@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/internal/oauth-kernel.d.mts

@@ -0,0 +1,1423 @@
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { QueryOperations, SqlExpression, SqlFragment, TableModel } from "./query-operations.mjs";
+import { OAuthReferenceGuardDescriptor, OAuthRegistrationAuthority } from "./models/oauth-model.mjs";
+import { OAuthConnectedMapping } from "./models/oauth-connected-model.mjs";
+import { Mapping, Revocations } from "./oauth/connected-state.mjs";
+import { OAuthCoordinatorError, OAuthTargetConfiguration, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./oauth/target.mjs";
+import "./sql-oauth-model.mjs";
+import { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } from "./oauth/connected-target.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/oauth-kernel.d.ts
+export type OAuthKernel = ReturnType<typeof makeOAuthKernel>;
+/** Adapter composition root. Shared operation Layers acquire their dependencies;
+ * database and transaction services are still resolved by each operation. */
+export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (table: object) => "pg" | "sqlite" | "mysql") => {
+  target: {
+    makeTargetOAuthSignInServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+      oauthSignInPersistence: {
+        readonly issue: <A>(input: import("@yielded/auth/OAuth").OAuthPendingFlow, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly claim: <A>(input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: import("@yielded/auth/Operations").RequestBindingFlowId;
+          readonly provider: import("@yielded/auth/OAuth").OAuthProviderKey;
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly stateDigest: import("@yielded/auth/Schema").TokenDigest;
+          readonly requestBindingVerifier: import("@yielded/auth/Schema").TokenDigest;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly responseIssuer?: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+          readonly nowMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthClaimDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly settle: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
+          readonly outcome: {
+            readonly _tag: "Verified";
+            readonly identity: import("@yielded/auth/OAuth").OAuthVerifiedExternalIdentity;
+          } | {
+            readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
+          };
+          readonly nowMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthSettlementDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly terminalized: number;
+          readonly removed: number;
+          readonly hasMore: boolean;
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+      };
+    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetOAuthRegistrationIntentServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+      oauthRegistrationIntents: {
+        readonly settle: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
+          readonly identity: import("@yielded/auth/OAuth").OAuthVerifiedExternalIdentity;
+          readonly intent?: import("@yielded/auth/OAuth").OAuthRegistrationIntent;
+          readonly nowMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+      };
+    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetOAuthRegistrationServices: <Registration>(mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+      registrationAuthority: OAuthRegistrationAuthority<Registration>;
+    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetOAuthAccountsServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+      oauthAccountsPersistence: {
+        readonly capture: (input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+        }) => Effect.Effect<import("@yielded/auth/OAuth").OAuthAccountRevision | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly issue: <A>(input: {
+          readonly flow: import("@yielded/auth/OAuth").OAuthLinkPendingFlow;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Issued";
+          readonly flow: {
+            readonly context: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly generation: number;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+              readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+              readonly access?: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+              readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+              readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly requestBindingExpiresAtMillis: number;
+              readonly issuedAtMillis: number;
+              readonly expiresAtMillis: number;
+              readonly claimLifetimeMillis: number;
+              readonly namespace: "effect-auth/oauth-link-context/v1";
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly maximumEvidenceAgeMillis: number;
+            };
+            readonly sealed: {
+              readonly format: "oauth-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+            readonly retentionUntilMillis: number;
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly preflight: (input: import("@yielded/auth/OAuth").OAuthLinkAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthLinkPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly claim: <A>(input: {
+          readonly access: import("@yielded/auth/OAuth").OAuthLinkAccess;
+          readonly flow: import("@yielded/auth/OAuth").OAuthLinkPendingFlow;
+          readonly claimId: import("@yielded/auth/OAuth").OAuthLinkClaim["claimId"];
+          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Claimed";
+          readonly claim: {
+            readonly flow: {
+              readonly context: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+                readonly generation: number;
+                readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+                readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+                readonly access?: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+                readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+                readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+                readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+                readonly requestBindingExpiresAtMillis: number;
+                readonly issuedAtMillis: number;
+                readonly expiresAtMillis: number;
+                readonly claimLifetimeMillis: number;
+                readonly namespace: "effect-auth/oauth-link-context/v1";
+                readonly revision: {
+                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly credentials: readonly {
+                    readonly credentialId: string;
+                    readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  }[];
+                };
+                readonly maximumEvidenceAgeMillis: number;
+              };
+              readonly sealed: {
+                readonly format: "oauth-xchacha20poly1305-v1";
+                readonly keyId: string;
+                readonly nonce: string;
+                readonly ciphertext: import("effect/Redacted").Redacted<string>;
+              };
+              readonly retentionUntilMillis: number;
+            };
+            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+            readonly claimedAtMillis: number;
+            readonly claimExpiresAtMillis: number;
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly settle: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthLinkClaim;
+          readonly outcome: import("@yielded/auth/OAuth").OAuthLinkOutcome;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
+          readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
+          readonly nowMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Ambiguous";
+        } | {
+          readonly _tag: "Cancelled";
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Linked";
+          readonly credential: {
+            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly credentialId: string;
+            readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+          };
+          readonly changed: boolean;
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly inspectUnlink: (input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly credentialId: string;
+        }) => Effect.Effect<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Target";
+          readonly credential: {
+            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly credentialId: string;
+            readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly revision: {
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly credentials: readonly {
+                readonly credentialId: string;
+                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              }[];
+            };
+          };
+        } | {
+          readonly _tag: "Replay";
+          readonly result: {
+            readonly _tag: "Unlinked";
+            readonly credentialId: string;
+            readonly invalidation: {
+              readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+              readonly existingSessions: "immediate" | "original-absolute-expiry";
+              readonly maximumExposureMillis: number;
+              readonly oldAuthenticationEvidence: "rejected";
+            };
+          };
+        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly unlink: <A>(input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly credential: import("@yielded/auth/OAuth").OAuthCredentialSnapshot;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
+          readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
+          readonly nowMillis: number;
+          readonly retentionUntilMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Unlinked";
+          readonly result: {
+            readonly _tag: "Unlinked";
+            readonly credentialId: string;
+            readonly invalidation: {
+              readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+              readonly existingSessions: "immediate" | "original-absolute-expiry";
+              readonly maximumExposureMillis: number;
+              readonly oldAuthenticationEvidence: "rejected";
+            };
+          };
+          readonly replayed: boolean;
+        } | {
+          readonly _tag: "LastSignInMethod";
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly terminalized: number;
+          readonly removed: number;
+          readonly hasMore: boolean;
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+      };
+    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetOAuthRegistration: <Registration, Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
+      readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
+    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetOAuthSignIn: <Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
+      readonly oauthSignInPersistence: import("@yielded/auth/OAuth").OAuthSignInPersistence["Service"];
+    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetOAuthRegistrationIntents: <Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
+      readonly oauthRegistrationIntents: import("@yielded/auth/OAuth").OAuthRegistrationIntents["Service"];
+    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetOAuthAccounts: <Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
+      readonly oauthAccountsPersistence: import("@yielded/auth/OAuth").OAuthAccountsPersistence["Service"];
+    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    sqlClientOAuthStandaloneGuard: (service: SqlClient["transactionService"] | undefined) => Effect.Effect<void, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    oauthAccountsPersistenceLayer: typeof oauthAccountsPersistenceLayer;
+    oauthSignInPersistenceLayer: typeof oauthSignInPersistenceLayer;
+    oauthRegistrationIntentsLayer: typeof oauthRegistrationIntentsLayer;
+    oauthRegistrationAuthorityLayer: typeof oauthRegistrationAuthorityLayer;
+  };
+  connectedTarget: {
+    makeTargetOAuthConnectedServices: (mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+      oauthConnectedPersistence: {
+        readonly claimSignIn: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
+          readonly configuration: import("@yielded/auth/OAuth").OAuthConnectedConfiguration;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthSignInAccessClaim, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly inspectSignIn: (input: {
+          readonly reservation: import("@yielded/auth/OAuth").OAuthSignInAccessClaim;
+          readonly credential: import("@yielded/auth/OAuth").OAuthCredentialSnapshot;
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        }) => Effect.Effect<import("@yielded/auth/OAuth").OAuthSignInAccessInspection, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly settleSignIn: <A>(input: {
+          readonly reservation: import("@yielded/auth/OAuth").OAuthSignInAccessClaim;
+          readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Ambiguous";
+        } | {
+          readonly _tag: "Cancelled";
+        } | {
+          readonly _tag: "Connected";
+          readonly grant: {
+            readonly context: {
+              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+              readonly exchangeOrder: string;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly metadata: {
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly accessExpiresAtMillis?: number;
+                readonly refreshExpiresAtMillis?: number;
+                readonly useUntilMillis: number;
+                readonly refreshUseUntilMillis?: number;
+                readonly obtainedAtMillis: number;
+                readonly profile?: {
+                  readonly displayName?: string;
+                  readonly handle?: string;
+                  readonly avatarUrl?: string;
+                  readonly profileUrl?: string;
+                  readonly email?: string;
+                  readonly emailVerified?: boolean;
+                  readonly providerData?: {
+                    readonly [x: string]: import("effect/Schema").Json;
+                  };
+                };
+              };
+            };
+            readonly sealed: {
+              readonly format: "oauth-connected-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+          };
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Busy";
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly capture: (input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+          readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        }) => Effect.Effect<{
+          readonly revision: import("@yielded/auth/OAuth").OAuthAccountRevision;
+          readonly target?: import("@yielded/auth/OAuth").OAuthConnectedTarget;
+        } | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly issue: <A>(input: {
+          readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Issued";
+          readonly flow: {
+            readonly context: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly generation: number;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+              readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+              readonly access?: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+              readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+              readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly requestBindingExpiresAtMillis: number;
+              readonly issuedAtMillis: number;
+              readonly expiresAtMillis: number;
+              readonly claimLifetimeMillis: number;
+              readonly namespace: "effect-auth/oauth-connected-context/v1";
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly reconnect?: {
+                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+                readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly identity: {
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                  readonly subject: string;
+                };
+                readonly configuration: {
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly protocol: "oauth" | "oidc";
+                  readonly configurationGeneration: number;
+                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                  readonly responseIssuerMode: "required" | "unsupported";
+                  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                  readonly profile: {
+                    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                    readonly generation: number;
+                    readonly issuance: "active" | "retired";
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly clientRegistrationId: string;
+                    readonly scopes: readonly string[];
+                    readonly resources: readonly string[];
+                    readonly retention: "access-and-refresh" | "access-only";
+                    readonly maximumAccessLifetimeMillis: number;
+                    readonly maximumRefreshLifetimeMillis?: number;
+                    readonly refreshAheadMillis: number;
+                    readonly refresh: "confidential" | "rotating" | "unsupported";
+                    readonly revocation: "cohort" | "unsupported";
+                  };
+                };
+              };
+              readonly maximumEvidenceAgeMillis: number;
+            };
+            readonly sealed: {
+              readonly format: "oauth-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+            readonly retentionUntilMillis: number;
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly prepare: <A>(input: {
+          readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Issued";
+          readonly flow: {
+            readonly context: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly generation: number;
+              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+              readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+              readonly access?: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+              readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+              readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly requestBindingExpiresAtMillis: number;
+              readonly issuedAtMillis: number;
+              readonly expiresAtMillis: number;
+              readonly claimLifetimeMillis: number;
+              readonly namespace: "effect-auth/oauth-connected-context/v1";
+              readonly revision: {
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly credentials: readonly {
+                  readonly credentialId: string;
+                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                }[];
+              };
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly reconnect?: {
+                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+                readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly identity: {
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                  readonly subject: string;
+                };
+                readonly configuration: {
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly protocol: "oauth" | "oidc";
+                  readonly configurationGeneration: number;
+                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                  readonly responseIssuerMode: "required" | "unsupported";
+                  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                  readonly profile: {
+                    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                    readonly generation: number;
+                    readonly issuance: "active" | "retired";
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly clientRegistrationId: string;
+                    readonly scopes: readonly string[];
+                    readonly resources: readonly string[];
+                    readonly retention: "access-and-refresh" | "access-only";
+                    readonly maximumAccessLifetimeMillis: number;
+                    readonly maximumRefreshLifetimeMillis?: number;
+                    readonly refreshAheadMillis: number;
+                    readonly refresh: "confidential" | "rotating" | "unsupported";
+                    readonly revocation: "cohort" | "unsupported";
+                  };
+                };
+              };
+              readonly maximumEvidenceAgeMillis: number;
+            };
+            readonly sealed: {
+              readonly format: "oauth-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+            readonly retentionUntilMillis: number;
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly claim: <A>(input: {
+          readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
+          readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Claimed";
+          readonly claim: {
+            readonly flow: {
+              readonly context: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+                readonly generation: number;
+                readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+                readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+                readonly access?: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+                readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+                readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+                readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+                readonly requestBindingExpiresAtMillis: number;
+                readonly issuedAtMillis: number;
+                readonly expiresAtMillis: number;
+                readonly claimLifetimeMillis: number;
+                readonly namespace: "effect-auth/oauth-connected-context/v1";
+                readonly revision: {
+                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly credentials: readonly {
+                    readonly credentialId: string;
+                    readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  }[];
+                };
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+                readonly reconnect?: {
+                  readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+                  readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly identity: {
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                    readonly subject: string;
+                  };
+                  readonly configuration: {
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly protocol: "oauth" | "oidc";
+                    readonly configurationGeneration: number;
+                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                    readonly responseIssuerMode: "required" | "unsupported";
+                    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                    readonly profile: {
+                      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                      readonly generation: number;
+                      readonly issuance: "active" | "retired";
+                      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                      readonly clientRegistrationId: string;
+                      readonly scopes: readonly string[];
+                      readonly resources: readonly string[];
+                      readonly retention: "access-and-refresh" | "access-only";
+                      readonly maximumAccessLifetimeMillis: number;
+                      readonly maximumRefreshLifetimeMillis?: number;
+                      readonly refreshAheadMillis: number;
+                      readonly refresh: "confidential" | "rotating" | "unsupported";
+                      readonly revocation: "cohort" | "unsupported";
+                    };
+                  };
+                };
+                readonly maximumEvidenceAgeMillis: number;
+              };
+              readonly sealed: {
+                readonly format: "oauth-xchacha20poly1305-v1";
+                readonly keyId: string;
+                readonly nonce: string;
+                readonly ciphertext: import("effect/Redacted").Redacted<string>;
+              };
+              readonly retentionUntilMillis: number;
+            };
+            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+            readonly claimedAtMillis: number;
+            readonly claimExpiresAtMillis: number;
+            readonly order: string;
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly inspectGrant: (input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+        }) => Effect.Effect<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Target";
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        } | {
+          readonly _tag: "Quarantine";
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly settle: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
+          readonly outcome: import("@yielded/auth/OAuth").OAuthConnectedOutcome;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
+          readonly nowMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Ambiguous";
+        } | {
+          readonly _tag: "Cancelled";
+        } | {
+          readonly _tag: "Connected";
+          readonly grant: {
+            readonly context: {
+              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+              readonly exchangeOrder: string;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly metadata: {
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly accessExpiresAtMillis?: number;
+                readonly refreshExpiresAtMillis?: number;
+                readonly useUntilMillis: number;
+                readonly refreshUseUntilMillis?: number;
+                readonly obtainedAtMillis: number;
+                readonly profile?: {
+                  readonly displayName?: string;
+                  readonly handle?: string;
+                  readonly avatarUrl?: string;
+                  readonly profileUrl?: string;
+                  readonly email?: string;
+                  readonly emailVerified?: boolean;
+                  readonly providerData?: {
+                    readonly [x: string]: import("effect/Schema").Json;
+                  };
+                };
+              };
+            };
+            readonly sealed: {
+              readonly format: "oauth-connected-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+          };
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Busy";
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly list: (input: {
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+          readonly limit: number;
+          readonly cursor?: string;
+        }) => Effect.Effect<{
+          readonly items: readonly {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+            readonly scopes: readonly string[];
+            readonly accessExpiresAtMillis?: number;
+            readonly useUntilMillis: number;
+            readonly profile?: {
+              readonly displayName?: string;
+              readonly handle?: string;
+              readonly avatarUrl?: string;
+              readonly profileUrl?: string;
+              readonly email?: string;
+              readonly emailVerified?: boolean;
+              readonly providerData?: {
+                readonly [x: string]: import("effect/Schema").Json;
+              };
+            };
+            readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+          }[];
+          readonly cursor?: string;
+        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly inspectDisconnect: (input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        }) => Effect.Effect<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Conflict";
+        } | {
+          readonly _tag: "Target";
+          readonly grant: {
+            readonly context: {
+              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+              readonly exchangeOrder: string;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly metadata: {
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly accessExpiresAtMillis?: number;
+                readonly refreshExpiresAtMillis?: number;
+                readonly useUntilMillis: number;
+                readonly refreshUseUntilMillis?: number;
+                readonly obtainedAtMillis: number;
+                readonly profile?: {
+                  readonly displayName?: string;
+                  readonly handle?: string;
+                  readonly avatarUrl?: string;
+                  readonly profileUrl?: string;
+                  readonly email?: string;
+                  readonly emailVerified?: boolean;
+                  readonly providerData?: {
+                    readonly [x: string]: import("effect/Schema").Json;
+                  };
+                };
+              };
+            };
+            readonly sealed?: {
+              readonly format: "oauth-connected-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+          };
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+        } | {
+          readonly _tag: "Replay";
+          readonly result: {
+            readonly _tag: "Disconnected";
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+            readonly affectedGrantCount: number;
+            readonly replayed: boolean;
+          };
+        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly disconnect: <A>(input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly grant: import("@yielded/auth/OAuth").OAuthConnectedDisconnectGrant;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
+          readonly revocation?: import("@yielded/auth/OAuth").OAuthConnectedRevocationJob;
+          readonly retentionUntilMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Disconnected";
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+          readonly affectedGrantCount: number;
+          readonly replayed: boolean;
+        } | {
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Conflict";
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly inspectAccess: (input: {
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        }) => Effect.Effect<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Busy";
+        } | {
+          readonly _tag: "Target";
+          readonly grant: {
+            readonly context: {
+              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+              readonly exchangeOrder: string;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly metadata: {
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly accessExpiresAtMillis?: number;
+                readonly refreshExpiresAtMillis?: number;
+                readonly useUntilMillis: number;
+                readonly refreshUseUntilMillis?: number;
+                readonly obtainedAtMillis: number;
+                readonly profile?: {
+                  readonly displayName?: string;
+                  readonly handle?: string;
+                  readonly avatarUrl?: string;
+                  readonly profileUrl?: string;
+                  readonly email?: string;
+                  readonly emailVerified?: boolean;
+                  readonly providerData?: {
+                    readonly [x: string]: import("effect/Schema").Json;
+                  };
+                };
+              };
+            };
+            readonly sealed: {
+              readonly format: "oauth-connected-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+          };
+        } | {
+          readonly _tag: "ReauthorizationRequired";
+        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly claimRefresh: <A>(input: {
+          readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+          readonly nextTokenVersion: import("@yielded/auth/OAuth").OAuthConnectedRefreshClaim["nextTokenVersion"];
+          readonly lifetimeMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Busy";
+        } | {
+          readonly _tag: "ReauthorizationRequired";
+        } | {
+          readonly _tag: "Claimed";
+          readonly claim: {
+            readonly grant: {
+              readonly context: {
+                readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+                readonly exchangeOrder: string;
+                readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                readonly identity: {
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                  readonly subject: string;
+                };
+                readonly configuration: {
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly protocol: "oauth" | "oidc";
+                  readonly configurationGeneration: number;
+                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                  readonly responseIssuerMode: "required" | "unsupported";
+                  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                  readonly profile: {
+                    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                    readonly generation: number;
+                    readonly issuance: "active" | "retired";
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly clientRegistrationId: string;
+                    readonly scopes: readonly string[];
+                    readonly resources: readonly string[];
+                    readonly retention: "access-and-refresh" | "access-only";
+                    readonly maximumAccessLifetimeMillis: number;
+                    readonly maximumRefreshLifetimeMillis?: number;
+                    readonly refreshAheadMillis: number;
+                    readonly refresh: "confidential" | "rotating" | "unsupported";
+                    readonly revocation: "cohort" | "unsupported";
+                  };
+                };
+                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+                readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                readonly metadata: {
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly accessExpiresAtMillis?: number;
+                  readonly refreshExpiresAtMillis?: number;
+                  readonly useUntilMillis: number;
+                  readonly refreshUseUntilMillis?: number;
+                  readonly obtainedAtMillis: number;
+                  readonly profile?: {
+                    readonly displayName?: string;
+                    readonly handle?: string;
+                    readonly avatarUrl?: string;
+                    readonly profileUrl?: string;
+                    readonly email?: string;
+                    readonly emailVerified?: boolean;
+                    readonly providerData?: {
+                      readonly [x: string]: import("effect/Schema").Json;
+                    };
+                  };
+                };
+              };
+              readonly sealed: {
+                readonly format: "oauth-connected-xchacha20poly1305-v1";
+                readonly keyId: string;
+                readonly nonce: string;
+                readonly ciphertext: import("effect/Redacted").Redacted<string>;
+              };
+            };
+            readonly order: string;
+            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+            readonly claimedAtMillis: number;
+            readonly claimExpiresAtMillis: number;
+            readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly settleRefresh: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedRefreshClaim;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+          readonly outcome: import("@yielded/auth/OAuth").OAuthConnectedRefreshOutcome;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "ReauthorizationRequired";
+        } | {
+          readonly _tag: "Refreshed";
+          readonly grant: {
+            readonly context: {
+              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+              readonly exchangeOrder: string;
+              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+              readonly identity: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly subject: string;
+              };
+              readonly configuration: {
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly protocol: "oauth" | "oidc";
+                readonly configurationGeneration: number;
+                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                readonly responseIssuerMode: "required" | "unsupported";
+                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                readonly profile: {
+                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                  readonly generation: number;
+                  readonly issuance: "active" | "retired";
+                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                  readonly clientRegistrationId: string;
+                  readonly scopes: readonly string[];
+                  readonly resources: readonly string[];
+                  readonly retention: "access-and-refresh" | "access-only";
+                  readonly maximumAccessLifetimeMillis: number;
+                  readonly maximumRefreshLifetimeMillis?: number;
+                  readonly refreshAheadMillis: number;
+                  readonly refresh: "confidential" | "rotating" | "unsupported";
+                  readonly revocation: "cohort" | "unsupported";
+                };
+              };
+              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+              readonly metadata: {
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly accessExpiresAtMillis?: number;
+                readonly refreshExpiresAtMillis?: number;
+                readonly useUntilMillis: number;
+                readonly refreshUseUntilMillis?: number;
+                readonly obtainedAtMillis: number;
+                readonly profile?: {
+                  readonly displayName?: string;
+                  readonly handle?: string;
+                  readonly avatarUrl?: string;
+                  readonly profileUrl?: string;
+                  readonly email?: string;
+                  readonly emailVerified?: boolean;
+                  readonly providerData?: {
+                    readonly [x: string]: import("effect/Schema").Json;
+                  };
+                };
+              };
+            };
+            readonly sealed: {
+              readonly format: "oauth-connected-xchacha20poly1305-v1";
+              readonly keyId: string;
+              readonly nonce: string;
+              readonly ciphertext: import("effect/Redacted").Redacted<string>;
+            };
+          };
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly admitUse: <A>(input: {
+          readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
+          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+          readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+          readonly lifetimeMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Busy";
+        } | {
+          readonly _tag: "ReauthorizationRequired";
+        } | {
+          readonly _tag: "Admitted";
+          readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly admittedAtMillis: number;
+          readonly expiresAtMillis: number;
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+        readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly terminalized: number;
+          readonly removed: number;
+          readonly hasMore: boolean;
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+      };
+    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetOAuthConnectedRevocationServices: (mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+      oauthConnectedRevocations: {
+        readonly claim: <A>(input: {
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+          readonly lifetimeMillis: number;
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly _tag: "Claimed";
+          readonly claim: {
+            readonly job: {
+              readonly context: {
+                readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
+                readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+                readonly token: {
+                  readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+                  readonly exchangeOrder: string;
+                  readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+                  readonly identity: {
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                    readonly subject: string;
+                  };
+                  readonly configuration: {
+                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                    readonly protocol: "oauth" | "oidc";
+                    readonly configurationGeneration: number;
+                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+                    readonly responseIssuerMode: "required" | "unsupported";
+                    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+                    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+                    readonly profile: {
+                      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                      readonly generation: number;
+                      readonly issuance: "active" | "retired";
+                      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                      readonly clientRegistrationId: string;
+                      readonly scopes: readonly string[];
+                      readonly resources: readonly string[];
+                      readonly retention: "access-and-refresh" | "access-only";
+                      readonly maximumAccessLifetimeMillis: number;
+                      readonly maximumRefreshLifetimeMillis?: number;
+                      readonly refreshAheadMillis: number;
+                      readonly refresh: "confidential" | "rotating" | "unsupported";
+                      readonly revocation: "cohort" | "unsupported";
+                    };
+                  };
+                  readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+                  readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+                  readonly metadata: {
+                    readonly scopes: readonly string[];
+                    readonly resources: readonly string[];
+                    readonly accessExpiresAtMillis?: number;
+                    readonly refreshExpiresAtMillis?: number;
+                    readonly useUntilMillis: number;
+                    readonly refreshUseUntilMillis?: number;
+                    readonly obtainedAtMillis: number;
+                    readonly profile?: {
+                      readonly displayName?: string;
+                      readonly handle?: string;
+                      readonly avatarUrl?: string;
+                      readonly profileUrl?: string;
+                      readonly email?: string;
+                      readonly emailVerified?: boolean;
+                      readonly providerData?: {
+                        readonly [x: string]: import("effect/Schema").Json;
+                      };
+                    };
+                  };
+                };
+              };
+              readonly sealed: {
+                readonly format: "oauth-connected-xchacha20poly1305-v1";
+                readonly keyId: string;
+                readonly nonce: string;
+                readonly ciphertext: import("effect/Redacted").Redacted<string>;
+              };
+            };
+            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+            readonly claimedAtMillis: number;
+            readonly claimExpiresAtMillis: number;
+          };
+        } | {
+          readonly _tag: "Empty";
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+        readonly settle: <A>(input: {
+          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedRevocationClaim;
+          readonly outcome: "Confirmed" | "Unknown";
+        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+          readonly settled: boolean;
+        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
+      };
+    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetOAuthConnected: <Transaction, A, E, R>(database: any, mapping: Mapping, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
+      readonly oauthConnectedPersistence: import("@yielded/auth/OAuth").OAuthConnectedPersistence["Service"];
+    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetOAuthConnectedRevocations: <Transaction, A, E, R>(database: any, mapping: Revocations, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
+      readonly oauthConnectedRevocations: import("@yielded/auth/OAuth").OAuthConnectedRevocations["Service"];
+    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    oauthConnectedPersistenceLayer: typeof oauthConnectedPersistenceLayer;
+    oauthConnectedRevocationsLayer: typeof oauthConnectedRevocationsLayer;
+  };
+  connectedReference: {
+    oauthConnectedOwnershipReferences: <S extends TableModel, AC extends TableModel, T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, A extends TableModel, D extends TableModel, N, J extends TableModel>(original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J, any>) => {
+      readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
+      readonly connectedReference: (input: {
+        readonly identityKey: string;
+        readonly subjectId: N;
+      }) => SqlExpression;
+    };
+    connectedReferenceCondition: (mapping: Mapping, identityKey: string | SqlExpression, knownIdentity?: {
+      readonly provider: string | SqlExpression;
+      readonly issuer: string | SqlExpression;
+    }) => SqlFragment;
+  };
+};
+//#endregion
+//# sourceMappingURL=oauth-kernel.d.mts.map