@yielded/auth 0.1.0-beta.1

package/dist/oauth/signInModule.d.mts

@@ -0,0 +1,1546 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { AuthInvocation, AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthCredentialCommandCollector, AuthOperationResult, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { AuthOperation, CredentialCollectorProvenance, OperationHandler, RevealCollectorProvenance } from "../operations/operation.mjs";
+import { IdentityConflict, LastSignInMethod } from "../identity/models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { RequestBindingConfig } from "../operations/RequestBindingConfig.mjs";
+import { RequestBindingFlowId, RequestBindingPublic } from "../operations/requestBindingModels.mjs";
+import { BindingModule, RequestBindingConfiguration, RequestBindingConfigurationError, RequestBindingInvalid, RequestBindingUnavailable, VerifiedRequestBinding } from "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Hooks.mjs";
+import { SessionApiError } from "../auth/session.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "../auth/AuthConfigurationError.mjs";
+import "../Auth.mjs";
+import { ModuleService, makeSessionModule } from "../sessions/module.mjs";
+import "../Identity.mjs";
+import { OAuthRegistrationAccess, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthRegistrationPolicy } from "./registrationModels.mjs";
+import { OAuthConfigurationError, OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthCleanupInput, OAuthCredentialSnapshot, OAuthSignInAuthorization, OAuthSignInBegin, OAuthSignInComplete, OAuthSignInPolicy } from "./signInModels.mjs";
+import { OAuthSignInPersistence, PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
+import { OAuthAccountsPolicy, OAuthActionRequired } from "./accountsModels.mjs";
+import { OAuthConnectedActionRequired, OAuthConnectedBusy, OAuthConnectedPolicy, OAuthConnectedReauthorizationRequired } from "./connectedModels.mjs";
+import { OAuthAccountsPersistence } from "./OAuthAccountsPersistence.mjs";
+import { OAuthActionEvidence } from "./OAuthActionEvidence.mjs";
+import { OAuthConnectedPersistence } from "./OAuthConnectedPersistence.mjs";
+import { OAuthConnectedProtocol } from "./OAuthConnectedProtocol.mjs";
+import { OAuthConnectedTokenProtector } from "./OAuthConnectedTokenProtector.mjs";
+import { OAuthConnectedUseAuthority } from "./OAuthConnectedUseAuthority.mjs";
+import { AccessModule } from "./connectedAccess.mjs";
+import { OAuthConnectedActionEvidence } from "./OAuthConnectedActionEvidence.mjs";
+import { OAuthConnectedTransactionProtector } from "./OAuthConnectedTransactionProtector.mjs";
+import { OAuthLinkTransactionProtector } from "./OAuthLinkTransactionProtector.mjs";
+import { OAuthProtocol } from "./OAuthProtocol.mjs";
+import { OAuthRegistrationIntents } from "./OAuthRegistrationIntents.mjs";
+import { OAuthReturnTargets } from "./OAuthReturnTargets.mjs";
+import { OAuthTransactionProtector } from "./OAuthTransactionProtector.mjs";
+import { MaintenanceModule } from "./connectedMaintenance.mjs";
+import { ConnectedModule } from "./connected.mjs";
+import { RegistrationModule } from "./registration.mjs";
+import { AccountsModule } from "./accounts.mjs";
+import { Context, Crypto, DateTime, Effect, Layer, Redacted, Schema, Types } from "effect";
+//#region src/oauth/signInModule.d.ts
+declare const Failure: Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>;
+type Failure = typeof Failure.Type;
+interface OAuthModule<Id extends string, Kind extends string, Claims> {
+  readonly moduleId: Id;
+  readonly kind: Kind;
+  readonly claims: Types.Invariant<Claims>;
+}
+/** Guest sign-in only. Durable flow/identity authority, configured protocol,
+ * separate transaction encryption and request-binding signing are explicit Layers.
+ * This installs no provider, database, registration or connected-token capability.
+ */
+declare const makeOAuthMethod: <const Id extends string, const SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, options: {
+  readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;
+}) => Readonly<{
+  binding: Readonly<{
+    RequestBinding: Context.Service<BindingModule<Id, "oauth-entry">, {
+      readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+      readonly verify: (flowId: RequestBindingFlowId, credential: Redacted.Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+    }>;
+    signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "oauth-entry">, RequestBindingConfigurationError, Crypto.Crypto | SubtleCrypto>;
+    layer: Layer.Layer<BindingModule<Id, "oauth-entry">, RequestBindingConfigurationError, Crypto.Crypto | RequestBindingConfig | SubtleCrypto>;
+  }>;
+  ClaimsForOAuth: Context.Service<OAuthModule<Id, "claims", Claims["Type"]>, {
+    readonly resolve: (credential: OAuthCredentialSnapshot) => Effect.Effect<Claims["Type"], OAuthUnavailable>;
+  }>;
+  SignIn: Context.Service<OAuthModule<Id, "sign-in", Claims["Type"]>, {
+    readonly begin: (input: typeof OAuthSignInBegin.Type) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;
+    readonly complete: (input: typeof OAuthSignInComplete.Type) => Effect.Effect<AuthOperationResult<{
+      readonly completion: {
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: DateTime.Utc;
+          readonly expiresAt: DateTime.Utc;
+          readonly absoluteExpiresAt: DateTime.Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: DateTime.Utc;
+      };
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    } | {
+      readonly _tag: "Cancelled";
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    } | {
+      readonly _tag: "RegistrationRequired";
+      readonly reference: string & import("effect/Brand").Brand<"effect-auth/OAuthRegistrationReference">;
+      readonly expiresAtMillis: number;
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    }>, Failure>;
+  }>;
+  signInLayer: (configuration: OAuthSignInPolicy) => Layer.Layer<OAuthModule<Id, "sign-in", Claims["Type"]>, OAuthConfigurationError, BindingModule<Id, "oauth-entry"> | Crypto.Crypto | ModuleService<SessionId, "completion", Claims["Type"]> | OAuthModule<Id, "claims", Claims["Type"]> | OAuthProtocol | OAuthReturnTargets | OAuthSignInPersistence | OAuthTransactionProtector>;
+  layer: (policy: OAuthSignInPolicy) => Layer.Layer<OperationHandler<`${Id}/sign-in/begin`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly returnTarget: string;
+  }, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly authorizationUrl: Redacted.Redacted<string>;
+    readonly expiresAtMillis: number;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/sign-in/complete`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly requestBinding: Redacted.Redacted<string>;
+    readonly response: {
+      readonly _tag: "Code";
+      readonly state: Redacted.Redacted<string>;
+      readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+      readonly code: Redacted.Redacted<string>;
+      readonly error?: undefined;
+    } | {
+      readonly _tag: "Error";
+      readonly state: Redacted.Redacted<string>;
+      readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+      readonly error: "access-denied" | "rejected";
+      readonly code?: undefined;
+    };
+  }, {
+    readonly completion: {
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    };
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+  } | {
+    readonly _tag: "Cancelled";
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+  } | {
+    readonly _tag: "RegistrationRequired";
+    readonly reference: string & import("effect/Brand").Brand<"effect-auth/OAuthRegistrationReference">;
+    readonly expiresAtMillis: number;
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported>, OAuthConfigurationError | RequestBindingConfigurationError, ModuleService<SessionId, "completion", Claims["Type"]> | OAuthModule<Id, "claims", Claims["Type"]> | OAuthProtocol | OAuthReturnTargets | OAuthSignInPersistence | OAuthTransactionProtector | RequestBindingConfig>;
+  registration: <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(codec: Registration) => Readonly<{
+    RegistrationCodec: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    CompleteInput: Schema.Struct<{
+      readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+      readonly credential: Schema.RedactedFromValue<Schema.String>;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    }>;
+    RegistrationAuthority: Context.Service<RegistrationModule<Id, "authority", Registration>, {
+      readonly read: (access: OAuthRegistrationAccess) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;
+      readonly inspect: (input: {
+        readonly intent: OAuthRegistrationIntent;
+        readonly registration: Registration["Type"];
+      }) => Effect.Effect<{
+        readonly fingerprint: TokenDigest;
+        readonly eligible: boolean;
+      }, OAuthUnavailable, never>;
+      readonly register: <A>(input: {
+        readonly access: OAuthRegistrationAccess;
+        readonly intent: OAuthRegistrationIntent;
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly registration: Registration["Type"];
+        readonly fingerprint: TokenDigest;
+      }, prepare: PrepareOAuthCommit<{
+        readonly _tag: "Rejected";
+      } | {
+        readonly _tag: "Conflict";
+      } | {
+        readonly _tag: "Registered";
+        readonly replayed: boolean;
+      } | {
+        readonly _tag: "ProvisioningPending";
+        readonly reference: string;
+        readonly replayed: boolean;
+      }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+      readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
+    }>;
+    Registrations: Context.Service<RegistrationModule<Id, "registrations", Registration>, {
+      readonly planComplete: (input: {
+        readonly reference: string & import("effect/Brand").Brand<"effect-auth/OAuthRegistrationReference">;
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly requestBinding: Redacted.Redacted<string>;
+        readonly credential: Redacted.Redacted<string>;
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly registration: Registration["Type"];
+      }) => Effect.Effect<{
+        readonly commit: Effect.Effect<PreparedCommit<AuthOperationResult<{
+          readonly _tag: "RegistrationAccepted";
+        } | {
+          readonly _tag: "ProvisioningPending";
+          readonly reference: string;
+        } | {
+          readonly _tag: "Rejected";
+        } | {
+          readonly _tag: "Conflict";
+        }>>, OAuthUnavailable, RegistrationModule<Id, "authority", Registration>>;
+      }, HookDenied | IdentityConflict | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable, never>;
+      readonly cleanup: (limit: number) => Effect.Effect<{
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, HookDenied | IdentityConflict | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable, never>;
+    }>;
+    layer: Layer.Layer<RegistrationModule<Id, "registrations", Registration>, OAuthUnavailable, BindingModule<Id, "oauth-entry"> | Crypto.Crypto | LifecycleHooks | RegistrationModule<Id, "authority", Registration> | Exclude<Registration["DecodingServices"], import("effect/Scope").Scope> | Exclude<Registration["EncodingServices"], import("effect/Scope").Scope>>;
+    operations: Readonly<{
+      Complete: AuthOperation<`${Id}/registration/complete`, Schema.Struct<{
+        readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+        readonly credential: Schema.RedactedFromValue<Schema.String>;
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+        readonly reference: Schema.String;
+      }>]>, Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+          readonly credential: Schema.RedactedFromValue<Schema.String>;
+          readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+          readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+          readonly reference: Schema.String;
+        }>]>;
+        readonly error: Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>;
+        readonly access: "any";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    }>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/registration/complete`, {
+      readonly reference: string & import("effect/Brand").Brand<"effect-auth/OAuthRegistrationReference">;
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly requestBinding: Redacted.Redacted<string>;
+      readonly credential: Redacted.Redacted<string>;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly registration: Registration["Type"];
+    }, {
+      readonly _tag: "RegistrationAccepted";
+    } | {
+      readonly _tag: "ProvisioningPending";
+      readonly reference: string;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported>, never, RegistrationModule<Id, "authority", Registration> | RegistrationModule<Id, "registrations", Registration>>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/registration/complete`, Schema.Struct<{
+      readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+      readonly credential: Schema.RedactedFromValue<Schema.String>;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly registration: Schema.Codec<Registration["Type"], Registration["Encoded"], Registration["DecodingServices"], Registration["EncodingServices"]>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+      readonly reference: Schema.String;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    signInLayer: (configuration: OAuthSignInPolicy, registrationConfiguration: OAuthRegistrationPolicy) => Layer.Layer<OAuthModule<Id, "sign-in", Claims["Type"]>, OAuthConfigurationError, BindingModule<Id, "oauth-entry"> | Crypto.Crypto | ModuleService<SessionId, "completion", Claims["Type"]> | OAuthModule<Id, "claims", Claims["Type"]> | OAuthProtocol | OAuthRegistrationIntents | OAuthReturnTargets | OAuthSignInPersistence | OAuthTransactionProtector>;
+    strategy: Readonly<{
+      completion: false;
+      make: Effect.Effect<{
+        readonly register: (input: {
+          readonly reference: string;
+          readonly flowId: string;
+          readonly requestBinding: string;
+          readonly credential: string;
+          readonly commandId: string;
+          readonly registration: Registration["Encoded"];
+        }) => Effect.Effect<{
+          readonly _tag: "RegistrationAccepted";
+        } | {
+          readonly _tag: "ProvisioningPending";
+          readonly reference: string;
+        }, IdentityConflict | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest | Exclude<Exclude<Registration["DecodingServices"], CredentialCollectorProvenance | RevealCollectorProvenance>, OperationHandler<`${Id}/registration/complete`, {
+          readonly reference: string & import("effect/Brand").Brand<"effect-auth/OAuthRegistrationReference">;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly requestBinding: Redacted.Redacted<string>;
+          readonly credential: Redacted.Redacted<string>;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly registration: Registration["Type"];
+        }, {
+          readonly _tag: "RegistrationAccepted";
+        } | {
+          readonly _tag: "ProvisioningPending";
+          readonly reference: string;
+        }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | (AuthCredentialCommandCollector | AuthRevealCommandCollectorService)>>;
+      }, AuthConfigurationError | OAuthUnavailable | RequestBindingConfigurationError, Layer.CurrentMemoMap | RegistrationModule<Id, "authority", Registration> | RequestBindingConfig | import("effect/Scope").Scope | Exclude<Exclude<Exclude<Registration["DecodingServices"], import("effect/Scope").Scope>, BindingModule<Id, "oauth-entry">>, Crypto.Crypto | LifecycleHooks | SubtleCrypto> | Exclude<Exclude<Exclude<Registration["EncodingServices"], import("effect/Scope").Scope>, BindingModule<Id, "oauth-entry">>, Crypto.Crypto | LifecycleHooks | SubtleCrypto>>;
+    }>;
+  }>;
+  accounts: (policy: OAuthAccountsPolicy) => Readonly<{
+    Accounts: Context.Service<AccountsModule<Id>, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly returnTarget: string;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, AuthenticationRequired | HookDenied | IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+      readonly complete: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly requestBinding: Redacted.Redacted<string>;
+        readonly response: {
+          readonly _tag: "Code";
+          readonly state: Redacted.Redacted<string>;
+          readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+          readonly code: Redacted.Redacted<string>;
+          readonly error?: undefined;
+        } | {
+          readonly _tag: "Error";
+          readonly state: Redacted.Redacted<string>;
+          readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+          readonly error: "access-denied" | "rejected";
+          readonly code?: undefined;
+        };
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Linked";
+        readonly credentialId: string;
+        readonly changed: true;
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      } | {
+        readonly _tag: "Linked";
+        readonly credentialId: string;
+        readonly changed: false;
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        readonly invalidation?: undefined;
+      } | {
+        readonly _tag: "Cancelled";
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      }>, AuthenticationRequired | HookDenied | IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+      readonly unlink: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly credentialId: string;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Unlinked";
+        readonly credentialId: string;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }>, AuthenticationRequired | HookDenied | IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+      readonly cleanup: (limit: number) => Effect.Effect<{
+        readonly terminalized: number;
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, AuthenticationRequired | HookDenied | IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable, never>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "oauth-link">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: Redacted.Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "oauth-link">, RequestBindingConfigurationError, Crypto.Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "oauth-link">, RequestBindingConfigurationError, Crypto.Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<AccountsModule<Id>, OAuthConfigurationError, BindingModule<Id, "oauth-link"> | Crypto.Crypto | LifecycleHooks | ModuleService<SessionId, "strategy", Claims["Type"]> | OAuthAccountsPersistence | OAuthActionEvidence | OAuthLinkTransactionProtector | OAuthProtocol | OAuthReturnTargets>;
+    operations: Readonly<{
+      Link: Readonly<{
+        Begin: AuthOperation<`${Id}/accounts/link/begin`, Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly returnTarget: Schema.String;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        }>, Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+          readonly expiresAtMillis: Schema.Int;
+        }>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>, never, {
+          readonly payload: Schema.Struct<{
+            readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+            readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+            readonly returnTarget: Schema.String;
+            readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+          }>;
+          readonly success: Schema.Struct<{
+            readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+            readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+            readonly expiresAtMillis: Schema.Int;
+          }>;
+          readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>;
+          readonly access: "authenticated";
+          readonly exposure: "public";
+          readonly replay: "non-idempotent";
+          readonly credentials: true;
+        }>;
+        Complete: AuthOperation<`${Id}/accounts/link/complete`, Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+            readonly state: Schema.RedactedFromValue<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+            readonly code: Schema.RedactedFromValue<Schema.String>;
+            readonly error: Schema.optionalKey<Schema.Never>;
+          }>, Schema.TaggedStruct<"Error", {
+            readonly state: Schema.RedactedFromValue<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+            readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+            readonly code: Schema.optionalKey<Schema.Never>;
+          }>]>;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        }>, Schema.Union<readonly [Schema.Union<readonly [Schema.TaggedStruct<"Linked", {
+          readonly credentialId: Schema.NonEmptyString;
+          readonly changed: Schema.Literal<true>;
+          readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>, Schema.TaggedStruct<"Linked", {
+          readonly credentialId: Schema.NonEmptyString;
+          readonly changed: Schema.Literal<false>;
+          readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+          readonly invalidation: Schema.optionalKey<Schema.Never>;
+        }>]>, Schema.TaggedStruct<"Cancelled", {
+          readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+        }>]>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>, never, {
+          readonly payload: Schema.Struct<{
+            readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+            readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+            readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+              readonly state: Schema.RedactedFromValue<Schema.String>;
+              readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+              readonly code: Schema.RedactedFromValue<Schema.String>;
+              readonly error: Schema.optionalKey<Schema.Never>;
+            }>, Schema.TaggedStruct<"Error", {
+              readonly state: Schema.RedactedFromValue<Schema.String>;
+              readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+              readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+              readonly code: Schema.optionalKey<Schema.Never>;
+            }>]>;
+            readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+          }>;
+          readonly success: Schema.Union<readonly [Schema.Union<readonly [Schema.TaggedStruct<"Linked", {
+            readonly credentialId: Schema.NonEmptyString;
+            readonly changed: Schema.Literal<true>;
+            readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+            readonly invalidation: Schema.Struct<{
+              readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+              readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+              readonly maximumExposureMillis: Schema.Natural;
+              readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+            }>;
+          }>, Schema.TaggedStruct<"Linked", {
+            readonly credentialId: Schema.NonEmptyString;
+            readonly changed: Schema.Literal<false>;
+            readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+            readonly invalidation: Schema.optionalKey<Schema.Never>;
+          }>]>, Schema.TaggedStruct<"Cancelled", {
+            readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+          }>]>;
+          readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>;
+          readonly access: "authenticated";
+          readonly exposure: "public";
+          readonly replay: "single-use";
+          readonly credentials: true;
+        }>;
+      }>;
+      Unlink: AuthOperation<`${Id}/accounts/unlink`, Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+      }>, Schema.TaggedStruct<"Unlinked", {
+        readonly credentialId: Schema.NonEmptyString;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+          readonly credentialId: Schema.NonEmptyString;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+        }>;
+        readonly success: Schema.TaggedStruct<"Unlinked", {
+          readonly credentialId: Schema.NonEmptyString;
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+        readonly credentials: true;
+      }>;
+    }>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/accounts/link/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly returnTarget: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly authorizationUrl: Redacted.Redacted<string>;
+      readonly expiresAtMillis: number;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/accounts/link/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly requestBinding: Redacted.Redacted<string>;
+      readonly response: {
+        readonly _tag: "Code";
+        readonly state: Redacted.Redacted<string>;
+        readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+        readonly code: Redacted.Redacted<string>;
+        readonly error?: undefined;
+      } | {
+        readonly _tag: "Error";
+        readonly state: Redacted.Redacted<string>;
+        readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+        readonly error: "access-denied" | "rejected";
+        readonly code?: undefined;
+      };
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly _tag: "Linked";
+      readonly credentialId: string;
+      readonly changed: true;
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    } | {
+      readonly _tag: "Linked";
+      readonly credentialId: string;
+      readonly changed: false;
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      readonly invalidation?: undefined;
+    } | {
+      readonly _tag: "Cancelled";
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/accounts/unlink`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly credentialId: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly _tag: "Unlinked";
+      readonly credentialId: string;
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported>, never, AccountsModule<Id>>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/accounts/link/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly returnTarget: Schema.String;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+      readonly expiresAtMillis: Schema.Int;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/accounts/link/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+        readonly state: Schema.RedactedFromValue<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+        readonly error: Schema.optionalKey<Schema.Never>;
+      }>, Schema.TaggedStruct<"Error", {
+        readonly state: Schema.RedactedFromValue<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+        readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+        readonly code: Schema.optionalKey<Schema.Never>;
+      }>]>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.TaggedStruct<"Linked", {
+      readonly credentialId: Schema.NonEmptyString;
+      readonly changed: Schema.Literal<true>;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.TaggedStruct<"Linked", {
+      readonly credentialId: Schema.NonEmptyString;
+      readonly changed: Schema.Literal<false>;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly invalidation: Schema.optionalKey<Schema.Never>;
+    }>]>, Schema.TaggedStruct<"Cancelled", {
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/accounts/unlink`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+    }>, Schema.TaggedStruct<"Unlinked", {
+      readonly credentialId: Schema.NonEmptyString;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthActionRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof LastSignInMethod, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    strategy: Readonly<{
+      completion: false;
+      make: Effect.Effect<{
+        readonly linkAccount: (input: {
+          readonly flowId: string;
+          readonly commandId: string;
+          readonly provider: string;
+          readonly callbackId: string;
+          readonly returnTarget: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly authorizationUrl: Redacted.Redacted<string>;
+          readonly expiresAtMillis: number;
+        }, IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+        readonly completeAccountLink: (input: {
+          readonly flowId: string;
+          readonly provider: string;
+          readonly callbackId: string;
+          readonly requestBinding: string;
+          readonly response: {
+            readonly _tag: "Code";
+            readonly state: string;
+            readonly issuer?: string | undefined;
+            readonly code: string;
+            readonly error?: undefined;
+          } | {
+            readonly _tag: "Error";
+            readonly state: string;
+            readonly issuer?: string | undefined;
+            readonly error: "access-denied" | "rejected";
+            readonly code?: undefined;
+          };
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly _tag: "Linked";
+          readonly credentialId: string;
+          readonly changed: true;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly invalidation: {
+            readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+            readonly existingSessions: "immediate" | "original-absolute-expiry";
+            readonly maximumExposureMillis: number;
+            readonly oldAuthenticationEvidence: "rejected";
+          };
+        } | {
+          readonly _tag: "Linked";
+          readonly credentialId: string;
+          readonly changed: false;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly invalidation?: undefined;
+        } | {
+          readonly _tag: "Cancelled";
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        }, IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+        readonly unlinkAccount: (input: {
+          readonly commandId: string;
+          readonly credentialId: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly _tag: "Unlinked";
+          readonly credentialId: string;
+          readonly invalidation: {
+            readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+            readonly existingSessions: "immediate" | "original-absolute-expiry";
+            readonly maximumExposureMillis: number;
+            readonly oldAuthenticationEvidence: "rejected";
+          };
+        }, IdentityConflict | LastSignInMethod | OAuthActionRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+      }, AuthConfigurationError | OAuthConfigurationError | RequestBindingConfigurationError, Layer.CurrentMemoMap | ModuleService<SessionId, "strategy", Claims["Type"]> | OAuthAccountsPersistence | OAuthActionEvidence | OAuthLinkTransactionProtector | OAuthProtocol | OAuthReturnTargets | RequestBindingConfig | import("effect/Scope").Scope>;
+    }>;
+  }>;
+  connected: (policy: OAuthConnectedPolicy) => Readonly<{
+    ConnectedAccess: Context.ServiceClass<AccessModule<Id>, string, {
+      readonly withAccessToken: <A, E, R>(invocation: AuthInvocation, input: {
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      }, use: (accessToken: Redacted.Redacted<string>) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | AuthenticationRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable, R>;
+    }>;
+    accessLayer: Layer.Layer<AccessModule<Id>, OAuthConfigurationError, Crypto.Crypto | OAuthConnectedPersistence | OAuthConnectedProtocol | OAuthConnectedTokenProtector | OAuthConnectedUseAuthority>;
+    ConnectedMaintenance: Context.ServiceClass<MaintenanceModule<Id>, string, {
+      readonly cleanup: (invocation: AuthInvocation, limit: number) => Effect.Effect<{
+        readonly terminalized: number;
+        readonly removed: number;
+        readonly hasMore: boolean;
+      }, OAuthMethodUnsupported | OAuthUnavailable | OperationForbidden>;
+      readonly runRevocation: (invocation: AuthInvocation) => Effect.Effect<{
+        readonly outcome: "Confirmed" | "Empty" | "Unknown";
+      }, OAuthMethodUnsupported | OAuthUnavailable | OperationForbidden>;
+    }>;
+    maintenanceLayer: Layer.Layer<MaintenanceModule<Id>, OAuthConfigurationError, Crypto.Crypto | OAuthConnectedPersistence | OAuthConnectedProtocol | OAuthConnectedTokenProtector>;
+    maintenanceHandlersLayer: Layer.Layer<OperationHandler<`${Id}/connected/maintenance/cleanup`, {
+      readonly limit: number;
+    }, {
+      readonly terminalized: number;
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OAuthMethodUnsupported | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/connected/maintenance/revocation`, {}, {
+      readonly outcome: "Confirmed" | "Empty" | "Unknown";
+    }, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OAuthMethodUnsupported | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported>, never, MaintenanceModule<Id>>;
+    maintenanceOperations: Readonly<{
+      Cleanup: AuthOperation<`${Id}/connected/maintenance/cleanup`, Schema.Struct<{
+        readonly limit: Schema.Int;
+      }>, Schema.Struct<{
+        readonly terminalized: Schema.Int;
+        readonly removed: Schema.Int;
+        readonly hasMore: Schema.Boolean;
+      }>, Schema.Union<readonly [typeof OperationForbidden, typeof OAuthMethodUnsupported, typeof OAuthUnavailable]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly limit: Schema.Int;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly terminalized: Schema.Int;
+          readonly removed: Schema.Int;
+          readonly hasMore: Schema.Boolean;
+        }>;
+        readonly error: Schema.Union<readonly [typeof OperationForbidden, typeof OAuthMethodUnsupported, typeof OAuthUnavailable]>;
+        readonly access: "system";
+        readonly exposure: "internal";
+        readonly replay: "idempotent";
+      }>;
+      RunRevocation: AuthOperation<`${Id}/connected/maintenance/revocation`, Schema.Struct<{}>, Schema.Struct<{
+        readonly outcome: Schema.Literals<readonly ["Empty", "Confirmed", "Unknown"]>;
+      }>, Schema.Union<readonly [typeof OperationForbidden, typeof OAuthMethodUnsupported, typeof OAuthUnavailable]>, never, {
+        readonly payload: Schema.Struct<{}>;
+        readonly success: Schema.Struct<{
+          readonly outcome: Schema.Literals<readonly ["Empty", "Confirmed", "Unknown"]>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof OperationForbidden, typeof OAuthMethodUnsupported, typeof OAuthUnavailable]>;
+        readonly access: "system";
+        readonly exposure: "internal";
+        readonly replay: "non-idempotent";
+      }>;
+    }>;
+    maintenanceGroup: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/connected/maintenance/cleanup`, Schema.Struct<{
+      readonly limit: Schema.Int;
+    }>, Schema.Struct<{
+      readonly terminalized: Schema.Int;
+      readonly removed: Schema.Int;
+      readonly hasMore: Schema.Boolean;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof OperationForbidden, typeof OAuthMethodUnsupported, typeof OAuthUnavailable]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/connected/maintenance/revocation`, Schema.Struct<{}>, Schema.Struct<{
+      readonly outcome: Schema.Literals<readonly ["Empty", "Confirmed", "Unknown"]>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof OperationForbidden, typeof OAuthMethodUnsupported, typeof OAuthUnavailable]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    Connected: Context.ServiceClass<ConnectedModule<Id>, string, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly intent: {
+          readonly _tag: "Connect";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        } | {
+          readonly _tag: "Reconnect";
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        };
+        readonly returnTarget: string;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, AuthenticationRequired | HookDenied | IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+      readonly complete: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+        readonly requestBinding: Redacted.Redacted<string>;
+        readonly response: {
+          readonly _tag: "Code";
+          readonly state: Redacted.Redacted<string>;
+          readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+          readonly code: Redacted.Redacted<string>;
+          readonly error?: undefined;
+        } | {
+          readonly _tag: "Error";
+          readonly state: Redacted.Redacted<string>;
+          readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+          readonly error: "access-denied" | "rejected";
+          readonly code?: undefined;
+        };
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly _tag: "Connected";
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly status: "Active";
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      } | {
+        readonly _tag: "Cancelled";
+        readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+      }>, AuthenticationRequired | HookDenied | IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+      readonly list: (invocation: AuthInvocation, input: {
+        readonly limit: number;
+        readonly cursor?: string | undefined;
+      }) => Effect.Effect<{
+        readonly items: readonly {
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+          readonly scopes: readonly string[];
+          readonly accessExpiresAtMillis?: number | undefined;
+          readonly useUntilMillis: number;
+          readonly profile?: {
+            readonly displayName?: string | undefined;
+            readonly handle?: string | undefined;
+          } | undefined;
+          readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+        }[];
+        readonly cursor?: string | undefined;
+      }, AuthenticationRequired | HookDenied | IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+      readonly disconnect: (invocation: AuthInvocation, input: {
+        readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly actionProof?: Redacted.Redacted<string> | undefined;
+      }) => Effect.Effect<{
+        readonly _tag: "Disconnected";
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+        readonly affectedGrantCount: number;
+        readonly replayed: boolean;
+      }, AuthenticationRequired | HookDenied | IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable>;
+    }>;
+    binding: Readonly<{
+      RequestBinding: Context.Service<BindingModule<Id, "oauth-connected">, {
+        readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+        readonly verify: (flowId: RequestBindingFlowId, credential: Redacted.Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+      }>;
+      signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "oauth-connected">, RequestBindingConfigurationError, Crypto.Crypto | SubtleCrypto>;
+      layer: Layer.Layer<BindingModule<Id, "oauth-connected">, RequestBindingConfigurationError, Crypto.Crypto | RequestBindingConfig | SubtleCrypto>;
+    }>;
+    layer: Layer.Layer<ConnectedModule<Id>, OAuthConfigurationError, BindingModule<Id, "oauth-connected"> | Crypto.Crypto | LifecycleHooks | OAuthConnectedActionEvidence | OAuthConnectedPersistence | OAuthConnectedProtocol | OAuthConnectedTokenProtector | OAuthConnectedTransactionProtector | OAuthConnectedUseAuthority | OAuthReturnTargets>;
+    operations: Readonly<{
+      Begin: AuthOperation<`${Id}/connected/begin`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly intent: Schema.Union<readonly [Schema.TaggedStruct<"Connect", {
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        }>, Schema.TaggedStruct<"Reconnect", {
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        }>]>;
+        readonly returnTarget: Schema.String;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+        readonly expiresAtMillis: Schema.Int;
+      }>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly intent: Schema.Union<readonly [Schema.TaggedStruct<"Connect", {
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          }>, Schema.TaggedStruct<"Reconnect", {
+            readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+            readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          }>]>;
+          readonly returnTarget: Schema.String;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+          readonly expiresAtMillis: Schema.Int;
+        }>;
+        readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "non-idempotent";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/connected/complete`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+          readonly state: Schema.RedactedFromValue<Schema.String>;
+          readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+          readonly code: Schema.RedactedFromValue<Schema.String>;
+          readonly error: Schema.optionalKey<Schema.Never>;
+        }>, Schema.TaggedStruct<"Error", {
+          readonly state: Schema.RedactedFromValue<Schema.String>;
+          readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+          readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+          readonly code: Schema.optionalKey<Schema.Never>;
+        }>]>;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>, Schema.Union<readonly [Schema.TaggedStruct<"Connected", {
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly status: Schema.Literal<"Active">;
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      }>, Schema.TaggedStruct<"Cancelled", {
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      }>]>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+            readonly state: Schema.RedactedFromValue<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+            readonly code: Schema.RedactedFromValue<Schema.String>;
+            readonly error: Schema.optionalKey<Schema.Never>;
+          }>, Schema.TaggedStruct<"Error", {
+            readonly state: Schema.RedactedFromValue<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+            readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+            readonly code: Schema.optionalKey<Schema.Never>;
+          }>]>;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        }>;
+        readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Connected", {
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly status: Schema.Literal<"Active">;
+          readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+        }>, Schema.TaggedStruct<"Cancelled", {
+          readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+        }>]>;
+        readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      List: AuthOperation<`${Id}/connected/list`, Schema.Struct<{
+        readonly limit: Schema.Int;
+        readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly items: Schema.$Array<Schema.Struct<{
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+          readonly status: Schema.Literals<readonly ["Active", "Refreshing", "ReauthorizationRequired", "Disconnected"]>;
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly useUntilMillis: Schema.Int;
+          readonly profile: Schema.optionalKey<Schema.Struct<{
+            readonly displayName: Schema.optionalKey<Schema.String>;
+            readonly handle: Schema.optionalKey<Schema.String>;
+          }>>;
+          readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+        }>>;
+        readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+      }>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly limit: Schema.Int;
+          readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly items: Schema.$Array<Schema.Struct<{
+            readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+            readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly status: Schema.Literals<readonly ["Active", "Refreshing", "ReauthorizationRequired", "Disconnected"]>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+            readonly useUntilMillis: Schema.Int;
+            readonly profile: Schema.optionalKey<Schema.Struct<{
+              readonly displayName: Schema.optionalKey<Schema.String>;
+              readonly handle: Schema.optionalKey<Schema.String>;
+            }>>;
+            readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+          }>>;
+          readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+        }>;
+        readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "read-only";
+      }>;
+      Disconnect: AuthOperation<`${Id}/connected/disconnect`, Schema.Struct<{
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>, Schema.TaggedStruct<"Disconnected", {
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+        readonly affectedGrantCount: Schema.Int;
+        readonly replayed: Schema.Boolean;
+      }>, Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        }>;
+        readonly success: Schema.TaggedStruct<"Disconnected", {
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+          readonly affectedGrantCount: Schema.Int;
+          readonly replayed: Schema.Boolean;
+        }>;
+        readonly error: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>;
+        readonly access: "authenticated";
+        readonly exposure: "public";
+        readonly replay: "idempotent";
+      }>;
+    }>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/connected/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly intent: {
+        readonly _tag: "Connect";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      } | {
+        readonly _tag: "Reconnect";
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      };
+      readonly returnTarget: string;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly authorizationUrl: Redacted.Redacted<string>;
+      readonly expiresAtMillis: number;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/connected/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly requestBinding: Redacted.Redacted<string>;
+      readonly response: {
+        readonly _tag: "Code";
+        readonly state: Redacted.Redacted<string>;
+        readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+        readonly code: Redacted.Redacted<string>;
+        readonly error?: undefined;
+      } | {
+        readonly _tag: "Error";
+        readonly state: Redacted.Redacted<string>;
+        readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+        readonly error: "access-denied" | "rejected";
+        readonly code?: undefined;
+      };
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly _tag: "Connected";
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      readonly status: "Active";
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    } | {
+      readonly _tag: "Cancelled";
+      readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/connected/disconnect`, {
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly actionProof?: Redacted.Redacted<string> | undefined;
+    }, {
+      readonly _tag: "Disconnected";
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+      readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+      readonly affectedGrantCount: number;
+      readonly replayed: boolean;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/connected/list`, {
+      readonly limit: number;
+      readonly cursor?: string | undefined;
+    }, {
+      readonly items: readonly {
+        readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+        readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+        readonly scopes: readonly string[];
+        readonly accessExpiresAtMillis?: number | undefined;
+        readonly useUntilMillis: number;
+        readonly profile?: {
+          readonly displayName?: string | undefined;
+          readonly handle?: string | undefined;
+        } | undefined;
+        readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+      }[];
+      readonly cursor?: string | undefined;
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | IdentityConflict | InvalidOperationInput | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported>, never, ConnectedModule<Id>>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/connected/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly intent: Schema.Union<readonly [Schema.TaggedStruct<"Connect", {
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      }>, Schema.TaggedStruct<"Reconnect", {
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      }>]>;
+      readonly returnTarget: Schema.String;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+      readonly expiresAtMillis: Schema.Int;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/connected/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+        readonly state: Schema.RedactedFromValue<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+        readonly error: Schema.optionalKey<Schema.Never>;
+      }>, Schema.TaggedStruct<"Error", {
+        readonly state: Schema.RedactedFromValue<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+        readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+        readonly code: Schema.optionalKey<Schema.Never>;
+      }>]>;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Connected", {
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+      readonly status: Schema.Literal<"Active">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    }>, Schema.TaggedStruct<"Cancelled", {
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/connected/disconnect`, Schema.Struct<{
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.TaggedStruct<"Disconnected", {
+      readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+      readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+      readonly affectedGrantCount: Schema.Int;
+      readonly replayed: Schema.Boolean;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/connected/list`, Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly items: Schema.$Array<Schema.Struct<{
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly profileKey: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+        readonly status: Schema.Literals<readonly ["Active", "Refreshing", "ReauthorizationRequired", "Disconnected"]>;
+        readonly scopes: Schema.$Array<Schema.String>;
+        readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+        readonly useUntilMillis: Schema.Int;
+        readonly profile: Schema.optionalKey<Schema.Struct<{
+          readonly displayName: Schema.optionalKey<Schema.String>;
+          readonly handle: Schema.optionalKey<Schema.String>;
+        }>>;
+        readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
+      }>>;
+      readonly cursor: Schema.optionalKey<Schema.NonEmptyString>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthConnectedActionRequired, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof IdentityConflict, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    strategy: Readonly<{
+      completion: false;
+      make: Effect.Effect<{
+        readonly connectAccount: (input: {
+          readonly flowId: string;
+          readonly commandId: string;
+          readonly callbackId: string;
+          readonly intent: {
+            readonly _tag: "Connect";
+            readonly provider: string;
+            readonly profileKey: string;
+          } | {
+            readonly _tag: "Reconnect";
+            readonly grantId: string;
+            readonly profileKey: string;
+          };
+          readonly returnTarget: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly authorizationUrl: Redacted.Redacted<string>;
+          readonly expiresAtMillis: number;
+        }, IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+        readonly completeAccountConnection: (input: {
+          readonly flowId: string;
+          readonly provider: string;
+          readonly callbackId: string;
+          readonly requestBinding: string;
+          readonly response: {
+            readonly _tag: "Code";
+            readonly state: string;
+            readonly issuer?: string | undefined;
+            readonly code: string;
+            readonly error?: undefined;
+          } | {
+            readonly _tag: "Error";
+            readonly state: string;
+            readonly issuer?: string | undefined;
+            readonly error: "access-denied" | "rejected";
+            readonly code?: undefined;
+          };
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly _tag: "Connected";
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly status: "Active";
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        } | {
+          readonly _tag: "Cancelled";
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+        }, IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+        readonly listAccountConnections: (input: {
+          readonly limit: number;
+          readonly cursor?: string | undefined;
+        }) => Effect.Effect<{
+          readonly items: readonly {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
+            readonly scopes: readonly string[];
+            readonly accessExpiresAtMillis?: number | undefined;
+            readonly useUntilMillis: number;
+            readonly profile?: {
+              readonly displayName?: string | undefined;
+              readonly handle?: string | undefined;
+            } | undefined;
+            readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+          }[];
+          readonly cursor?: string | undefined;
+        }, IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+        readonly disconnectAccount: (input: {
+          readonly commandId: string;
+          readonly grantId: string;
+          readonly actionProof?: string | undefined;
+        }) => Effect.Effect<{
+          readonly _tag: "Disconnected";
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
+          readonly affectedGrantCount: number;
+          readonly replayed: boolean;
+        }, IdentityConflict | OAuthConnectedActionRequired | OAuthConnectedBusy | OAuthConnectedReauthorizationRequired | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | SessionApiError, AuthRequest>;
+      }, AuthConfigurationError | OAuthConfigurationError | RequestBindingConfigurationError, Layer.CurrentMemoMap | OAuthConnectedActionEvidence | OAuthConnectedPersistence | OAuthConnectedProtocol | OAuthConnectedTokenProtector | OAuthConnectedTransactionProtector | OAuthConnectedUseAuthority | OAuthReturnTargets | RequestBindingConfig | import("effect/Scope").Scope>;
+    }>;
+  }>;
+  CompletionResult: Schema.Union<readonly [Schema.Struct<{
+    readonly completion: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  }>, Schema.TaggedStruct<"Cancelled", {
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  }>, Schema.TaggedStruct<"RegistrationRequired", {
+    readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  }>]>;
+  operations: Readonly<{
+    Begin: AuthOperation<`${Id}/sign-in/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly returnTarget: Schema.String;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+      readonly expiresAtMillis: Schema.Int;
+    }>, Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly returnTarget: Schema.String;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+        readonly expiresAtMillis: Schema.Int;
+      }>;
+      readonly error: Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/sign-in/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+        readonly state: Schema.RedactedFromValue<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+        readonly error: Schema.optionalKey<Schema.Never>;
+      }>, Schema.TaggedStruct<"Error", {
+        readonly state: Schema.RedactedFromValue<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+        readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+        readonly code: Schema.optionalKey<Schema.Never>;
+      }>]>;
+    }>, Schema.Union<readonly [Schema.Struct<{
+      readonly completion: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    }>, Schema.TaggedStruct<"Cancelled", {
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    }>, Schema.TaggedStruct<"RegistrationRequired", {
+      readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    }>]>, Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+          readonly state: Schema.RedactedFromValue<Schema.String>;
+          readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+          readonly code: Schema.RedactedFromValue<Schema.String>;
+          readonly error: Schema.optionalKey<Schema.Never>;
+        }>, Schema.TaggedStruct<"Error", {
+          readonly state: Schema.RedactedFromValue<Schema.String>;
+          readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+          readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+          readonly code: Schema.optionalKey<Schema.Never>;
+        }>]>;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.Struct<{
+        readonly completion: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+          readonly session: Schema.Struct<{
+            readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+            readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+            readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+            readonly assurance: typeof AuthenticationAssurance;
+            readonly issuedAt: Schema.DateTimeUtcFromMillis;
+            readonly expiresAt: Schema.DateTimeUtcFromMillis;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+            readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+          }>;
+        }>, Schema.TaggedStruct<"PendingAuthentication", {
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        }>]>;
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      }>, Schema.TaggedStruct<"Cancelled", {
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      }>, Schema.TaggedStruct<"RegistrationRequired", {
+        readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+  }>;
+  handlersLayer: Layer.Layer<OperationHandler<`${Id}/sign-in/begin`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly returnTarget: string;
+  }, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly authorizationUrl: Redacted.Redacted<string>;
+    readonly expiresAtMillis: number;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<`${Id}/sign-in/complete`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+    readonly requestBinding: Redacted.Redacted<string>;
+    readonly response: {
+      readonly _tag: "Code";
+      readonly state: Redacted.Redacted<string>;
+      readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+      readonly code: Redacted.Redacted<string>;
+      readonly error?: undefined;
+    } | {
+      readonly _tag: "Error";
+      readonly state: Redacted.Redacted<string>;
+      readonly issuer?: (string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">) | undefined;
+      readonly error: "access-denied" | "rejected";
+      readonly code?: undefined;
+    };
+  }, {
+    readonly completion: {
+      readonly _tag: "Authenticated";
+      readonly session: {
+        readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly assurance: AuthenticationAssurance;
+        readonly issuedAt: DateTime.Utc;
+        readonly expiresAt: DateTime.Utc;
+        readonly absoluteExpiresAt: DateTime.Utc;
+        readonly claims: Claims["Type"];
+      };
+    } | {
+      readonly _tag: "PendingAuthentication";
+      readonly expiresAt: DateTime.Utc;
+    };
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+  } | {
+    readonly _tag: "Cancelled";
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+  } | {
+    readonly _tag: "RegistrationRequired";
+    readonly reference: string & import("effect/Brand").Brand<"effect-auth/OAuthRegistrationReference">;
+    readonly expiresAtMillis: number;
+    readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OAuthMethodUnsupported | OAuthRejected | OAuthUnavailable | OperationForbidden | OperationPrivateOutputUnsupported>, never, OAuthModule<Id, "sign-in", Claims["Type"]>>;
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/sign-in/begin`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly returnTarget: Schema.String;
+  }>, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly authorizationUrl: Schema.RedactedFromValue<Schema.String>;
+    readonly expiresAtMillis: Schema.Int;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/sign-in/complete`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+      readonly state: Schema.RedactedFromValue<Schema.String>;
+      readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+      readonly error: Schema.optionalKey<Schema.Never>;
+    }>, Schema.TaggedStruct<"Error", {
+      readonly state: Schema.RedactedFromValue<Schema.String>;
+      readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+      readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+      readonly code: Schema.optionalKey<Schema.Never>;
+    }>]>;
+  }>, Schema.Union<readonly [Schema.Struct<{
+    readonly completion: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  }>, Schema.TaggedStruct<"Cancelled", {
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  }>, Schema.TaggedStruct<"RegistrationRequired", {
+    readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+//#endregion
+export { OAuthModule, makeOAuthMethod };
+//# sourceMappingURL=signInModule.d.mts.map