@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/D1.d.mts

@@ -25,12 +25,12 @@ export declare const makeSubjectProvisioningServices: <Subject extends AnySQLite
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(mapping: D1ExternalIdentityMapping<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const commitMode: "batch";
 export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: D1GeneratedIdentityMapping<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -39,7 +39,7 @@ export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Iden
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, AC extends AnySQLiteTable<{
@@ -78,10 +78,10 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -277,6 +277,120 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -424,10 +538,10 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -918,7 +1032,7 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -1026,7 +1140,7 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, AC extends AnySQLiteTable<{
   dialect: "sqlite";

package/dist/Libsql.d.mts

@@ -77,16 +77,16 @@ export declare const coordinateEmailAddress: {
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, EmailUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
+}, EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
   registrationAuthority: EmailRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
+}, EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
   emailSignInTargets: {
     readonly lookup: (input: {
       readonly moduleId: string;
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
     }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, EmailUnavailable>;
   };
-}, never, Database>;
+}, EmailUnavailable, Database>;
 export declare const coordinatePasswordPersistence: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<A>, DrizzleTableModel<RS>, DrizzleTableModel<CE>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
@@ -151,9 +151,9 @@ export declare const coordinatePasswordPersistence: {
       readonly hasMore: boolean;
     }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
+}, PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
   registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateProofPersistence: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<Rq>, DrizzleTableModel<S>, DrizzleTableModel<G>, DrizzleTableModel<Cn>, DrizzleTableModel<Rs>, DrizzleTableModel<Aev>, DrizzleTableModel<F>, DrizzleTableModel<C>, DrizzleTableModel<Sub>, DrizzleTableModel<I>, DrizzleTableModel<Cr>, NativeId, import("drizzle-orm").SQL<unknown>>;
@@ -213,7 +213,7 @@ export declare const coordinateProofPersistence: {
       readonly limit: number;
     }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofCleanupResult, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, ProofUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, ProofUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateAuthenticationAuthority: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
@@ -270,11 +270,11 @@ export declare const coordinateAuthenticationAuthority: {
       readonly pending?: import("@yielded/auth/Sessions").PendingConsumption;
     }, prepare: import("@yielded/auth/Sessions").PrepareSessionCommit<void, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").PendingAuthenticationInvalid | SessionUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
+}, SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
   pendingAuthentication: import("@yielded/auth/Sessions").PendingAuthentication<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
+}, SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
   sessionStepUpPersistence: import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
+}, SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
     readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
@@ -287,10 +287,10 @@ export declare const coordinateAuthenticationAuthority: {
   }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
 }, makeSignedSessionValidityServices: <S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>) => Effect.Effect<{
   signedSessionValidity: import("@yielded/auth/Sessions").SignedSessionValidity;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
+}, SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
   readonly statefulSessionPersistence: import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>;
   readonly sessionRepository: import("@yielded/auth/Sessions").SessionRepository;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const commitMode: "interactive";
 export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -299,20 +299,20 @@ export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Iden
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
   passwordPreparedPersistence: import("@yielded/auth/Password").PasswordPreparedPersistence;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
+}, PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
     readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
@@ -486,10 +486,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Conflict";
     } | {
@@ -590,7 +590,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -632,7 +632,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -655,7 +655,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -671,7 +671,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -859,10 +859,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -1058,6 +1058,120 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -1205,10 +1319,10 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -1699,7 +1813,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -1807,7 +1921,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{