@yielded/auth-persistence-drizzle 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/SqliteDo.d.mts

@@ -78,16 +78,16 @@ export declare const coordinateEmailAddress: {
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Email").EmailUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
   registrationAuthority: EmailRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
   emailSignInTargets: {
     readonly lookup: (input: {
       readonly moduleId: string;
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
     }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, import("@yielded/auth/Email").EmailUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Email").EmailUnavailable, Database>;
 /**
  * Password mutations and registration must own their outer transactionSync.
  * Arbitrary raw Drizzle nesting is not detectable; owner bodies must remain
@@ -157,9 +157,9 @@ export declare const coordinatePasswordPersistence: {
       readonly hasMore: boolean;
     }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Password").PasswordUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
   registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 /**
  * Proof mutations and coordinateProofPersistence must own their outermost
  * transactionSync call. The installed driver cannot detect an arbitrary raw
@@ -225,7 +225,7 @@ export declare const coordinateProofPersistence: {
       readonly limit: number;
     }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofCleanupResult, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Proofs").ProofUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 /**
  * Session mutation methods and coordinate* functions must own their outermost
  * transactionSync call. The installed Drizzle driver exposes no context marker
@@ -289,11 +289,11 @@ export declare const coordinateAuthenticationAuthority: {
       readonly pending?: import("@yielded/auth/Sessions").PendingConsumption;
     }, prepare: import("@yielded/auth/Sessions").PrepareSessionCommit<void, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").PendingAuthenticationInvalid | import("@yielded/auth/Sessions").SessionUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
   pendingAuthentication: import("@yielded/auth/Sessions").PendingAuthentication<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
   sessionStepUpPersistence: import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
   <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
     readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
@@ -306,10 +306,10 @@ export declare const coordinateAuthenticationAuthority: {
   }, body: Effect.Effect<A, E, NoInfer<Id | TxId>>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks>;
 }, makeSignedSessionValidityServices: <S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>) => Effect.Effect<{
   signedSessionValidity: import("@yielded/auth/Sessions").SignedSessionValidity;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
   readonly statefulSessionPersistence: import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>;
   readonly sessionRepository: import("@yielded/auth/Sessions").SessionRepository;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const commitMode: "synchronous";
 export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -318,20 +318,20 @@ export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Iden
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
   passwordPreparedPersistence: import("@yielded/auth/Password").PasswordPreparedPersistence;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
   <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
     readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
@@ -609,7 +609,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -651,7 +651,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -674,7 +674,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -690,7 +690,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -882,6 +882,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -951,8 +953,6 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
@@ -1077,6 +1077,120 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -1228,6 +1342,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -1297,8 +1413,6 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
@@ -1452,6 +1566,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "ReauthorizationRequired";
     } | {
       readonly _tag: "Busy";
     } | {
@@ -1523,8 +1639,6 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "ReauthorizationRequired";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claimRefresh: <A>(input: {
       readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
@@ -1534,10 +1648,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly lifetimeMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
     } | {
       readonly _tag: "ReauthorizationRequired";
+    } | {
+      readonly _tag: "Busy";
     } | {
       readonly _tag: "Claimed";
       readonly claim: {
@@ -1700,10 +1814,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly lifetimeMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
     } | {
       readonly _tag: "ReauthorizationRequired";
+    } | {
+      readonly _tag: "Busy";
     } | {
       readonly _tag: "Admitted";
       readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
@@ -1718,7 +1832,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -1826,7 +1940,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectSQLiteDoDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{