@yielded/auth 0.1.0-beta.1

package/dist/oauth/connectedModels.d.mts

@@ -0,0 +1,2023 @@
+import { Schema } from "effect";
+//#region src/oauth/connectedModels.d.ts
+declare const OAuthGrantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+declare const OAuthPermissionProfileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+/** Durable authority-issued total order, comparable with cohort cutoffs. Never caller time. */
+declare const OAuthConnectedOrder: Schema.String;
+declare const OAuthConnectedScopes: Schema.$Array<Schema.String>;
+declare const OAuthConnectedResources: Schema.$Array<Schema.NonEmptyString>;
+declare const OAuthConnectedProfile: Schema.Struct<{
+  readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+  readonly generation: Schema.Int;
+  readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly clientRegistrationId: Schema.String;
+  readonly scopes: Schema.$Array<Schema.String>;
+  readonly resources: Schema.$Array<Schema.NonEmptyString>;
+  readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+  readonly maximumAccessLifetimeMillis: Schema.Int;
+  readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+  readonly refreshAheadMillis: Schema.Int;
+  readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+  readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+}>;
+type OAuthConnectedProfile = typeof OAuthConnectedProfile.Type;
+declare const OAuthConnectedPolicy: Schema.Struct<{
+  readonly generation: Schema.Int;
+  readonly lifetimeMillis: Schema.Int;
+  readonly claimLifetimeMillis: Schema.Int;
+  readonly settlementTimeoutMillis: Schema.Int;
+  readonly retentionMillis: Schema.Int;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+  readonly refreshClaimLifetimeMillis: Schema.Int;
+  readonly useAdmissionLifetimeMillis: Schema.Int;
+  readonly profiles: Schema.NonEmptyArray<Schema.Struct<{
+    readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+    readonly generation: Schema.Int;
+    readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly clientRegistrationId: Schema.String;
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly resources: Schema.$Array<Schema.NonEmptyString>;
+    readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+    readonly maximumAccessLifetimeMillis: Schema.Int;
+    readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+    readonly refreshAheadMillis: Schema.Int;
+    readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+    readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+  }>>;
+}>;
+type OAuthConnectedPolicy = typeof OAuthConnectedPolicy.Type;
+declare const OAuthConnectedBusy_base: Schema.Class<OAuthConnectedBusy, Schema.TaggedStruct<"OAuthConnectedBusy", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthConnectedBusy extends OAuthConnectedBusy_base {}
+declare const OAuthConnectedReauthorizationRequired_base: Schema.Class<OAuthConnectedReauthorizationRequired, Schema.TaggedStruct<"OAuthConnectedReauthorizationRequired", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthConnectedReauthorizationRequired extends OAuthConnectedReauthorizationRequired_base {}
+declare const OAuthConnectedActionRequired_base: Schema.Class<OAuthConnectedActionRequired, Schema.TaggedStruct<"OAuthConnectedActionRequired", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthConnectedActionRequired extends OAuthConnectedActionRequired_base {}
+declare const OAuthConnectedConfiguration: Schema.Struct<{
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+  readonly configurationGeneration: Schema.Int;
+  readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+  readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+  readonly profile: Schema.Struct<{
+    readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+    readonly generation: Schema.Int;
+    readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly clientRegistrationId: Schema.String;
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly resources: Schema.$Array<Schema.NonEmptyString>;
+    readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+    readonly maximumAccessLifetimeMillis: Schema.Int;
+    readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+    readonly refreshAheadMillis: Schema.Int;
+    readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+    readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+  }>;
+}>;
+type OAuthConnectedConfiguration = typeof OAuthConnectedConfiguration.Type;
+declare const OAuthConnectedIntent: Schema.Union<readonly [Schema.TaggedStruct<"Connect", {
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+}>, Schema.TaggedStruct<"Reconnect", {
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+}>]>;
+declare const OAuthConnectedBegin: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly intent: Schema.Union<readonly [Schema.TaggedStruct<"Connect", {
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+  }>, Schema.TaggedStruct<"Reconnect", {
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+  }>]>;
+  readonly returnTarget: Schema.String;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+}>;
+declare const OAuthConnectedComplete: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+  readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+    readonly state: Schema.RedactedFromValue<Schema.String>;
+    readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+    readonly error: Schema.optionalKey<Schema.Never>;
+  }>, Schema.TaggedStruct<"Error", {
+    readonly state: Schema.RedactedFromValue<Schema.String>;
+    readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+    readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+    readonly code: Schema.optionalKey<Schema.Never>;
+  }>]>;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+}>;
+declare const OAuthConnectedDisconnect: Schema.Struct<{
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+}>;
+declare const OAuthConnectedList: Schema.Struct<{
+  readonly limit: Schema.Int;
+  readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+}>;
+declare const OAuthConnectedUse: Schema.Struct<{
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+}>;
+declare const OAuthConnectedTarget: Schema.Struct<{
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly identity: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly subject: Schema.NonEmptyString;
+  }>;
+  readonly configuration: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+    readonly configurationGeneration: Schema.Int;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+    readonly profile: Schema.Struct<{
+      readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: Schema.Int;
+      readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: Schema.String;
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+      readonly maximumAccessLifetimeMillis: Schema.Int;
+      readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshAheadMillis: Schema.Int;
+      readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+      readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+    }>;
+  }>;
+}>;
+type OAuthConnectedTarget = typeof OAuthConnectedTarget.Type;
+declare const OAuthConnectedTransactionContext: Schema.Struct<{
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+  readonly configurationGeneration: Schema.Int;
+  readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+  readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly generation: Schema.Int;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingExpiresAtMillis: Schema.Int;
+  readonly issuedAtMillis: Schema.Int;
+  readonly expiresAtMillis: Schema.Int;
+  readonly claimLifetimeMillis: Schema.Int;
+  readonly namespace: Schema.Literal<"effect-auth/oauth-connected-context/v1">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly profile: Schema.Struct<{
+    readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+    readonly generation: Schema.Int;
+    readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly clientRegistrationId: Schema.String;
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly resources: Schema.$Array<Schema.NonEmptyString>;
+    readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+    readonly maximumAccessLifetimeMillis: Schema.Int;
+    readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+    readonly refreshAheadMillis: Schema.Int;
+    readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+    readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+  }>;
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly reconnect: Schema.optionalKey<Schema.Struct<{
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly configuration: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+    }>;
+  }>>;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+}>;
+type OAuthConnectedTransactionContext = typeof OAuthConnectedTransactionContext.Type;
+declare const OAuthConnectedPendingFlow: Schema.Struct<{
+  readonly context: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+    readonly configurationGeneration: Schema.Int;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly generation: Schema.Int;
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly requestBindingExpiresAtMillis: Schema.Int;
+    readonly issuedAtMillis: Schema.Int;
+    readonly expiresAtMillis: Schema.Int;
+    readonly claimLifetimeMillis: Schema.Int;
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-context/v1">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly profile: Schema.Struct<{
+      readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: Schema.Int;
+      readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: Schema.String;
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+      readonly maximumAccessLifetimeMillis: Schema.Int;
+      readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshAheadMillis: Schema.Int;
+      readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+      readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+    }>;
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly reconnect: Schema.optionalKey<Schema.Struct<{
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+    }>>;
+    readonly maximumEvidenceAgeMillis: Schema.Int;
+  }>;
+  readonly sealed: Schema.Struct<{
+    readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+    readonly keyId: Schema.String;
+    readonly nonce: Schema.String;
+    readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+  }>;
+  readonly retentionUntilMillis: Schema.Int;
+}>;
+type OAuthConnectedPendingFlow = typeof OAuthConnectedPendingFlow.Type;
+declare const OAuthConnectedClaim: Schema.Struct<{
+  readonly flow: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly generation: Schema.Int;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: Schema.Int;
+      readonly issuedAtMillis: Schema.Int;
+      readonly expiresAtMillis: Schema.Int;
+      readonly claimLifetimeMillis: Schema.Int;
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-context/v1">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly reconnect: Schema.optionalKey<Schema.Struct<{
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+      }>>;
+      readonly maximumEvidenceAgeMillis: Schema.Int;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+    readonly retentionUntilMillis: Schema.Int;
+  }>;
+  readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly claimedAtMillis: Schema.Int;
+  readonly claimExpiresAtMillis: Schema.Int;
+  readonly order: Schema.String;
+}>;
+type OAuthConnectedClaim = typeof OAuthConnectedClaim.Type;
+declare const OAuthConnectedActionChallenge: Schema.Struct<{
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly action: Schema.Literals<readonly ["connected-begin", "connected-complete", "connected-disconnect"]>;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly intentDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>;
+type OAuthConnectedActionChallenge = typeof OAuthConnectedActionChallenge.Type;
+declare const OAuthConnectedActionAuthorization: Schema.Struct<{
+  readonly evidence: Schema.Struct<{
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      readonly method: Schema.NonEmptyString;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    }>>;
+  }>;
+  readonly requirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+  readonly challenge: Schema.Struct<{
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly action: Schema.Literals<readonly ["connected-begin", "connected-complete", "connected-disconnect"]>;
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly intentDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>;
+}>;
+type OAuthConnectedActionAuthorization = typeof OAuthConnectedActionAuthorization.Type;
+declare const OAuthConnectedUseAuthorization: Schema.Struct<{
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly policyRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly expiresAtMillis: Schema.Int;
+  readonly purpose: Schema.Literals<readonly ["metadata", "use"]>;
+  readonly grantId: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthGrantId">>;
+  readonly profileKey: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">>;
+}>;
+type OAuthConnectedUseAuthorization = typeof OAuthConnectedUseAuthorization.Type;
+declare const OAuthConnectedContinuation: Schema.Union<readonly [Schema.TaggedStruct<"Oidc", {
+  readonly clientId: Schema.NonEmptyString;
+  readonly nonce: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+  readonly authTime: Schema.optionalKey<Schema.Finite>;
+}>, Schema.TaggedStruct<"OAuth", {}>]>;
+declare const OAuthConnectedTokenMaterial: Schema.Struct<{
+  readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-material/v1">;
+  readonly accessToken: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  readonly refreshToken: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  readonly continuation: Schema.Union<readonly [Schema.TaggedStruct<"Oidc", {
+    readonly clientId: Schema.NonEmptyString;
+    readonly nonce: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    readonly authTime: Schema.optionalKey<Schema.Finite>;
+  }>, Schema.TaggedStruct<"OAuth", {}>]>;
+}>;
+type OAuthConnectedTokenMaterial = typeof OAuthConnectedTokenMaterial.Type;
+declare const OAuthConnectedGrantResponse: Schema.Struct<{
+  readonly identity: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly subject: Schema.NonEmptyString;
+  }>;
+  readonly profile: Schema.optionalKey<Schema.Struct<{
+    readonly displayName: Schema.optionalKey<Schema.String>;
+    readonly handle: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly scopes: Schema.$Array<Schema.String>;
+  readonly resources: Schema.$Array<Schema.NonEmptyString>;
+  readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+  readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+  readonly material: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-material/v1">;
+    readonly accessToken: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly refreshToken: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    readonly continuation: Schema.Union<readonly [Schema.TaggedStruct<"Oidc", {
+      readonly clientId: Schema.NonEmptyString;
+      readonly nonce: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      readonly authTime: Schema.optionalKey<Schema.Finite>;
+    }>, Schema.TaggedStruct<"OAuth", {}>]>;
+  }>;
+}>;
+type OAuthConnectedGrantResponse = typeof OAuthConnectedGrantResponse.Type;
+declare const OAuthConnectedTokenMetadata: Schema.Struct<{
+  readonly scopes: Schema.$Array<Schema.String>;
+  readonly resources: Schema.$Array<Schema.NonEmptyString>;
+  readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+  readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+  readonly useUntilMillis: Schema.Int;
+  readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+  readonly obtainedAtMillis: Schema.Int;
+  readonly profile: Schema.optionalKey<Schema.Struct<{
+    readonly displayName: Schema.optionalKey<Schema.String>;
+    readonly handle: Schema.optionalKey<Schema.String>;
+  }>>;
+}>;
+declare const OAuthConnectedTokenContext: Schema.Struct<{
+  readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly identity: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly subject: Schema.NonEmptyString;
+  }>;
+  readonly configuration: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+    readonly configurationGeneration: Schema.Int;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+    readonly profile: Schema.Struct<{
+      readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: Schema.Int;
+      readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: Schema.String;
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+      readonly maximumAccessLifetimeMillis: Schema.Int;
+      readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshAheadMillis: Schema.Int;
+      readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+      readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+    }>;
+  }>;
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly metadata: Schema.Struct<{
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly resources: Schema.$Array<Schema.NonEmptyString>;
+    readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly useUntilMillis: Schema.Int;
+    readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+    readonly obtainedAtMillis: Schema.Int;
+    readonly profile: Schema.optionalKey<Schema.Struct<{
+      readonly displayName: Schema.optionalKey<Schema.String>;
+      readonly handle: Schema.optionalKey<Schema.String>;
+    }>>;
+  }>;
+}>;
+type OAuthConnectedTokenContext = typeof OAuthConnectedTokenContext.Type;
+declare const OAuthConnectedRevocationContext: Schema.Struct<{
+  readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+  readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly token: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly configuration: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+    }>;
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly metadata: Schema.Struct<{
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly useUntilMillis: Schema.Int;
+      readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+      readonly obtainedAtMillis: Schema.Int;
+      readonly profile: Schema.optionalKey<Schema.Struct<{
+        readonly displayName: Schema.optionalKey<Schema.String>;
+        readonly handle: Schema.optionalKey<Schema.String>;
+      }>>;
+    }>;
+  }>;
+}>;
+type OAuthConnectedRevocationContext = typeof OAuthConnectedRevocationContext.Type;
+declare const OAuthConnectedProtectionContext: Schema.Union<readonly [Schema.Struct<{
+  readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly identity: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly subject: Schema.NonEmptyString;
+  }>;
+  readonly configuration: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+    readonly configurationGeneration: Schema.Int;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+    readonly profile: Schema.Struct<{
+      readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: Schema.Int;
+      readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: Schema.String;
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+      readonly maximumAccessLifetimeMillis: Schema.Int;
+      readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshAheadMillis: Schema.Int;
+      readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+      readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+    }>;
+  }>;
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly metadata: Schema.Struct<{
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly resources: Schema.$Array<Schema.NonEmptyString>;
+    readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly useUntilMillis: Schema.Int;
+    readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+    readonly obtainedAtMillis: Schema.Int;
+    readonly profile: Schema.optionalKey<Schema.Struct<{
+      readonly displayName: Schema.optionalKey<Schema.String>;
+      readonly handle: Schema.optionalKey<Schema.String>;
+    }>>;
+  }>;
+}>, Schema.Struct<{
+  readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+  readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly token: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly configuration: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+    }>;
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly metadata: Schema.Struct<{
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly useUntilMillis: Schema.Int;
+      readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+      readonly obtainedAtMillis: Schema.Int;
+      readonly profile: Schema.optionalKey<Schema.Struct<{
+        readonly displayName: Schema.optionalKey<Schema.String>;
+        readonly handle: Schema.optionalKey<Schema.String>;
+      }>>;
+    }>;
+  }>;
+}>]>;
+type OAuthConnectedProtectionContext = typeof OAuthConnectedProtectionContext.Type;
+declare const OAuthConnectedSealedTokens: Schema.Struct<{
+  readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+  readonly keyId: Schema.String;
+  readonly nonce: Schema.String;
+  readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+}>;
+type OAuthConnectedSealedTokens = typeof OAuthConnectedSealedTokens.Type;
+declare const OAuthConnectedStoredGrant: Schema.Struct<{
+  readonly context: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly configuration: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+    }>;
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly metadata: Schema.Struct<{
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly useUntilMillis: Schema.Int;
+      readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+      readonly obtainedAtMillis: Schema.Int;
+      readonly profile: Schema.optionalKey<Schema.Struct<{
+        readonly displayName: Schema.optionalKey<Schema.String>;
+        readonly handle: Schema.optionalKey<Schema.String>;
+      }>>;
+    }>;
+  }>;
+  readonly sealed: Schema.Struct<{
+    readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+    readonly keyId: Schema.String;
+    readonly nonce: Schema.String;
+    readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+  }>;
+}>;
+type OAuthConnectedStoredGrant = typeof OAuthConnectedStoredGrant.Type;
+declare const OAuthConnectedDisconnectGrant: Schema.Struct<{
+  readonly context: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly configuration: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+    }>;
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly metadata: Schema.Struct<{
+      readonly scopes: Schema.$Array<Schema.String>;
+      readonly resources: Schema.$Array<Schema.NonEmptyString>;
+      readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+      readonly useUntilMillis: Schema.Int;
+      readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+      readonly obtainedAtMillis: Schema.Int;
+      readonly profile: Schema.optionalKey<Schema.Struct<{
+        readonly displayName: Schema.optionalKey<Schema.String>;
+        readonly handle: Schema.optionalKey<Schema.String>;
+      }>>;
+    }>;
+  }>;
+  readonly sealed: Schema.optionalKey<Schema.Struct<{
+    readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+    readonly keyId: Schema.String;
+    readonly nonce: Schema.String;
+    readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+  }>>;
+}>;
+type OAuthConnectedDisconnectGrant = typeof OAuthConnectedDisconnectGrant.Type;
+declare const OAuthConnectedRevocationJob: Schema.Struct<{
+  readonly context: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+    readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly token: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+  }>;
+  readonly sealed: Schema.Struct<{
+    readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+    readonly keyId: Schema.String;
+    readonly nonce: Schema.String;
+    readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+  }>;
+}>;
+type OAuthConnectedRevocationJob = typeof OAuthConnectedRevocationJob.Type;
+declare const OAuthConnectedRefreshClaim: Schema.Struct<{
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+  readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly claimedAtMillis: Schema.Int;
+  readonly claimExpiresAtMillis: Schema.Int;
+  readonly nextTokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+}>;
+type OAuthConnectedRefreshClaim = typeof OAuthConnectedRefreshClaim.Type;
+declare const OAuthConnectedSummary: Schema.Struct<{
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+  readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+  readonly status: Schema.Literals<readonly ["Active", "Refreshing", "ReauthorizationRequired", "Disconnected"]>;
+  readonly scopes: Schema.$Array<Schema.String>;
+  readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+  readonly useUntilMillis: Schema.Int;
+  readonly profile: Schema.optionalKey<Schema.Struct<{
+    readonly displayName: Schema.optionalKey<Schema.String>;
+    readonly handle: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+}>;
+declare const OAuthConnectedListResult: Schema.Struct<{
+  readonly items: Schema.$Array<Schema.Struct<{
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+    readonly status: Schema.Literals<readonly ["Active", "Refreshing", "ReauthorizationRequired", "Disconnected"]>;
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+    readonly useUntilMillis: Schema.Int;
+    readonly profile: Schema.optionalKey<Schema.Struct<{
+      readonly displayName: Schema.optionalKey<Schema.String>;
+      readonly handle: Schema.optionalKey<Schema.String>;
+    }>>;
+    readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+  }>>;
+  readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+}>;
+declare const OAuthConnectedResult: Schema.Union<readonly [Schema.TaggedStruct<"Connected", {
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+  readonly status: Schema.Literal<"Active">;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+}>, Schema.TaggedStruct<"Cancelled", {
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+}>]>;
+declare const OAuthConnectedDisconnected: Schema.TaggedStruct<"Disconnected", {
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+  readonly affectedGrantCount: Schema.Int;
+  readonly replayed: Schema.Boolean;
+}>;
+declare const OAuthConnectedAccess: Schema.Struct<{
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly generation: Schema.Int;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingExpiresAtMillis: Schema.Int;
+  readonly responseIssuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+  readonly nowMillis: Schema.Int;
+}>;
+type OAuthConnectedAccess = typeof OAuthConnectedAccess.Type;
+declare const OAuthConnectedIssueDecision: Schema.Union<readonly [Schema.TaggedStruct<"Issued", {
+  readonly flow: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly generation: Schema.Int;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: Schema.Int;
+      readonly issuedAtMillis: Schema.Int;
+      readonly expiresAtMillis: Schema.Int;
+      readonly claimLifetimeMillis: Schema.Int;
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-context/v1">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly profile: Schema.Struct<{
+        readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: Schema.Int;
+        readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+        readonly maximumAccessLifetimeMillis: Schema.Int;
+        readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshAheadMillis: Schema.Int;
+        readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+        readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly reconnect: Schema.optionalKey<Schema.Struct<{
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+      }>>;
+      readonly maximumEvidenceAgeMillis: Schema.Int;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+    readonly retentionUntilMillis: Schema.Int;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthConnectedClaimDecision: Schema.Union<readonly [Schema.TaggedStruct<"Claimed", {
+  readonly claim: Schema.Struct<{
+    readonly flow: Schema.Struct<{
+      readonly context: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly generation: Schema.Int;
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+        readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: Schema.Int;
+        readonly issuedAtMillis: Schema.Int;
+        readonly expiresAtMillis: Schema.Int;
+        readonly claimLifetimeMillis: Schema.Int;
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-context/v1">;
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly reconnect: Schema.optionalKey<Schema.Struct<{
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly identity: Schema.Struct<{
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+            readonly subject: Schema.NonEmptyString;
+          }>;
+          readonly configuration: Schema.Struct<{
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+            readonly configurationGeneration: Schema.Int;
+            readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+            readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+            readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+            readonly profile: Schema.Struct<{
+              readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: Schema.Int;
+              readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+              readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: Schema.String;
+              readonly scopes: Schema.$Array<Schema.String>;
+              readonly resources: Schema.$Array<Schema.NonEmptyString>;
+              readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+              readonly maximumAccessLifetimeMillis: Schema.Int;
+              readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+              readonly refreshAheadMillis: Schema.Int;
+              readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+              readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+            }>;
+          }>;
+        }>>;
+        readonly maximumEvidenceAgeMillis: Schema.Int;
+      }>;
+      readonly sealed: Schema.Struct<{
+        readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+        readonly keyId: Schema.String;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly retentionUntilMillis: Schema.Int;
+    }>;
+    readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: Schema.Int;
+    readonly claimExpiresAtMillis: Schema.Int;
+    readonly order: Schema.String;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthConnectedGrantInspection: Schema.Union<readonly [Schema.TaggedStruct<"Target", {
+  readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+}>, Schema.TaggedStruct<"Quarantine", {
+  readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>]>;
+declare const OAuthConnectedOutcome: Schema.Union<readonly [Schema.TaggedStruct<"Verified", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+  readonly cleanup: Schema.optionalKey<Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+      readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+      readonly token: Schema.Struct<{
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly metadata: Schema.Struct<{
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly useUntilMillis: Schema.Int;
+          readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+          readonly obtainedAtMillis: Schema.Int;
+          readonly profile: Schema.optionalKey<Schema.Struct<{
+            readonly displayName: Schema.optionalKey<Schema.String>;
+            readonly handle: Schema.optionalKey<Schema.String>;
+          }>>;
+        }>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>>;
+}>, Schema.TaggedStruct<"Quarantined", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+  readonly cleanup: Schema.optionalKey<Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+      readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+      readonly token: Schema.Struct<{
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly metadata: Schema.Struct<{
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly useUntilMillis: Schema.Int;
+          readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+          readonly obtainedAtMillis: Schema.Int;
+          readonly profile: Schema.optionalKey<Schema.Struct<{
+            readonly displayName: Schema.optionalKey<Schema.String>;
+            readonly handle: Schema.optionalKey<Schema.String>;
+          }>>;
+        }>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>>;
+}>, Schema.TaggedStruct<"Cancelled", {}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>, Schema.TaggedStruct<"Ambiguous", {}>]>;
+type OAuthConnectedOutcome = typeof OAuthConnectedOutcome.Type;
+declare const OAuthConnectedSettlementDecision: Schema.Union<readonly [Schema.TaggedStruct<"Connected", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+}>, Schema.TaggedStruct<"Cancelled", {}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>, Schema.TaggedStruct<"Busy", {}>, Schema.TaggedStruct<"Ambiguous", {}>]>;
+declare const OAuthConnectedDisconnectInspection: Schema.Union<readonly [Schema.TaggedStruct<"Target", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.optionalKey<Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>>;
+  }>;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+}>, Schema.TaggedStruct<"Replay", {
+  readonly result: Schema.TaggedStruct<"Disconnected", {
+    readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+    readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+    readonly affectedGrantCount: Schema.Int;
+    readonly replayed: Schema.Boolean;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>]>;
+declare const OAuthConnectedDisconnectDecision: Schema.Union<readonly [Schema.TaggedStruct<"Disconnected", {
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+  readonly affectedGrantCount: Schema.Int;
+  readonly replayed: Schema.Boolean;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>]>;
+declare const OAuthConnectedAccessInspection: Schema.Union<readonly [Schema.TaggedStruct<"Target", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+}>, Schema.TaggedStruct<"Busy", {}>, Schema.TaggedStruct<"ReauthorizationRequired", {}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthConnectedRefreshDecision: Schema.Union<readonly [Schema.TaggedStruct<"Claimed", {
+  readonly claim: Schema.Struct<{
+    readonly grant: Schema.Struct<{
+      readonly context: Schema.Struct<{
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly metadata: Schema.Struct<{
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly useUntilMillis: Schema.Int;
+          readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+          readonly obtainedAtMillis: Schema.Int;
+          readonly profile: Schema.optionalKey<Schema.Struct<{
+            readonly displayName: Schema.optionalKey<Schema.String>;
+            readonly handle: Schema.optionalKey<Schema.String>;
+          }>>;
+        }>;
+      }>;
+      readonly sealed: Schema.Struct<{
+        readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+        readonly keyId: Schema.String;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+      }>;
+    }>;
+    readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: Schema.Int;
+    readonly claimExpiresAtMillis: Schema.Int;
+    readonly nextTokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  }>;
+}>, Schema.TaggedStruct<"Busy", {}>, Schema.TaggedStruct<"ReauthorizationRequired", {}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthConnectedRefreshOutcome: Schema.Union<readonly [Schema.TaggedStruct<"Refreshed", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+  readonly cleanup: Schema.optionalKey<Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+      readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+      readonly token: Schema.Struct<{
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly metadata: Schema.Struct<{
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly useUntilMillis: Schema.Int;
+          readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+          readonly obtainedAtMillis: Schema.Int;
+          readonly profile: Schema.optionalKey<Schema.Struct<{
+            readonly displayName: Schema.optionalKey<Schema.String>;
+            readonly handle: Schema.optionalKey<Schema.String>;
+          }>>;
+        }>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>>;
+}>, Schema.TaggedStruct<"ReauthorizationRequired", {}>]>;
+type OAuthConnectedRefreshOutcome = typeof OAuthConnectedRefreshOutcome.Type;
+declare const OAuthConnectedRefreshSettlement: Schema.Union<readonly [Schema.TaggedStruct<"Refreshed", {
+  readonly grant: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly identity: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly subject: Schema.NonEmptyString;
+      }>;
+      readonly configuration: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly profile: Schema.Struct<{
+          readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: Schema.Int;
+          readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: Schema.String;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+          readonly maximumAccessLifetimeMillis: Schema.Int;
+          readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshAheadMillis: Schema.Int;
+          readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+          readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+        }>;
+      }>;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly metadata: Schema.Struct<{
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly resources: Schema.$Array<Schema.NonEmptyString>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+        readonly obtainedAtMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+}>, Schema.TaggedStruct<"ReauthorizationRequired", {}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthConnectedUseAdmission: Schema.Union<readonly [Schema.TaggedStruct<"Admitted", {
+  readonly admissionId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+  readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly admittedAtMillis: Schema.Int;
+  readonly expiresAtMillis: Schema.Int;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Busy", {}>, Schema.TaggedStruct<"ReauthorizationRequired", {}>]>;
+declare const OAuthConnectedCleanupResult: Schema.Struct<{
+  readonly terminalized: Schema.Int;
+  readonly removed: Schema.Int;
+  readonly hasMore: Schema.Boolean;
+}>;
+//#endregion
+export { OAuthConnectedAccess, OAuthConnectedAccessInspection, OAuthConnectedActionAuthorization, OAuthConnectedActionChallenge, OAuthConnectedActionRequired, OAuthConnectedBegin, OAuthConnectedBusy, OAuthConnectedClaim, OAuthConnectedClaimDecision, OAuthConnectedCleanupResult, OAuthConnectedComplete, OAuthConnectedConfiguration, OAuthConnectedContinuation, OAuthConnectedDisconnect, OAuthConnectedDisconnectDecision, OAuthConnectedDisconnectGrant, OAuthConnectedDisconnectInspection, OAuthConnectedDisconnected, OAuthConnectedGrantInspection, OAuthConnectedGrantResponse, OAuthConnectedIntent, OAuthConnectedIssueDecision, OAuthConnectedList, OAuthConnectedListResult, OAuthConnectedOrder, OAuthConnectedOutcome, OAuthConnectedPendingFlow, OAuthConnectedPolicy, OAuthConnectedProfile, OAuthConnectedProtectionContext, OAuthConnectedReauthorizationRequired, OAuthConnectedRefreshClaim, OAuthConnectedRefreshDecision, OAuthConnectedRefreshOutcome, OAuthConnectedRefreshSettlement, OAuthConnectedResources, OAuthConnectedResult, OAuthConnectedRevocationContext, OAuthConnectedRevocationJob, OAuthConnectedScopes, OAuthConnectedSealedTokens, OAuthConnectedSettlementDecision, OAuthConnectedStoredGrant, OAuthConnectedSummary, OAuthConnectedTarget, OAuthConnectedTokenContext, OAuthConnectedTokenMaterial, OAuthConnectedTokenMetadata, OAuthConnectedTransactionContext, OAuthConnectedUse, OAuthConnectedUseAdmission, OAuthConnectedUseAuthorization, OAuthGrantId, OAuthPermissionProfileKey };
+//# sourceMappingURL=connectedModels.d.mts.map