@effect-auth/core 0.1.0-alpha.0 → 0.1.0-alpha.10

package/dist/OAuth.d.ts

@@ -0,0 +1,934 @@
+import { Brand, Context, Duration, Effect, Layer, Redacted } from "effect";
+import type * as OptionTypes from "effect/Option";
+import { Challenge } from "./Challenge.js";
+import type { ChallengeService } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoService } from "./Crypto.js";
+import { ChallengeId, Email, OAuthAccountId, OAuthProviderId, UnixMillis, UserId } from "./Identifiers.js";
+import { JwtError, JwtVerifier, type JwksDocument, type JwtAudience, type JwtAlgorithm, type JwtClaims, type JwtHeader, type JwtKeyInfo, type JwtKeysService, type JwtVerifierService, type JwtVerificationFailureReason } from "./Jwt.js";
+export type OAuthStateToken = Brand.Branded<string, "auth/OAuthStateToken">;
+export declare const OAuthStateToken: Brand.Constructor<OAuthStateToken>;
+export type OAuthCodeVerifier = Brand.Branded<string, "auth/OAuthCodeVerifier">;
+export declare const OAuthCodeVerifier: Brand.Constructor<OAuthCodeVerifier>;
+export type OAuthCodeChallenge = Brand.Branded<string, "auth/OAuthCodeChallenge">;
+export declare const OAuthCodeChallenge: Brand.Constructor<OAuthCodeChallenge>;
+export type OAuthNonce = Brand.Branded<string, "auth/OAuthNonce">;
+export declare const OAuthNonce: Brand.Constructor<OAuthNonce>;
+export type OAuthAuthorizationCode = Brand.Branded<string, "auth/OAuthAuthorizationCode">;
+export declare const OAuthAuthorizationCode: Brand.Constructor<OAuthAuthorizationCode>;
+export type OAuthAccessToken = Brand.Branded<string, "auth/OAuthAccessToken">;
+export declare const OAuthAccessToken: Brand.Constructor<OAuthAccessToken>;
+export type OAuthRefreshToken = Brand.Branded<string, "auth/OAuthRefreshToken">;
+export declare const OAuthRefreshToken: Brand.Constructor<OAuthRefreshToken>;
+export type OAuthIdToken = Brand.Branded<string, "auth/OAuthIdToken">;
+export declare const OAuthIdToken: Brand.Constructor<OAuthIdToken>;
+export declare const defaultOAuthStateTtl: Duration.Duration;
+export declare const defaultOAuthLinkConfirmationTtl: Duration.Duration;
+export declare const defaultOAuthJwksCacheTtl: Duration.Duration;
+export declare const defaultOAuthStateSecretBytes = 32;
+export declare const defaultOAuthCodeVerifierBytes = 32;
+export declare const defaultOAuthLinkConfirmationSecretBytes = 32;
+export declare const defaultOAuthNonceBytes = 16;
+export declare const appleSignInProviderId: OAuthProviderId;
+export declare const appleSignInIssuer = "https://appleid.apple.com";
+export declare const appleSignInAuthorizationEndpoint = "https://appleid.apple.com/auth/authorize";
+export declare const appleSignInTokenEndpoint = "https://appleid.apple.com/auth/token";
+export declare const appleSignInRevocationEndpoint = "https://appleid.apple.com/auth/revoke";
+export declare const appleSignInJwksUri = "https://appleid.apple.com/auth/keys";
+export declare const appleSignInPrivateRelayDomain = "privaterelay.appleid.com";
+export declare const appleSignInDefaultScopes: readonly ["openid", "email", "name"];
+export declare const appleSignInDefaultAuthorizationParams: {
+    readonly response_mode: "form_post";
+};
+export declare const githubOAuthProviderId: OAuthProviderId;
+export declare const githubOAuthAuthorizationEndpoint = "https://github.com/login/oauth/authorize";
+export declare const githubOAuthTokenEndpoint = "https://github.com/login/oauth/access_token";
+export declare const githubOAuthUserEndpoint = "https://api.github.com/user";
+export declare const githubOAuthEmailsEndpoint = "https://api.github.com/user/emails";
+export declare const githubOAuthDefaultScopes: readonly ["read:user", "user:email"];
+export declare const githubOAuthApiVersion = "2022-11-28";
+export declare const githubOAuthApiVersionHeader: {
+    readonly "x-github-api-version": "2022-11-28";
+};
+export declare const googleOidcProviderId: OAuthProviderId;
+export declare const googleOidcIssuer = "https://accounts.google.com";
+export declare const googleOidcAuthorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+export declare const googleOidcTokenEndpoint = "https://oauth2.googleapis.com/token";
+export declare const googleOidcRevocationEndpoint = "https://oauth2.googleapis.com/revoke";
+export declare const googleOidcUserInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+export declare const googleOidcJwksUri = "https://www.googleapis.com/oauth2/v3/certs";
+export declare const googleOidcDefaultScopes: readonly ["openid", "email", "profile"];
+export declare const googleOidcOfflineAccessAuthorizationParams: {
+    readonly access_type: "offline";
+    readonly prompt: "consent";
+};
+export declare const microsoftOidcProviderId: OAuthProviderId;
+export declare const microsoftOidcLoginBaseUrl = "https://login.microsoftonline.com";
+export declare const microsoftOidcUserInfoEndpoint = "https://graph.microsoft.com/oidc/userinfo";
+export declare const microsoftOidcDefaultScopes: readonly ["openid", "email", "profile"];
+export declare const microsoftOidcOfflineAccessScopes: readonly ["openid", "email", "profile", "offline_access"];
+export declare const genericOidcDefaultScopes: readonly ["openid", "email", "profile"];
+export declare const microsoftOidcAuthorizationEndpoint: (tenant: string) => string;
+export declare const microsoftOidcTokenEndpoint: (tenant: string) => string;
+export declare const microsoftOidcJwksUri: (tenant: string) => string;
+export declare const microsoftOidcIssuer: (tenant: string) => string;
+export interface GoogleOidcProviderOptions {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface GithubOAuthProviderOptions {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface MicrosoftOidcProviderOptions {
+    readonly tenant: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface AppleSignInProviderOptions {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface GenericOidcProviderOptions {
+    readonly id: OAuthProviderId;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly redirectUri: string;
+    readonly userInfoEndpoint?: string;
+    readonly jwksUri?: string;
+    readonly revocationEndpoint?: string;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface AppleSignInAuthorizationUser {
+    readonly email?: string;
+    readonly name?: {
+        readonly firstName?: string;
+        readonly lastName?: string;
+    };
+}
+export interface GithubOAuthEmailRecord {
+    readonly email: string;
+    readonly primary?: boolean;
+    readonly verified?: boolean;
+    readonly visibility?: string | null;
+}
+export interface OAuthProviderConfig {
+    readonly id: OAuthProviderId;
+    readonly clientId: string;
+    readonly authorizationEndpoint: string;
+    readonly redirectUri: string;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly issuer?: string;
+    readonly tokenEndpoint?: string;
+    readonly revocationEndpoint?: string;
+    readonly userInfoEndpoint?: string;
+    readonly jwksUri?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthJwksFetchInput {
+    readonly provider: OAuthProviderConfig;
+    readonly url: string;
+}
+export interface OAuthJwksJwtKeysDependencies {
+    readonly provider: OAuthProviderConfig;
+    readonly fetch: (input: OAuthJwksFetchInput) => Effect.Effect<unknown, JwtError>;
+    readonly cacheTtl?: Duration.Duration;
+    readonly allowedAlgorithms?: readonly JwtAlgorithm[];
+}
+export type OAuthProviderOperation = "get";
+declare const OAuthProviderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderError";
+} & Readonly<A>;
+export declare class OAuthProviderError extends OAuthProviderError_base<{
+    readonly operation: OAuthProviderOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProvidersService {
+    readonly get: (id: OAuthProviderId) => Effect.Effect<OptionTypes.Option<OAuthProviderConfig>, OAuthProviderError>;
+}
+export type OAuthClientAuthentication = {
+    readonly method: "none";
+} | {
+    readonly method: "client_secret_basic";
+    readonly clientSecret: Redacted.Redacted<string>;
+} | {
+    readonly method: "client_secret_post";
+    readonly clientSecret: Redacted.Redacted<string>;
+};
+export interface OAuthAuthorizationCodeTokenInput {
+    readonly provider: OAuthProviderConfig;
+    readonly code: OAuthAuthorizationCode | string;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly redirectUri?: string;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface OAuthRefreshTokenInput {
+    readonly provider: OAuthProviderConfig;
+    readonly refreshToken: Redacted.Redacted<OAuthRefreshToken | string>;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly scopes?: readonly string[];
+    readonly params?: Readonly<Record<string, string>>;
+}
+export type OAuthTokenRevocationHint = "access_token" | "refresh_token";
+export interface OAuthTokenRevocationInput {
+    readonly provider: OAuthProviderConfig;
+    readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: OAuthTokenRevocationHint;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface OAuthTokenRequest {
+    readonly url: string;
+    readonly method: "POST";
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: string;
+}
+export interface OAuthUserInfoRequestInput {
+    readonly provider: OAuthProviderConfig;
+    readonly accessToken: Redacted.Redacted<OAuthAccessToken | string>;
+    readonly params?: Readonly<Record<string, string>>;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface OAuthUserInfoRequest {
+    readonly url: string;
+    readonly method: "GET";
+    readonly headers: Readonly<Record<string, string>>;
+}
+export type OAuthUserInfo = Readonly<Record<string, unknown>>;
+export type OAuthUserInfoOperation = "request" | "decode";
+declare const OAuthUserInfoError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthUserInfoError";
+} & Readonly<A>;
+export declare class OAuthUserInfoError extends OAuthUserInfoError_base<{
+    readonly operation: OAuthUserInfoOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenResponse {
+    readonly accessToken: Redacted.Redacted<OAuthAccessToken>;
+    readonly tokenType: string;
+    readonly expiresIn?: number;
+    readonly refreshToken?: Redacted.Redacted<OAuthRefreshToken>;
+    readonly idToken?: Redacted.Redacted<OAuthIdToken>;
+    readonly scopes?: readonly string[];
+    readonly extra?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthProviderTokenVaultRecord {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly accessTokenCiphertext: Redacted.Redacted<string>;
+    readonly refreshTokenCiphertext?: Redacted.Redacted<string>;
+    readonly idTokenCiphertext?: Redacted.Redacted<string>;
+    readonly tokenType: string;
+    readonly scopes?: readonly string[];
+    readonly expiresAt?: UnixMillis;
+    readonly updatedAt: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly revocationReason?: string;
+}
+export interface OAuthProviderTokenVaultTokens {
+    readonly accessTokenCiphertext: Redacted.Redacted<string>;
+    readonly refreshTokenCiphertext?: Redacted.Redacted<string>;
+    readonly idTokenCiphertext?: Redacted.Redacted<string>;
+    readonly tokenType: string;
+    readonly scopes?: readonly string[];
+    readonly expiresAt?: UnixMillis;
+}
+export interface OAuthProviderTokenVaultLookupInput {
+    readonly accountId: OAuthAccountId;
+}
+export interface OAuthProviderTokenVaultMarkRevokedInput {
+    readonly accountId: OAuthAccountId;
+    readonly revokedAt: UnixMillis;
+    readonly reason: string;
+}
+export type OAuthProviderTokenVaultOperation = "upsert" | "refresh-token" | "tokens" | "mark-revoked";
+declare const OAuthProviderTokenVaultError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderTokenVaultError";
+} & Readonly<A>;
+export declare class OAuthProviderTokenVaultError extends OAuthProviderTokenVaultError_base<{
+    readonly operation: OAuthProviderTokenVaultOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderTokenVaultService {
+    readonly upsert: (record: OAuthProviderTokenVaultRecord) => Effect.Effect<void, OAuthProviderTokenVaultError>;
+    readonly refreshTokenForAccount: (input: OAuthProviderTokenVaultLookupInput) => Effect.Effect<OptionTypes.Option<Redacted.Redacted<string>>, OAuthProviderTokenVaultError>;
+    readonly tokensForAccount: (input: OAuthProviderTokenVaultLookupInput) => Effect.Effect<OptionTypes.Option<OAuthProviderTokenVaultTokens>, OAuthProviderTokenVaultError>;
+    readonly markRevoked: (input: OAuthProviderTokenVaultMarkRevokedInput) => Effect.Effect<OptionTypes.Option<OAuthProviderTokenVaultRecord>, OAuthProviderTokenVaultError>;
+}
+declare const OAuthProviderTokenVault_base: Context.ServiceClass<OAuthProviderTokenVault, "auth/OAuthProviderTokenVault", OAuthProviderTokenVaultService>;
+export declare class OAuthProviderTokenVault extends OAuthProviderTokenVault_base {
+}
+export declare namespace OAuthProviderTokenVault {
+    const make: (service: OAuthProviderTokenVaultService) => OAuthProviderTokenVaultService;
+}
+export interface OAuthProviderTokenLifecycleStoreInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly tokens: OAuthTokenResponse;
+    readonly fallbackRefreshTokenCiphertext?: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+}
+export interface OAuthProviderTokenLifecycleStoreResult {
+    readonly accountId: OAuthAccountId;
+    readonly expiresAt?: UnixMillis;
+    readonly hasRefreshToken: boolean;
+    readonly scopes: readonly string[];
+}
+export interface OAuthProviderTokenLifecycleRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export type OAuthProviderTokenLifecycleRefreshResult = {
+    readonly status: "missing-refresh-token";
+    readonly accountId: OAuthAccountId;
+} | ({
+    readonly status: "refreshed";
+} & OAuthProviderTokenLifecycleStoreResult);
+export interface OAuthProviderTokenLifecycleRevokeInput {
+    readonly accountId: OAuthAccountId;
+    readonly provider: OAuthProviderConfig;
+    readonly reason: string;
+    readonly now?: UnixMillis;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export type OAuthProviderTokenLifecycleRevokeResult = {
+    readonly status: "missing-tokens";
+    readonly accountId: OAuthAccountId;
+} | {
+    readonly status: "revoked";
+    readonly accountId: OAuthAccountId;
+    readonly revokedAt: UnixMillis;
+};
+export type OAuthProviderTokenLifecycleOperation = "store" | "refresh" | "revoke";
+declare const OAuthProviderTokenLifecycleError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderTokenLifecycleError";
+} & Readonly<A>;
+export declare class OAuthProviderTokenLifecycleError extends OAuthProviderTokenLifecycleError_base<{
+    readonly operation: OAuthProviderTokenLifecycleOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderTokenLifecycleService {
+    readonly store: (input: OAuthProviderTokenLifecycleStoreInput) => Effect.Effect<OAuthProviderTokenLifecycleStoreResult, OAuthProviderTokenLifecycleError>;
+    readonly refresh: (input: OAuthProviderTokenLifecycleRefreshInput) => Effect.Effect<OAuthProviderTokenLifecycleRefreshResult, OAuthProviderTokenLifecycleError>;
+    readonly revoke: (input: OAuthProviderTokenLifecycleRevokeInput) => Effect.Effect<OAuthProviderTokenLifecycleRevokeResult, OAuthProviderTokenLifecycleError>;
+}
+declare const OAuthProviderTokenLifecycle_base: Context.ServiceClass<OAuthProviderTokenLifecycle, "auth/OAuthProviderTokenLifecycle", OAuthProviderTokenLifecycleService>;
+export declare class OAuthProviderTokenLifecycle extends OAuthProviderTokenLifecycle_base {
+}
+export declare namespace OAuthProviderTokenLifecycle {
+    const make: (service: OAuthProviderTokenLifecycleService) => OAuthProviderTokenLifecycleService;
+}
+export interface OAuthProviderTokenLifecycleDependencies {
+    readonly tokenVault: OAuthProviderTokenVaultService;
+    readonly encryptToken: (token: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<string>, unknown>;
+    readonly decryptToken: (ciphertext: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<string>, unknown>;
+    readonly request: (request: OAuthTokenRequest) => Effect.Effect<unknown, unknown>;
+}
+export type OAuthProviderTokenLifecycleLiveOptions = Omit<OAuthProviderTokenLifecycleDependencies, "tokenVault">;
+export interface GoogleOidcProviderTokenRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly clientSecret?: Redacted.Redacted<string>;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface GoogleOidcProviderTokenRevokeInput {
+    readonly accountId: OAuthAccountId;
+    readonly provider: OAuthProviderConfig;
+    readonly reason: string;
+    readonly now?: UnixMillis;
+    readonly clientSecret?: Redacted.Redacted<string>;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface MicrosoftOidcProviderTokenRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly clientSecret?: Redacted.Redacted<string>;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface AppleSignInProviderTokenRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface AppleSignInProviderTokenRevokeInput {
+    readonly accountId: OAuthAccountId;
+    readonly provider: OAuthProviderConfig;
+    readonly reason: string;
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface OidcIdTokenClaims extends JwtClaims {
+    readonly iss: string;
+    readonly sub: string;
+    readonly aud: JwtAudience;
+    readonly exp: number;
+    readonly iat: number;
+    readonly nonce?: string;
+    readonly azp?: string;
+    readonly email?: string;
+    readonly email_verified?: boolean;
+    readonly name?: string;
+    readonly preferred_username?: string;
+    readonly picture?: string;
+}
+export type OidcIdTokenVerificationFailureReason = JwtVerificationFailureReason | "missing_provider_issuer" | "missing_subject" | "missing_expiration" | "missing_issued_at" | "missing_authorized_party" | "authorized_party_mismatch" | "nonce_mismatch";
+export interface OidcIdTokenVerifyInput {
+    readonly provider: OAuthProviderConfig;
+    readonly idToken: Redacted.Redacted<OAuthIdToken | string>;
+    readonly nonce?: OAuthNonce | string;
+    readonly audience?: JwtAudience;
+    readonly authorizedParty?: string;
+    readonly now?: UnixMillis;
+    readonly clockTolerance?: Duration.Duration;
+}
+export type OidcIdTokenVerificationResult = {
+    readonly valid: true;
+    readonly header: JwtHeader;
+    readonly claims: OidcIdTokenClaims;
+    readonly key: JwtKeyInfo;
+} | {
+    readonly valid: false;
+    readonly reason: OidcIdTokenVerificationFailureReason;
+};
+export type OidcIdTokenVerifierOperation = "verify";
+declare const OidcIdTokenVerifierError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OidcIdTokenVerifierError";
+} & Readonly<A>;
+export declare class OidcIdTokenVerifierError extends OidcIdTokenVerifierError_base<{
+    readonly operation: OidcIdTokenVerifierOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OidcIdTokenVerifierService {
+    readonly verify: (input: OidcIdTokenVerifyInput) => Effect.Effect<OidcIdTokenVerificationResult, OidcIdTokenVerifierError>;
+}
+declare const OidcIdTokenVerifier_base: Context.ServiceClass<OidcIdTokenVerifier, "auth/OidcIdTokenVerifier", OidcIdTokenVerifierService>;
+export declare class OidcIdTokenVerifier extends OidcIdTokenVerifier_base {
+}
+export declare namespace OidcIdTokenVerifier {
+    const make: (service: OidcIdTokenVerifierService) => OidcIdTokenVerifierService;
+}
+export interface OidcIdTokenVerifierDependencies {
+    readonly jwtVerifier: JwtVerifierService;
+}
+export interface OAuthProfile {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly email?: Email;
+    readonly emailVerified?: boolean;
+    readonly name?: string;
+    readonly username?: string;
+    readonly avatarUrl?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthProfileNormalizeInput {
+    readonly provider: OAuthProviderConfig;
+    readonly claims?: OidcIdTokenClaims;
+    readonly userInfo?: unknown;
+    readonly profile?: unknown;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type OAuthProfileNormalizationFailureReason = "missing_claims" | "missing_subject" | "invalid_userinfo" | "subject_mismatch";
+export type OAuthProfileNormalizationOperation = "normalize";
+declare const OAuthProfileNormalizationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProfileNormalizationError";
+} & Readonly<A>;
+export declare class OAuthProfileNormalizationError extends OAuthProfileNormalizationError_base<{
+    readonly operation: OAuthProfileNormalizationOperation;
+    readonly reason: OAuthProfileNormalizationFailureReason;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProfileNormalizerService {
+    readonly normalize: (input: OAuthProfileNormalizeInput) => Effect.Effect<OAuthProfile, OAuthProfileNormalizationError>;
+}
+declare const OAuthProfileNormalizer_base: Context.ServiceClass<OAuthProfileNormalizer, "auth/OAuthProfileNormalizer", OAuthProfileNormalizerService>;
+export declare class OAuthProfileNormalizer extends OAuthProfileNormalizer_base {
+}
+export declare namespace OAuthProfileNormalizer {
+    const make: (service: OAuthProfileNormalizerService) => OAuthProfileNormalizerService;
+}
+export type OAuthTokenExchangeOperation = "token-request" | "refresh-token-request" | "revocation-request" | "decode-token-response" | "exchange-code";
+declare const OAuthTokenExchangeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenExchangeError";
+} & Readonly<A>;
+export declare class OAuthTokenExchangeError extends OAuthTokenExchangeError_base<{
+    readonly operation: OAuthTokenExchangeOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenExchangeService {
+    readonly exchangeAuthorizationCode: (input: OAuthAuthorizationCodeTokenInput) => Effect.Effect<OAuthTokenResponse, OAuthTokenExchangeError>;
+}
+declare const OAuthTokenExchange_base: Context.ServiceClass<OAuthTokenExchange, "auth/OAuthTokenExchange", OAuthTokenExchangeService>;
+export declare class OAuthTokenExchange extends OAuthTokenExchange_base {
+}
+export declare namespace OAuthTokenExchange {
+    const make: (service: OAuthTokenExchangeService) => OAuthTokenExchangeService;
+}
+export interface OAuthTokenExchangeDependencies {
+    readonly request: (request: OAuthTokenRequest) => Effect.Effect<unknown, OAuthTokenExchangeError>;
+}
+declare const OAuthProviders_base: Context.ServiceClass<OAuthProviders, "auth/OAuthProviders", OAuthProvidersService>;
+export declare class OAuthProviders extends OAuthProviders_base {
+}
+export declare namespace OAuthProviders {
+    const make: (service: OAuthProvidersService) => OAuthProvidersService;
+}
+export interface OAuthPkce {
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier>;
+    readonly codeChallenge: OAuthCodeChallenge;
+    readonly codeChallengeMethod: "S256";
+}
+export interface OAuthPkceInput {
+    readonly codeVerifier?: Redacted.Redacted<string>;
+    readonly verifierBytes?: number;
+}
+export interface OAuthAuthorizationStartInput {
+    readonly provider: OAuthProviderConfig;
+    readonly ttl?: Duration.Duration;
+    readonly redirectUri?: string;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly codeVerifier?: Redacted.Redacted<string>;
+    readonly includeNonce?: boolean;
+    readonly nonce?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface StartedOAuthAuthorization {
+    readonly providerId: OAuthProviderId;
+    readonly authorizationUrl: string;
+    readonly state: OAuthStateToken;
+    readonly challengeId: ChallengeId;
+    readonly expiresAt: UnixMillis;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier>;
+    readonly codeChallenge: OAuthCodeChallenge;
+    readonly codeChallengeMethod: "S256";
+    readonly nonce?: OAuthNonce;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+}
+export interface OAuthStateVerifyInput {
+    readonly state: OAuthStateToken | string;
+}
+export interface VerifiedOAuthState {
+    readonly challengeId: ChallengeId;
+    readonly providerId: OAuthProviderId;
+    readonly redirectUri?: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly nonce?: OAuthNonce;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthCallbackInput {
+    readonly provider: OAuthProviderConfig;
+    readonly state: OAuthStateToken | string;
+    readonly code: OAuthAuthorizationCode | string;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly redirectUri?: string;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly tokenParams?: Readonly<Record<string, string>>;
+}
+export interface OAuthCallbackResult {
+    readonly state: VerifiedOAuthState;
+    readonly tokens: OAuthTokenResponse;
+}
+export type OAuthStateOperation = "start" | "verify" | "parse" | "pkce" | "authorization-url";
+declare const OAuthStateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthStateError";
+} & Readonly<A>;
+export declare class OAuthStateError extends OAuthStateError_base<{
+    readonly operation: OAuthStateOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthStateService {
+    readonly start: (input: OAuthAuthorizationStartInput) => Effect.Effect<StartedOAuthAuthorization, OAuthStateError>;
+    readonly verify: (input: OAuthStateVerifyInput) => Effect.Effect<VerifiedOAuthState, OAuthStateError>;
+}
+declare const OAuthState_base: Context.ServiceClass<OAuthState, "auth/OAuthState", OAuthStateService>;
+export declare class OAuthState extends OAuthState_base {
+}
+export declare namespace OAuthState {
+    const make: (service: OAuthStateService) => OAuthStateService;
+}
+export interface OAuthAccountRecord {
+    readonly id: OAuthAccountId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly userId: UserId;
+    readonly email?: Email;
+    readonly emailVerified?: boolean;
+    readonly createdAt: UnixMillis;
+    readonly updatedAt: UnixMillis;
+    readonly unlinkedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface VerifiedOAuthIdentity {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly email?: Email;
+    readonly emailVerified?: boolean;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthAccountLookupInput {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly includeUnlinked?: boolean;
+}
+export interface OAuthAccountListByUserInput {
+    readonly userId: UserId;
+    readonly includeUnlinked?: boolean;
+}
+export interface OAuthAccountUnlinkInput {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly unlinkedAt: UnixMillis;
+    readonly reason?: string;
+}
+export type OAuthAccountStoreOperation = "insert" | "find" | "list" | "unlink";
+declare const OAuthAccountStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAccountStoreError";
+} & Readonly<A>;
+export declare class OAuthAccountStoreError extends OAuthAccountStoreError_base<{
+    readonly operation: OAuthAccountStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAccountStoreService {
+    readonly insert: (row: OAuthAccountRecord) => Effect.Effect<void, OAuthAccountStoreError>;
+    readonly findById: (id: OAuthAccountId) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
+    readonly findByProviderAccount: (input: OAuthAccountLookupInput) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
+    readonly listByUser: (input: OAuthAccountListByUserInput) => Effect.Effect<readonly OAuthAccountRecord[], OAuthAccountStoreError>;
+    readonly unlink: (input: OAuthAccountUnlinkInput) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
+}
+declare const OAuthAccountStore_base: Context.ServiceClass<OAuthAccountStore, "auth/OAuthAccountStore", OAuthAccountStoreService>;
+export declare class OAuthAccountStore extends OAuthAccountStore_base {
+}
+export declare namespace OAuthAccountStore {
+    const make: (service: OAuthAccountStoreService) => OAuthAccountStoreService;
+}
+export interface OAuthAccountLinkingResolveInput {
+    readonly identity: VerifiedOAuthIdentity;
+    readonly currentUserId?: UserId;
+    readonly matchedUserId?: UserId;
+}
+export type OAuthAccountLinkingResolution = {
+    readonly type: "sign-in";
+    readonly reason: "linked-account";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+} | {
+    readonly type: "link-existing-user";
+    readonly reason: "current-user" | "verified-email";
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+} | {
+    readonly type: "require-explicit-linking";
+    readonly reason: "matched-email" | "unverified-email" | "no-linked-account";
+    readonly identity: VerifiedOAuthIdentity;
+    readonly matchedUserId?: UserId;
+} | {
+    readonly type: "deny";
+    readonly reason: "provider-account-linked-to-different-user";
+    readonly identity: VerifiedOAuthIdentity;
+    readonly account: OAuthAccountRecord;
+    readonly currentUserId: UserId;
+};
+export type OAuthAccountLinkingOperation = "resolve";
+declare const OAuthAccountLinkingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAccountLinkingError";
+} & Readonly<A>;
+export declare class OAuthAccountLinkingError extends OAuthAccountLinkingError_base<{
+    readonly operation: OAuthAccountLinkingOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAccountLinkingService {
+    readonly resolve: (input: OAuthAccountLinkingResolveInput) => Effect.Effect<OAuthAccountLinkingResolution, OAuthAccountLinkingError>;
+}
+declare const OAuthAccountLinking_base: Context.ServiceClass<OAuthAccountLinking, "auth/OAuthAccountLinking", OAuthAccountLinkingService>;
+export declare class OAuthAccountLinking extends OAuthAccountLinking_base {
+}
+export declare namespace OAuthAccountLinking {
+    const make: (service: OAuthAccountLinkingService) => OAuthAccountLinkingService;
+}
+export interface OAuthAccountLinkingPolicyOptions {
+    readonly autoLinkVerifiedEmail?: boolean;
+}
+export interface OAuthAccountLinkingPolicyDependencies extends OAuthAccountLinkingPolicyOptions {
+    readonly accounts: OAuthAccountStoreService;
+}
+export interface OAuthAccountUnlinkingResolveInput {
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly stepUpSatisfied?: boolean;
+}
+export type OAuthAccountUnlinkingResolution = {
+    readonly type: "allow";
+    readonly reason: "owned-account";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+    readonly remainingAccounts: readonly OAuthAccountRecord[];
+} | {
+    readonly type: "requires-step-up";
+    readonly reason: "step-up-required";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+    readonly remainingAccounts: readonly OAuthAccountRecord[];
+} | {
+    readonly type: "deny-not-found";
+    readonly reason: "provider-account-not-found";
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+} | {
+    readonly type: "deny-not-owner";
+    readonly reason: "provider-account-linked-to-different-user";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+} | {
+    readonly type: "deny-last-account";
+    readonly reason: "last-linked-account";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+};
+export type OAuthAccountUnlinkingOperation = "resolve";
+declare const OAuthAccountUnlinkingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAccountUnlinkingError";
+} & Readonly<A>;
+export declare class OAuthAccountUnlinkingError extends OAuthAccountUnlinkingError_base<{
+    readonly operation: OAuthAccountUnlinkingOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAccountUnlinkingService {
+    readonly resolve: (input: OAuthAccountUnlinkingResolveInput) => Effect.Effect<OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingError>;
+}
+declare const OAuthAccountUnlinking_base: Context.ServiceClass<OAuthAccountUnlinking, "auth/OAuthAccountUnlinking", OAuthAccountUnlinkingService>;
+export declare class OAuthAccountUnlinking extends OAuthAccountUnlinking_base {
+}
+export declare namespace OAuthAccountUnlinking {
+    const make: (service: OAuthAccountUnlinkingService) => OAuthAccountUnlinkingService;
+}
+export interface OAuthAccountUnlinkingPolicyOptions {
+    readonly allowLastAccount?: boolean;
+    readonly requireStepUp?: boolean;
+}
+export interface OAuthAccountUnlinkingPolicyDependencies extends OAuthAccountUnlinkingPolicyOptions {
+    readonly accounts: OAuthAccountStoreService;
+}
+export type OAuthLinkConfirmationReason = "current-user" | "matched-email" | "unverified-email" | "no-linked-account" | "manual" | (string & {});
+export interface OAuthLinkConfirmationStartInput {
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason?: OAuthLinkConfirmationReason;
+    readonly ttl?: Duration.Duration;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface StartedOAuthLinkConfirmation {
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason: OAuthLinkConfirmationReason;
+    readonly secret: Redacted.Redacted<string>;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthLinkConfirmationInspectInput {
+    readonly challengeId: ChallengeId;
+    readonly secret?: Redacted.Redacted<string>;
+}
+export interface PendingOAuthLinkConfirmation {
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason: OAuthLinkConfirmationReason;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthLinkConfirmationConfirmInput {
+    readonly challengeId: ChallengeId;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly currentUserId?: UserId;
+    readonly expectedProviderId?: OAuthProviderId;
+    readonly expectedProviderAccountId?: string;
+}
+export interface ConfirmedOAuthLinkConfirmation {
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason: OAuthLinkConfirmationReason;
+    readonly existingAccount?: OAuthAccountRecord;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type OAuthLinkConfirmationOperation = "start" | "inspect" | "confirm";
+declare const OAuthLinkConfirmationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthLinkConfirmationError";
+} & Readonly<A>;
+export declare class OAuthLinkConfirmationError extends OAuthLinkConfirmationError_base<{
+    readonly operation: OAuthLinkConfirmationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthLinkConfirmationService {
+    readonly start: (input: OAuthLinkConfirmationStartInput) => Effect.Effect<StartedOAuthLinkConfirmation, OAuthLinkConfirmationError>;
+    readonly inspect: (input: OAuthLinkConfirmationInspectInput) => Effect.Effect<PendingOAuthLinkConfirmation, OAuthLinkConfirmationError>;
+    readonly confirm: (input: OAuthLinkConfirmationConfirmInput) => Effect.Effect<ConfirmedOAuthLinkConfirmation, OAuthLinkConfirmationError>;
+}
+declare const OAuthLinkConfirmation_base: Context.ServiceClass<OAuthLinkConfirmation, "auth/OAuthLinkConfirmation", OAuthLinkConfirmationService>;
+export declare class OAuthLinkConfirmation extends OAuthLinkConfirmation_base {
+}
+export declare namespace OAuthLinkConfirmation {
+    const make: (service: OAuthLinkConfirmationService) => OAuthLinkConfirmationService;
+}
+export interface OAuthLinkConfirmationDependencies {
+    readonly challenge: ChallengeService;
+    readonly accounts: OAuthAccountStoreService;
+    readonly crypto: CryptoService;
+    readonly secretBytes?: number;
+}
+export interface OAuthStateDependencies {
+    readonly crypto: CryptoService;
+    readonly challenge: ChallengeService;
+    readonly stateSecretBytes?: number;
+    readonly codeVerifierBytes?: number;
+    readonly nonceBytes?: number;
+}
+export declare const makeAppleSignInProvider: (input: AppleSignInProviderOptions) => OAuthProviderConfig;
+export declare const makeGithubOAuthProvider: (input: GithubOAuthProviderOptions) => OAuthProviderConfig;
+export declare const makeGoogleOidcProvider: (input: GoogleOidcProviderOptions) => OAuthProviderConfig;
+export declare const makeMicrosoftOidcProvider: (input: MicrosoftOidcProviderOptions) => OAuthProviderConfig;
+export declare const makeGenericOidcProvider: (input: GenericOidcProviderOptions) => OAuthProviderConfig;
+export declare const makeGoogleOidcProviderTokenRefreshInput: (input: GoogleOidcProviderTokenRefreshInput) => OAuthProviderTokenLifecycleRefreshInput;
+export declare const makeGoogleOidcProviderTokenRevokeInput: (input: GoogleOidcProviderTokenRevokeInput) => OAuthProviderTokenLifecycleRevokeInput;
+export declare const makeMicrosoftOidcProviderTokenRefreshInput: (input: MicrosoftOidcProviderTokenRefreshInput) => OAuthProviderTokenLifecycleRefreshInput;
+export declare const makeAppleSignInProviderTokenRefreshInput: (input: AppleSignInProviderTokenRefreshInput) => OAuthProviderTokenLifecycleRefreshInput;
+export declare const makeAppleSignInProviderTokenRevokeInput: (input: AppleSignInProviderTokenRevokeInput) => OAuthProviderTokenLifecycleRevokeInput;
+export declare const parseOAuthState: (state: OAuthStateToken | string) => Effect.Effect<{
+    readonly challengeId: ChallengeId;
+    readonly secret: Redacted.Redacted<string>;
+}, OAuthStateError>;
+export declare const githubOAuthVerifiedEmail: (emails: readonly GithubOAuthEmailRecord[]) => string | undefined;
+export declare const googleOidcHostedDomain: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const microsoftOidcTenantId: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const microsoftOidcObjectId: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const microsoftOidcAccountId: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const decodeAppleSignInAuthorizationUser: (value: unknown) => AppleSignInAuthorizationUser | undefined;
+export declare const appleSignInAuthorizationUserFullName: (user: AppleSignInAuthorizationUser | undefined) => string | undefined;
+export declare const appleSignInAuthorizationUserEmail: (user: AppleSignInAuthorizationUser | undefined) => Email | undefined;
+export declare const appleSignInIsPrivateEmail: (input: {
+    readonly claims?: Readonly<Record<string, unknown>>;
+    readonly email?: Email | string;
+}) => boolean | undefined;
+export declare const makeOAuthTokenRequest: (input: OAuthAuthorizationCodeTokenInput) => Effect.Effect<OAuthTokenRequest, OAuthTokenExchangeError>;
+export declare const makeOAuthRefreshTokenRequest: (input: OAuthRefreshTokenInput) => Effect.Effect<OAuthTokenRequest, OAuthTokenExchangeError>;
+export declare const makeOAuthTokenRevocationRequest: (input: OAuthTokenRevocationInput) => Effect.Effect<OAuthTokenRequest, OAuthTokenExchangeError>;
+export declare const makeOAuthUserInfoRequest: (input: OAuthUserInfoRequestInput) => Effect.Effect<OAuthUserInfoRequest, OAuthUserInfoError>;
+export declare const decodeOAuthUserInfoResponse: (value: unknown) => Effect.Effect<OAuthUserInfo, OAuthUserInfoError>;
+export declare const decodeOAuthTokenResponse: (value: unknown) => Effect.Effect<OAuthTokenResponse, OAuthTokenExchangeError>;
+export declare const makeOidcIdTokenVerifier: (dependencies: OidcIdTokenVerifierDependencies) => OidcIdTokenVerifierService;
+export declare const verifyOidcIdToken: (input: OidcIdTokenVerifyInput) => Effect.Effect<OidcIdTokenVerificationResult, OidcIdTokenVerifierError, OidcIdTokenVerifier>;
+export declare const decodeOAuthJwksDocument: (input: unknown) => Effect.Effect<JwksDocument, JwtError>;
+export declare const makeOAuthJwksJwtKeys: (dependencies: OAuthJwksJwtKeysDependencies) => JwtKeysService;
+export declare const normalizeOidcProfile: (input: OAuthProfileNormalizeInput) => Effect.Effect<OAuthProfile, OAuthProfileNormalizationError>;
+export declare const makeOidcOAuthProfileNormalizer: () => OAuthProfileNormalizerService;
+export declare const normalizeOAuthProfile: (input: OAuthProfileNormalizeInput) => Effect.Effect<OAuthProfile, OAuthProfileNormalizationError, OAuthProfileNormalizer>;
+export declare const verifiedOAuthIdentityFromProfile: (profile: OAuthProfile) => VerifiedOAuthIdentity;
+export declare const makeOAuthTokenExchange: (dependencies: OAuthTokenExchangeDependencies) => OAuthTokenExchangeService;
+export declare const makeOAuthProviderTokenLifecycle: (dependencies: OAuthProviderTokenLifecycleDependencies) => OAuthProviderTokenLifecycleService;
+export declare const OAuthProviderTokenLifecycleLive: (options: OAuthProviderTokenLifecycleLiveOptions) => Layer.Layer<OAuthProviderTokenLifecycle, never, OAuthProviderTokenVault>;
+export declare const storeOAuthProviderTokens: (input: OAuthProviderTokenLifecycleStoreInput) => Effect.Effect<OAuthProviderTokenLifecycleStoreResult, OAuthProviderTokenLifecycleError, OAuthProviderTokenLifecycle>;
+export declare const refreshOAuthProviderTokens: (input: OAuthProviderTokenLifecycleRefreshInput) => Effect.Effect<OAuthProviderTokenLifecycleRefreshResult, OAuthProviderTokenLifecycleError, OAuthProviderTokenLifecycle>;
+export declare const revokeOAuthProviderTokens: (input: OAuthProviderTokenLifecycleRevokeInput) => Effect.Effect<OAuthProviderTokenLifecycleRevokeResult, OAuthProviderTokenLifecycleError, OAuthProviderTokenLifecycle>;
+export declare const completeOAuthCallback: (input: OAuthCallbackInput) => Effect.Effect<OAuthCallbackResult, OAuthStateError | OAuthTokenExchangeError, OAuthState | OAuthTokenExchange>;
+export declare const makeOAuthAccountLinkingPolicy: (dependencies: OAuthAccountLinkingPolicyDependencies) => OAuthAccountLinkingService;
+export declare const resolveOAuthAccountLinking: (input: OAuthAccountLinkingResolveInput) => Effect.Effect<OAuthAccountLinkingResolution, OAuthAccountLinkingError, OAuthAccountLinking>;
+export declare const makeOAuthAccountUnlinkingPolicy: (dependencies: OAuthAccountUnlinkingPolicyDependencies) => OAuthAccountUnlinkingService;
+export declare const resolveOAuthAccountUnlinking: (input: OAuthAccountUnlinkingResolveInput) => Effect.Effect<OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingError, OAuthAccountUnlinking>;
+export declare const makeOAuthLinkConfirmation: (dependencies: OAuthLinkConfirmationDependencies) => OAuthLinkConfirmationService;
+export declare const startOAuthLinkConfirmation: (input: OAuthLinkConfirmationStartInput) => Effect.Effect<StartedOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const inspectOAuthLinkConfirmation: (input: OAuthLinkConfirmationInspectInput) => Effect.Effect<PendingOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const confirmOAuthLinkConfirmation: (input: OAuthLinkConfirmationConfirmInput) => Effect.Effect<ConfirmedOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const makeOAuthPkce: (input?: OAuthPkceInput) => Effect.Effect<OAuthPkce, OAuthStateError, Crypto>;
+export declare const makeOAuthState: (dependencies: OAuthStateDependencies) => OAuthStateService;
+export declare const OAuthStateLive: Layer.Layer<OAuthState, never, Crypto | Challenge>;
+export declare const makeOAuthProviders: (providers: readonly OAuthProviderConfig[]) => OAuthProvidersService;
+export declare const OAuthProvidersLive: (providers: readonly OAuthProviderConfig[]) => Layer.Layer<OAuthProviders, never, never>;
+export declare const OidcIdTokenVerifierLive: Layer.Layer<OidcIdTokenVerifier, never, JwtVerifier>;
+export declare const OAuthOidcProfileNormalizerLive: Layer.Layer<OAuthProfileNormalizer, never, never>;
+export declare const OAuthAccountLinkingLive: Layer.Layer<OAuthAccountLinking, never, OAuthAccountStore>;
+export declare const OAuthAccountUnlinkingLive: Layer.Layer<OAuthAccountUnlinking, never, OAuthAccountStore>;
+export declare const OAuthLinkConfirmationLive: Layer.Layer<OAuthLinkConfirmation, never, Crypto | Challenge | OAuthAccountStore>;
+export declare const makeOAuthProviderTokenVaultMemory: () => OAuthProviderTokenVaultService;
+export declare const OAuthProviderTokenVaultMemoryLive: Layer.Layer<OAuthProviderTokenVault, never, never>;
+export declare const makeOAuthAccountStoreMemory: () => OAuthAccountStoreService;
+export declare const OAuthAccountStoreMemoryLive: Layer.Layer<OAuthAccountStore, never, never>;
+export {};
+//# sourceMappingURL=OAuth.d.ts.map