@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/drizzle/oauth-connected-state.d.mts

@@ -1,2062 +0,0 @@
-import { OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedMapping, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping } from "./oauth-connected-model.mjs";
-import { Row } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
-import { currentSubject } from "./oauth-flow.mjs";
-import { SQL, Table } from "drizzle-orm";
-import { DateTime, Effect, Schema } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision } from "@yielded/auth/OAuth";
-declare namespace oauth_connected_state_d_exports {
-  export { Authority, ClientAnchor, Current, Mapping, Revocations, ScopeAnchor, action, admissionStorage, claimStorage, client, clientKey, cohort, cohortKey, cohortWork, commandStorage, configuration, contextStorage, countCondition, current, disconnectStorage, disconnectedStorage, flowStorage, grantStorage, heldScope, initialGeneration, jobStorage, jobTable, lockClientById, nativeCopy, nativeOrder, nextOrder, orderNumber, policy, prelockClients, readGrant, readScope, refreshStorage, retainedUntil, rowCount, scope, scopeKey, sealedStorage, summaryStorage, tokenContextStorage, touchScope, unknownWork, useAuthority };
-}
-export type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {
-  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, "encodeInsert">>;
-  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, "encodeInsert">>;
-};
-export type Mapping = OAuthConnectedMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
-export type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;
-export type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;
-export declare const contextStorage: {
-  encode: (value: {
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly protocol: "oauth" | "oidc";
-    readonly configurationGeneration: number;
-    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-    readonly responseIssuerMode: "required" | "unsupported";
-    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-    readonly generation: number;
-    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-    readonly access?: {
-      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-      readonly generation: number;
-      readonly issuance: "active" | "retired";
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly clientRegistrationId: string;
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly retention: "access-and-refresh" | "access-only";
-      readonly maximumAccessLifetimeMillis: number;
-      readonly maximumRefreshLifetimeMillis?: number;
-      readonly refreshAheadMillis: number;
-      readonly refresh: "confidential" | "rotating" | "unsupported";
-      readonly revocation: "cohort" | "unsupported";
-    };
-    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-    readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    readonly requestBindingExpiresAtMillis: number;
-    readonly issuedAtMillis: number;
-    readonly expiresAtMillis: number;
-    readonly claimLifetimeMillis: number;
-    readonly namespace: "effect-auth/oauth-connected-context/v1";
-    readonly revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-    readonly profile: {
-      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-      readonly generation: number;
-      readonly issuance: "active" | "retired";
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly clientRegistrationId: string;
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly retention: "access-and-refresh" | "access-only";
-      readonly maximumAccessLifetimeMillis: number;
-      readonly maximumRefreshLifetimeMillis?: number;
-      readonly refreshAheadMillis: number;
-      readonly refresh: "confidential" | "rotating" | "unsupported";
-      readonly revocation: "cohort" | "unsupported";
-    };
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly reconnect?: {
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-    };
-    readonly maximumEvidenceAgeMillis: number;
-  }) => string;
-  decode: (value: string) => {
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly protocol: "oauth" | "oidc";
-    readonly configurationGeneration: number;
-    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-    readonly responseIssuerMode: "required" | "unsupported";
-    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-    readonly generation: number;
-    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-    readonly access?: {
-      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-      readonly generation: number;
-      readonly issuance: "active" | "retired";
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly clientRegistrationId: string;
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly retention: "access-and-refresh" | "access-only";
-      readonly maximumAccessLifetimeMillis: number;
-      readonly maximumRefreshLifetimeMillis?: number;
-      readonly refreshAheadMillis: number;
-      readonly refresh: "confidential" | "rotating" | "unsupported";
-      readonly revocation: "cohort" | "unsupported";
-    };
-    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-    readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    readonly requestBindingExpiresAtMillis: number;
-    readonly issuedAtMillis: number;
-    readonly expiresAtMillis: number;
-    readonly claimLifetimeMillis: number;
-    readonly namespace: "effect-auth/oauth-connected-context/v1";
-    readonly revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-    readonly profile: {
-      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-      readonly generation: number;
-      readonly issuance: "active" | "retired";
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly clientRegistrationId: string;
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly retention: "access-and-refresh" | "access-only";
-      readonly maximumAccessLifetimeMillis: number;
-      readonly maximumRefreshLifetimeMillis?: number;
-      readonly refreshAheadMillis: number;
-      readonly refresh: "confidential" | "rotating" | "unsupported";
-      readonly revocation: "cohort" | "unsupported";
-    };
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly reconnect?: {
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-    };
-    readonly maximumEvidenceAgeMillis: number;
-  };
-};
-export declare const flowStorage: {
-  encode: (value: {
-    readonly context: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly protocol: "oauth" | "oidc";
-      readonly configurationGeneration: number;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly responseIssuerMode: "required" | "unsupported";
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly generation: number;
-      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly access?: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-      readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-      readonly requestBindingExpiresAtMillis: number;
-      readonly issuedAtMillis: number;
-      readonly expiresAtMillis: number;
-      readonly claimLifetimeMillis: number;
-      readonly namespace: "effect-auth/oauth-connected-context/v1";
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      readonly profile: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly reconnect?: {
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-      };
-      readonly maximumEvidenceAgeMillis: number;
-    };
-    readonly sealed: {
-      readonly format: "oauth-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-    readonly retentionUntilMillis: number;
-  }) => string;
-  decode: (value: string) => {
-    readonly context: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly protocol: "oauth" | "oidc";
-      readonly configurationGeneration: number;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly responseIssuerMode: "required" | "unsupported";
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly generation: number;
-      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly access?: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-      readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-      readonly requestBindingExpiresAtMillis: number;
-      readonly issuedAtMillis: number;
-      readonly expiresAtMillis: number;
-      readonly claimLifetimeMillis: number;
-      readonly namespace: "effect-auth/oauth-connected-context/v1";
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      readonly profile: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly reconnect?: {
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-      };
-      readonly maximumEvidenceAgeMillis: number;
-    };
-    readonly sealed: {
-      readonly format: "oauth-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-    readonly retentionUntilMillis: number;
-  };
-};
-export declare const claimStorage: {
-  encode: (value: {
-    readonly flow: {
-      readonly context: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly generation: number;
-        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-        readonly access?: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-        readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-        readonly requestBindingExpiresAtMillis: number;
-        readonly issuedAtMillis: number;
-        readonly expiresAtMillis: number;
-        readonly claimLifetimeMillis: number;
-        readonly namespace: "effect-auth/oauth-connected-context/v1";
-        readonly revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly reconnect?: {
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-        };
-        readonly maximumEvidenceAgeMillis: number;
-      };
-      readonly sealed: {
-        readonly format: "oauth-xchacha20poly1305-v1";
-        readonly keyId: string;
-        readonly nonce: string;
-        readonly ciphertext: import("effect/Redacted").Redacted<string>;
-      };
-      readonly retentionUntilMillis: number;
-    };
-    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-    readonly claimedAtMillis: number;
-    readonly claimExpiresAtMillis: number;
-    readonly order: string;
-  }) => string;
-  decode: (value: string) => {
-    readonly flow: {
-      readonly context: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly generation: number;
-        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-        readonly access?: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-        readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-        readonly requestBindingExpiresAtMillis: number;
-        readonly issuedAtMillis: number;
-        readonly expiresAtMillis: number;
-        readonly claimLifetimeMillis: number;
-        readonly namespace: "effect-auth/oauth-connected-context/v1";
-        readonly revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly reconnect?: {
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-          readonly configuration: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly protocol: "oauth" | "oidc";
-            readonly configurationGeneration: number;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly responseIssuerMode: "required" | "unsupported";
-            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-            readonly profile: {
-              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-              readonly generation: number;
-              readonly issuance: "active" | "retired";
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly clientRegistrationId: string;
-              readonly scopes: readonly string[];
-              readonly resources: readonly string[];
-              readonly retention: "access-and-refresh" | "access-only";
-              readonly maximumAccessLifetimeMillis: number;
-              readonly maximumRefreshLifetimeMillis?: number;
-              readonly refreshAheadMillis: number;
-              readonly refresh: "confidential" | "rotating" | "unsupported";
-              readonly revocation: "cohort" | "unsupported";
-            };
-          };
-        };
-        readonly maximumEvidenceAgeMillis: number;
-      };
-      readonly sealed: {
-        readonly format: "oauth-xchacha20poly1305-v1";
-        readonly keyId: string;
-        readonly nonce: string;
-        readonly ciphertext: import("effect/Redacted").Redacted<string>;
-      };
-      readonly retentionUntilMillis: number;
-    };
-    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-    readonly claimedAtMillis: number;
-    readonly claimExpiresAtMillis: number;
-    readonly order: string;
-  };
-};
-export declare const tokenContextStorage: {
-  encode: (value: {
-    readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-    readonly exchangeOrder: string;
-    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly identity: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly subject: string;
-    };
-    readonly configuration: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly protocol: "oauth" | "oidc";
-      readonly configurationGeneration: number;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly responseIssuerMode: "required" | "unsupported";
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-      readonly profile: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-    };
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly metadata: {
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly accessExpiresAtMillis?: number;
-      readonly refreshExpiresAtMillis?: number;
-      readonly useUntilMillis: number;
-      readonly refreshUseUntilMillis?: number;
-      readonly obtainedAtMillis: number;
-      readonly profile?: {
-        readonly displayName?: string;
-        readonly handle?: string;
-        readonly avatarUrl?: string;
-        readonly profileUrl?: string;
-        readonly email?: string;
-        readonly emailVerified?: boolean;
-        readonly providerData?: {
-          readonly [x: string]: Schema.Json;
-        };
-      };
-    };
-  }) => string;
-  decode: (value: string) => {
-    readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-    readonly exchangeOrder: string;
-    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly identity: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly subject: string;
-    };
-    readonly configuration: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly protocol: "oauth" | "oidc";
-      readonly configurationGeneration: number;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly responseIssuerMode: "required" | "unsupported";
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-      readonly profile: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-    };
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly metadata: {
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly accessExpiresAtMillis?: number;
-      readonly refreshExpiresAtMillis?: number;
-      readonly useUntilMillis: number;
-      readonly refreshUseUntilMillis?: number;
-      readonly obtainedAtMillis: number;
-      readonly profile?: {
-        readonly displayName?: string;
-        readonly handle?: string;
-        readonly avatarUrl?: string;
-        readonly profileUrl?: string;
-        readonly email?: string;
-        readonly emailVerified?: boolean;
-        readonly providerData?: {
-          readonly [x: string]: Schema.Json;
-        };
-      };
-    };
-  };
-};
-export declare const sealedStorage: {
-  encode: (value: {
-    readonly format: "oauth-connected-xchacha20poly1305-v1";
-    readonly keyId: string;
-    readonly nonce: string;
-    readonly ciphertext: import("effect/Redacted").Redacted<string>;
-  }) => string;
-  decode: (value: string) => {
-    readonly format: "oauth-connected-xchacha20poly1305-v1";
-    readonly keyId: string;
-    readonly nonce: string;
-    readonly ciphertext: import("effect/Redacted").Redacted<string>;
-  };
-};
-export declare const grantStorage: {
-  encode: (value: {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-      readonly exchangeOrder: string;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly metadata: {
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly refreshExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly refreshUseUntilMillis?: number;
-        readonly obtainedAtMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-      };
-    };
-    readonly sealed: {
-      readonly format: "oauth-connected-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-  }) => string;
-  decode: (value: string) => {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-      readonly exchangeOrder: string;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly metadata: {
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly refreshExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly refreshUseUntilMillis?: number;
-        readonly obtainedAtMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-      };
-    };
-    readonly sealed: {
-      readonly format: "oauth-connected-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-  };
-};
-export declare const admissionStorage: {
-  encode: (value: {
-    readonly grant: {
-      readonly context: {
-        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-        readonly exchangeOrder: string;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly metadata: {
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly accessExpiresAtMillis?: number;
-          readonly refreshExpiresAtMillis?: number;
-          readonly useUntilMillis: number;
-          readonly refreshUseUntilMillis?: number;
-          readonly obtainedAtMillis: number;
-          readonly profile?: {
-            readonly displayName?: string;
-            readonly handle?: string;
-            readonly avatarUrl?: string;
-            readonly profileUrl?: string;
-            readonly email?: string;
-            readonly emailVerified?: boolean;
-            readonly providerData?: {
-              readonly [x: string]: Schema.Json;
-            };
-          };
-        };
-      };
-      readonly sealed: {
-        readonly format: "oauth-connected-xchacha20poly1305-v1";
-        readonly keyId: string;
-        readonly nonce: string;
-        readonly ciphertext: import("effect/Redacted").Redacted<string>;
-      };
-    };
-    readonly authorization: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      readonly policyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly expiresAtMillis: number;
-      readonly purpose: "metadata" | "use";
-      readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly profileKey?: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    };
-  }) => string;
-  decode: (value: string) => {
-    readonly grant: {
-      readonly context: {
-        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-        readonly exchangeOrder: string;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly metadata: {
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly accessExpiresAtMillis?: number;
-          readonly refreshExpiresAtMillis?: number;
-          readonly useUntilMillis: number;
-          readonly refreshUseUntilMillis?: number;
-          readonly obtainedAtMillis: number;
-          readonly profile?: {
-            readonly displayName?: string;
-            readonly handle?: string;
-            readonly avatarUrl?: string;
-            readonly profileUrl?: string;
-            readonly email?: string;
-            readonly emailVerified?: boolean;
-            readonly providerData?: {
-              readonly [x: string]: Schema.Json;
-            };
-          };
-        };
-      };
-      readonly sealed: {
-        readonly format: "oauth-connected-xchacha20poly1305-v1";
-        readonly keyId: string;
-        readonly nonce: string;
-        readonly ciphertext: import("effect/Redacted").Redacted<string>;
-      };
-    };
-    readonly authorization: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      readonly policyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly expiresAtMillis: number;
-      readonly purpose: "metadata" | "use";
-      readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly profileKey?: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    };
-  };
-};
-export declare const commandStorage: {
-  encode: (value: {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-      readonly exchangeOrder: string;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly metadata: {
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly refreshExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly refreshUseUntilMillis?: number;
-        readonly obtainedAtMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-      };
-    };
-    readonly originalDigest: string;
-    readonly revocationJobId?: string;
-  }) => string;
-  decode: (value: string) => {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-      readonly exchangeOrder: string;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly metadata: {
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly refreshExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly refreshUseUntilMillis?: number;
-        readonly obtainedAtMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-      };
-    };
-    readonly originalDigest: string;
-    readonly revocationJobId?: string;
-  };
-};
-export declare const disconnectStorage: {
-  encode: (value: {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-      readonly exchangeOrder: string;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly metadata: {
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly refreshExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly refreshUseUntilMillis?: number;
-        readonly obtainedAtMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-      };
-    };
-    readonly sealed?: {
-      readonly format: "oauth-connected-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-  }) => string;
-  decode: (value: string) => {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-      readonly exchangeOrder: string;
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly identity: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly subject: string;
-      };
-      readonly configuration: {
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly protocol: "oauth" | "oidc";
-        readonly configurationGeneration: number;
-        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-        readonly responseIssuerMode: "required" | "unsupported";
-        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-        readonly profile: {
-          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-          readonly generation: number;
-          readonly issuance: "active" | "retired";
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly clientRegistrationId: string;
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly retention: "access-and-refresh" | "access-only";
-          readonly maximumAccessLifetimeMillis: number;
-          readonly maximumRefreshLifetimeMillis?: number;
-          readonly refreshAheadMillis: number;
-          readonly refresh: "confidential" | "rotating" | "unsupported";
-          readonly revocation: "cohort" | "unsupported";
-        };
-      };
-      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly metadata: {
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly accessExpiresAtMillis?: number;
-        readonly refreshExpiresAtMillis?: number;
-        readonly useUntilMillis: number;
-        readonly refreshUseUntilMillis?: number;
-        readonly obtainedAtMillis: number;
-        readonly profile?: {
-          readonly displayName?: string;
-          readonly handle?: string;
-          readonly avatarUrl?: string;
-          readonly profileUrl?: string;
-          readonly email?: string;
-          readonly emailVerified?: boolean;
-          readonly providerData?: {
-            readonly [x: string]: Schema.Json;
-          };
-        };
-      };
-    };
-    readonly sealed?: {
-      readonly format: "oauth-connected-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-  };
-};
-export declare const refreshStorage: {
-  encode: (value: {
-    readonly grant: {
-      readonly context: {
-        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-        readonly exchangeOrder: string;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly metadata: {
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly accessExpiresAtMillis?: number;
-          readonly refreshExpiresAtMillis?: number;
-          readonly useUntilMillis: number;
-          readonly refreshUseUntilMillis?: number;
-          readonly obtainedAtMillis: number;
-          readonly profile?: {
-            readonly displayName?: string;
-            readonly handle?: string;
-            readonly avatarUrl?: string;
-            readonly profileUrl?: string;
-            readonly email?: string;
-            readonly emailVerified?: boolean;
-            readonly providerData?: {
-              readonly [x: string]: Schema.Json;
-            };
-          };
-        };
-      };
-      readonly sealed: {
-        readonly format: "oauth-connected-xchacha20poly1305-v1";
-        readonly keyId: string;
-        readonly nonce: string;
-        readonly ciphertext: import("effect/Redacted").Redacted<string>;
-      };
-    };
-    readonly order: string;
-    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-    readonly claimedAtMillis: number;
-    readonly claimExpiresAtMillis: number;
-    readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  }) => string;
-  decode: (value: string) => {
-    readonly grant: {
-      readonly context: {
-        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-        readonly exchangeOrder: string;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly metadata: {
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly accessExpiresAtMillis?: number;
-          readonly refreshExpiresAtMillis?: number;
-          readonly useUntilMillis: number;
-          readonly refreshUseUntilMillis?: number;
-          readonly obtainedAtMillis: number;
-          readonly profile?: {
-            readonly displayName?: string;
-            readonly handle?: string;
-            readonly avatarUrl?: string;
-            readonly profileUrl?: string;
-            readonly email?: string;
-            readonly emailVerified?: boolean;
-            readonly providerData?: {
-              readonly [x: string]: Schema.Json;
-            };
-          };
-        };
-      };
-      readonly sealed: {
-        readonly format: "oauth-connected-xchacha20poly1305-v1";
-        readonly keyId: string;
-        readonly nonce: string;
-        readonly ciphertext: import("effect/Redacted").Redacted<string>;
-      };
-    };
-    readonly order: string;
-    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-    readonly claimedAtMillis: number;
-    readonly claimExpiresAtMillis: number;
-    readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  };
-};
-export declare const jobStorage: {
-  encode: (value: {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
-      readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly token: {
-        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-        readonly exchangeOrder: string;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly metadata: {
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly accessExpiresAtMillis?: number;
-          readonly refreshExpiresAtMillis?: number;
-          readonly useUntilMillis: number;
-          readonly refreshUseUntilMillis?: number;
-          readonly obtainedAtMillis: number;
-          readonly profile?: {
-            readonly displayName?: string;
-            readonly handle?: string;
-            readonly avatarUrl?: string;
-            readonly profileUrl?: string;
-            readonly email?: string;
-            readonly emailVerified?: boolean;
-            readonly providerData?: {
-              readonly [x: string]: Schema.Json;
-            };
-          };
-        };
-      };
-    };
-    readonly sealed: {
-      readonly format: "oauth-connected-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-  }) => string;
-  decode: (value: string) => {
-    readonly context: {
-      readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
-      readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly token: {
-        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-        readonly exchangeOrder: string;
-        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly identity: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly subject: string;
-        };
-        readonly configuration: {
-          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-          readonly protocol: "oauth" | "oidc";
-          readonly configurationGeneration: number;
-          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly responseIssuerMode: "required" | "unsupported";
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-          readonly profile: {
-            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly generation: number;
-            readonly issuance: "active" | "retired";
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly clientRegistrationId: string;
-            readonly scopes: readonly string[];
-            readonly resources: readonly string[];
-            readonly retention: "access-and-refresh" | "access-only";
-            readonly maximumAccessLifetimeMillis: number;
-            readonly maximumRefreshLifetimeMillis?: number;
-            readonly refreshAheadMillis: number;
-            readonly refresh: "confidential" | "rotating" | "unsupported";
-            readonly revocation: "cohort" | "unsupported";
-          };
-        };
-        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly metadata: {
-          readonly scopes: readonly string[];
-          readonly resources: readonly string[];
-          readonly accessExpiresAtMillis?: number;
-          readonly refreshExpiresAtMillis?: number;
-          readonly useUntilMillis: number;
-          readonly refreshUseUntilMillis?: number;
-          readonly obtainedAtMillis: number;
-          readonly profile?: {
-            readonly displayName?: string;
-            readonly handle?: string;
-            readonly avatarUrl?: string;
-            readonly profileUrl?: string;
-            readonly email?: string;
-            readonly emailVerified?: boolean;
-            readonly providerData?: {
-              readonly [x: string]: Schema.Json;
-            };
-          };
-        };
-      };
-    };
-    readonly sealed: {
-      readonly format: "oauth-connected-xchacha20poly1305-v1";
-      readonly keyId: string;
-      readonly nonce: string;
-      readonly ciphertext: import("effect/Redacted").Redacted<string>;
-    };
-  };
-};
-export declare const summaryStorage: {
-  encode: (value: {
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-    readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
-    readonly scopes: readonly string[];
-    readonly accessExpiresAtMillis?: number;
-    readonly useUntilMillis: number;
-    readonly profile?: {
-      readonly displayName?: string;
-      readonly handle?: string;
-      readonly avatarUrl?: string;
-      readonly profileUrl?: string;
-      readonly email?: string;
-      readonly emailVerified?: boolean;
-      readonly providerData?: {
-        readonly [x: string]: Schema.Json;
-      };
-    };
-    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-  }) => string;
-  decode: (value: string) => {
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-    readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
-    readonly scopes: readonly string[];
-    readonly accessExpiresAtMillis?: number;
-    readonly useUntilMillis: number;
-    readonly profile?: {
-      readonly displayName?: string;
-      readonly handle?: string;
-      readonly avatarUrl?: string;
-      readonly profileUrl?: string;
-      readonly email?: string;
-      readonly emailVerified?: boolean;
-      readonly providerData?: {
-        readonly [x: string]: Schema.Json;
-      };
-    };
-    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-  };
-};
-export declare const disconnectedStorage: {
-  encode: (value: {
-    readonly _tag: "Disconnected";
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-    readonly affectedGrantCount: number;
-    readonly replayed: boolean;
-  }) => string;
-  decode: (value: string) => {
-    readonly _tag: "Disconnected";
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-    readonly affectedGrantCount: number;
-    readonly replayed: boolean;
-  };
-};
-export declare const orderNumber: (value: string) => number;
-export declare const nativeOrder: (mapping: Authority, value: unknown) => number;
-export declare const clientKey: (configuration: M.OAuthConnectedConfiguration) => Effect.Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
-export declare const cohortKey: (client: string, identity: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
-export declare const initialGeneration: (cohort: string) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
-export declare const configuration: (flow: M.OAuthConnectedPendingFlow) => M.OAuthConnectedConfiguration;
-export declare const retainedUntil: (mapping: Authority, now: number) => number;
-export declare const rowCount: (table: Table<import("drizzle-orm").TableConfig<import("drizzle-orm").Columns>>, where: SQL<unknown>) => Effect.Effect<number, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const countCondition: (table: Table, where: SQL, count: number) => SQL<unknown>;
-export declare const current: (mapping: Mapping, subject: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<{
-  subject: import("@yielded/auth-persistence/Adapter").Observation;
-  row: Row;
-  authorities: import("@yielded/auth-persistence/Adapter").Observation;
-  revision: {
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly credentials: readonly {
-      readonly credentialId: string;
-      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }[];
-  };
-  nativeId: unknown;
-} | undefined, M.OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, CurrentOAuthTransaction>;
-export declare const nativeCopy: <N>(value: N) => N;
-export declare const jobTable: (mapping: Authority) => Omit<OAuthConnectedRevocationJobTable<any, any>, "encodeInsert"> | undefined;
-export declare const policy: (mapping: Mapping, input: OAuthConnectedPolicyInput<any>) => Effect.Effect<boolean, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const action: (mapping: Mapping, found: {
-  subject: import("@yielded/auth-persistence/Adapter").Observation;
-  row: Row;
-  authorities: import("@yielded/auth-persistence/Adapter").Observation;
-  revision: {
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly credentials: readonly {
-      readonly credentialId: string;
-      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }[];
-  };
-  nativeId: unknown;
-}, authorization: {
-  readonly evidence: {
-    readonly revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
-    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    readonly proofs: readonly [{
-      readonly userVerified: boolean;
-      readonly phishingResistant: boolean;
-      readonly verifiedAt: DateTime.Utc;
-      readonly method: string;
-      readonly credentialId: string;
-      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
-    }, ...{
-      readonly userVerified: boolean;
-      readonly phishingResistant: boolean;
-      readonly verifiedAt: DateTime.Utc;
-      readonly method: string;
-      readonly credentialId: string;
-      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
-    }[]];
-  };
-  readonly requirement: {
-    readonly maximumAgeMillis: number;
-    readonly alternatives: readonly [{
-      readonly userVerified: boolean;
-      readonly phishingResistant: boolean;
-      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
-      readonly minimumCredentials: number;
-    }, ...{
-      readonly userVerified: boolean;
-      readonly phishingResistant: boolean;
-      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
-      readonly minimumCredentials: number;
-    }[]];
-  };
-  readonly challenge: {
-    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-    readonly action: "connected-begin" | "connected-complete" | "connected-disconnect";
-    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-    readonly revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-    readonly intentDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-  };
-}, operation: "claim" | "disconnect" | "issue" | "settle", expected: {
-  readonly moduleId: string;
-  readonly flowId: string;
-  readonly commandId: string;
-  readonly revision: OAuthAccountRevision;
-  readonly intent: string;
-  readonly maximumAgeMillis: number;
-  readonly configuration: M.OAuthConnectedConfiguration;
-  readonly grant?: M.OAuthConnectedTokenContext;
-}) => Effect.Effect<boolean, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const useAuthority: (mapping: Mapping, authorization: {
-  readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-  readonly revision: {
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly credentials: readonly {
-      readonly credentialId: string;
-      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }[];
-  };
-  readonly policyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  readonly expiresAtMillis: number;
-  readonly purpose: "metadata" | "use";
-  readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-  readonly profileKey?: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-}, kind: "metadata" | "use", grant?: {
-  readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-  readonly exchangeOrder: string;
-  readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-  readonly identity: {
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-    readonly subject: string;
-  };
-  readonly configuration: {
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly protocol: "oauth" | "oidc";
-    readonly configurationGeneration: number;
-    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-    readonly responseIssuerMode: "required" | "unsupported";
-    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-    readonly profile: {
-      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-      readonly generation: number;
-      readonly issuance: "active" | "retired";
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly clientRegistrationId: string;
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly retention: "access-and-refresh" | "access-only";
-      readonly maximumAccessLifetimeMillis: number;
-      readonly maximumRefreshLifetimeMillis?: number;
-      readonly refreshAheadMillis: number;
-      readonly refresh: "confidential" | "rotating" | "unsupported";
-      readonly revocation: "cohort" | "unsupported";
-    };
-  };
-  readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-  readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  readonly metadata: {
-    readonly scopes: readonly string[];
-    readonly resources: readonly string[];
-    readonly accessExpiresAtMillis?: number;
-    readonly refreshExpiresAtMillis?: number;
-    readonly useUntilMillis: number;
-    readonly refreshUseUntilMillis?: number;
-    readonly obtainedAtMillis: number;
-    readonly profile?: {
-      readonly displayName?: string;
-      readonly handle?: string;
-      readonly avatarUrl?: string;
-      readonly profileUrl?: string;
-      readonly email?: string;
-      readonly emailVerified?: boolean;
-      readonly providerData?: {
-        readonly [x: string]: Schema.Json;
-      };
-    };
-  };
-} | undefined) => Effect.Effect<{
-  subject: import("@yielded/auth-persistence/Adapter").Observation;
-  row: Row;
-  authorities: import("@yielded/auth-persistence/Adapter").Observation;
-  revision: {
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly credentials: readonly {
-      readonly credentialId: string;
-      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }[];
-  };
-  nativeId: unknown;
-} | undefined, M.OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, CurrentOAuthTransaction>;
-export declare const scopeKey: (provider: string, issuer: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
-export interface ScopeAnchor {
-  readonly id: string;
-  row: Row;
-}
-export interface ClientAnchor {
-  readonly id: string;
-  row: Row;
-  counter: number;
-  readonly scope: ScopeAnchor;
-}
-/** Empty registration ID is impossible in the public profile label schema. The
- * distinct 52-byte key domain shares the physical table, never a client counter. */
-export declare const scope: (mapping: Authority, config: {
-  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-  readonly protocol: "oauth" | "oidc";
-  readonly configurationGeneration: number;
-  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-  readonly responseIssuerMode: "required" | "unsupported";
-  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-  readonly profile: {
-    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    readonly generation: number;
-    readonly issuance: "active" | "retired";
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly clientRegistrationId: string;
-    readonly scopes: readonly string[];
-    readonly resources: readonly string[];
-    readonly retention: "access-and-refresh" | "access-only";
-    readonly maximumAccessLifetimeMillis: number;
-    readonly maximumRefreshLifetimeMillis?: number;
-    readonly refreshAheadMillis: number;
-    readonly refresh: "confidential" | "rotating" | "unsupported";
-    readonly revocation: "cohort" | "unsupported";
-  };
-}, create: boolean) => Effect.Effect<ScopeAnchor | undefined, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const touchScope: (mapping: Authority, found: ScopeAnchor) => Effect.Effect<void, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const readScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const lockClientById: (mapping: Authority, id: string) => Effect.Effect<ClientAnchor, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const heldScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor | undefined, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-/** Cleanup obtains every scope then every client before entering any tuple. */
-export declare const prelockClients: (mapping: Authority, ids: readonly string[], releaseScopes?: readonly {
-  readonly provider: string;
-  readonly issuer: string;
-}[] | undefined) => Effect.Effect<void, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const client: (mapping: Authority, config: {
-  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-  readonly protocol: "oauth" | "oidc";
-  readonly configurationGeneration: number;
-  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-  readonly responseIssuerMode: "required" | "unsupported";
-  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-  readonly profile: {
-    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-    readonly generation: number;
-    readonly issuance: "active" | "retired";
-    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-    readonly clientRegistrationId: string;
-    readonly scopes: readonly string[];
-    readonly resources: readonly string[];
-    readonly retention: "access-and-refresh" | "access-only";
-    readonly maximumAccessLifetimeMillis: number;
-    readonly maximumRefreshLifetimeMillis?: number;
-    readonly refreshAheadMillis: number;
-    readonly refresh: "confidential" | "rotating" | "unsupported";
-    readonly revocation: "cohort" | "unsupported";
-  };
-}, create: boolean) => Effect.Effect<ClientAnchor | undefined, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const nextOrder: (mapping: Authority, found: ClientAnchor) => Effect.Effect<number, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const cohort: (mapping: Authority, clientId: string, identityId: string, create: boolean) => Effect.Effect<{
-  id: string;
-  row: undefined;
-  generation: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  cutoff: number;
-  blocked: boolean;
-} | {
-  id: string;
-  row: Row;
-  generation: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-  cutoff: number;
-  blocked: boolean;
-}, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const readGrant: (mapping: Authority, moduleId: string, grantId: string, lock?: any) => Effect.Effect<{
-  row: Row;
-  context: {
-    readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-    readonly exchangeOrder: string;
-    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly identity: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly subject: string;
-    };
-    readonly configuration: {
-      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-      readonly protocol: "oauth" | "oidc";
-      readonly configurationGeneration: number;
-      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly responseIssuerMode: "required" | "unsupported";
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-      readonly profile: {
-        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        readonly generation: number;
-        readonly issuance: "active" | "retired";
-        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-        readonly clientRegistrationId: string;
-        readonly scopes: readonly string[];
-        readonly resources: readonly string[];
-        readonly retention: "access-and-refresh" | "access-only";
-        readonly maximumAccessLifetimeMillis: number;
-        readonly maximumRefreshLifetimeMillis?: number;
-        readonly refreshAheadMillis: number;
-        readonly refresh: "confidential" | "rotating" | "unsupported";
-        readonly revocation: "cohort" | "unsupported";
-      };
-    };
-    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-    readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly metadata: {
-      readonly scopes: readonly string[];
-      readonly resources: readonly string[];
-      readonly accessExpiresAtMillis?: number;
-      readonly refreshExpiresAtMillis?: number;
-      readonly useUntilMillis: number;
-      readonly refreshUseUntilMillis?: number;
-      readonly obtainedAtMillis: number;
-      readonly profile?: {
-        readonly displayName?: string;
-        readonly handle?: string;
-        readonly avatarUrl?: string;
-        readonly profileUrl?: string;
-        readonly email?: string;
-        readonly emailVerified?: boolean;
-        readonly providerData?: {
-          readonly [x: string]: Schema.Json;
-        };
-      };
-    };
-  };
-  native: any;
-  sealed: {
-    readonly format: "oauth-connected-xchacha20poly1305-v1";
-    readonly keyId: string;
-    readonly nonce: string;
-    readonly ciphertext: import("effect/Redacted").Redacted<string>;
-  } | undefined;
-} | undefined, M.OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
-export declare const unknownWork: (mapping: Authority, clientId: string | SQL, cutoff?: number) => SQL<unknown>;
-export declare const cohortWork: (mapping: Authority, id: string | SQL) => SQL<unknown>;
-//#endregion
-export { oauth_connected_state_d_exports };
-//# sourceMappingURL=oauth-connected-state.d.mts.map