@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/Postgres.d.mts

@@ -26,12 +26,12 @@ export declare const makeSubjectProvisioningServices: <Subject extends AnyPgTabl
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnyPgTable, External extends AnyPgTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const commitMode: "interactive";
 export declare const makeIdentityServices: <Subject extends AnyPgTable, Identifier extends AnyPgTable, External extends AnyPgTable, Request extends AnyPgTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -40,7 +40,7 @@ export declare const makeIdentityServices: <Subject extends AnyPgTable, Identifi
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
@@ -201,10 +201,10 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Conflict";
     } | {
@@ -305,7 +305,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -347,7 +347,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -370,7 +370,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -386,7 +386,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
   dialect: "pg";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectPgDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnyPgTable<{
     dialect: "pg";
   }>, O extends AnyPgTable<{
@@ -574,10 +574,10 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -773,6 +773,120 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -920,10 +1034,10 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -1414,7 +1528,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnyPgTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnyPgTable<{
   dialect: "pg";
 }>, O extends AnyPgTable<{
   dialect: "pg";
@@ -1522,7 +1636,7 @@ export declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectPgDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnyPgTable<{
     dialect: "pg";
   }>, AC extends AnyPgTable<{

package/dist/SqliteBun.d.mts

@@ -73,16 +73,16 @@ export declare const coordinateEmailAddress: {
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Email").EmailUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
   registrationAuthority: EmailRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
   emailSignInTargets: {
     readonly lookup: (input: {
       readonly moduleId: string;
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
     }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, import("@yielded/auth/Email").EmailUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Email").EmailUnavailable, Database>;
 export declare const coordinatePasswordPersistence: {
   <Database extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<A>, DrizzleTableModel<RS>, DrizzleTableModel<CE>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
@@ -147,9 +147,9 @@ export declare const coordinatePasswordPersistence: {
       readonly hasMore: boolean;
     }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Password").PasswordUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
   registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateProofPersistence: {
   <Database extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<Rq>, DrizzleTableModel<S>, DrizzleTableModel<G>, DrizzleTableModel<Cn>, DrizzleTableModel<Rs>, DrizzleTableModel<Aev>, DrizzleTableModel<F>, DrizzleTableModel<C>, DrizzleTableModel<Sub>, DrizzleTableModel<I>, DrizzleTableModel<Cr>, NativeId, import("drizzle-orm").SQL<unknown>>;
@@ -209,7 +209,7 @@ export declare const coordinateProofPersistence: {
       readonly limit: number;
     }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofCleanupResult, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Proofs").ProofUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateAuthenticationAuthority: {
   <Database extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
@@ -266,11 +266,11 @@ export declare const coordinateAuthenticationAuthority: {
       readonly pending?: import("@yielded/auth/Sessions").PendingConsumption;
     }, prepare: import("@yielded/auth/Sessions").PrepareSessionCommit<void, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").PendingAuthenticationInvalid | import("@yielded/auth/Sessions").SessionUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
   pendingAuthentication: import("@yielded/auth/Sessions").PendingAuthentication<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
   sessionStepUpPersistence: import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
   <Database extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
     readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
@@ -283,10 +283,10 @@ export declare const coordinateAuthenticationAuthority: {
   }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
 }, makeSignedSessionValidityServices: <S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>) => Effect.Effect<{
   signedSessionValidity: import("@yielded/auth/Sessions").SignedSessionValidity;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
   readonly statefulSessionPersistence: import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>;
   readonly sessionRepository: import("@yielded/auth/Sessions").SessionRepository;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const commitMode: "interactive";
 export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -295,20 +295,20 @@ export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Iden
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
   passwordPreparedPersistence: import("@yielded/auth/Password").PasswordPreparedPersistence;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
   <Database extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
     readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
@@ -586,7 +586,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -628,7 +628,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -651,7 +651,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -667,7 +667,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -1054,6 +1054,120 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -1695,7 +1809,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -1803,7 +1917,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectSQLiteBunDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{