@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/drizzle/oauth-connected-target.d.mts

@@ -1,993 +1,6 @@
-import { OAuthTargetConfiguration } from "./oauth-target.mjs";
-import { Mapping, Revocations, oauth_connected_state_d_exports } from "./oauth-connected-state.mjs";
-import { Crypto, Effect, Layer, Schema } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
-import { Statement } from "effect/sql/Statement";
+import { OAuthKernel } from "@yielded/auth-persistence/Adapter";
 //#region src/drizzle/oauth-connected-target.d.ts
-export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-  oauthConnectedPersistence: {
-    readonly claimSignIn: <A>(input: {
-      readonly claim: M.OAuthClaim;
-      readonly configuration: M.OAuthConnectedConfiguration;
-    }, prepare: PrepareOAuthCommit<M.OAuthSignInAccessClaim, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly inspectSignIn: (input: {
-      readonly reservation: M.OAuthSignInAccessClaim;
-      readonly credential: M.OAuthCredentialSnapshot;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    }) => Effect.Effect<M.OAuthSignInAccessInspection, M.OAuthUnavailable>;
-    readonly settleSignIn: <A>(input: {
-      readonly reservation: M.OAuthSignInAccessClaim;
-      readonly outcome: M.OAuthSignInAccessOutcome;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Connected";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: Schema.Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    } | {
-      readonly _tag: "Busy";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly capture: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    }) => Effect.Effect<{
-      readonly revision: M.OAuthAccountRevision;
-      readonly target?: M.OAuthConnectedTarget;
-    } | undefined, M.OAuthUnavailable>;
-    readonly issue: <A>(input: {
-      readonly flow: M.OAuthConnectedPendingFlow;
-      readonly authorization: M.OAuthConnectedActionAuthorization;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Issued";
-      readonly flow: {
-        readonly context: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly generation: number;
-          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly access?: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingExpiresAtMillis: number;
-          readonly issuedAtMillis: number;
-          readonly expiresAtMillis: number;
-          readonly claimLifetimeMillis: number;
-          readonly namespace: "effect-auth/oauth-connected-context/v1";
-          readonly revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly reconnect?: {
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly configuration: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-            };
-          };
-          readonly maximumEvidenceAgeMillis: number;
-        };
-        readonly sealed: {
-          readonly format: "oauth-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-        readonly retentionUntilMillis: number;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly prepare: <A>(input: {
-      readonly flow: M.OAuthConnectedPendingFlow;
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Issued";
-      readonly flow: {
-        readonly context: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly generation: number;
-          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly access?: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          readonly requestBindingExpiresAtMillis: number;
-          readonly issuedAtMillis: number;
-          readonly expiresAtMillis: number;
-          readonly claimLifetimeMillis: number;
-          readonly namespace: "effect-auth/oauth-connected-context/v1";
-          readonly revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly reconnect?: {
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly configuration: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-            };
-          };
-          readonly maximumEvidenceAgeMillis: number;
-        };
-        readonly sealed: {
-          readonly format: "oauth-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-        readonly retentionUntilMillis: number;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly inspectPrepared: (input: M.OAuthConnectedPreparedAccess) => Effect.Effect<M.OAuthConnectedPendingFlow | undefined, M.OAuthUnavailable>;
-    readonly preflight: (input: M.OAuthConnectedAccess) => Effect.Effect<M.OAuthConnectedPendingFlow | undefined, M.OAuthUnavailable>;
-    readonly claim: <A>(input: {
-      readonly access: M.OAuthConnectedAccess;
-      readonly flow: M.OAuthConnectedPendingFlow;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly authorization: M.OAuthConnectedActionAuthorization;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Claimed";
-      readonly claim: {
-        readonly flow: {
-          readonly context: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly generation: number;
-            readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-            readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-            readonly access?: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-            readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-            readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-            readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-            readonly requestBindingExpiresAtMillis: number;
-            readonly issuedAtMillis: number;
-            readonly expiresAtMillis: number;
-            readonly claimLifetimeMillis: number;
-            readonly namespace: "effect-auth/oauth-connected-context/v1";
-            readonly revision: {
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly credentials: readonly {
-                readonly credentialId: string;
-                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              }[];
-            };
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly reconnect?: {
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-            };
-            readonly maximumEvidenceAgeMillis: number;
-          };
-          readonly sealed: {
-            readonly format: "oauth-xchacha20poly1305-v1";
-            readonly keyId: string;
-            readonly nonce: string;
-            readonly ciphertext: import("effect/Redacted").Redacted<string>;
-          };
-          readonly retentionUntilMillis: number;
-        };
-        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-        readonly claimedAtMillis: number;
-        readonly claimExpiresAtMillis: number;
-        readonly order: string;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly inspectGrant: (input: {
-      readonly claim: M.OAuthConnectedClaim;
-      readonly identity: typeof OAuthExternalIdentity.Type;
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Target";
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Quarantine";
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }, M.OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: M.OAuthConnectedClaim;
-      readonly outcome: M.OAuthConnectedOutcome;
-      readonly authorization: M.OAuthConnectedActionAuthorization;
-      readonly nowMillis: number;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Connected";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: Schema.Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    } | {
-      readonly _tag: "Busy";
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly list: (input: {
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-      readonly limit: number;
-      readonly cursor?: string;
-    }) => Effect.Effect<{
-      readonly items: readonly {
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
-        readonly scopes: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-      }[];
-      readonly cursor?: string;
-    }, M.OAuthUnavailable>;
-    readonly inspectDisconnect: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Target";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: Schema.Json;
-              };
-            };
-          };
-        };
-        readonly sealed?: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-    } | {
-      readonly _tag: "Replay";
-      readonly result: {
-        readonly _tag: "Disconnected";
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-        readonly affectedGrantCount: number;
-        readonly replayed: boolean;
-      };
-    }, M.OAuthUnavailable>;
-    readonly disconnect: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly grant: M.OAuthConnectedDisconnectGrant;
-      readonly authorization: M.OAuthConnectedActionAuthorization;
-      readonly revocation?: M.OAuthConnectedRevocationJob;
-      readonly retentionUntilMillis: number;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Disconnected";
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-      readonly affectedGrantCount: number;
-      readonly replayed: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly inspectAccess: (input: {
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    }) => Effect.Effect<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
-    } | {
-      readonly _tag: "Target";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: Schema.Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    }, M.OAuthUnavailable>;
-    readonly claimRefresh: <A>(input: {
-      readonly grant: M.OAuthConnectedStoredGrant;
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly nextTokenVersion: M.OAuthConnectedRefreshClaim["nextTokenVersion"];
-      readonly lifetimeMillis: number;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    } | {
-      readonly _tag: "Claimed";
-      readonly claim: {
-        readonly grant: {
-          readonly context: {
-            readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-            readonly exchangeOrder: string;
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly configuration: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-            };
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly metadata: {
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly accessExpiresAtMillis?: number;
-              readonly refreshExpiresAtMillis?: number;
-              readonly useUntilMillis: number;
-              readonly refreshUseUntilMillis?: number;
-              readonly obtainedAtMillis: number;
-              readonly profile?: {
-                readonly displayName?: string;
-                readonly handle?: string;
-                readonly avatarUrl?: string;
-                readonly profileUrl?: string;
-                readonly email?: string;
-                readonly emailVerified?: boolean;
-                readonly providerData?: {
-                  readonly [x: string]: Schema.Json;
-                };
-              };
-            };
-          };
-          readonly sealed: {
-            readonly format: "oauth-connected-xchacha20poly1305-v1";
-            readonly keyId: string;
-            readonly nonce: string;
-            readonly ciphertext: import("effect/Redacted").Redacted<string>;
-          };
-        };
-        readonly order: string;
-        readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-        readonly claimedAtMillis: number;
-        readonly claimExpiresAtMillis: number;
-        readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly settleRefresh: <A>(input: {
-      readonly claim: M.OAuthConnectedRefreshClaim;
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-      readonly outcome: M.OAuthConnectedRefreshOutcome;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    } | {
-      readonly _tag: "Refreshed";
-      readonly grant: {
-        readonly context: {
-          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-          readonly exchangeOrder: string;
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly metadata: {
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly refreshExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly refreshUseUntilMillis?: number;
-            readonly obtainedAtMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: Schema.Json;
-              };
-            };
-          };
-        };
-        readonly sealed: {
-          readonly format: "oauth-connected-xchacha20poly1305-v1";
-          readonly keyId: string;
-          readonly nonce: string;
-          readonly ciphertext: import("effect/Redacted").Redacted<string>;
-        };
-      };
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly admitUse: <A>(input: {
-      readonly grant: M.OAuthConnectedStoredGrant;
-      readonly authorization: M.OAuthConnectedUseAuthorization;
-      readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly lifetimeMillis: number;
-    }, prepare: PrepareOAuthCommit<{
-      readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Busy";
-    } | {
-      readonly _tag: "ReauthorizationRequired";
-    } | {
-      readonly _tag: "Admitted";
-      readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly admittedAtMillis: number;
-      readonly expiresAtMillis: number;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-    readonly cleanup: <A>(input: M.OAuthCleanupInput, prepare: PrepareOAuthCommit<{
-      readonly terminalized: number;
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
-  };
-}, M.OAuthUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
-export declare const makeTargetOAuthConnectedRevocationServices: (mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-  oauthConnectedRevocations: {
-    readonly claim: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly lifetimeMillis: number;
-    }, prepare: PrepareOAuthCommit<typeof OAuthConnectedRevocationDecision.Type, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: M.OAuthConnectedRevocationClaim;
-      readonly outcome: "Confirmed" | "Unknown";
-    }, prepare: PrepareOAuthCommit<{
-      readonly settled: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable>;
-  };
-}, M.OAuthUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
-export declare const oauthConnectedPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthConnectedServices>>, E, R>) => Layer.Layer<OAuthConnectedPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
-export declare const oauthConnectedRevocationsLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthConnectedRevocationServices>>, E, R>) => Layer.Layer<OAuthConnectedRevocations, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthConnectedPersistenceLayer: OAuthKernel["connectedTarget"]["oauthConnectedPersistenceLayer"];
+export declare const oauthConnectedRevocationsLayer: OAuthKernel["connectedTarget"]["oauthConnectedRevocationsLayer"];
 //#endregion
 //# sourceMappingURL=oauth-connected-target.d.mts.map