./password/methods/PasswordPreparedPersistence.mjs";
+import { PasswordPersistenceMapping, PasswordRegistrationMapping } from "./drizzle/password-model.mjs";
+import { ProofPersistenceMapping } from "./drizzle/proof-model.mjs";
+import { PasswordPreparedPersistenceMapping, PasswordPreparedProofMapping } from "./drizzle/password-prepared-model.mjs";
+import { AuthenticationAuthorityMapping, PendingAuthenticationMapping, SignedSessionValidityMapping, StatefulSessionMapping } from "./drizzle/session-model.mjs";
+import { PasskeyConfigurationError } from "./passkey/errors.mjs";
+import { PasskeyPersistence } from "./passkey/PasskeyPersistence.mjs";
+import { PasskeyCredentialMapping, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyMappingSource, PasskeyPersistenceMapping, PasskeyPersistenceServices } from "./drizzle/passkey-model.mjs";
+import { SessionStepUpMapping } from "./drizzle/step-up-model.mjs";
+import { OAuthRegistrationIntent } from "./oauth/registrationModels.mjs";
+import { OAuthUnavailable } from "./oauth/signInErrors.mjs";
+import { OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthPendingFlow, OAuthSettlementDecision, OAuthVerifiedExternalIdentity } from "./oauth/signInModels.mjs";
+import { OAuthSignInPersistence, PrepareOAuthCommit } from "./oauth/OAuthSignInPersistence.mjs";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkOutcome, OAuthLinkPendingFlow } from "./oauth/accountsModels.mjs";
+import { OAuthAccountsMapping, OAuthRegistrationAuthority, OAuthRegistrationIntentMapping, OAuthRegistrationMapping, OAuthSignInMapping } from "./drizzle/oauth-model.mjs";
+import { OAuthConnectedAccess, OAuthConnectedActionAuthorization, OAuthConnectedClaim, OAuthConnectedDisconnectGrant, OAuthConnectedOutcome, OAuthConnectedPendingFlow, OAuthConnectedRefreshClaim, OAuthConnectedRefreshOutcome, OAuthConnectedRevocationJob, OAuthConnectedStoredGrant, OAuthConnectedTarget, OAuthConnectedUseAuthorization } from "./oauth/connectedModels.mjs";
+import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "./drizzle/oauth-connected-model.mjs";
+import { PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices } from "./drizzle/passkey-registration-ceremony-model.mjs";
+import { EmailUnavailable } from "./email/errors.mjs";
+import { EmailAddressMutation, EmailAddressPersistence, EmailAddressTarget, PrepareEmailCommit } from "./email/EmailAddressPersistence.mjs";
+import "./Email.mjs";
+import { EmailRegistrationAuthority } from "./drizzle/email-registration.mjs";
+import { OAuthAccountsPersistence } from "./oauth/OAuthAccountsPersistence.mjs";
+import { OAuthConnectedPersistence } from "./oauth/OAuthConnectedPersistence.mjs";
+import { OAuthConnectedRevocationClaim, OAuthConnectedRevocations } from "./oauth/OAuthConnectedRevocations.mjs";
+import { OAuthRegistrationIntents, OAuthRegistrationSettlement } from "./oauth/OAuthRegistrationIntents.mjs";
+import { OAuthStateDecisions } from "./oauth/OAuthStateDecisions.mjs";
+import "./OAuth.mjs";
+import { OAuthCoordinatorError } from "./drizzle/oauth-target.mjs";
+import "./Password.mjs";
+import { PasswordRegistrationAuthority } from "./drizzle/password-registration.mjs";
+import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
+import { TotpConfigurationError } from "./totp/errors.mjs";
+import { TotpPersistence } from "./totp/TotpPersistence.mjs";
+import { TotpMapping, TotpMappingSource, TotpPersistenceServices } from "./drizzle/totp-model.mjs";
+import { PasskeyManagementPersistence } from "./passkey/PasskeyManagementPersistence.mjs";
+import { PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter } from "./drizzle/passkey-write-model.mjs";
+import { PasskeyCoordinatorError } from "./drizzle/passkey-target.mjs";
+import { PhoneConfigurationError } from "./phone/lifecycleModels.mjs";
+import { PhoneAdmission } from "./phone/PhoneAdmission.mjs";
+import { PhonePersistence } from "./phone/PhonePersistence.mjs";
+import { PhoneSignInTargets } from "./phone/PhoneSignInTargets.mjs";
+import { PhoneMapping, PhoneMappingSource, PhonePersistenceServices } from "./drizzle/phone-model.mjs";
+import "./Drizzle.mjs";
+import "./Totp.mjs";
+import { SuppliedService } from "./drizzle/SuppliedService.mjs";
+import { TotpCoordinatorError } from "./drizzle/totp-target.mjs";
+import "./Passkey.mjs";
+import "./PhoneOtp.mjs";
+import { PhoneCoordinatorError } from "./drizzle/phone-target.mjs";
+import { Context, Effect } from "effect";
+import { AnyRelations } from "drizzle-orm";
+import { SqlError } from "effect/unstable/sql/SqlError";
+import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
+//#region src/DrizzleSqliteDo.d.ts
+/**
+ * Email mutations must own their outer transactionSync. Arbitrary raw Drizzle
+ * nesting is not detectable; owner bodies and mapping allocators stay runSync-compatible.
+ */
+declare const coordinateEmailAddress: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+    readonly proofMapping: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<Out, E, NoInfer<EmailAddressPersistence>>): Effect.Effect<Out, DatabaseError | E | EmailUnavailable | HookConfigurationError | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+    readonly proofMapping: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<Out, E, NoInfer<TxId | EmailAddressPersistence>>): Effect.Effect<Out, DatabaseError | E | EmailUnavailable | HookConfigurationError | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, coordinateEmailRegistration: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly proofMapping: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<Out, E, NoInfer<TargetId>>): Effect.Effect<Out, DatabaseError | E | EmailUnavailable | HookConfigurationError | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly proofMapping: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<Out, E, NoInfer<TargetId | TxId>>): Effect.Effect<Out, DatabaseError | E | EmailUnavailable | HookConfigurationError | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, makeEmailAddressServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>, proofMapping: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+  emailAddressPersistence: {
+    readonly target: (input: {
+      readonly moduleId: string;
+      readonly subjectId: SubjectId;
+      readonly target: LoginIdentifier;
+      readonly sourceCredentialId?: string;
+    }) => Effect.Effect<EmailAddressTarget, EmailUnavailable>;
+    readonly checkCompletion: (input: ProofCompletionInput) => Effect.Effect<boolean, EmailUnavailable>;
+    readonly verifyWithProof: <A>(input: EmailAddressMutation, prepare: PrepareEmailCommit<EmailAddressDecision, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
+    readonly changeWithProof: <A>(input: EmailAddressMutation, prepare: PrepareEmailCommit<EmailAddressDecision, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: number;
+    }, prepare: PrepareEmailCommit<{
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
+  };
+}, never, LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+  registrationAuthority: EmailRegistrationAuthority<Registration>;
+}, never, LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
+  emailSignInTargets: {
+    readonly lookup: (input: {
+      readonly moduleId: string;
+      readonly identifier: LoginIdentifier;
+    }) => Effect.Effect<import("effect/Option").Option<EmailCredentialSnapshot>, EmailUnavailable>;
+  };
+}, never, never>;
+/**
+ * Password mutations and registration must own their outer transactionSync.
+ * Arbitrary raw Drizzle nesting is not detectable; owner bodies must remain
+ * runSync-compatible. Detectable Effect commit scopes are rejected pre-write.
+ */
+declare const coordinatePasswordPersistence: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+    readonly proofMapping?: PM | undefined;
+    readonly transaction?: never;
+  }, body: Effect.Effect<Out, E, NoInfer<PasswordPersistence>>): Effect.Effect<Out, DatabaseError | E | HookConfigurationError | PasswordUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+    readonly proofMapping?: PM | undefined;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<Out, E, NoInfer<TxId | PasswordPersistence>>): Effect.Effect<Out, DatabaseError | E | HookConfigurationError | PasswordUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, coordinatePasswordRegistration: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<Out, E, NoInfer<TargetId>>): Effect.Effect<Out, DatabaseError | E | HookConfigurationError | PasswordUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<Out, E, NoInfer<TargetId | TxId>>): Effect.Effect<Out, DatabaseError | E | HookConfigurationError | PasswordUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, makePasswordPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+  passwordPersistence: {
+    readonly admitAttempt: <A_1>(input: {
+      readonly moduleId: string;
+      readonly action: "sign-in" | "change";
+      readonly identifier: LoginIdentifier;
+      readonly subjectId?: SubjectId;
+      readonly policy: PasswordAttemptPolicy;
+    }, prepare: PreparePasswordCommit<PasswordAttemptAdmission, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly settleAttempt: <A_1>(input: {
+      readonly moduleId: string;
+      readonly attemptId: PasswordAttemptId;
+      readonly captured?: PasswordCredentialSnapshot;
+      readonly outcome: PasswordAttemptDecision;
+      readonly rehash?: {
+        readonly expectedVersion: SecurityRevision;
+        readonly expectedVerifier: import("effect/Redacted").Redacted<EncodedPasswordHash>;
+        readonly nextVerifier: import("effect/Redacted").Redacted<EncodedPasswordHash>;
+      };
+    }, prepare: PreparePasswordCommit<PasswordAttemptDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly readForSubject: (input: {
+      readonly moduleId: string;
+      readonly subjectId: SubjectId;
+    }) => Effect.Effect<import("effect/Option").Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly recoveryTarget: (input: {
+      readonly moduleId: string;
+      readonly identifier: LoginIdentifier;
+    }) => Effect.Effect<import("effect/Option").Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly addIfAbsent: <A_1>(input: PasswordMutationInput, prepare: PreparePasswordCommit<PasswordMutationDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly replaceIfCurrent: <A_1>(input: PasswordMutationInput, prepare: PreparePasswordCommit<PasswordMutationDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly checkReset: (input: ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
+    readonly resetWithProof: <A_1>(input: PasswordMutationInput & {
+      readonly completion: ProofCompletionPlan;
+    }, prepare: PreparePasswordCommit<PasswordMutationDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly cleanupAttempts: <A_1>(input: {
+      readonly moduleId: string;
+      readonly limit: number;
+    }, prepare: PreparePasswordCommit<{
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
+  };
+}, never, LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
+  registrationAuthority: PasswordRegistrationAuthority<Registration>;
+}, never, LifecycleHooks>;
+/**
+ * Proof mutations and coordinateProofPersistence must own their outermost
+ * transactionSync call. The installed driver cannot detect an arbitrary raw
+ * Drizzle outer transaction; calling either boundary from one is unsupported.
+ * The owner body must remain runSync-compatible.
+ */
+declare const coordinateProofPersistence: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<ProofPersistence>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | ProofUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | ProofPersistence>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | ProofUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, makeProofPersistenceServices: <Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, A extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>) => Effect.Effect<{
+  proofPersistence: {
+    readonly issue: <A_1>(input: {
+      readonly record: ProofRecord;
+      readonly policy: ProofPolicy;
+      readonly eligible: boolean;
+      readonly supersedes?: ProofId;
+    }, prepare: PrepareProofCommit<ProofIssueDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofRequestConflict | ProofUnavailable>;
+    readonly attempt: <A_1>(input: {
+      readonly moduleId: string;
+      readonly purpose: ProofPurpose;
+      readonly proofId: ProofId;
+      readonly binding: ProofBinding;
+      readonly candidate?: ProofDigest;
+      readonly continuationId: ProofContinuationId;
+      readonly continuationDigest: TokenDigest;
+      readonly nowMillis: number;
+      readonly policy: ProofPolicy;
+    }, prepare: PrepareProofCommit<ProofAttemptDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
+    readonly complete: <A_1>(input: ProofCompletionInput, prepare: PrepareProofCommit<ProofCompletionDecision, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
+    readonly claimDelivery: <A_1>(input: {
+      readonly moduleId: string;
+      readonly proofId: ProofId;
+      readonly version: ProofVersion;
+      readonly deliveryId: ProofDeliveryId;
+      readonly nowMillis: number;
+      readonly policy: ProofPolicy;
+      readonly allowAmbiguousRetry: boolean;
+    }, prepare: PrepareProofCommit<ProofDeliveryClaim, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
+    readonly settleDelivery: <A_1>(input: {
+      readonly moduleId: string;
+      readonly proofId: ProofId;
+      readonly version: ProofVersion;
+      readonly deliveryId: ProofDeliveryId;
+      readonly claimVersion: ProofVersion;
+      readonly outcome: ProofDeliveryOutcome;
+      readonly nowMillis: number;
+    }, prepare: PrepareProofCommit<void, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
+    readonly cancel: <A_1>(input: {
+      readonly moduleId: string;
+      readonly purpose: ProofPurpose;
+      readonly binding: ProofBinding;
+      readonly nowMillis: number;
+    }, prepare: PrepareProofCommit<void, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
+    readonly cleanup: <A_1>(input: {
+      readonly moduleId: string;
+      readonly nowMillis: number;
+      readonly limit: number;
+    }, prepare: PrepareProofCommit<ProofCleanupResult, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
+  };
+}, never, LifecycleHooks>;
+/**
+ * Session mutation methods and coordinate* functions must own their outermost
+ * transactionSync call. The installed Drizzle driver exposes no context marker
+ * for an arbitrary raw outer database.transaction call, so invoking either
+ * boundary from one is unsupported and cannot be detected. Detectable Effect
+ * commit scopes are rejected before writes.
+ */
+declare const coordinateAuthenticationAuthority: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<AuthenticationAuthority>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | AuthenticationAuthority>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, coordinatePendingAuthentication: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;
+    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<TargetId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;
+    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TargetId | TxId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, coordinateSignedSessionValidity: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;
+    readonly target: SuppliedService<TargetId, SignedSessionValidity>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<TargetId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;
+    readonly target: SuppliedService<TargetId, SignedSessionValidity>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TargetId | TxId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, coordinateStatefulSessions: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, PersistenceId, RepositoryId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: StatefulSessionMapping<NoInfer<Claims>, S, C, Session, F, P, NativeId, NativeSessionId>;
+    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;
+    readonly repository: SuppliedService<RepositoryId, SessionRepository>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<PersistenceId | RepositoryId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, PersistenceId, RepositoryId, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: StatefulSessionMapping<NoInfer<Claims>, S, C, Session, F, P, NativeId, NativeSessionId>;
+    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;
+    readonly repository: SuppliedService<RepositoryId, SessionRepository>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<PersistenceId | RepositoryId | TxId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, makeAuthenticationAuthorityServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>) => Effect.Effect<{
+  authenticationAuthority: {
+    capture: (subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">, credentialIds: readonly string[]) => Effect.Effect<{
+      subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      securityRevision: SecurityRevision;
+      credentials: {
+        credentialId: any;
+        revision: any;
+      }[];
+    }, SessionUnavailable | StaleAuthentication, never>;
+    requirements: (evidence: {
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly proofs: readonly [{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: import("effect/DateTime").Utc;
+      }, ...{
+        readonly method: string;
+        readonly credentialId: string;
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly verifiedAt: import("effect/DateTime").Utc;
+      }[]];
+    }) => Effect.Effect<{
+      readonly alternatives: readonly [{
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly minimumCredentials: number;
+      }, ...{
+        readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+        readonly userVerified: boolean;
+        readonly phishingResistant: boolean;
+        readonly minimumCredentials: number;
+      }[]];
+      readonly maximumAgeMillis: number;
+    }, SessionUnavailable | StaleAuthentication, never>;
+    approve: <A>(input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly now: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly pending?: PendingConsumption;
+    }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, PendingAuthenticationInvalid | SessionUnavailable | StaleAuthentication, never>;
+  };
+}, never, LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
+  pendingAuthentication: {
+    create: <A>(input: Omit<PendingAuthenticationRecord<Claims>, "version">, now: import("effect/DateTime").Utc, prepare: PrepareSessionCommit<PendingAuthenticationRecord<Claims>, A>) => Effect.Effect<PreparedCommit<A>, SessionConflict | SessionUnavailable | StaleAuthentication, never>;
+    context: (input: {
+      readonly digest: TokenDigest;
+      readonly now: import("effect/DateTime").Utc;
+    }) => Effect.Effect<Readonly<{
+      flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+      bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      expiresAtMillis: number;
+      revision: Readonly<{
+        subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        credentials: readonly Readonly<{
+          credentialId: string;
+          revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }>[];
+      }>;
+    }>, PendingAuthenticationInvalid | SessionUnavailable, never>;
+    read: (input: {
+      readonly digest: TokenDigest;
+      readonly bindingDigest: TokenDigest;
+      readonly now: import("effect/DateTime").Utc;
+    }) => Effect.Effect<PendingAuthenticationRecord<Claims>, PendingAuthenticationInvalid | SessionUnavailable, never>;
+    reject: <A>(input: {
+      readonly digest: TokenDigest;
+      readonly bindingDigest: TokenDigest;
+      readonly now: import("effect/DateTime").Utc;
+    }, prepare: PrepareSessionCommit<{
+      readonly _tag: "Rejected";
+    }, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable, never>;
+  };
+}, never, LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, SessionStepUpPersistence<Claims>>) => Effect.Effect<{
+  sessionStepUpPersistence: SessionStepUpPersistence<Claims>;
+}, never, LifecycleHooks>, coordinateSessionStepUp: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
+    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<Id>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
+    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<Id | TxId>>): Effect.Effect<A, DatabaseError | E | HookConfigurationError | SessionUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+}, makeSignedSessionValidityServices: <S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>) => Effect.Effect<{
+  signedSessionValidity: {
+    verify: (session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+    }, now: import("effect/DateTime").Utc) => Effect.Effect<undefined, SessionInvalid | SessionUnavailable, never>;
+    revoke: <A>(input: {
+      readonly subjectId: SubjectId;
+      readonly sessionId: SessionId;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly expectedSecurityRevision: SecurityRevision;
+    }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable | StaleAuthentication, never>;
+    revokeAll: <A>(input: {
+      readonly subjectId: SubjectId;
+      readonly expectedSecurityRevision: SecurityRevision;
+    }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable | StaleAuthentication, never>;
+  };
+}, never, LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
+  statefulSessionPersistence: {
+    establish: <A>(input: {
+      readonly session: Omit<StatefulSessionRecord<Claims>, "sessionId" | "version">;
+      readonly evidence: AuthenticationEvidence;
+      readonly pending?: PendingConsumption;
+      readonly now: import("effect/DateTime").Utc;
+    }, prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>) => Effect.Effect<PreparedCommit<A>, PendingAuthenticationInvalid | SessionConflict | SessionUnavailable | StaleAuthentication, never>;
+    verify: (input: {
+      readonly digest: TokenDigest;
+      readonly now: import("effect/DateTime").Utc;
+    }) => Effect.Effect<StatefulSessionRecord<Claims>, SessionInvalid | SessionUnavailable, never>;
+    rotate: <A>(input: {
+      readonly sessionId: SessionId;
+      readonly expectedDigest: TokenDigest;
+      readonly expectedVersion: SecurityRevision;
+      readonly expectedSecurityRevision: SecurityRevision;
+      readonly nextDigest: TokenDigest;
+      readonly nextCredentialVersion: SessionCredentialVersion;
+      readonly nextExpiresAt: import("effect/DateTime").Utc;
+      readonly now: import("effect/DateTime").Utc;
+    }, prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>) => Effect.Effect<PreparedCommit<A>, SessionConflict | SessionUnavailable, never>;
+    revokeDigest: <A>(digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, prepare: PrepareSessionCommit<boolean, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable, never>;
+    revoke: <A>(input: {
+      readonly subjectId: SubjectId;
+      readonly sessionId: SessionId;
+      readonly expectedSecurityRevision: SecurityRevision;
+    }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable | StaleAuthentication, never>;
+    revokeAll: <A>(input: {
+      readonly subjectId: SubjectId;
+      readonly expectedSecurityRevision: SecurityRevision;
+    }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable | StaleAuthentication, never>;
+  };
+  sessionRepository: {
+    list: (input: {
+      readonly subjectId: SubjectId;
+      readonly cursor?: string;
+      readonly limit: number;
+      readonly now: import("effect/DateTime").Utc;
+    }) => Effect.Effect<{
+      sessions: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: import("effect/DateTime").Utc;
+        readonly expiresAt: import("effect/DateTime").Utc;
+        readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      }[];
+      nextCursor?: (string & import("effect/Brand").Brand<"effect-auth/SessionId">) | undefined;
+    }, SessionUnavailable, never>;
+  };
+}, never, LifecycleHooks>;
+declare const commitMode: "synchronous";
+declare const makeAuthStoreServices: <C extends AnySQLiteTable, R extends AnySQLiteTable>(database: EffectSQLiteDoDatabase<AnyRelations>, mapping: AuthStoreTables<C, R>) => {
+  readonly authStore: {
+    readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, IssueChallengeError>;
+    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;
+    readonly issueRegistration: (input: NewRegistration) => Effect.Effect<void, AuthStoreError>;
+    readonly inspectRegistration: (tokenDigest: TokenDigest) => Effect.Effect<PendingRegistration, InvalidRegistration | AuthStoreError>;
+    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<void, InvalidRegistration | AuthStoreError>;
+  };
+  readonly decisions: {
+    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<ChallengeConsumeDecision, AuthStoreError, never>;
+    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<ConsumeDecision<void>, AuthStoreError, never>;
+  };
+};
+declare const makeOAuthStateServices: <S extends AnySQLiteTable>(database: EffectSQLiteDoDatabase<AnyRelations>, mapping: OAuthStateTables<S>) => {
+  readonly oauthStateStore: {
+    readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;
+    readonly consume: (stateDigest: TokenDigest) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;
+  };
+  readonly decisions: {
+    readonly consumeOAuthState: (digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">) => Effect.Effect<ConsumeDecision<OAuthState>, AuthStoreError, never>;
+  };
+};
+declare const makeAuthServices: <C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable>(database: EffectSQLiteDoDatabase<AnyRelations>, mapping: AuthTables<C, R, S>) => {
+  readonly authStore: {
+    readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, IssueChallengeError>;
+    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;
+    readonly issueRegistration: (input: NewRegistration) => Effect.Effect<void, AuthStoreError>;
+    readonly inspectRegistration: (tokenDigest: TokenDigest) => Effect.Effect<PendingRegistration, InvalidRegistration | AuthStoreError>;
+    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<void, InvalidRegistration | AuthStoreError>;
+  };
+  readonly oauthStateStore: {
+    readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;
+    readonly consume: (stateDigest: TokenDigest) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;
+  };
+  readonly decisions: {
+    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<ChallengeConsumeDecision, AuthStoreError, never>;
+    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<ConsumeDecision<void>, AuthStoreError, never>;
+    readonly consumeOAuthState: (digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">) => Effect.Effect<ConsumeDecision<OAuthState>, AuthStoreError, never>;
+  };
+};
+type TransactionOf<D extends EffectSQLiteDoDatabase<AnyRelations>> = Parameters<Parameters<D["transaction"]>[0]>[0];
+declare function coordinateAuthStoreTransaction<D extends EffectSQLiteDoDatabase<AnyRelations>, C extends AnySQLiteTable, R extends AnySQLiteTable, A, E, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthStoreTables<C, R>;
+  readonly transaction?: never;
+}, body: Effect.Effect<A, E, NoInfer<AuthStoreDecisions>>): Effect.Effect<A, E | DatabaseError | SqlError, DatabaseRequirements>;
+declare function coordinateAuthStoreTransaction<D extends EffectSQLiteDoDatabase<AnyRelations>, C extends AnySQLiteTable, R extends AnySQLiteTable, A, E, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthStoreTables<C, R>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<A, E, NoInfer<AuthStoreDecisions | TxId>>): Effect.Effect<A, E | DatabaseError | SqlError, DatabaseRequirements>;
+declare function coordinateOAuthStateTransaction<D extends EffectSQLiteDoDatabase<AnyRelations>, S extends AnySQLiteTable, A, E, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: OAuthStateTables<S>;
+  readonly transaction?: never;
+}, body: Effect.Effect<A, E, NoInfer<OAuthStateDecisions>>): Effect.Effect<A, E | DatabaseError | SqlError, DatabaseRequirements>;
+declare function coordinateOAuthStateTransaction<D extends EffectSQLiteDoDatabase<AnyRelations>, S extends AnySQLiteTable, A, E, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: OAuthStateTables<S>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<A, E, NoInfer<OAuthStateDecisions | TxId>>): Effect.Effect<A, E | DatabaseError | SqlError, DatabaseRequirements>;
+/**
+ * Supported composition boundary for Durable Objects. The owner must return
+ * decisions as values and translate rejection only after this root
+ * transactionSync commit. Its body may contain only runSync-compatible Effects;
+ * the installed driver rejects suspension and rolls back. Owner failure rolls
+ * back synchronously, so no retry is performed inside this boundary.
+ */
+declare function coordinateAuthTransaction<D extends EffectSQLiteDoDatabase<AnyRelations>, C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable, A, E, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthTables<C, R, S>;
+  readonly transaction?: never;
+}, body: Effect.Effect<A, E, NoInfer<AuthStoreDecisions | OAuthStateDecisions>>): Effect.Effect<A, E | DatabaseError | SqlError, DatabaseRequirements>;
+declare function coordinateAuthTransaction<D extends EffectSQLiteDoDatabase<AnyRelations>, C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable, A, E, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthTables<C, R, S>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<A, E, NoInfer<AuthStoreDecisions | OAuthStateDecisions | TxId>>): Effect.Effect<A, E | DatabaseError | SqlError, DatabaseRequirements>;
+declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<AnyRelations>, mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => {
+  subjectProvisioner: {
+    readonly provision: (input: SubjectProvisioningInput) => Effect.Effect<ProvisioningResult, IdentityConflict | IdentityUnavailable>;
+  };
+  externalIdentityMutation: {
+    readonly bind: (subjectId: SubjectId, identity: ExternalIdentity) => Effect.Effect<void, IdentityConflict | IdentityUnavailable>;
+  };
+};
+declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<AnyRelations>, mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => {
+  readonly subjectProvisioner: {
+    readonly provision: (input: SubjectProvisioningInput) => Effect.Effect<ProvisioningResult, IdentityConflict | IdentityUnavailable>;
+  };
+};
+declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(database: EffectSQLiteDoDatabase<AnyRelations>, mapping: ExternalIdentityTables<Subject, External, NativeId>) => {
+  readonly externalIdentityMutation: {
+    readonly bind: (subjectId: SubjectId, identity: ExternalIdentity) => Effect.Effect<void, IdentityConflict | IdentityUnavailable>;
+  };
+};
+declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
+  passwordPreparedPersistence: PasswordPreparedPersistence;
+}, never, LifecycleHooks>, coordinatePasswordPreparedPersistence: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+    readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
+    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<Out, E, NoInfer<TargetId>>): Effect.Effect<Out, DatabaseError | E | HookConfigurationError | PasswordUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+    readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
+    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
+  }, body: Effect.Effect<Out, E, NoInfer<TargetId | TxId>>): Effect.Effect<Out, DatabaseError | E | HookConfigurationError | PasswordUnavailable | SqlError, DatabaseRequirements | LifecycleHooks>;
+};
+declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, AC extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, TA extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, U extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>) => Effect.Effect<{
+  oauthAccountsPersistence: {
+    readonly capture: (input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: SubjectId;
+    }) => Effect.Effect<OAuthAccountRevision | undefined, OAuthUnavailable>;
+    readonly issue: <A>(input: {
+      readonly flow: OAuthLinkPendingFlow;
+      readonly authorization: OAuthActionAuthorization;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-link-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly preflight: (input: OAuthLinkAccess) => Effect.Effect<OAuthLinkPendingFlow | undefined, OAuthUnavailable>;
+    readonly claim: <A>(input: {
+      readonly access: OAuthLinkAccess;
+      readonly flow: OAuthLinkPendingFlow;
+      readonly claimId: OAuthLinkClaim["claimId"];
+      readonly authorization: OAuthActionAuthorization;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Claimed";
+      readonly claim: {
+        readonly flow: {
+          readonly context: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+            readonly generation: number;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+            readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+            readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+            readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly requestBindingExpiresAtMillis: number;
+            readonly issuedAtMillis: number;
+            readonly expiresAtMillis: number;
+            readonly claimLifetimeMillis: number;
+            readonly namespace: "effect-auth/oauth-link-context/v1";
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly maximumEvidenceAgeMillis: number;
+          };
+          readonly sealed: {
+            readonly format: "oauth-xchacha20poly1305-v1";
+            readonly keyId: string;
+            readonly nonce: string;
+            readonly ciphertext: import("effect/Redacted").Redacted<string>;
+          };
+          readonly retentionUntilMillis: number;
+        };
+        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+        readonly claimedAtMillis: number;
+        readonly claimExpiresAtMillis: number;
+      };
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly settle: <A>(input: {
+      readonly claim: OAuthLinkClaim;
+      readonly outcome: OAuthLinkOutcome;
+      readonly authorization: OAuthActionAuthorization;
+      readonly invalidation: SessionInvalidationWindow;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Linked";
+      readonly credential: {
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly credentialId: string;
+        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+      };
+      readonly changed: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly inspectUnlink: (input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: SubjectId;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly credentialId: string;
+    }) => Effect.Effect<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Target";
+      readonly credential: {
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly credentialId: string;
+        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+      };
+    } | {
+      readonly _tag: "Replay";
+      readonly result: {
+        readonly _tag: "Unlinked";
+        readonly credentialId: string;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      };
+    }, OAuthUnavailable>;
+    readonly unlink: <A>(input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly credential: OAuthCredentialSnapshot;
+      readonly authorization: OAuthActionAuthorization;
+      readonly invalidation: SessionInvalidationWindow;
+      readonly nowMillis: number;
+      readonly retentionUntilMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "LastSignInMethod";
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Unlinked";
+      readonly result: {
+        readonly _tag: "Unlinked";
+        readonly credentialId: string;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      };
+      readonly replayed: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+      readonly terminalized: number;
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, AC extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: OAuthSignInMapping<S, O, C, AC, F, N>) => Effect.Effect<{
+  oauthSignInPersistence: {
+    readonly issue: <A>(input: OAuthPendingFlow, prepare: PrepareOAuthCommit<OAuthIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly claim: <A>(input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly generation: number;
+      readonly flowId: RequestBindingFlowId;
+      readonly provider: OAuthProviderKey;
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly stateDigest: TokenDigest;
+      readonly requestBindingVerifier: TokenDigest;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly responseIssuer?: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<OAuthClaimDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly settle: <A>(input: {
+      readonly claim: OAuthClaim;
+      readonly outcome: {
+        readonly _tag: "Verified";
+        readonly identity: OAuthVerifiedExternalIdentity;
+      } | {
+        readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
+      };
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<OAuthSettlementDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+      readonly terminalized: number;
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, AC extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, TA extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, I extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>) => Effect.Effect<{
+  oauthRegistrationIntents: {
+    readonly settle: <A>(input: {
+      readonly claim: OAuthClaim;
+      readonly identity: OAuthVerifiedExternalIdentity;
+      readonly intent?: OAuthRegistrationIntent;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<OAuthRegistrationSettlement, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, AC extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, TA extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, I extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, R extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
+  registrationAuthority: OAuthRegistrationAuthority<Registration>;
+}, never, LifecycleHooks>, coordinateOAuthRegistration: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, TA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, I extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Rq extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;
+    readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<TargetId>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, TA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, I extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Rq extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;
+    readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TargetId | TxId>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+}, coordinateOAuthSignIn: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<OAuthSignInPersistence>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | OAuthSignInPersistence>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+}, coordinateOAuthRegistrationIntents: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, TA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, I extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<OAuthRegistrationIntents>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, TA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, I extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | OAuthRegistrationIntents>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+}, coordinateOAuthAccounts: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, TA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, U extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<OAuthAccountsPersistence>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, TA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, U extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | OAuthAccountsPersistence>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+}, makeOAuthConnectedServices: <S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, AC extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, T extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, G extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, UA extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, DC extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, J extends AnySQLiteTable<{
+  dialect: "sqlite";
+}> = never>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>) => Effect.Effect<{
+  oauthConnectedPersistence: {
+    readonly capture: (input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: SubjectId;
+      readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    }) => Effect.Effect<{
+      readonly revision: OAuthAccountRevision;
+      readonly target?: OAuthConnectedTarget;
+    } | undefined, OAuthUnavailable>;
+    readonly issue: <A>(input: {
+      readonly flow: OAuthConnectedPendingFlow;
+      readonly authorization: OAuthConnectedActionAuthorization;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly preflight: (input: OAuthConnectedAccess) => Effect.Effect<OAuthConnectedPendingFlow | undefined, OAuthUnavailable>;
+    readonly claim: <A>(input: {
+      readonly access: OAuthConnectedAccess;
+      readonly flow: OAuthConnectedPendingFlow;
+      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly authorization: OAuthConnectedActionAuthorization;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Claimed";
+      readonly claim: {
+        readonly flow: {
+          readonly context: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+            readonly generation: number;
+            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+            readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+            readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+            readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+            readonly requestBindingExpiresAtMillis: number;
+            readonly issuedAtMillis: number;
+            readonly expiresAtMillis: number;
+            readonly claimLifetimeMillis: number;
+            readonly namespace: "effect-auth/oauth-connected-context/v1";
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly reconnect?: {
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number | undefined;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+            } | undefined;
+            readonly maximumEvidenceAgeMillis: number;
+          };
+          readonly sealed: {
+            readonly format: "oauth-xchacha20poly1305-v1";
+            readonly keyId: string;
+            readonly nonce: string;
+            readonly ciphertext: import("effect/Redacted").Redacted<string>;
+          };
+          readonly retentionUntilMillis: number;
+        };
+        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+        readonly claimedAtMillis: number;
+        readonly claimExpiresAtMillis: number;
+        readonly order: string;
+      };
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly inspectGrant: (input: {
+      readonly claim: OAuthConnectedClaim;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+    }) => Effect.Effect<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Target";
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    } | {
+      readonly _tag: "Quarantine";
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    } | {
+      readonly _tag: "Conflict";
+    }, OAuthUnavailable>;
+    readonly settle: <A>(input: {
+      readonly claim: OAuthConnectedClaim;
+      readonly outcome: OAuthConnectedOutcome;
+      readonly authorization: OAuthConnectedActionAuthorization;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Connected";
+      readonly grant: {
+        readonly context: {
+          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly metadata: {
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly accessExpiresAtMillis?: number | undefined;
+            readonly refreshExpiresAtMillis?: number | undefined;
+            readonly useUntilMillis: number;
+            readonly refreshUseUntilMillis?: number | undefined;
+            readonly obtainedAtMillis: number;
+            readonly profile?: {
+              readonly displayName?: string | undefined;
+              readonly handle?: string | undefined;
+            } | undefined;
+          };
+        };
+        readonly sealed: {
+          readonly format: "oauth-connected-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+      };
+    } | {
+      readonly _tag: "Busy";
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly list: (input: {
+      readonly authorization: OAuthConnectedUseAuthorization;
+      readonly limit: number;
+      readonly cursor?: string;
+    }) => Effect.Effect<{
+      readonly items: readonly {
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+        readonly scopes: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+        } | undefined;
+        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+      }[];
+      readonly cursor?: string | undefined;
+    }, OAuthUnavailable>;
+    readonly inspectDisconnect: (input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: SubjectId;
+      readonly authorization: OAuthConnectedUseAuthorization;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    }) => Effect.Effect<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Target";
+      readonly grant: {
+        readonly context: {
+          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly metadata: {
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly accessExpiresAtMillis?: number | undefined;
+            readonly refreshExpiresAtMillis?: number | undefined;
+            readonly useUntilMillis: number;
+            readonly refreshUseUntilMillis?: number | undefined;
+            readonly obtainedAtMillis: number;
+            readonly profile?: {
+              readonly displayName?: string | undefined;
+              readonly handle?: string | undefined;
+            } | undefined;
+          };
+        };
+        readonly sealed?: {
+          readonly format: "oauth-connected-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        } | undefined;
+      };
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+    } | {
+      readonly _tag: "Replay";
+      readonly result: {
+        readonly _tag: "Disconnected";
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+        readonly affectedGrantCount: number;
+        readonly replayed: boolean;
+      };
+    }, OAuthUnavailable>;
+    readonly disconnect: <A>(input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly grant: OAuthConnectedDisconnectGrant;
+      readonly authorization: OAuthConnectedActionAuthorization;
+      readonly revocation?: OAuthConnectedRevocationJob;
+      readonly retentionUntilMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Disconnected";
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+      readonly affectedGrantCount: number;
+      readonly replayed: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly inspectAccess: (input: {
+      readonly authorization: OAuthConnectedUseAuthorization;
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+    }) => Effect.Effect<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Busy";
+    } | {
+      readonly _tag: "Target";
+      readonly grant: {
+        readonly context: {
+          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly metadata: {
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly accessExpiresAtMillis?: number | undefined;
+            readonly refreshExpiresAtMillis?: number | undefined;
+            readonly useUntilMillis: number;
+            readonly refreshUseUntilMillis?: number | undefined;
+            readonly obtainedAtMillis: number;
+            readonly profile?: {
+              readonly displayName?: string | undefined;
+              readonly handle?: string | undefined;
+            } | undefined;
+          };
+        };
+        readonly sealed: {
+          readonly format: "oauth-connected-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+      };
+    } | {
+      readonly _tag: "ReauthorizationRequired";
+    }, OAuthUnavailable>;
+    readonly claimRefresh: <A>(input: {
+      readonly grant: OAuthConnectedStoredGrant;
+      readonly authorization: OAuthConnectedUseAuthorization;
+      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly nextTokenVersion: OAuthConnectedRefreshClaim["nextTokenVersion"];
+      readonly lifetimeMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Busy";
+    } | {
+      readonly _tag: "ReauthorizationRequired";
+    } | {
+      readonly _tag: "Claimed";
+      readonly claim: {
+        readonly grant: {
+          readonly context: {
+            readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly metadata: {
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly accessExpiresAtMillis?: number | undefined;
+              readonly refreshExpiresAtMillis?: number | undefined;
+              readonly useUntilMillis: number;
+              readonly refreshUseUntilMillis?: number | undefined;
+              readonly obtainedAtMillis: number;
+              readonly profile?: {
+                readonly displayName?: string | undefined;
+                readonly handle?: string | undefined;
+              } | undefined;
+            };
+          };
+          readonly sealed: {
+            readonly format: "oauth-connected-xchacha20poly1305-v1";
+            readonly keyId: string;
+            readonly nonce: string;
+            readonly ciphertext: import("effect/Redacted").Redacted<string>;
+          };
+        };
+        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+        readonly claimedAtMillis: number;
+        readonly claimExpiresAtMillis: number;
+        readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      };
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly settleRefresh: <A>(input: {
+      readonly claim: OAuthConnectedRefreshClaim;
+      readonly authorization: OAuthConnectedUseAuthorization;
+      readonly outcome: OAuthConnectedRefreshOutcome;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "ReauthorizationRequired";
+    } | {
+      readonly _tag: "Refreshed";
+      readonly grant: {
+        readonly context: {
+          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly metadata: {
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly accessExpiresAtMillis?: number | undefined;
+            readonly refreshExpiresAtMillis?: number | undefined;
+            readonly useUntilMillis: number;
+            readonly refreshUseUntilMillis?: number | undefined;
+            readonly obtainedAtMillis: number;
+            readonly profile?: {
+              readonly displayName?: string | undefined;
+              readonly handle?: string | undefined;
+            } | undefined;
+          };
+        };
+        readonly sealed: {
+          readonly format: "oauth-connected-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+      };
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly admitUse: <A>(input: {
+      readonly grant: OAuthConnectedStoredGrant;
+      readonly authorization: OAuthConnectedUseAuthorization;
+      readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly lifetimeMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Busy";
+    } | {
+      readonly _tag: "ReauthorizationRequired";
+    } | {
+      readonly _tag: "Admitted";
+      readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly admittedAtMillis: number;
+      readonly expiresAtMillis: number;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+      readonly terminalized: number;
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+  };
+}, never, LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, G extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, J extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N>(database: EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>) => Effect.Effect<{
+  oauthConnectedRevocations: {
+    readonly claim: <A>(input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly lifetimeMillis: number;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Claimed";
+      readonly claim: {
+        readonly job: {
+          readonly context: {
+            readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
+            readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+            readonly token: {
+              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number | undefined;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly metadata: {
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly accessExpiresAtMillis?: number | undefined;
+                readonly refreshExpiresAtMillis?: number | undefined;
+                readonly useUntilMillis: number;
+                readonly refreshUseUntilMillis?: number | undefined;
+                readonly obtainedAtMillis: number;
+                readonly profile?: {
+                  readonly displayName?: string | undefined;
+                  readonly handle?: string | undefined;
+                } | undefined;
+              };
+            };
+          };
+          readonly sealed: {
+            readonly format: "oauth-connected-xchacha20poly1305-v1";
+            readonly keyId: string;
+            readonly nonce: string;
+            readonly ciphertext: import("effect/Redacted").Redacted<string>;
+          };
+        };
+        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+        readonly claimedAtMillis: number;
+        readonly claimExpiresAtMillis: number;
+      };
+    } | {
+      readonly _tag: "Empty";
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly settle: <A>(input: {
+      readonly claim: OAuthConnectedRevocationClaim;
+      readonly outcome: "Confirmed" | "Unknown";
+    }, prepare: PrepareOAuthCommit<{
+      readonly settled: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>, coordinateOAuthConnected: {
+  <D extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, T extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, G extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, UA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, DC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, J extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<OAuthConnectedPersistence>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+  <D extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, AC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, T extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, G extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, UA extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, DC extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, J extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>;
+    readonly transaction: SuppliedService<TxId, NoInfer<D extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<D["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | OAuthConnectedPersistence>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+}, coordinateOAuthConnectedRevocations: {
+  <D extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, T extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, G extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, J extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<OAuthConnectedRevocations>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+  <D extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, T extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, G extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, J extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>;
+    readonly transaction: SuppliedService<TxId, NoInfer<D extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<D["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | OAuthConnectedRevocations>>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | LifecycleHooks>;
+};
+declare const makePasskeyCredentialServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, RSetup = never>(database: Database, mapping: PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N>, RSetup>) => Effect.Effect<PasskeyCredentialServices, DrizzleMappingError | PasskeyConfigurationError, RSetup>, makePasskeyPersistenceServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, M extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Flow extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Admission extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Charge extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, RSetup = never>(database: Database, mapping: PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, Admission, Charge, N>, RSetup>) => Effect.Effect<PasskeyPersistenceServices, DrizzleMappingError | PasskeyConfigurationError, RSetup | LifecycleHooks>, makePasskeyEnrollmentContextServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, M extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, RSetup = never>(database: Database, mapping: PasskeyMappingSource<PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N>, RSetup>) => Effect.Effect<PasskeyEnrollmentContextServices, DrizzleMappingError | PasskeyConfigurationError, RSetup>, makePasskeyRegistrationCeremonyServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, M extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Flow extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Admission extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Charge extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Intent extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, RSetup = never>(database: Database, mapping: PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H>, RSetup>) => Effect.Effect<PasskeyRegistrationCeremonyServices, DrizzleMappingError | PasskeyConfigurationError, RSetup | LifecycleHooks>, coordinatePasskeyPersistence: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, Admission, Charge, N>, RSetup>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, Admission, Charge, N>, RSetup>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+}, coordinatePasskeyRegistrationCeremony: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Intent extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H>, RSetup>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Intent extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H>, RSetup>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+}, makePasskeyManagementServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, M extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Flow extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Admission extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Charge extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Command extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, RSetup = never>(database: Database, mapping: PasskeyMappingSource<PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N>, RSetup>) => Effect.Effect<PasskeyManagementServices, DrizzleMappingError | PasskeyConfigurationError, RSetup | LifecycleHooks>, makePasskeyRegistrationServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, O extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, H extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, M extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Flow extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Admission extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Charge extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, Intent extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, Value, RSetup = never>(database: Database, mapping: PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value>, RSetup>) => Effect.Effect<PasskeyRegistrationServices<Value>, DrizzleMappingError | PasskeyConfigurationError, RSetup | LifecycleHooks>, coordinatePasskeyManagement: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Command extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N>, RSetup>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<PasskeyManagementPersistence | PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Command extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N>, RSetup>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | PasskeyManagementPersistence | PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+}, coordinatePasskeyRegistration: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Intent extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, Value, A, E, R, AuthorityId, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value>, RSetup>;
+    readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<AuthorityId | PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, O extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, H extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, M extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Flow extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Admission extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Charge extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, Intent extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, Value, A, E, R, AuthorityId, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasskeyMappingSource<PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value>, RSetup>;
+    readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<AuthorityId | TxId | PasskeyPersistence>>): Effect.Effect<A, DatabaseError | PasskeyCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+};
+declare const makeTotpPersistenceServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, RSetup = never>(database: Database, mapping: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>) => Effect.Effect<TotpPersistenceServices, DrizzleMappingError | TotpConfigurationError, RSetup | LifecycleHooks>, coordinateTotpPersistence: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<TotpPersistence>>): Effect.Effect<A, DatabaseError | TotpCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | TotpPersistence>>): Effect.Effect<A, DatabaseError | TotpCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+};
+declare const makePhonePersistenceServices: <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, I extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, F extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, C extends AnySQLiteTable<{
+  dialect: "sqlite";
+}>, N, RSetup = never>(database: Database, mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>) => Effect.Effect<PhonePersistenceServices, DrizzleMappingError | PhoneConfigurationError, RSetup | LifecycleHooks>, coordinatePhonePersistence: {
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, I extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>;
+    readonly transaction?: never;
+  }, body: Effect.Effect<A, E, NoInfer<PhoneAdmission | PhonePersistence | PhoneSignInTargets>>): Effect.Effect<A, DatabaseError | PhoneCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+  <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, I extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, F extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, C extends AnySQLiteTable<{
+    dialect: "sqlite";
+  }>, N, A, E, R, TxId, TxShape, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>;
+    readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
+      readonly transaction: (...args: any[]) => any;
+    } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
+  }, body: Effect.Effect<A, E, NoInfer<TxId | PhoneAdmission | PhonePersistence | PhoneSignInTargets>>): Effect.Effect<A, DatabaseError | PhoneCoordinatorError<E>, DatabaseRequirements | RSetup | LifecycleHooks>;
+};
+//#endregion
+export { commitMode, coordinateAuthStoreTransaction, coordinateAuthTransaction, coordinateAuthenticationAuthority, coordinateEmailAddress, coordinateEmailRegistration, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, coordinateOAuthStateTransaction, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinatePasswordPersistence, coordinatePasswordPreparedPersistence, coordinatePasswordRegistration, coordinatePendingAuthentication, coordinatePhonePersistence, coordinateProofPersistence, coordinateSessionStepUp, coordinateSignedSessionValidity, coordinateStatefulSessions, coordinateTotpPersistence, makeAuthServices, makeAuthStoreServices, makeAuthenticationAuthorityServices, makeEmailAddressServices, makeEmailRegistrationServices, makeEmailSignInServices, makeExternalIdentityServices, makeIdentityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, makeOAuthStateServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makePasswordPersistenceServices, makePasswordPreparedPersistenceServices, makePasswordRegistrationServices, makePendingAuthenticationServices, makePhonePersistenceServices, makeProofPersistenceServices, makeSessionStepUpServices, makeSignedSessionValidityServices, makeStatefulSessionServices, makeSubjectProvisioningServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
+//# sourceMappingURL=DrizzleSqliteDo.d.mts.map