@yielded/auth-persistence 0.1.0-beta.8 → 0.1.0-beta.9

package/dist/drizzle/oauth-connected-state.d.mts

@@ -1,14 +1,1957 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
 import "./model.mjs";
-import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "./oauth-connected-model.mjs";
+import { OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedMapping, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping } from "./oauth-connected-model.mjs";
+import { Observation, Row } from "../internal/transaction-kernel.mjs";
 import "./transaction-owner.mjs";
-import "./oauth-owner.mjs";
-import "./oauth-flow.mjs";
+import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
+import { currentSubject } from "./oauth-flow.mjs";
 import { DateTime, Effect, Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
 import { OAuthAccountRevision } from "@yielded/auth/OAuth";
 import { SQL, Table } from "drizzle-orm";
-//#region src/drizzle/oauth-connected-state.d.ts
-type Mapping = OAuthConnectedMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
-type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;
+declare namespace oauth_connected_state_d_exports {
+  export { Authority, ClientAnchor, Current, Mapping, Revocations, ScopeAnchor, action, admissionStorage, claimStorage, client, clientKey, cohort, cohortKey, cohortWork, commandStorage, configuration, contextStorage, countCondition, current, disconnectStorage, disconnectedStorage, flowStorage, grantStorage, heldScope, initialGeneration, jobStorage, jobTable, lockClientById, nativeCopy, nativeOrder, nextOrder, orderNumber, policy, prelockClients, readGrant, readScope, refreshStorage, retainedUntil, rowCount, scope, scopeKey, sealedStorage, summaryStorage, tokenContextStorage, touchScope, unknownWork, useAuthority };
+}
+export type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {
+  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, "encodeInsert">>;
+  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, "encodeInsert">>;
+};
+export type Mapping = OAuthConnectedMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+export type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;
+export type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;
+export declare const contextStorage: {
+  encode: (value: {
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly protocol: "oauth" | "oidc";
+    readonly configurationGeneration: number;
+    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: "required" | "unsupported";
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+    readonly generation: number;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly requestBindingExpiresAtMillis: number;
+    readonly issuedAtMillis: number;
+    readonly expiresAtMillis: number;
+    readonly claimLifetimeMillis: number;
+    readonly namespace: "effect-auth/oauth-connected-context/v1";
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly profile: {
+      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: number;
+      readonly issuance: "active" | "retired";
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: string;
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly retention: "access-and-refresh" | "access-only";
+      readonly maximumAccessLifetimeMillis: number;
+      readonly maximumRefreshLifetimeMillis?: number | undefined;
+      readonly refreshAheadMillis: number;
+      readonly refresh: "confidential" | "rotating" | "unsupported";
+      readonly revocation: "cohort" | "unsupported";
+    };
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly reconnect?: {
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+    } | undefined;
+    readonly maximumEvidenceAgeMillis: number;
+  }) => string;
+  decode: (value: string) => {
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly protocol: "oauth" | "oidc";
+    readonly configurationGeneration: number;
+    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: "required" | "unsupported";
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+    readonly generation: number;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly requestBindingExpiresAtMillis: number;
+    readonly issuedAtMillis: number;
+    readonly expiresAtMillis: number;
+    readonly claimLifetimeMillis: number;
+    readonly namespace: "effect-auth/oauth-connected-context/v1";
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly profile: {
+      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: number;
+      readonly issuance: "active" | "retired";
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: string;
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly retention: "access-and-refresh" | "access-only";
+      readonly maximumAccessLifetimeMillis: number;
+      readonly maximumRefreshLifetimeMillis?: number | undefined;
+      readonly refreshAheadMillis: number;
+      readonly refresh: "confidential" | "rotating" | "unsupported";
+      readonly revocation: "cohort" | "unsupported";
+    };
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly reconnect?: {
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+    } | undefined;
+    readonly maximumEvidenceAgeMillis: number;
+  };
+};
+export declare const flowStorage: {
+  encode: (value: {
+    readonly context: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly protocol: "oauth" | "oidc";
+      readonly configurationGeneration: number;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: "required" | "unsupported";
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly generation: number;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly issuedAtMillis: number;
+      readonly expiresAtMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly namespace: "effect-auth/oauth-connected-context/v1";
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly profile: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly reconnect?: {
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+      } | undefined;
+      readonly maximumEvidenceAgeMillis: number;
+    };
+    readonly sealed: {
+      readonly format: "oauth-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    };
+    readonly retentionUntilMillis: number;
+  }) => string;
+  decode: (value: string) => {
+    readonly context: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly protocol: "oauth" | "oidc";
+      readonly configurationGeneration: number;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: "required" | "unsupported";
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly generation: number;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly issuedAtMillis: number;
+      readonly expiresAtMillis: number;
+      readonly claimLifetimeMillis: number;
+      readonly namespace: "effect-auth/oauth-connected-context/v1";
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly profile: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly reconnect?: {
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+      } | undefined;
+      readonly maximumEvidenceAgeMillis: number;
+    };
+    readonly sealed: {
+      readonly format: "oauth-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    };
+    readonly retentionUntilMillis: number;
+  };
+};
+export declare const claimStorage: {
+  encode: (value: {
+    readonly flow: {
+      readonly context: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly generation: number;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: number;
+        readonly issuedAtMillis: number;
+        readonly expiresAtMillis: number;
+        readonly claimLifetimeMillis: number;
+        readonly namespace: "effect-auth/oauth-connected-context/v1";
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly reconnect?: {
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+        } | undefined;
+        readonly maximumEvidenceAgeMillis: number;
+      };
+      readonly sealed: {
+        readonly format: "oauth-xchacha20poly1305-v1";
+        readonly keyId: string;
+        readonly nonce: string;
+        readonly ciphertext: import("effect/Redacted").Redacted<string>;
+      };
+      readonly retentionUntilMillis: number;
+    };
+    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: number;
+    readonly claimExpiresAtMillis: number;
+    readonly order: string;
+  }) => string;
+  decode: (value: string) => {
+    readonly flow: {
+      readonly context: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly generation: number;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: number;
+        readonly issuedAtMillis: number;
+        readonly expiresAtMillis: number;
+        readonly claimLifetimeMillis: number;
+        readonly namespace: "effect-auth/oauth-connected-context/v1";
+        readonly revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly reconnect?: {
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+        } | undefined;
+        readonly maximumEvidenceAgeMillis: number;
+      };
+      readonly sealed: {
+        readonly format: "oauth-xchacha20poly1305-v1";
+        readonly keyId: string;
+        readonly nonce: string;
+        readonly ciphertext: import("effect/Redacted").Redacted<string>;
+      };
+      readonly retentionUntilMillis: number;
+    };
+    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: number;
+    readonly claimExpiresAtMillis: number;
+    readonly order: string;
+  };
+};
+export declare const tokenContextStorage: {
+  encode: (value: {
+    readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly identity: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly subject: string;
+    };
+    readonly configuration: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly protocol: "oauth" | "oidc";
+      readonly configurationGeneration: number;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: "required" | "unsupported";
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+      readonly profile: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      };
+    };
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly metadata: {
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly accessExpiresAtMillis?: number | undefined;
+      readonly refreshExpiresAtMillis?: number | undefined;
+      readonly useUntilMillis: number;
+      readonly refreshUseUntilMillis?: number | undefined;
+      readonly obtainedAtMillis: number;
+      readonly profile?: {
+        readonly displayName?: string | undefined;
+        readonly handle?: string | undefined;
+        readonly avatarUrl?: string | undefined;
+        readonly profileUrl?: string | undefined;
+        readonly email?: string | undefined;
+        readonly emailVerified?: boolean | undefined;
+        readonly providerData?: {
+          readonly [x: string]: Schema.Json;
+        } | undefined;
+      } | undefined;
+    };
+  }) => string;
+  decode: (value: string) => {
+    readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly identity: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly subject: string;
+    };
+    readonly configuration: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly protocol: "oauth" | "oidc";
+      readonly configurationGeneration: number;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: "required" | "unsupported";
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+      readonly profile: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      };
+    };
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly metadata: {
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly accessExpiresAtMillis?: number | undefined;
+      readonly refreshExpiresAtMillis?: number | undefined;
+      readonly useUntilMillis: number;
+      readonly refreshUseUntilMillis?: number | undefined;
+      readonly obtainedAtMillis: number;
+      readonly profile?: {
+        readonly displayName?: string | undefined;
+        readonly handle?: string | undefined;
+        readonly avatarUrl?: string | undefined;
+        readonly profileUrl?: string | undefined;
+        readonly email?: string | undefined;
+        readonly emailVerified?: boolean | undefined;
+        readonly providerData?: {
+          readonly [x: string]: Schema.Json;
+        } | undefined;
+      } | undefined;
+    };
+  };
+};
+export declare const sealedStorage: {
+  encode: (value: {
+    readonly format: "oauth-connected-xchacha20poly1305-v1";
+    readonly keyId: string;
+    readonly nonce: string;
+    readonly ciphertext: import("effect/Redacted").Redacted<string>;
+  }) => string;
+  decode: (value: string) => {
+    readonly format: "oauth-connected-xchacha20poly1305-v1";
+    readonly keyId: string;
+    readonly nonce: string;
+    readonly ciphertext: import("effect/Redacted").Redacted<string>;
+  };
+};
+export declare const grantStorage: {
+  encode: (value: {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly metadata: {
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly refreshExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly refreshUseUntilMillis?: number | undefined;
+        readonly obtainedAtMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
+        } | undefined;
+      };
+    };
+    readonly sealed: {
+      readonly format: "oauth-connected-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    };
+  }) => string;
+  decode: (value: string) => {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly metadata: {
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly refreshExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly refreshUseUntilMillis?: number | undefined;
+        readonly obtainedAtMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
+        } | undefined;
+      };
+    };
+    readonly sealed: {
+      readonly format: "oauth-connected-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    };
+  };
+};
+export declare const admissionStorage: {
+  encode: (value: {
+    readonly grant: {
+      readonly context: {
+        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly metadata: {
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly refreshExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly refreshUseUntilMillis?: number | undefined;
+          readonly obtainedAtMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
+          } | undefined;
+        };
+      };
+      readonly sealed: {
+        readonly format: "oauth-connected-xchacha20poly1305-v1";
+        readonly keyId: string;
+        readonly nonce: string;
+        readonly ciphertext: import("effect/Redacted").Redacted<string>;
+      };
+    };
+    readonly authorization: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly policyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly expiresAtMillis: number;
+      readonly purpose: "metadata" | "use";
+      readonly grantId?: (string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">) | undefined;
+      readonly profileKey?: (string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">) | undefined;
+    };
+  }) => string;
+  decode: (value: string) => {
+    readonly grant: {
+      readonly context: {
+        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly metadata: {
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly refreshExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly refreshUseUntilMillis?: number | undefined;
+          readonly obtainedAtMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
+          } | undefined;
+        };
+      };
+      readonly sealed: {
+        readonly format: "oauth-connected-xchacha20poly1305-v1";
+        readonly keyId: string;
+        readonly nonce: string;
+        readonly ciphertext: import("effect/Redacted").Redacted<string>;
+      };
+    };
+    readonly authorization: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly revision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      readonly policyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly expiresAtMillis: number;
+      readonly purpose: "metadata" | "use";
+      readonly grantId?: (string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">) | undefined;
+      readonly profileKey?: (string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">) | undefined;
+    };
+  };
+};
+export declare const commandStorage: {
+  encode: (value: {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly metadata: {
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly refreshExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly refreshUseUntilMillis?: number | undefined;
+        readonly obtainedAtMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
+        } | undefined;
+      };
+    };
+    readonly originalDigest: string;
+    readonly revocationJobId?: string | undefined;
+  }) => string;
+  decode: (value: string) => {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly metadata: {
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly refreshExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly refreshUseUntilMillis?: number | undefined;
+        readonly obtainedAtMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
+        } | undefined;
+      };
+    };
+    readonly originalDigest: string;
+    readonly revocationJobId?: string | undefined;
+  };
+};
+export declare const disconnectStorage: {
+  encode: (value: {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly metadata: {
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly refreshExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly refreshUseUntilMillis?: number | undefined;
+        readonly obtainedAtMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
+        } | undefined;
+      };
+    };
+    readonly sealed?: {
+      readonly format: "oauth-connected-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    } | undefined;
+  }) => string;
+  decode: (value: string) => {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly identity: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly subject: string;
+      };
+      readonly configuration: {
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly protocol: "oauth" | "oidc";
+        readonly configurationGeneration: number;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: "required" | "unsupported";
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+        readonly profile: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        };
+      };
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly metadata: {
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly refreshExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly refreshUseUntilMillis?: number | undefined;
+        readonly obtainedAtMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
+        } | undefined;
+      };
+    };
+    readonly sealed?: {
+      readonly format: "oauth-connected-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    } | undefined;
+  };
+};
+export declare const refreshStorage: {
+  encode: (value: {
+    readonly grant: {
+      readonly context: {
+        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly metadata: {
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly refreshExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly refreshUseUntilMillis?: number | undefined;
+          readonly obtainedAtMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
+          } | undefined;
+        };
+      };
+      readonly sealed: {
+        readonly format: "oauth-connected-xchacha20poly1305-v1";
+        readonly keyId: string;
+        readonly nonce: string;
+        readonly ciphertext: import("effect/Redacted").Redacted<string>;
+      };
+    };
+    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: number;
+    readonly claimExpiresAtMillis: number;
+    readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  }) => string;
+  decode: (value: string) => {
+    readonly grant: {
+      readonly context: {
+        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly metadata: {
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly refreshExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly refreshUseUntilMillis?: number | undefined;
+          readonly obtainedAtMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
+          } | undefined;
+        };
+      };
+      readonly sealed: {
+        readonly format: "oauth-connected-xchacha20poly1305-v1";
+        readonly keyId: string;
+        readonly nonce: string;
+        readonly ciphertext: import("effect/Redacted").Redacted<string>;
+      };
+    };
+    readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: number;
+    readonly claimExpiresAtMillis: number;
+    readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  };
+};
+export declare const jobStorage: {
+  encode: (value: {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
+      readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly token: {
+        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly metadata: {
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly refreshExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly refreshUseUntilMillis?: number | undefined;
+          readonly obtainedAtMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
+          } | undefined;
+        };
+      };
+    };
+    readonly sealed: {
+      readonly format: "oauth-connected-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    };
+  }) => string;
+  decode: (value: string) => {
+    readonly context: {
+      readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
+      readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly token: {
+        readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly identity: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly subject: string;
+        };
+        readonly configuration: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+        };
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly metadata: {
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly refreshExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly refreshUseUntilMillis?: number | undefined;
+          readonly obtainedAtMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
+          } | undefined;
+        };
+      };
+    };
+    readonly sealed: {
+      readonly format: "oauth-connected-xchacha20poly1305-v1";
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: import("effect/Redacted").Redacted<string>;
+    };
+  };
+};
+export declare const summaryStorage: {
+  encode: (value: {
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+    readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+    readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+    readonly scopes: readonly string[];
+    readonly accessExpiresAtMillis?: number | undefined;
+    readonly useUntilMillis: number;
+    readonly profile?: {
+      readonly displayName?: string | undefined;
+      readonly handle?: string | undefined;
+      readonly avatarUrl?: string | undefined;
+      readonly profileUrl?: string | undefined;
+      readonly email?: string | undefined;
+      readonly emailVerified?: boolean | undefined;
+      readonly providerData?: {
+        readonly [x: string]: Schema.Json;
+      } | undefined;
+    } | undefined;
+    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+  }) => string;
+  decode: (value: string) => {
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+    readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+    readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+    readonly scopes: readonly string[];
+    readonly accessExpiresAtMillis?: number | undefined;
+    readonly useUntilMillis: number;
+    readonly profile?: {
+      readonly displayName?: string | undefined;
+      readonly handle?: string | undefined;
+      readonly avatarUrl?: string | undefined;
+      readonly profileUrl?: string | undefined;
+      readonly email?: string | undefined;
+      readonly emailVerified?: boolean | undefined;
+      readonly providerData?: {
+        readonly [x: string]: Schema.Json;
+      } | undefined;
+    } | undefined;
+    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+  };
+};
+export declare const disconnectedStorage: {
+  encode: (value: {
+    readonly _tag: "Disconnected";
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+    readonly affectedGrantCount: number;
+    readonly replayed: boolean;
+  }) => string;
+  decode: (value: string) => {
+    readonly _tag: "Disconnected";
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+    readonly affectedGrantCount: number;
+    readonly replayed: boolean;
+  };
+};
+export declare const orderNumber: (value: string) => number;
+export declare const nativeOrder: (mapping: Authority, value: unknown) => number;
+export declare const clientKey: (configuration: M.OAuthConnectedConfiguration) => string;
+export declare const cohortKey: (client: string, identity: string) => string;
+export declare const initialGeneration: (cohort: string) => string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+export declare const configuration: (flow: M.OAuthConnectedPendingFlow) => M.OAuthConnectedConfiguration;
+export declare const retainedUntil: (mapping: Authority, now: number) => number;
+export declare const rowCount: (table: Table<import("drizzle-orm").TableConfig<import("drizzle-orm").Columns>>, where: SQL<unknown>) => Effect.Effect<number, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const countCondition: (table: Table, where: SQL, count: number) => SQL<unknown>;
+export declare const current: (mapping: Mapping, subject: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<{
+  subject: Observation;
+  row: Row;
+  authorities: Observation;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  nativeId: unknown;
+} | undefined, M.OAuthUnavailable | PersistenceMappingError, CurrentOAuthTransaction>;
+export declare const nativeCopy: <N>(value: N) => N;
+export declare const jobTable: (mapping: Authority) => Omit<OAuthConnectedRevocationJobTable<any, any>, "encodeInsert"> | undefined;
+export declare const policy: (mapping: Mapping, input: OAuthConnectedPolicyInput<any>) => Effect.Effect<boolean, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const action: (mapping: Mapping, found: {
+  subject: Observation;
+  row: Row;
+  authorities: Observation;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  nativeId: unknown;
+}, authorization: {
+  readonly evidence: {
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly proofs: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    }[]];
+  };
+  readonly requirement: {
+    readonly maximumAgeMillis: number;
+    readonly alternatives: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }[]];
+  };
+  readonly challenge: {
+    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+    readonly action: "connected-begin" | "connected-complete" | "connected-disconnect";
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly intentDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  };
+}, operation: "claim" | "disconnect" | "issue" | "settle", expected: {
+  readonly moduleId: string;
+  readonly flowId: string;
+  readonly commandId: string;
+  readonly revision: OAuthAccountRevision;
+  readonly intent: string;
+  readonly maximumAgeMillis: number;
+  readonly configuration: M.OAuthConnectedConfiguration;
+  readonly grant?: M.OAuthConnectedTokenContext;
+}) => Effect.Effect<boolean, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const useAuthority: (mapping: Mapping, authorization: {
+  readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly policyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly expiresAtMillis: number;
+  readonly purpose: "metadata" | "use";
+  readonly grantId?: (string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">) | undefined;
+  readonly profileKey?: (string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">) | undefined;
+}, kind: "metadata" | "use", grant?: {
+  readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+  readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+  readonly identity: {
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+    readonly subject: string;
+  };
+  readonly configuration: {
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly protocol: "oauth" | "oidc";
+    readonly configurationGeneration: number;
+    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: "required" | "unsupported";
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+    readonly profile: {
+      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: number;
+      readonly issuance: "active" | "retired";
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: string;
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly retention: "access-and-refresh" | "access-only";
+      readonly maximumAccessLifetimeMillis: number;
+      readonly maximumRefreshLifetimeMillis?: number | undefined;
+      readonly refreshAheadMillis: number;
+      readonly refresh: "confidential" | "rotating" | "unsupported";
+      readonly revocation: "cohort" | "unsupported";
+    };
+  };
+  readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+  readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly metadata: {
+    readonly scopes: readonly string[];
+    readonly resources: readonly string[];
+    readonly accessExpiresAtMillis?: number | undefined;
+    readonly refreshExpiresAtMillis?: number | undefined;
+    readonly useUntilMillis: number;
+    readonly refreshUseUntilMillis?: number | undefined;
+    readonly obtainedAtMillis: number;
+    readonly profile?: {
+      readonly displayName?: string | undefined;
+      readonly handle?: string | undefined;
+      readonly avatarUrl?: string | undefined;
+      readonly profileUrl?: string | undefined;
+      readonly email?: string | undefined;
+      readonly emailVerified?: boolean | undefined;
+      readonly providerData?: {
+        readonly [x: string]: Schema.Json;
+      } | undefined;
+    } | undefined;
+  };
+} | undefined) => Effect.Effect<{
+  subject: Observation;
+  row: Row;
+  authorities: Observation;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  nativeId: unknown;
+} | undefined, M.OAuthUnavailable | PersistenceMappingError, CurrentOAuthTransaction>;
+export declare const scopeKey: (provider: string, issuer: string) => string;
+export interface ScopeAnchor {
+  readonly id: string;
+  row: Row;
+}
+export interface ClientAnchor {
+  readonly id: string;
+  row: Row;
+  counter: number;
+  readonly scope: ScopeAnchor;
+}
+/** Empty registration ID is impossible in the public profile label schema. The
+ * distinct 52-byte key domain shares the physical table, never a client counter. */
+export declare const scope: (mapping: Authority, config: {
+  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+  readonly protocol: "oauth" | "oidc";
+  readonly configurationGeneration: number;
+  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+  readonly responseIssuerMode: "required" | "unsupported";
+  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+  readonly profile: {
+    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+    readonly generation: number;
+    readonly issuance: "active" | "retired";
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly clientRegistrationId: string;
+    readonly scopes: readonly string[];
+    readonly resources: readonly string[];
+    readonly retention: "access-and-refresh" | "access-only";
+    readonly maximumAccessLifetimeMillis: number;
+    readonly maximumRefreshLifetimeMillis?: number | undefined;
+    readonly refreshAheadMillis: number;
+    readonly refresh: "confidential" | "rotating" | "unsupported";
+    readonly revocation: "cohort" | "unsupported";
+  };
+}, create: boolean) => Effect.Effect<ScopeAnchor | undefined, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const touchScope: (mapping: Authority, found: ScopeAnchor) => Effect.Effect<void, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const readScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const lockClientById: (mapping: Authority, id: string) => Effect.Effect<ClientAnchor, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const heldScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor | undefined, never, CurrentOAuthTransaction>;
+/** Cleanup obtains every scope then every client before entering any tuple. */
+export declare const prelockClients: (mapping: Authority, ids: readonly string[], releaseScopes?: readonly {
+  readonly provider: string;
+  readonly issuer: string;
+}[] | undefined) => Effect.Effect<void, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const client: (mapping: Authority, config: {
+  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+  readonly protocol: "oauth" | "oidc";
+  readonly configurationGeneration: number;
+  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+  readonly responseIssuerMode: "required" | "unsupported";
+  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+  readonly profile: {
+    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+    readonly generation: number;
+    readonly issuance: "active" | "retired";
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly clientRegistrationId: string;
+    readonly scopes: readonly string[];
+    readonly resources: readonly string[];
+    readonly retention: "access-and-refresh" | "access-only";
+    readonly maximumAccessLifetimeMillis: number;
+    readonly maximumRefreshLifetimeMillis?: number | undefined;
+    readonly refreshAheadMillis: number;
+    readonly refresh: "confidential" | "rotating" | "unsupported";
+    readonly revocation: "cohort" | "unsupported";
+  };
+}, create: boolean) => Effect.Effect<ClientAnchor | undefined, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const nextOrder: (mapping: Authority, found: ClientAnchor) => Effect.Effect<number, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const cohort: (mapping: Authority, clientId: string, identityId: string, create: boolean) => Effect.Effect<{
+  id: string;
+  row: undefined;
+  generation: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  cutoff: number;
+  blocked: boolean;
+} | {
+  id: string;
+  row: Row;
+  generation: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  cutoff: number;
+  blocked: boolean;
+}, M.OAuthUnavailable, CurrentOAuthTransaction>;
+export declare const readGrant: (mapping: Authority, moduleId: string, grantId: string, lock?: any) => Effect.Effect<{
+  row: Row;
+  context: {
+    readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+    readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly identity: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly subject: string;
+    };
+    readonly configuration: {
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly protocol: "oauth" | "oidc";
+      readonly configurationGeneration: number;
+      readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: "required" | "unsupported";
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+      readonly profile: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      };
+    };
+    readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly metadata: {
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly accessExpiresAtMillis?: number | undefined;
+      readonly refreshExpiresAtMillis?: number | undefined;
+      readonly useUntilMillis: number;
+      readonly refreshUseUntilMillis?: number | undefined;
+      readonly obtainedAtMillis: number;
+      readonly profile?: {
+        readonly displayName?: string | undefined;
+        readonly handle?: string | undefined;
+        readonly avatarUrl?: string | undefined;
+        readonly profileUrl?: string | undefined;
+        readonly email?: string | undefined;
+        readonly emailVerified?: boolean | undefined;
+        readonly providerData?: {
+          readonly [x: string]: Schema.Json;
+        } | undefined;
+      } | undefined;
+    };
+  };
+  native: any;
+  sealed: {
+    readonly format: "oauth-connected-xchacha20poly1305-v1";
+    readonly keyId: string;
+    readonly nonce: string;
+    readonly ciphertext: import("effect/Redacted").Redacted<string>;
+  } | undefined;
+} | undefined, M.OAuthUnavailable | PersistenceMappingError, CurrentOAuthTransaction>;
+export declare const unknownWork: (mapping: Authority, clientId: string | SQL, cutoff?: number) => SQL<unknown>;
+export declare const cohortWork: (mapping: Authority, id: string | SQL) => SQL<unknown>;
 //#endregion
-export { Mapping, Revocations };
+export { oauth_connected_state_d_exports };
 //# sourceMappingURL=oauth-connected-state.d.mts.map