@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/Mysql2.d.mts

@@ -19,19 +19,19 @@ import { coordinateMysqlPasswordPersistence, coordinateMysqlPasswordRegistration
 import { coordinateMysqlEmailAddress, coordinateMysqlEmailRegistration, makeMysqlEmailAddressServices, makeMysqlEmailRegistrationServices, makeMysqlEmailSignInServices } from "./drizzle/mysql-emails.mjs";
 import { coordinateMySqlPasswordPreparedPersistence, makeMySqlPasswordPreparedPersistenceServices } from "./drizzle/mysql-password-prepared.mjs";
 import { Layer } from "effect";
-import { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import { AnyMySqlTable } from "drizzle-orm/mysql-core";
+import { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 //#region src/Mysql2.d.ts
 export declare const makeSubjectProvisioningServices: <Subject extends AnyMySqlTable, Identifier extends AnyMySqlTable, Request extends AnyMySqlTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => import("effect/Effect").Effect<{
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => import("effect/Effect").Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnyMySqlTable, External extends AnyMySqlTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => import("effect/Effect").Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => import("effect/Effect").Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const commitMode: "interactive";
 export declare const makeIdentityServices: <Subject extends AnyMySqlTable, Identifier extends AnyMySqlTable, External extends AnyMySqlTable, Request extends AnyMySqlTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => import("effect/Effect").Effect<{
   subjectProvisioner: {
@@ -40,7 +40,7 @@ export declare const makeIdentityServices: <Subject extends AnyMySqlTable, Ident
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => import("effect/Effect").Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
   dialect: "mysql";
 }>, O extends AnyMySqlTable<{
@@ -305,7 +305,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
       readonly hasMore: boolean;
     }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnyMySqlTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnyMySqlTable<{
   dialect: "mysql";
 }>, O extends AnyMySqlTable<{
   dialect: "mysql";
@@ -347,7 +347,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
       readonly hasMore: boolean;
     }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnyMySqlTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnyMySqlTable<{
   dialect: "mysql";
 }>, O extends AnyMySqlTable<{
   dialect: "mysql";
@@ -370,7 +370,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnyMySqlTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnyMySqlTable<{
   dialect: "mysql";
 }>, O extends AnyMySqlTable<{
   dialect: "mysql";
@@ -386,7 +386,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
   dialect: "mysql";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => import("effect/Effect").Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectMysql2Database<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnyMySqlTable<{
     dialect: "mysql";
   }>, O extends AnyMySqlTable<{
@@ -773,6 +773,120 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => import("effect/Effect").Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => import("effect/Effect").Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -1414,7 +1528,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
       readonly hasMore: boolean;
     }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnyMySqlTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnyMySqlTable<{
   dialect: "mysql";
 }>, O extends AnyMySqlTable<{
   dialect: "mysql";
@@ -1522,7 +1636,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
       readonly settled: boolean;
     }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectMysql2Database<import("drizzle-orm").TablesRelationalConfig>, S extends AnyMySqlTable<{
     dialect: "mysql";
   }>, AC extends AnyMySqlTable<{

package/dist/Pglite.d.mts

@@ -19,19 +19,19 @@ import { coordinatePgPasswordPersistence, coordinatePgPasswordRegistration, make
 import { coordinatePgEmailAddress, coordinatePgEmailRegistration, makePgEmailAddressServices, makePgEmailRegistrationServices, makePgEmailSignInServices } from "./drizzle/pg-emails.mjs";
 import { coordinatePgPasswordPreparedPersistence, makePgPasswordPreparedPersistenceServices } from "./drizzle/pg-password-prepared.mjs";
 import { Effect, Layer } from "effect";
-import { EffectPgDatabase } from "drizzle-orm/effect-pglite";
 import { AnyPgTable } from "drizzle-orm/pg-core";
+import { EffectPgDatabase } from "drizzle-orm/effect-pglite";
 //#region src/Pglite.d.ts
 export declare const makeSubjectProvisioningServices: <Subject extends AnyPgTable, Identifier extends AnyPgTable, Request extends AnyPgTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnyPgTable, External extends AnyPgTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const commitMode: "interactive";
 export declare const makeIdentityServices: <Subject extends AnyPgTable, Identifier extends AnyPgTable, External extends AnyPgTable, Request extends AnyPgTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -40,7 +40,7 @@ export declare const makeIdentityServices: <Subject extends AnyPgTable, Identifi
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
@@ -305,7 +305,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -347,7 +347,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -370,7 +370,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -386,7 +386,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectPgDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnyPgTable<{
     dialect: "pg";
   }>, O extends AnyPgTable<{
@@ -773,6 +773,120 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -1414,7 +1528,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -1522,7 +1636,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectPgDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnyPgTable<{
     dialect: "pg";
   }>, AC extends AnyPgTable<{