@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/OAuth.d.ts

@@ -0,0 +1,1890 @@
+import { Brand, Context, Duration, Effect, Layer, Redacted } from "effect";
+import type * as OptionTypes from "effect/Option";
+import { Challenge } from "./Challenge.js";
+import type { ChallengeService } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoService } from "./Crypto.js";
+import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId } from "./Identifiers.js";
+import { JwtError, JwtVerifier, type JwksDocument, type JwtAudience, type JwtAlgorithm, type JwtClaims, type JwtHeader, type JwtKeyInfo, type JwtKeysService, type JwtVerifierService, type JwtVerificationFailureReason } from "./Jwt.js";
+export type OAuthStateToken = Brand.Branded<string, "auth/OAuthStateToken">;
+export declare const OAuthStateToken: Brand.Constructor<OAuthStateToken>;
+export type OAuthCodeVerifier = Brand.Branded<string, "auth/OAuthCodeVerifier">;
+export declare const OAuthCodeVerifier: Brand.Constructor<OAuthCodeVerifier>;
+export type OAuthCodeChallenge = Brand.Branded<string, "auth/OAuthCodeChallenge">;
+export declare const OAuthCodeChallenge: Brand.Constructor<OAuthCodeChallenge>;
+export type OAuthNonce = Brand.Branded<string, "auth/OAuthNonce">;
+export declare const OAuthNonce: Brand.Constructor<OAuthNonce>;
+export type OAuthAuthorizationCode = Brand.Branded<string, "auth/OAuthAuthorizationCode">;
+export declare const OAuthAuthorizationCode: Brand.Constructor<OAuthAuthorizationCode>;
+export type OAuthAccessToken = Brand.Branded<string, "auth/OAuthAccessToken">;
+export declare const OAuthAccessToken: Brand.Constructor<OAuthAccessToken>;
+export type OAuthRefreshToken = Brand.Branded<string, "auth/OAuthRefreshToken">;
+export declare const OAuthRefreshToken: Brand.Constructor<OAuthRefreshToken>;
+export type OAuthIdToken = Brand.Branded<string, "auth/OAuthIdToken">;
+export declare const OAuthIdToken: Brand.Constructor<OAuthIdToken>;
+export declare const defaultOAuthStateTtl: Duration.Duration;
+export declare const defaultOAuthLinkConfirmationTtl: Duration.Duration;
+export declare const defaultOAuthJwksCacheTtl: Duration.Duration;
+export declare const defaultOAuthStateSecretBytes = 32;
+export declare const defaultOAuthCodeVerifierBytes = 32;
+export declare const defaultOAuthAuthorizationCodeBytes = 32;
+export declare const defaultOAuthAuthorizationCodeTtl: Duration.Duration;
+export declare const defaultOAuthLinkConfirmationSecretBytes = 32;
+export declare const defaultOAuthNonceBytes = 16;
+export declare const defaultOAuthProviderModeAccessTokenBytes = 32;
+export declare const defaultOAuthProviderModeRefreshTokenBytes = 32;
+export declare const defaultOAuthProviderModeAccessTokenTtl: Duration.Duration;
+export declare const defaultOAuthProviderModeRefreshTokenTtl: Duration.Duration;
+export declare const appleSignInProviderId: OAuthProviderId;
+export declare const appleSignInIssuer = "https://appleid.apple.com";
+export declare const appleSignInAuthorizationEndpoint = "https://appleid.apple.com/auth/authorize";
+export declare const appleSignInTokenEndpoint = "https://appleid.apple.com/auth/token";
+export declare const appleSignInRevocationEndpoint = "https://appleid.apple.com/auth/revoke";
+export declare const appleSignInJwksUri = "https://appleid.apple.com/auth/keys";
+export declare const appleSignInPrivateRelayDomain = "privaterelay.appleid.com";
+export declare const appleSignInDefaultScopes: readonly ["openid", "email", "name"];
+export declare const appleSignInDefaultAuthorizationParams: {
+    readonly response_mode: "form_post";
+};
+export declare const githubOAuthProviderId: OAuthProviderId;
+export declare const githubOAuthAuthorizationEndpoint = "https://github.com/login/oauth/authorize";
+export declare const githubOAuthTokenEndpoint = "https://github.com/login/oauth/access_token";
+export declare const githubOAuthUserEndpoint = "https://api.github.com/user";
+export declare const githubOAuthEmailsEndpoint = "https://api.github.com/user/emails";
+export declare const githubOAuthDefaultScopes: readonly ["read:user", "user:email"];
+export declare const githubOAuthApiVersion = "2022-11-28";
+export declare const githubOAuthApiVersionHeader: {
+    readonly "x-github-api-version": "2022-11-28";
+};
+export declare const googleOidcProviderId: OAuthProviderId;
+export declare const googleOidcIssuer = "https://accounts.google.com";
+export declare const googleOidcAuthorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+export declare const googleOidcTokenEndpoint = "https://oauth2.googleapis.com/token";
+export declare const googleOidcRevocationEndpoint = "https://oauth2.googleapis.com/revoke";
+export declare const googleOidcUserInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+export declare const googleOidcJwksUri = "https://www.googleapis.com/oauth2/v3/certs";
+export declare const googleOidcDefaultScopes: readonly ["openid", "email", "profile"];
+export declare const googleOidcOfflineAccessAuthorizationParams: {
+    readonly access_type: "offline";
+    readonly prompt: "consent";
+};
+export declare const microsoftOidcProviderId: OAuthProviderId;
+export declare const microsoftOidcLoginBaseUrl = "https://login.microsoftonline.com";
+export declare const microsoftOidcUserInfoEndpoint = "https://graph.microsoft.com/oidc/userinfo";
+export declare const microsoftOidcDefaultScopes: readonly ["openid", "email", "profile"];
+export declare const microsoftOidcOfflineAccessScopes: readonly ["openid", "email", "profile", "offline_access"];
+export declare const genericOidcDefaultScopes: readonly ["openid", "email", "profile"];
+export declare const microsoftOidcAuthorizationEndpoint: (tenant: string) => string;
+export declare const microsoftOidcTokenEndpoint: (tenant: string) => string;
+export declare const microsoftOidcJwksUri: (tenant: string) => string;
+export declare const microsoftOidcIssuer: (tenant: string) => string;
+export interface GoogleOidcProviderOptions {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface GithubOAuthProviderOptions {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface MicrosoftOidcProviderOptions {
+    readonly tenant: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface AppleSignInProviderOptions {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly id?: OAuthProviderId;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface GenericOidcProviderOptions {
+    readonly id: OAuthProviderId;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly redirectUri: string;
+    readonly userInfoEndpoint?: string;
+    readonly jwksUri?: string;
+    readonly revocationEndpoint?: string;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface AppleSignInAuthorizationUser {
+    readonly email?: string;
+    readonly name?: {
+        readonly firstName?: string;
+        readonly lastName?: string;
+    };
+}
+export interface GithubOAuthEmailRecord {
+    readonly email: string;
+    readonly primary?: boolean;
+    readonly verified?: boolean;
+    readonly visibility?: string | null;
+}
+export interface OAuthProviderConfig {
+    readonly id: OAuthProviderId;
+    readonly clientId: string;
+    readonly authorizationEndpoint: string;
+    readonly redirectUri: string;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly issuer?: string;
+    readonly tokenEndpoint?: string;
+    readonly revocationEndpoint?: string;
+    readonly userInfoEndpoint?: string;
+    readonly jwksUri?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthJwksFetchInput {
+    readonly provider: OAuthProviderConfig;
+    readonly url: string;
+}
+export interface OAuthJwksJwtKeysDependencies {
+    readonly provider: OAuthProviderConfig;
+    readonly fetch: (input: OAuthJwksFetchInput) => Effect.Effect<unknown, JwtError>;
+    readonly cacheTtl?: Duration.Duration;
+    readonly allowedAlgorithms?: readonly JwtAlgorithm[];
+}
+export type OAuthProviderOperation = "get";
+declare const OAuthProviderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderError";
+} & Readonly<A>;
+export declare class OAuthProviderError extends OAuthProviderError_base<{
+    readonly operation: OAuthProviderOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProvidersService {
+    readonly get: (id: OAuthProviderId) => Effect.Effect<OptionTypes.Option<OAuthProviderConfig>, OAuthProviderError>;
+}
+export type OAuthClientType = "public" | "confidential";
+export type OAuthClientStatus = "active" | "disabled";
+export type OAuthClientGrantType = "authorization_code" | "refresh_token" | "client_credentials";
+export type OAuthClientResponseType = "code";
+export type OAuthClientSecretAuthenticationMethod = "client_secret_basic" | "client_secret_post";
+export type OAuthClientSecretPrefix = Brand.Branded<string, "auth/OAuthClientSecretPrefix">;
+export declare const OAuthClientSecretPrefix: Brand.Constructor<OAuthClientSecretPrefix>;
+export type OAuthClientSecret = Brand.Branded<string, "auth/OAuthClientSecret">;
+export declare const OAuthClientSecret: Brand.Constructor<OAuthClientSecret>;
+export type OAuthClientSecretHash = Brand.Branded<string, "auth/OAuthClientSecretHash">;
+export declare const OAuthClientSecretHash: Brand.Constructor<OAuthClientSecretHash>;
+export declare const defaultOAuthClientSecretPrefixBytes = 8;
+export declare const defaultOAuthClientSecretBytes = 32;
+export interface OAuthClientRecord {
+    readonly id: OAuthClientId;
+    readonly type: OAuthClientType;
+    readonly status: OAuthClientStatus;
+    readonly name?: string;
+    readonly redirectUris: readonly string[];
+    readonly allowedGrantTypes: readonly OAuthClientGrantType[];
+    readonly allowedResponseTypes: readonly OAuthClientResponseType[];
+    readonly allowedScopes?: readonly string[];
+    readonly createdAt?: UnixMillis;
+    readonly updatedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthClientLookupInput {
+    readonly clientId: OAuthClientId;
+}
+export interface OAuthClientRedirectUriValidationInput extends OAuthClientLookupInput {
+    readonly redirectUri: string;
+    readonly responseType?: OAuthClientResponseType;
+    readonly grantType?: OAuthClientGrantType;
+}
+export type OAuthClientRedirectUriValidationFailureReason = "unknown_client" | "disabled_client" | "unsupported_response_type" | "unsupported_grant_type" | "redirect_uri_mismatch";
+export type OAuthClientRedirectUriValidationResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthClientRedirectUriValidationFailureReason;
+};
+export type OAuthClientRegistryOperation = "find" | "validate-redirect-uri";
+declare const OAuthClientRegistryError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientRegistryError";
+} & Readonly<A>;
+export declare class OAuthClientRegistryError extends OAuthClientRegistryError_base<{
+    readonly operation: OAuthClientRegistryOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientRegistryService {
+    readonly find: (input: OAuthClientLookupInput) => Effect.Effect<OptionTypes.Option<OAuthClientRecord>, OAuthClientRegistryError>;
+    readonly validateRedirectUri: (input: OAuthClientRedirectUriValidationInput) => Effect.Effect<OAuthClientRedirectUriValidationResult, OAuthClientRegistryError>;
+}
+declare const OAuthClientRegistry_base: Context.ServiceClass<OAuthClientRegistry, "auth/OAuthClientRegistry", OAuthClientRegistryService>;
+export declare class OAuthClientRegistry extends OAuthClientRegistry_base {
+}
+export declare namespace OAuthClientRegistry {
+    const make: (service: OAuthClientRegistryService) => OAuthClientRegistryService;
+}
+export interface OAuthClientStoreListInput {
+    readonly includeDisabled?: boolean;
+}
+export type OAuthClientStoreOperation = "upsert" | "find" | "list" | "validate-redirect-uri";
+declare const OAuthClientStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientStoreError";
+} & Readonly<A>;
+export declare class OAuthClientStoreError extends OAuthClientStoreError_base<{
+    readonly operation: OAuthClientStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientStoreService {
+    readonly upsert: (record: OAuthClientRecord) => Effect.Effect<void, OAuthClientStoreError>;
+    readonly find: (input: OAuthClientLookupInput) => Effect.Effect<OptionTypes.Option<OAuthClientRecord>, OAuthClientStoreError>;
+    readonly list: (input?: OAuthClientStoreListInput) => Effect.Effect<readonly OAuthClientRecord[], OAuthClientStoreError>;
+    readonly validateRedirectUri: (input: OAuthClientRedirectUriValidationInput) => Effect.Effect<OAuthClientRedirectUriValidationResult, OAuthClientStoreError>;
+}
+declare const OAuthClientStore_base: Context.ServiceClass<OAuthClientStore, "auth/OAuthClientStore", OAuthClientStoreService>;
+export declare class OAuthClientStore extends OAuthClientStore_base {
+}
+export declare namespace OAuthClientStore {
+    const make: (service: OAuthClientStoreService) => OAuthClientStoreService;
+}
+export interface OAuthConsentRecord {
+    readonly userId: UserId;
+    readonly clientId: OAuthClientId;
+    readonly scopes: readonly string[];
+    readonly grantedAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthConsentFindActiveInput {
+    readonly userId: UserId;
+    readonly clientId: OAuthClientId;
+    readonly scopes?: readonly string[];
+    readonly now: UnixMillis;
+}
+export interface OAuthConsentListForUserInput {
+    readonly userId: UserId;
+    readonly now: UnixMillis;
+    readonly includeInactive?: boolean;
+}
+export interface OAuthConsentRevokeInput {
+    readonly userId: UserId;
+    readonly clientId: OAuthClientId;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export interface OAuthConsentStoreDeleteInactiveCutoffs {
+    readonly beforeExpiresAt?: UnixMillis;
+    readonly beforeRevokedAt?: UnixMillis;
+}
+export type OAuthConsentStoreDeleteInactiveInput = (OAuthConsentStoreDeleteInactiveCutoffs & {
+    readonly beforeExpiresAt: UnixMillis;
+}) | (OAuthConsentStoreDeleteInactiveCutoffs & {
+    readonly beforeRevokedAt: UnixMillis;
+});
+export type OAuthConsentStoreOperation = "upsert" | "find-active" | "list-for-user" | "revoke" | "deleteInactive";
+declare const OAuthConsentStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthConsentStoreError";
+} & Readonly<A>;
+export declare class OAuthConsentStoreError extends OAuthConsentStoreError_base<{
+    readonly operation: OAuthConsentStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthConsentStoreService {
+    readonly upsert: (record: OAuthConsentRecord) => Effect.Effect<void, OAuthConsentStoreError>;
+    readonly findActive: (input: OAuthConsentFindActiveInput) => Effect.Effect<OptionTypes.Option<OAuthConsentRecord>, OAuthConsentStoreError>;
+    readonly listForUser: (input: OAuthConsentListForUserInput) => Effect.Effect<readonly OAuthConsentRecord[], OAuthConsentStoreError>;
+    readonly revoke: (input: OAuthConsentRevokeInput) => Effect.Effect<OptionTypes.Option<OAuthConsentRecord>, OAuthConsentStoreError>;
+    readonly deleteInactive: (input: OAuthConsentStoreDeleteInactiveInput) => Effect.Effect<number, OAuthConsentStoreError>;
+}
+declare const OAuthConsentStore_base: Context.ServiceClass<OAuthConsentStore, "auth/OAuthConsentStore", OAuthConsentStoreService>;
+export declare class OAuthConsentStore extends OAuthConsentStore_base {
+}
+export declare namespace OAuthConsentStore {
+    const make: (service: OAuthConsentStoreService) => OAuthConsentStoreService;
+}
+export type OAuthClientSecretOperation = "generate" | "parse" | "hash" | "verify";
+declare const OAuthClientSecretError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientSecretError";
+} & Readonly<A>;
+export declare class OAuthClientSecretError extends OAuthClientSecretError_base<{
+    readonly operation: OAuthClientSecretOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientSecretGenerateInput {
+    readonly prefixBytes?: number;
+    readonly secretBytes?: number;
+}
+export interface GeneratedOAuthClientSecret {
+    readonly prefix: OAuthClientSecretPrefix;
+    readonly secret: Redacted.Redacted<OAuthClientSecret>;
+}
+export interface OAuthClientSecretHashInput {
+    readonly secret: Redacted.Redacted<string>;
+}
+export interface OAuthClientSecretVerifyInput extends OAuthClientSecretHashInput {
+    readonly hash: OAuthClientSecretHash;
+}
+export interface OAuthClientSecretsService {
+    readonly generate: (input?: OAuthClientSecretGenerateInput) => Effect.Effect<GeneratedOAuthClientSecret, OAuthClientSecretError>;
+    readonly parse: (secret: Redacted.Redacted<string>) => Effect.Effect<OAuthClientSecretPrefix, OAuthClientSecretError>;
+    readonly hash: (input: OAuthClientSecretHashInput) => Effect.Effect<OAuthClientSecretHash, OAuthClientSecretError>;
+    readonly verify: (input: OAuthClientSecretVerifyInput) => Effect.Effect<boolean, OAuthClientSecretError>;
+}
+declare const OAuthClientSecrets_base: Context.ServiceClass<OAuthClientSecrets, "auth/OAuthClientSecrets", OAuthClientSecretsService>;
+export declare class OAuthClientSecrets extends OAuthClientSecrets_base {
+}
+export declare namespace OAuthClientSecrets {
+    const make: (service: OAuthClientSecretsService) => OAuthClientSecretsService;
+}
+export interface OAuthClientSecretsDependencies {
+    readonly crypto: CryptoService;
+}
+export interface OAuthClientSecretRecord {
+    readonly clientId: OAuthClientId;
+    readonly prefix: OAuthClientSecretPrefix;
+    readonly secretHash: OAuthClientSecretHash;
+    readonly authenticationMethods: readonly OAuthClientSecretAuthenticationMethod[];
+    readonly createdAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly lastUsedAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthClientSecretStoreLookupInput {
+    readonly clientId: OAuthClientId;
+    readonly prefix: OAuthClientSecretPrefix;
+}
+export interface OAuthClientSecretStoreMarkUsedInput extends OAuthClientSecretStoreLookupInput {
+    readonly lastUsedAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthClientSecretStoreRevokeInput extends OAuthClientSecretStoreLookupInput {
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export type OAuthClientSecretStoreOperation = "upsert" | "find" | "mark-used" | "revoke";
+declare const OAuthClientSecretStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientSecretStoreError";
+} & Readonly<A>;
+export declare class OAuthClientSecretStoreError extends OAuthClientSecretStoreError_base<{
+    readonly operation: OAuthClientSecretStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientSecretStoreService {
+    readonly upsert: (record: OAuthClientSecretRecord) => Effect.Effect<void, OAuthClientSecretStoreError>;
+    readonly findByClientIdAndPrefix: (input: OAuthClientSecretStoreLookupInput) => Effect.Effect<OptionTypes.Option<OAuthClientSecretRecord>, OAuthClientSecretStoreError>;
+    readonly markUsed: (input: OAuthClientSecretStoreMarkUsedInput) => Effect.Effect<OptionTypes.Option<OAuthClientSecretRecord>, OAuthClientSecretStoreError>;
+    readonly revoke: (input: OAuthClientSecretStoreRevokeInput) => Effect.Effect<OptionTypes.Option<OAuthClientSecretRecord>, OAuthClientSecretStoreError>;
+}
+declare const OAuthClientSecretStore_base: Context.ServiceClass<OAuthClientSecretStore, "auth/OAuthClientSecretStore", OAuthClientSecretStoreService>;
+export declare class OAuthClientSecretStore extends OAuthClientSecretStore_base {
+}
+export declare namespace OAuthClientSecretStore {
+    const make: (service: OAuthClientSecretStoreService) => OAuthClientSecretStoreService;
+}
+export interface OAuthClientSecretAuthenticateClientInput {
+    readonly clientId: OAuthClientId;
+    readonly method: OAuthClientSecretAuthenticationMethod;
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type OAuthClientSecretVerificationOperation = "authenticate-client";
+declare const OAuthClientSecretVerificationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientSecretVerificationError";
+} & Readonly<A>;
+export declare class OAuthClientSecretVerificationError extends OAuthClientSecretVerificationError_base<{
+    readonly operation: OAuthClientSecretVerificationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientSecretVerificationService {
+    readonly authenticateClient: (input: OAuthClientSecretAuthenticateClientInput) => Effect.Effect<boolean, OAuthClientSecretVerificationError>;
+}
+declare const OAuthClientSecretVerification_base: Context.ServiceClass<OAuthClientSecretVerification, "auth/OAuthClientSecretVerification", OAuthClientSecretVerificationService>;
+export declare class OAuthClientSecretVerification extends OAuthClientSecretVerification_base {
+}
+export declare namespace OAuthClientSecretVerification {
+    const make: (service: OAuthClientSecretVerificationService) => OAuthClientSecretVerificationService;
+}
+export interface OAuthClientSecretVerificationDependencies {
+    readonly clientSecrets: OAuthClientSecretsService;
+    readonly secretStore: OAuthClientSecretStoreService;
+}
+export interface OAuthAuthorizationCodeRecord {
+    readonly codeHash: string;
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly codeChallengeMethod?: "S256";
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly consumedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthIssuedAuthorizationCode {
+    readonly code: Redacted.Redacted<OAuthAuthorizationCode>;
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly codeChallengeMethod?: "S256";
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthConsumedAuthorizationCode {
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly codeChallengeMethod?: "S256";
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly consumedAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthAuthorizationCodeIssueInput {
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes?: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge | string;
+    readonly codeChallengeMethod?: "S256";
+    readonly code?: Redacted.Redacted<OAuthAuthorizationCode | string>;
+    readonly issuedAt?: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly expiresIn?: Duration.Duration;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthAuthorizationCodeConsumeInput {
+    readonly code: Redacted.Redacted<OAuthAuthorizationCode | string>;
+    readonly clientId: OAuthClientId;
+    readonly redirectUri: string;
+    readonly codeVerifier?: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly now?: UnixMillis;
+}
+export type OAuthAuthorizationCodeConsumeFailureReason = "unknown_code" | "already_consumed" | "expired" | "client_mismatch" | "redirect_uri_mismatch" | "pkce_required" | "pkce_mismatch";
+export type OAuthAuthorizationCodeConsumeResult = {
+    readonly valid: true;
+    readonly code: OAuthConsumedAuthorizationCode;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthAuthorizationCodeConsumeFailureReason;
+};
+export interface OAuthAuthorizationCodeStoreLookupInput {
+    readonly codeHash: string;
+}
+export interface OAuthAuthorizationCodeStoreMarkConsumedInput extends OAuthAuthorizationCodeStoreLookupInput {
+    readonly consumedAt: UnixMillis;
+}
+export type OAuthAuthorizationCodeStoreMarkConsumedResult = {
+    readonly status: "missing";
+} | {
+    readonly status: "already_consumed";
+    readonly record: OAuthAuthorizationCodeRecord;
+} | {
+    readonly status: "consumed";
+    readonly record: OAuthAuthorizationCodeRecord;
+};
+export type OAuthAuthorizationCodeStoreOperation = "upsert" | "find" | "mark-consumed";
+declare const OAuthAuthorizationCodeStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeStoreError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeStoreError extends OAuthAuthorizationCodeStoreError_base<{
+    readonly operation: OAuthAuthorizationCodeStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeStoreService {
+    readonly upsert: (record: OAuthAuthorizationCodeRecord) => Effect.Effect<void, OAuthAuthorizationCodeStoreError>;
+    readonly findByHash: (input: OAuthAuthorizationCodeStoreLookupInput) => Effect.Effect<OptionTypes.Option<OAuthAuthorizationCodeRecord>, OAuthAuthorizationCodeStoreError>;
+    readonly markConsumed: (input: OAuthAuthorizationCodeStoreMarkConsumedInput) => Effect.Effect<OAuthAuthorizationCodeStoreMarkConsumedResult, OAuthAuthorizationCodeStoreError>;
+}
+declare const OAuthAuthorizationCodeStore_base: Context.ServiceClass<OAuthAuthorizationCodeStore, "auth/OAuthAuthorizationCodeStore", OAuthAuthorizationCodeStoreService>;
+export declare class OAuthAuthorizationCodeStore extends OAuthAuthorizationCodeStore_base {
+}
+export declare namespace OAuthAuthorizationCodeStore {
+    const make: (service: OAuthAuthorizationCodeStoreService) => OAuthAuthorizationCodeStoreService;
+}
+export type OAuthAuthorizationCodeGrantOperation = "issue" | "consume";
+declare const OAuthAuthorizationCodeGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeGrantError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeGrantError extends OAuthAuthorizationCodeGrantError_base<{
+    readonly operation: OAuthAuthorizationCodeGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeGrantService {
+    readonly issue: (input: OAuthAuthorizationCodeIssueInput) => Effect.Effect<OAuthIssuedAuthorizationCode, OAuthAuthorizationCodeGrantError>;
+    readonly consume: (input: OAuthAuthorizationCodeConsumeInput) => Effect.Effect<OAuthAuthorizationCodeConsumeResult, OAuthAuthorizationCodeGrantError>;
+}
+declare const OAuthAuthorizationCodeGrant_base: Context.ServiceClass<OAuthAuthorizationCodeGrant, "auth/OAuthAuthorizationCodeGrant", OAuthAuthorizationCodeGrantService>;
+export declare class OAuthAuthorizationCodeGrant extends OAuthAuthorizationCodeGrant_base {
+}
+export declare namespace OAuthAuthorizationCodeGrant {
+    const make: (service: OAuthAuthorizationCodeGrantService) => OAuthAuthorizationCodeGrantService;
+}
+export interface OAuthAuthorizationCodeTokenIssueInput {
+    readonly client: OAuthClientRecord;
+    readonly code: OAuthConsumedAuthorizationCode;
+    readonly now: UnixMillis;
+}
+export type OAuthAuthorizationCodeTokenIssuerOperation = "issue";
+declare const OAuthAuthorizationCodeTokenIssuerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeTokenIssuerError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeTokenIssuerError extends OAuthAuthorizationCodeTokenIssuerError_base<{
+    readonly operation: OAuthAuthorizationCodeTokenIssuerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeTokenIssuerService {
+    readonly issue: (input: OAuthAuthorizationCodeTokenIssueInput) => Effect.Effect<OAuthTokenResponse, OAuthAuthorizationCodeTokenIssuerError>;
+}
+declare const OAuthAuthorizationCodeTokenIssuer_base: Context.ServiceClass<OAuthAuthorizationCodeTokenIssuer, "auth/OAuthAuthorizationCodeTokenIssuer", OAuthAuthorizationCodeTokenIssuerService>;
+export declare class OAuthAuthorizationCodeTokenIssuer extends OAuthAuthorizationCodeTokenIssuer_base {
+}
+export declare namespace OAuthAuthorizationCodeTokenIssuer {
+    const make: (service: OAuthAuthorizationCodeTokenIssuerService) => OAuthAuthorizationCodeTokenIssuerService;
+}
+export interface OAuthAuthorizationCodeTokenGrantInput {
+    readonly grantType: string;
+    readonly code?: Redacted.Redacted<OAuthAuthorizationCode | string>;
+    readonly clientId?: OAuthClientId | string;
+    readonly redirectUri?: string;
+    readonly codeVerifier?: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthAuthorizationCodeTokenGrantFailureReason = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type";
+export type OAuthAuthorizationCodeTokenGrantResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly code: OAuthConsumedAuthorizationCode;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthAuthorizationCodeTokenGrantFailureReason;
+};
+export type OAuthAuthorizationCodeTokenGrantOperation = "exchange";
+declare const OAuthAuthorizationCodeTokenGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeTokenGrantError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeTokenGrantError extends OAuthAuthorizationCodeTokenGrantError_base<{
+    readonly operation: OAuthAuthorizationCodeTokenGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeTokenGrantService {
+    readonly exchange: (input: OAuthAuthorizationCodeTokenGrantInput) => Effect.Effect<OAuthAuthorizationCodeTokenGrantResult, OAuthAuthorizationCodeTokenGrantError>;
+}
+declare const OAuthAuthorizationCodeTokenGrant_base: Context.ServiceClass<OAuthAuthorizationCodeTokenGrant, "auth/OAuthAuthorizationCodeTokenGrant", OAuthAuthorizationCodeTokenGrantService>;
+export declare class OAuthAuthorizationCodeTokenGrant extends OAuthAuthorizationCodeTokenGrant_base {
+}
+export declare namespace OAuthAuthorizationCodeTokenGrant {
+    const make: (service: OAuthAuthorizationCodeTokenGrantService) => OAuthAuthorizationCodeTokenGrantService;
+}
+export interface OAuthRefreshTokenIssueInput {
+    readonly client: OAuthClientRecord;
+    readonly refreshToken: Redacted.Redacted<OAuthRefreshToken | string>;
+    readonly scopes?: readonly string[];
+    readonly now: UnixMillis;
+}
+export type OAuthRefreshTokenIssueFailureReason = "invalid_grant" | "invalid_scope";
+export type OAuthRefreshTokenIssueResult = {
+    readonly valid: true;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthRefreshTokenIssueFailureReason;
+};
+export type OAuthRefreshTokenIssuerOperation = "issue";
+declare const OAuthRefreshTokenIssuerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthRefreshTokenIssuerError";
+} & Readonly<A>;
+export declare class OAuthRefreshTokenIssuerError extends OAuthRefreshTokenIssuerError_base<{
+    readonly operation: OAuthRefreshTokenIssuerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthRefreshTokenIssuerService {
+    readonly issue: (input: OAuthRefreshTokenIssueInput) => Effect.Effect<OAuthRefreshTokenIssueResult, OAuthRefreshTokenIssuerError>;
+}
+declare const OAuthRefreshTokenIssuer_base: Context.ServiceClass<OAuthRefreshTokenIssuer, "auth/OAuthRefreshTokenIssuer", OAuthRefreshTokenIssuerService>;
+export declare class OAuthRefreshTokenIssuer extends OAuthRefreshTokenIssuer_base {
+}
+export declare namespace OAuthRefreshTokenIssuer {
+    const make: (service: OAuthRefreshTokenIssuerService) => OAuthRefreshTokenIssuerService;
+}
+export interface OAuthRefreshTokenGrantInput {
+    readonly grantType: string;
+    readonly refreshToken?: Redacted.Redacted<OAuthRefreshToken | string>;
+    readonly clientId?: OAuthClientId | string;
+    readonly scopes?: readonly string[] | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthRefreshTokenGrantFailureReason = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type" | "invalid_scope";
+export type OAuthRefreshTokenGrantResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthRefreshTokenGrantFailureReason;
+};
+export type OAuthRefreshTokenGrantOperation = "exchange";
+declare const OAuthRefreshTokenGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthRefreshTokenGrantError";
+} & Readonly<A>;
+export declare class OAuthRefreshTokenGrantError extends OAuthRefreshTokenGrantError_base<{
+    readonly operation: OAuthRefreshTokenGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthRefreshTokenGrantService {
+    readonly exchange: (input: OAuthRefreshTokenGrantInput) => Effect.Effect<OAuthRefreshTokenGrantResult, OAuthRefreshTokenGrantError>;
+}
+declare const OAuthRefreshTokenGrant_base: Context.ServiceClass<OAuthRefreshTokenGrant, "auth/OAuthRefreshTokenGrant", OAuthRefreshTokenGrantService>;
+export declare class OAuthRefreshTokenGrant extends OAuthRefreshTokenGrant_base {
+}
+export declare namespace OAuthRefreshTokenGrant {
+    const make: (service: OAuthRefreshTokenGrantService) => OAuthRefreshTokenGrantService;
+}
+export interface OAuthClientCredentialsTokenIssueInput {
+    readonly client: OAuthClientRecord;
+    readonly scopes?: readonly string[];
+    readonly now: UnixMillis;
+}
+export type OAuthClientCredentialsTokenIssueFailureReason = "invalid_scope";
+export type OAuthClientCredentialsTokenIssueResult = {
+    readonly valid: true;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthClientCredentialsTokenIssueFailureReason;
+};
+export type OAuthClientCredentialsTokenIssuerOperation = "issue";
+declare const OAuthClientCredentialsTokenIssuerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientCredentialsTokenIssuerError";
+} & Readonly<A>;
+export declare class OAuthClientCredentialsTokenIssuerError extends OAuthClientCredentialsTokenIssuerError_base<{
+    readonly operation: OAuthClientCredentialsTokenIssuerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientCredentialsTokenIssuerService {
+    readonly issue: (input: OAuthClientCredentialsTokenIssueInput) => Effect.Effect<OAuthClientCredentialsTokenIssueResult, OAuthClientCredentialsTokenIssuerError>;
+}
+declare const OAuthClientCredentialsTokenIssuer_base: Context.ServiceClass<OAuthClientCredentialsTokenIssuer, "auth/OAuthClientCredentialsTokenIssuer", OAuthClientCredentialsTokenIssuerService>;
+export declare class OAuthClientCredentialsTokenIssuer extends OAuthClientCredentialsTokenIssuer_base {
+}
+export declare namespace OAuthClientCredentialsTokenIssuer {
+    const make: (service: OAuthClientCredentialsTokenIssuerService) => OAuthClientCredentialsTokenIssuerService;
+}
+export interface OAuthClientCredentialsGrantInput {
+    readonly grantType: string;
+    readonly clientId?: OAuthClientId | string;
+    readonly scopes?: readonly string[] | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthClientCredentialsGrantFailureReason = "invalid_request" | "invalid_client" | "unauthorized_client" | "unsupported_grant_type" | "invalid_scope";
+export type OAuthClientCredentialsGrantResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthClientCredentialsGrantFailureReason;
+};
+export type OAuthClientCredentialsGrantOperation = "exchange";
+declare const OAuthClientCredentialsGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientCredentialsGrantError";
+} & Readonly<A>;
+export declare class OAuthClientCredentialsGrantError extends OAuthClientCredentialsGrantError_base<{
+    readonly operation: OAuthClientCredentialsGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientCredentialsGrantService {
+    readonly exchange: (input: OAuthClientCredentialsGrantInput) => Effect.Effect<OAuthClientCredentialsGrantResult, OAuthClientCredentialsGrantError>;
+}
+declare const OAuthClientCredentialsGrant_base: Context.ServiceClass<OAuthClientCredentialsGrant, "auth/OAuthClientCredentialsGrant", OAuthClientCredentialsGrantService>;
+export declare class OAuthClientCredentialsGrant extends OAuthClientCredentialsGrant_base {
+}
+export declare namespace OAuthClientCredentialsGrant {
+    const make: (service: OAuthClientCredentialsGrantService) => OAuthClientCredentialsGrantService;
+}
+export interface OAuthTokenRevokeInput {
+    readonly client: OAuthClientRecord;
+    readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: OAuthTokenRevocationHint;
+    readonly now: UnixMillis;
+}
+export type OAuthTokenRevokerOperation = "revoke";
+declare const OAuthTokenRevokerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenRevokerError";
+} & Readonly<A>;
+export declare class OAuthTokenRevokerError extends OAuthTokenRevokerError_base<{
+    readonly operation: OAuthTokenRevokerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenRevokerService {
+    readonly revoke: (input: OAuthTokenRevokeInput) => Effect.Effect<void, OAuthTokenRevokerError>;
+}
+declare const OAuthTokenRevoker_base: Context.ServiceClass<OAuthTokenRevoker, "auth/OAuthTokenRevoker", OAuthTokenRevokerService>;
+export declare class OAuthTokenRevoker extends OAuthTokenRevoker_base {
+}
+export declare namespace OAuthTokenRevoker {
+    const make: (service: OAuthTokenRevokerService) => OAuthTokenRevokerService;
+}
+export interface OAuthTokenRevocationRequestInput {
+    readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: OAuthTokenRevocationHint | string;
+    readonly clientId?: OAuthClientId | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthTokenRevocationFailureReason = "invalid_request" | "invalid_client" | "unsupported_token_type";
+export type OAuthTokenRevocationResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthTokenRevocationFailureReason;
+};
+export type OAuthTokenRevocationOperation = "revoke";
+declare const OAuthTokenRevocationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenRevocationError";
+} & Readonly<A>;
+export declare class OAuthTokenRevocationError extends OAuthTokenRevocationError_base<{
+    readonly operation: OAuthTokenRevocationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenRevocationService {
+    readonly revoke: (input: OAuthTokenRevocationRequestInput) => Effect.Effect<OAuthTokenRevocationResult, OAuthTokenRevocationError>;
+}
+declare const OAuthTokenRevocation_base: Context.ServiceClass<OAuthTokenRevocation, "auth/OAuthTokenRevocation", OAuthTokenRevocationService>;
+export declare class OAuthTokenRevocation extends OAuthTokenRevocation_base {
+}
+export declare namespace OAuthTokenRevocation {
+    const make: (service: OAuthTokenRevocationService) => OAuthTokenRevocationService;
+}
+export interface OAuthTokenIntrospectInput {
+    readonly client: OAuthClientRecord;
+    readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: string;
+    readonly now: UnixMillis;
+}
+export type OAuthTokenIntrospectionResponse = {
+    readonly active: false;
+} | {
+    readonly active: true;
+    readonly scopes?: readonly string[];
+    readonly clientId?: OAuthClientId | string;
+    readonly username?: string;
+    readonly tokenType?: string;
+    readonly expiresAt?: UnixMillis;
+    readonly issuedAt?: UnixMillis;
+    readonly notBefore?: UnixMillis;
+    readonly subject?: string;
+    readonly audience?: string | readonly string[];
+    readonly issuer?: string;
+    readonly jwtId?: string;
+    readonly extra?: Readonly<Record<string, unknown>>;
+};
+export type OAuthTokenIntrospectorOperation = "introspect";
+declare const OAuthTokenIntrospectorError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenIntrospectorError";
+} & Readonly<A>;
+export declare class OAuthTokenIntrospectorError extends OAuthTokenIntrospectorError_base<{
+    readonly operation: OAuthTokenIntrospectorOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenIntrospectorService {
+    readonly introspect: (input: OAuthTokenIntrospectInput) => Effect.Effect<OAuthTokenIntrospectionResponse, OAuthTokenIntrospectorError>;
+}
+declare const OAuthTokenIntrospector_base: Context.ServiceClass<OAuthTokenIntrospector, "auth/OAuthTokenIntrospector", OAuthTokenIntrospectorService>;
+export declare class OAuthTokenIntrospector extends OAuthTokenIntrospector_base {
+}
+export declare namespace OAuthTokenIntrospector {
+    const make: (service: OAuthTokenIntrospectorService) => OAuthTokenIntrospectorService;
+}
+export interface OAuthTokenIntrospectionRequestInput {
+    readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: string;
+    readonly clientId?: OAuthClientId | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthTokenIntrospectionFailureReason = "invalid_request" | "invalid_client";
+export type OAuthTokenIntrospectionResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly introspection: OAuthTokenIntrospectionResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthTokenIntrospectionFailureReason;
+};
+export type OAuthTokenIntrospectionOperation = "introspect";
+declare const OAuthTokenIntrospectionError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenIntrospectionError";
+} & Readonly<A>;
+export declare class OAuthTokenIntrospectionError extends OAuthTokenIntrospectionError_base<{
+    readonly operation: OAuthTokenIntrospectionOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenIntrospectionService {
+    readonly introspect: (input: OAuthTokenIntrospectionRequestInput) => Effect.Effect<OAuthTokenIntrospectionResult, OAuthTokenIntrospectionError>;
+}
+declare const OAuthTokenIntrospection_base: Context.ServiceClass<OAuthTokenIntrospection, "auth/OAuthTokenIntrospection", OAuthTokenIntrospectionService>;
+export declare class OAuthTokenIntrospection extends OAuthTokenIntrospection_base {
+}
+export declare namespace OAuthTokenIntrospection {
+    const make: (service: OAuthTokenIntrospectionService) => OAuthTokenIntrospectionService;
+}
+export interface OAuthProviderAuthorizationInput {
+    readonly responseType: string;
+    readonly clientId?: OAuthClientId | string;
+    readonly redirectUri?: string;
+    readonly scopes?: readonly string[] | string;
+    readonly state?: string;
+    readonly codeChallenge?: OAuthCodeChallenge | string;
+    readonly codeChallengeMethod?: string;
+    readonly now?: UnixMillis;
+}
+export type OAuthProviderAuthorizationFailureReason = "invalid_request" | "unauthorized_client" | "access_denied" | "unsupported_response_type" | "invalid_scope" | "login_required" | "consent_required";
+export interface OAuthProviderAuthorizationPolicyInput {
+    readonly client: OAuthClientRecord;
+    readonly requestedScopes: readonly string[];
+    readonly state?: string;
+    readonly request: OAuthProviderAuthorizationInput;
+}
+export type OAuthProviderAuthorizationDecision = {
+    readonly type: "allow";
+    readonly subject: string;
+    readonly scopes?: readonly string[];
+    readonly metadata?: Readonly<Record<string, unknown>>;
+} | {
+    readonly type: "deny";
+    readonly reason: OAuthProviderAuthorizationFailureReason;
+    readonly errorDescription?: string;
+};
+export type OAuthProviderAuthorizationPolicyOperation = "decide";
+declare const OAuthProviderAuthorizationPolicyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderAuthorizationPolicyError";
+} & Readonly<A>;
+export declare class OAuthProviderAuthorizationPolicyError extends OAuthProviderAuthorizationPolicyError_base<{
+    readonly operation: OAuthProviderAuthorizationPolicyOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderAuthorizationPolicyService {
+    readonly decide: (input: OAuthProviderAuthorizationPolicyInput) => Effect.Effect<OAuthProviderAuthorizationDecision, OAuthProviderAuthorizationPolicyError>;
+}
+declare const OAuthProviderAuthorizationPolicy_base: Context.ServiceClass<OAuthProviderAuthorizationPolicy, "auth/OAuthProviderAuthorizationPolicy", OAuthProviderAuthorizationPolicyService>;
+export declare class OAuthProviderAuthorizationPolicy extends OAuthProviderAuthorizationPolicy_base {
+}
+export declare namespace OAuthProviderAuthorizationPolicy {
+    const make: (service: OAuthProviderAuthorizationPolicyService) => OAuthProviderAuthorizationPolicyService;
+}
+export type OAuthProviderAuthorizationResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly redirectUri: string;
+    readonly state?: string;
+    readonly code: OAuthIssuedAuthorizationCode;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthProviderAuthorizationFailureReason;
+    readonly redirectUri?: string;
+    readonly state?: string;
+    readonly client?: OAuthClientRecord;
+    readonly errorDescription?: string;
+};
+export type OAuthProviderAuthorizationOperation = "authorize";
+declare const OAuthProviderAuthorizationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderAuthorizationError";
+} & Readonly<A>;
+export declare class OAuthProviderAuthorizationError extends OAuthProviderAuthorizationError_base<{
+    readonly operation: OAuthProviderAuthorizationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderAuthorizationService {
+    readonly authorize: (input: OAuthProviderAuthorizationInput) => Effect.Effect<OAuthProviderAuthorizationResult, OAuthProviderAuthorizationError>;
+}
+declare const OAuthProviderAuthorization_base: Context.ServiceClass<OAuthProviderAuthorization, "auth/OAuthProviderAuthorization", OAuthProviderAuthorizationService>;
+export declare class OAuthProviderAuthorization extends OAuthProviderAuthorization_base {
+}
+export declare namespace OAuthProviderAuthorization {
+    const make: (service: OAuthProviderAuthorizationService) => OAuthProviderAuthorizationService;
+}
+export type OAuthClientAuthentication = {
+    readonly method: "none";
+} | {
+    readonly method: "client_secret_basic";
+    readonly clientSecret: Redacted.Redacted<string>;
+} | {
+    readonly method: "client_secret_post";
+    readonly clientSecret: Redacted.Redacted<string>;
+};
+export interface OAuthAuthorizationCodeTokenInput {
+    readonly provider: OAuthProviderConfig;
+    readonly code: OAuthAuthorizationCode | string;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly redirectUri?: string;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface OAuthRefreshTokenInput {
+    readonly provider: OAuthProviderConfig;
+    readonly refreshToken: Redacted.Redacted<OAuthRefreshToken | string>;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly scopes?: readonly string[];
+    readonly params?: Readonly<Record<string, string>>;
+}
+export type OAuthTokenRevocationHint = "access_token" | "refresh_token";
+export interface OAuthTokenRevocationInput {
+    readonly provider: OAuthProviderConfig;
+    readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: OAuthTokenRevocationHint;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface OAuthTokenRequest {
+    readonly url: string;
+    readonly method: "POST";
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: string;
+}
+export interface OAuthUserInfoRequestInput {
+    readonly provider: OAuthProviderConfig;
+    readonly accessToken: Redacted.Redacted<OAuthAccessToken | string>;
+    readonly params?: Readonly<Record<string, string>>;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface OAuthUserInfoRequest {
+    readonly url: string;
+    readonly method: "GET";
+    readonly headers: Readonly<Record<string, string>>;
+}
+export type OAuthUserInfo = Readonly<Record<string, unknown>>;
+export type OAuthUserInfoOperation = "request" | "decode";
+declare const OAuthUserInfoError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthUserInfoError";
+} & Readonly<A>;
+export declare class OAuthUserInfoError extends OAuthUserInfoError_base<{
+    readonly operation: OAuthUserInfoOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenResponse {
+    readonly accessToken: Redacted.Redacted<OAuthAccessToken>;
+    readonly tokenType: string;
+    readonly expiresIn?: number;
+    readonly refreshToken?: Redacted.Redacted<OAuthRefreshToken>;
+    readonly idToken?: Redacted.Redacted<OAuthIdToken>;
+    readonly scopes?: readonly string[];
+    readonly extra?: Readonly<Record<string, unknown>>;
+}
+export type OAuthProviderModeTokenType = "access_token" | "refresh_token";
+export interface OAuthProviderModeTokenRecord {
+    readonly tokenHash: string;
+    readonly tokenType: OAuthProviderModeTokenType;
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly scopes: readonly string[];
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly issuer?: string;
+    readonly audience?: string | readonly string[];
+    readonly jwtId?: string;
+    readonly revokedAt?: UnixMillis;
+    readonly revocationReason?: string;
+    readonly rotatedAt?: UnixMillis;
+    readonly replacedByTokenHash?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthProviderModeTokenStoreLookupInput {
+    readonly tokenHash: string;
+}
+export interface OAuthProviderModeTokenStoreRevokeInput extends OAuthProviderModeTokenStoreLookupInput {
+    readonly tokenTypeHint?: OAuthProviderModeTokenType;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export interface OAuthProviderModeTokenStoreRotateInput extends OAuthProviderModeTokenStoreLookupInput {
+    readonly replacedByTokenHash: string;
+    readonly rotatedAt: UnixMillis;
+}
+export interface OAuthProviderModeTokenStoreDeleteRetiredCutoffs {
+    readonly beforeExpiresAt?: UnixMillis;
+    readonly beforeRevokedAt?: UnixMillis;
+    readonly beforeRotatedAt?: UnixMillis;
+}
+export type OAuthProviderModeTokenStoreDeleteRetiredInput = (OAuthProviderModeTokenStoreDeleteRetiredCutoffs & {
+    readonly beforeExpiresAt: UnixMillis;
+}) | (OAuthProviderModeTokenStoreDeleteRetiredCutoffs & {
+    readonly beforeRevokedAt: UnixMillis;
+}) | (OAuthProviderModeTokenStoreDeleteRetiredCutoffs & {
+    readonly beforeRotatedAt: UnixMillis;
+});
+export type OAuthProviderModeTokenStoreOperation = "upsert" | "find" | "revoke" | "rotate" | "deleteRetired";
+declare const OAuthProviderModeTokenStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderModeTokenStoreError";
+} & Readonly<A>;
+export declare class OAuthProviderModeTokenStoreError extends OAuthProviderModeTokenStoreError_base<{
+    readonly operation: OAuthProviderModeTokenStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderModeTokenStoreService {
+    readonly upsert: (record: OAuthProviderModeTokenRecord) => Effect.Effect<void, OAuthProviderModeTokenStoreError>;
+    readonly findByHash: (input: OAuthProviderModeTokenStoreLookupInput) => Effect.Effect<OptionTypes.Option<OAuthProviderModeTokenRecord>, OAuthProviderModeTokenStoreError>;
+    readonly revokeByHash: (input: OAuthProviderModeTokenStoreRevokeInput) => Effect.Effect<OptionTypes.Option<OAuthProviderModeTokenRecord>, OAuthProviderModeTokenStoreError>;
+    readonly rotateRefreshToken: (input: OAuthProviderModeTokenStoreRotateInput) => Effect.Effect<OptionTypes.Option<OAuthProviderModeTokenRecord>, OAuthProviderModeTokenStoreError>;
+    readonly deleteRetired: (input: OAuthProviderModeTokenStoreDeleteRetiredInput) => Effect.Effect<number, OAuthProviderModeTokenStoreError>;
+}
+declare const OAuthProviderModeTokenStore_base: Context.ServiceClass<OAuthProviderModeTokenStore, "auth/OAuthProviderModeTokenStore", OAuthProviderModeTokenStoreService>;
+export declare class OAuthProviderModeTokenStore extends OAuthProviderModeTokenStore_base {
+}
+export declare namespace OAuthProviderModeTokenStore {
+    const make: (service: OAuthProviderModeTokenStoreService) => OAuthProviderModeTokenStoreService;
+}
+export interface OAuthProviderTokenVaultRecord {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly accessTokenCiphertext: Redacted.Redacted<string>;
+    readonly refreshTokenCiphertext?: Redacted.Redacted<string>;
+    readonly idTokenCiphertext?: Redacted.Redacted<string>;
+    readonly tokenType: string;
+    readonly scopes?: readonly string[];
+    readonly expiresAt?: UnixMillis;
+    readonly updatedAt: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly revocationReason?: string;
+}
+export interface OAuthProviderTokenVaultTokens {
+    readonly accessTokenCiphertext: Redacted.Redacted<string>;
+    readonly refreshTokenCiphertext?: Redacted.Redacted<string>;
+    readonly idTokenCiphertext?: Redacted.Redacted<string>;
+    readonly tokenType: string;
+    readonly scopes?: readonly string[];
+    readonly expiresAt?: UnixMillis;
+}
+export interface OAuthProviderTokenVaultLookupInput {
+    readonly accountId: OAuthAccountId;
+}
+export interface OAuthProviderTokenVaultMarkRevokedInput {
+    readonly accountId: OAuthAccountId;
+    readonly revokedAt: UnixMillis;
+    readonly reason: string;
+}
+export type OAuthProviderTokenVaultOperation = "upsert" | "refresh-token" | "tokens" | "mark-revoked";
+declare const OAuthProviderTokenVaultError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderTokenVaultError";
+} & Readonly<A>;
+export declare class OAuthProviderTokenVaultError extends OAuthProviderTokenVaultError_base<{
+    readonly operation: OAuthProviderTokenVaultOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderTokenVaultService {
+    readonly upsert: (record: OAuthProviderTokenVaultRecord) => Effect.Effect<void, OAuthProviderTokenVaultError>;
+    readonly refreshTokenForAccount: (input: OAuthProviderTokenVaultLookupInput) => Effect.Effect<OptionTypes.Option<Redacted.Redacted<string>>, OAuthProviderTokenVaultError>;
+    readonly tokensForAccount: (input: OAuthProviderTokenVaultLookupInput) => Effect.Effect<OptionTypes.Option<OAuthProviderTokenVaultTokens>, OAuthProviderTokenVaultError>;
+    readonly markRevoked: (input: OAuthProviderTokenVaultMarkRevokedInput) => Effect.Effect<OptionTypes.Option<OAuthProviderTokenVaultRecord>, OAuthProviderTokenVaultError>;
+}
+declare const OAuthProviderTokenVault_base: Context.ServiceClass<OAuthProviderTokenVault, "auth/OAuthProviderTokenVault", OAuthProviderTokenVaultService>;
+export declare class OAuthProviderTokenVault extends OAuthProviderTokenVault_base {
+}
+export declare namespace OAuthProviderTokenVault {
+    const make: (service: OAuthProviderTokenVaultService) => OAuthProviderTokenVaultService;
+}
+export interface OAuthProviderTokenLifecycleStoreInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly tokens: OAuthTokenResponse;
+    readonly fallbackRefreshTokenCiphertext?: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+}
+export interface OAuthProviderTokenLifecycleStoreResult {
+    readonly accountId: OAuthAccountId;
+    readonly expiresAt?: UnixMillis;
+    readonly hasRefreshToken: boolean;
+    readonly scopes: readonly string[];
+}
+export interface OAuthProviderTokenLifecycleRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export type OAuthProviderTokenLifecycleRefreshResult = {
+    readonly status: "missing-refresh-token";
+    readonly accountId: OAuthAccountId;
+} | ({
+    readonly status: "refreshed";
+} & OAuthProviderTokenLifecycleStoreResult);
+export interface OAuthProviderTokenLifecycleRevokeInput {
+    readonly accountId: OAuthAccountId;
+    readonly provider: OAuthProviderConfig;
+    readonly reason: string;
+    readonly now?: UnixMillis;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export type OAuthProviderTokenLifecycleRevokeResult = {
+    readonly status: "missing-tokens";
+    readonly accountId: OAuthAccountId;
+} | {
+    readonly status: "revoked";
+    readonly accountId: OAuthAccountId;
+    readonly revokedAt: UnixMillis;
+};
+export type OAuthProviderTokenLifecycleOperation = "store" | "refresh" | "revoke";
+declare const OAuthProviderTokenLifecycleError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderTokenLifecycleError";
+} & Readonly<A>;
+export declare class OAuthProviderTokenLifecycleError extends OAuthProviderTokenLifecycleError_base<{
+    readonly operation: OAuthProviderTokenLifecycleOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderTokenLifecycleService {
+    readonly store: (input: OAuthProviderTokenLifecycleStoreInput) => Effect.Effect<OAuthProviderTokenLifecycleStoreResult, OAuthProviderTokenLifecycleError>;
+    readonly refresh: (input: OAuthProviderTokenLifecycleRefreshInput) => Effect.Effect<OAuthProviderTokenLifecycleRefreshResult, OAuthProviderTokenLifecycleError>;
+    readonly revoke: (input: OAuthProviderTokenLifecycleRevokeInput) => Effect.Effect<OAuthProviderTokenLifecycleRevokeResult, OAuthProviderTokenLifecycleError>;
+}
+declare const OAuthProviderTokenLifecycle_base: Context.ServiceClass<OAuthProviderTokenLifecycle, "auth/OAuthProviderTokenLifecycle", OAuthProviderTokenLifecycleService>;
+export declare class OAuthProviderTokenLifecycle extends OAuthProviderTokenLifecycle_base {
+}
+export declare namespace OAuthProviderTokenLifecycle {
+    const make: (service: OAuthProviderTokenLifecycleService) => OAuthProviderTokenLifecycleService;
+}
+export interface OAuthProviderTokenLifecycleDependencies {
+    readonly tokenVault: OAuthProviderTokenVaultService;
+    readonly encryptToken: (token: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<string>, unknown>;
+    readonly decryptToken: (ciphertext: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<string>, unknown>;
+    readonly request: (request: OAuthTokenRequest) => Effect.Effect<unknown, unknown>;
+}
+export type OAuthProviderTokenLifecycleLiveOptions = Omit<OAuthProviderTokenLifecycleDependencies, "tokenVault">;
+export interface GoogleOidcProviderTokenRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly clientSecret?: Redacted.Redacted<string>;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface GoogleOidcProviderTokenRevokeInput {
+    readonly accountId: OAuthAccountId;
+    readonly provider: OAuthProviderConfig;
+    readonly reason: string;
+    readonly now?: UnixMillis;
+    readonly clientSecret?: Redacted.Redacted<string>;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface MicrosoftOidcProviderTokenRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly clientSecret?: Redacted.Redacted<string>;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface AppleSignInProviderTokenRefreshInput {
+    readonly accountId: OAuthAccountId;
+    readonly userId: UserId;
+    readonly providerAccountId: string;
+    readonly provider: OAuthProviderConfig;
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly scopes?: readonly string[];
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface AppleSignInProviderTokenRevokeInput {
+    readonly accountId: OAuthAccountId;
+    readonly provider: OAuthProviderConfig;
+    readonly reason: string;
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly params?: Readonly<Record<string, string>>;
+}
+export interface OidcIdTokenClaims extends JwtClaims {
+    readonly iss: string;
+    readonly sub: string;
+    readonly aud: JwtAudience;
+    readonly exp: number;
+    readonly iat: number;
+    readonly nonce?: string;
+    readonly azp?: string;
+    readonly email?: string;
+    readonly email_verified?: boolean;
+    readonly name?: string;
+    readonly preferred_username?: string;
+    readonly picture?: string;
+}
+export type OidcIdTokenVerificationFailureReason = JwtVerificationFailureReason | "missing_provider_issuer" | "missing_subject" | "missing_expiration" | "missing_issued_at" | "missing_authorized_party" | "authorized_party_mismatch" | "nonce_mismatch";
+export interface OidcIdTokenVerifyInput {
+    readonly provider: OAuthProviderConfig;
+    readonly idToken: Redacted.Redacted<OAuthIdToken | string>;
+    readonly nonce?: OAuthNonce | string;
+    readonly audience?: JwtAudience;
+    readonly authorizedParty?: string;
+    readonly now?: UnixMillis;
+    readonly clockTolerance?: Duration.Duration;
+}
+export type OidcIdTokenVerificationResult = {
+    readonly valid: true;
+    readonly header: JwtHeader;
+    readonly claims: OidcIdTokenClaims;
+    readonly key: JwtKeyInfo;
+} | {
+    readonly valid: false;
+    readonly reason: OidcIdTokenVerificationFailureReason;
+};
+export type OidcIdTokenVerifierOperation = "verify";
+declare const OidcIdTokenVerifierError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OidcIdTokenVerifierError";
+} & Readonly<A>;
+export declare class OidcIdTokenVerifierError extends OidcIdTokenVerifierError_base<{
+    readonly operation: OidcIdTokenVerifierOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OidcIdTokenVerifierService {
+    readonly verify: (input: OidcIdTokenVerifyInput) => Effect.Effect<OidcIdTokenVerificationResult, OidcIdTokenVerifierError>;
+}
+declare const OidcIdTokenVerifier_base: Context.ServiceClass<OidcIdTokenVerifier, "auth/OidcIdTokenVerifier", OidcIdTokenVerifierService>;
+export declare class OidcIdTokenVerifier extends OidcIdTokenVerifier_base {
+}
+export declare namespace OidcIdTokenVerifier {
+    const make: (service: OidcIdTokenVerifierService) => OidcIdTokenVerifierService;
+}
+export interface OidcIdTokenVerifierDependencies {
+    readonly jwtVerifier: JwtVerifierService;
+}
+export interface OAuthProfile {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly email?: Email;
+    readonly emailVerified?: boolean;
+    readonly name?: string;
+    readonly username?: string;
+    readonly avatarUrl?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthProfileNormalizeInput {
+    readonly provider: OAuthProviderConfig;
+    readonly claims?: OidcIdTokenClaims;
+    readonly userInfo?: unknown;
+    readonly profile?: unknown;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type OAuthProfileNormalizationFailureReason = "missing_claims" | "missing_subject" | "invalid_userinfo" | "subject_mismatch";
+export type OAuthProfileNormalizationOperation = "normalize";
+declare const OAuthProfileNormalizationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProfileNormalizationError";
+} & Readonly<A>;
+export declare class OAuthProfileNormalizationError extends OAuthProfileNormalizationError_base<{
+    readonly operation: OAuthProfileNormalizationOperation;
+    readonly reason: OAuthProfileNormalizationFailureReason;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProfileNormalizerService {
+    readonly normalize: (input: OAuthProfileNormalizeInput) => Effect.Effect<OAuthProfile, OAuthProfileNormalizationError>;
+}
+declare const OAuthProfileNormalizer_base: Context.ServiceClass<OAuthProfileNormalizer, "auth/OAuthProfileNormalizer", OAuthProfileNormalizerService>;
+export declare class OAuthProfileNormalizer extends OAuthProfileNormalizer_base {
+}
+export declare namespace OAuthProfileNormalizer {
+    const make: (service: OAuthProfileNormalizerService) => OAuthProfileNormalizerService;
+}
+export type OAuthTokenExchangeOperation = "token-request" | "refresh-token-request" | "revocation-request" | "decode-token-response" | "exchange-code";
+declare const OAuthTokenExchangeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenExchangeError";
+} & Readonly<A>;
+export declare class OAuthTokenExchangeError extends OAuthTokenExchangeError_base<{
+    readonly operation: OAuthTokenExchangeOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenExchangeService {
+    readonly exchangeAuthorizationCode: (input: OAuthAuthorizationCodeTokenInput) => Effect.Effect<OAuthTokenResponse, OAuthTokenExchangeError>;
+}
+declare const OAuthTokenExchange_base: Context.ServiceClass<OAuthTokenExchange, "auth/OAuthTokenExchange", OAuthTokenExchangeService>;
+export declare class OAuthTokenExchange extends OAuthTokenExchange_base {
+}
+export declare namespace OAuthTokenExchange {
+    const make: (service: OAuthTokenExchangeService) => OAuthTokenExchangeService;
+}
+export interface OAuthTokenExchangeDependencies {
+    readonly request: (request: OAuthTokenRequest) => Effect.Effect<unknown, OAuthTokenExchangeError>;
+}
+declare const OAuthProviders_base: Context.ServiceClass<OAuthProviders, "auth/OAuthProviders", OAuthProvidersService>;
+export declare class OAuthProviders extends OAuthProviders_base {
+}
+export declare namespace OAuthProviders {
+    const make: (service: OAuthProvidersService) => OAuthProvidersService;
+}
+export interface OAuthPkce {
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier>;
+    readonly codeChallenge: OAuthCodeChallenge;
+    readonly codeChallengeMethod: "S256";
+}
+export interface OAuthPkceInput {
+    readonly codeVerifier?: Redacted.Redacted<string>;
+    readonly verifierBytes?: number;
+}
+export interface OAuthAuthorizationStartInput {
+    readonly provider: OAuthProviderConfig;
+    readonly ttl?: Duration.Duration;
+    readonly redirectUri?: string;
+    readonly scopes?: readonly string[];
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+    readonly codeVerifier?: Redacted.Redacted<string>;
+    readonly includeNonce?: boolean;
+    readonly nonce?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface StartedOAuthAuthorization {
+    readonly providerId: OAuthProviderId;
+    readonly authorizationUrl: string;
+    readonly state: OAuthStateToken;
+    readonly challengeId: ChallengeId;
+    readonly expiresAt: UnixMillis;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier>;
+    readonly codeChallenge: OAuthCodeChallenge;
+    readonly codeChallengeMethod: "S256";
+    readonly nonce?: OAuthNonce;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+}
+export interface OAuthStateVerifyInput {
+    readonly state: OAuthStateToken | string;
+}
+export interface VerifiedOAuthState {
+    readonly challengeId: ChallengeId;
+    readonly providerId: OAuthProviderId;
+    readonly redirectUri?: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly nonce?: OAuthNonce;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthCallbackInput {
+    readonly provider: OAuthProviderConfig;
+    readonly state: OAuthStateToken | string;
+    readonly code: OAuthAuthorizationCode | string;
+    readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly redirectUri?: string;
+    readonly clientAuthentication?: OAuthClientAuthentication;
+    readonly tokenParams?: Readonly<Record<string, string>>;
+}
+export interface OAuthCallbackResult {
+    readonly state: VerifiedOAuthState;
+    readonly tokens: OAuthTokenResponse;
+}
+export type OAuthStateOperation = "start" | "verify" | "parse" | "pkce" | "authorization-url";
+declare const OAuthStateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthStateError";
+} & Readonly<A>;
+export declare class OAuthStateError extends OAuthStateError_base<{
+    readonly operation: OAuthStateOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthStateService {
+    readonly start: (input: OAuthAuthorizationStartInput) => Effect.Effect<StartedOAuthAuthorization, OAuthStateError>;
+    readonly verify: (input: OAuthStateVerifyInput) => Effect.Effect<VerifiedOAuthState, OAuthStateError>;
+}
+declare const OAuthState_base: Context.ServiceClass<OAuthState, "auth/OAuthState", OAuthStateService>;
+export declare class OAuthState extends OAuthState_base {
+}
+export declare namespace OAuthState {
+    const make: (service: OAuthStateService) => OAuthStateService;
+}
+export interface OAuthAccountRecord {
+    readonly id: OAuthAccountId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly userId: UserId;
+    readonly email?: Email;
+    readonly emailVerified?: boolean;
+    readonly createdAt: UnixMillis;
+    readonly updatedAt: UnixMillis;
+    readonly unlinkedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface VerifiedOAuthIdentity {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly email?: Email;
+    readonly emailVerified?: boolean;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthAccountLookupInput {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly includeUnlinked?: boolean;
+}
+export interface OAuthAccountListByUserInput {
+    readonly userId: UserId;
+    readonly includeUnlinked?: boolean;
+}
+export interface OAuthAccountUnlinkInput {
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly unlinkedAt: UnixMillis;
+    readonly reason?: string;
+}
+export type OAuthAccountStoreOperation = "insert" | "find" | "list" | "unlink";
+declare const OAuthAccountStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAccountStoreError";
+} & Readonly<A>;
+export declare class OAuthAccountStoreError extends OAuthAccountStoreError_base<{
+    readonly operation: OAuthAccountStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAccountStoreService {
+    readonly insert: (row: OAuthAccountRecord) => Effect.Effect<void, OAuthAccountStoreError>;
+    readonly findById: (id: OAuthAccountId) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
+    readonly findByProviderAccount: (input: OAuthAccountLookupInput) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
+    readonly listByUser: (input: OAuthAccountListByUserInput) => Effect.Effect<readonly OAuthAccountRecord[], OAuthAccountStoreError>;
+    readonly unlink: (input: OAuthAccountUnlinkInput) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
+}
+declare const OAuthAccountStore_base: Context.ServiceClass<OAuthAccountStore, "auth/OAuthAccountStore", OAuthAccountStoreService>;
+export declare class OAuthAccountStore extends OAuthAccountStore_base {
+}
+export declare namespace OAuthAccountStore {
+    const make: (service: OAuthAccountStoreService) => OAuthAccountStoreService;
+}
+export interface OAuthAccountLinkingResolveInput {
+    readonly identity: VerifiedOAuthIdentity;
+    readonly currentUserId?: UserId;
+    readonly matchedUserId?: UserId;
+}
+export type OAuthAccountLinkingResolution = {
+    readonly type: "sign-in";
+    readonly reason: "linked-account";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+} | {
+    readonly type: "link-existing-user";
+    readonly reason: "current-user" | "verified-email";
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+} | {
+    readonly type: "require-explicit-linking";
+    readonly reason: "matched-email" | "unverified-email" | "no-linked-account";
+    readonly identity: VerifiedOAuthIdentity;
+    readonly matchedUserId?: UserId;
+} | {
+    readonly type: "deny";
+    readonly reason: "provider-account-linked-to-different-user";
+    readonly identity: VerifiedOAuthIdentity;
+    readonly account: OAuthAccountRecord;
+    readonly currentUserId: UserId;
+};
+export type OAuthAccountLinkingOperation = "resolve";
+declare const OAuthAccountLinkingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAccountLinkingError";
+} & Readonly<A>;
+export declare class OAuthAccountLinkingError extends OAuthAccountLinkingError_base<{
+    readonly operation: OAuthAccountLinkingOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAccountLinkingService {
+    readonly resolve: (input: OAuthAccountLinkingResolveInput) => Effect.Effect<OAuthAccountLinkingResolution, OAuthAccountLinkingError>;
+}
+declare const OAuthAccountLinking_base: Context.ServiceClass<OAuthAccountLinking, "auth/OAuthAccountLinking", OAuthAccountLinkingService>;
+export declare class OAuthAccountLinking extends OAuthAccountLinking_base {
+}
+export declare namespace OAuthAccountLinking {
+    const make: (service: OAuthAccountLinkingService) => OAuthAccountLinkingService;
+}
+export interface OAuthAccountLinkingPolicyOptions {
+    readonly autoLinkVerifiedEmail?: boolean;
+}
+export interface OAuthAccountLinkingPolicyDependencies extends OAuthAccountLinkingPolicyOptions {
+    readonly accounts: OAuthAccountStoreService;
+}
+export interface OAuthAccountUnlinkingResolveInput {
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+    readonly stepUpSatisfied?: boolean;
+}
+export type OAuthAccountUnlinkingResolution = {
+    readonly type: "allow";
+    readonly reason: "owned-account";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+    readonly remainingAccounts: readonly OAuthAccountRecord[];
+} | {
+    readonly type: "requires-step-up";
+    readonly reason: "step-up-required";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+    readonly remainingAccounts: readonly OAuthAccountRecord[];
+} | {
+    readonly type: "deny-not-found";
+    readonly reason: "provider-account-not-found";
+    readonly userId: UserId;
+    readonly providerId: OAuthProviderId;
+    readonly providerAccountId: string;
+} | {
+    readonly type: "deny-not-owner";
+    readonly reason: "provider-account-linked-to-different-user";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+} | {
+    readonly type: "deny-last-account";
+    readonly reason: "last-linked-account";
+    readonly userId: UserId;
+    readonly account: OAuthAccountRecord;
+};
+export type OAuthAccountUnlinkingOperation = "resolve";
+declare const OAuthAccountUnlinkingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAccountUnlinkingError";
+} & Readonly<A>;
+export declare class OAuthAccountUnlinkingError extends OAuthAccountUnlinkingError_base<{
+    readonly operation: OAuthAccountUnlinkingOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAccountUnlinkingService {
+    readonly resolve: (input: OAuthAccountUnlinkingResolveInput) => Effect.Effect<OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingError>;
+}
+declare const OAuthAccountUnlinking_base: Context.ServiceClass<OAuthAccountUnlinking, "auth/OAuthAccountUnlinking", OAuthAccountUnlinkingService>;
+export declare class OAuthAccountUnlinking extends OAuthAccountUnlinking_base {
+}
+export declare namespace OAuthAccountUnlinking {
+    const make: (service: OAuthAccountUnlinkingService) => OAuthAccountUnlinkingService;
+}
+export interface OAuthAccountUnlinkingPolicyOptions {
+    readonly allowLastAccount?: boolean;
+    readonly requireStepUp?: boolean;
+}
+export interface OAuthAccountUnlinkingPolicyDependencies extends OAuthAccountUnlinkingPolicyOptions {
+    readonly accounts: OAuthAccountStoreService;
+}
+export type OAuthLinkConfirmationReason = "current-user" | "matched-email" | "unverified-email" | "no-linked-account" | "manual" | (string & {});
+export interface OAuthLinkConfirmationStartInput {
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason?: OAuthLinkConfirmationReason;
+    readonly ttl?: Duration.Duration;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface StartedOAuthLinkConfirmation {
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason: OAuthLinkConfirmationReason;
+    readonly secret: Redacted.Redacted<string>;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthLinkConfirmationInspectInput {
+    readonly challengeId: ChallengeId;
+    readonly secret?: Redacted.Redacted<string>;
+}
+export interface PendingOAuthLinkConfirmation {
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason: OAuthLinkConfirmationReason;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthLinkConfirmationConfirmInput {
+    readonly challengeId: ChallengeId;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly currentUserId?: UserId;
+    readonly expectedProviderId?: OAuthProviderId;
+    readonly expectedProviderAccountId?: string;
+}
+export interface ConfirmedOAuthLinkConfirmation {
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly identity: VerifiedOAuthIdentity;
+    readonly reason: OAuthLinkConfirmationReason;
+    readonly existingAccount?: OAuthAccountRecord;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type OAuthLinkConfirmationOperation = "start" | "inspect" | "confirm";
+declare const OAuthLinkConfirmationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthLinkConfirmationError";
+} & Readonly<A>;
+export declare class OAuthLinkConfirmationError extends OAuthLinkConfirmationError_base<{
+    readonly operation: OAuthLinkConfirmationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthLinkConfirmationService {
+    readonly start: (input: OAuthLinkConfirmationStartInput) => Effect.Effect<StartedOAuthLinkConfirmation, OAuthLinkConfirmationError>;
+    readonly inspect: (input: OAuthLinkConfirmationInspectInput) => Effect.Effect<PendingOAuthLinkConfirmation, OAuthLinkConfirmationError>;
+    readonly confirm: (input: OAuthLinkConfirmationConfirmInput) => Effect.Effect<ConfirmedOAuthLinkConfirmation, OAuthLinkConfirmationError>;
+}
+declare const OAuthLinkConfirmation_base: Context.ServiceClass<OAuthLinkConfirmation, "auth/OAuthLinkConfirmation", OAuthLinkConfirmationService>;
+export declare class OAuthLinkConfirmation extends OAuthLinkConfirmation_base {
+}
+export declare namespace OAuthLinkConfirmation {
+    const make: (service: OAuthLinkConfirmationService) => OAuthLinkConfirmationService;
+}
+export interface OAuthLinkConfirmationDependencies {
+    readonly challenge: ChallengeService;
+    readonly accounts: OAuthAccountStoreService;
+    readonly crypto: CryptoService;
+    readonly secretBytes?: number;
+}
+export interface OAuthStateDependencies {
+    readonly crypto: CryptoService;
+    readonly challenge: ChallengeService;
+    readonly stateSecretBytes?: number;
+    readonly codeVerifierBytes?: number;
+    readonly nonceBytes?: number;
+}
+export interface OAuthAuthorizationCodeGrantDependencies {
+    readonly crypto: CryptoService;
+    readonly store: OAuthAuthorizationCodeStoreService;
+    readonly codeBytes?: number;
+    readonly codeTtl?: Duration.Duration;
+}
+export interface OAuthAuthorizationCodeTokenGrantDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly authorizationCodes: OAuthAuthorizationCodeGrantService;
+    readonly issuer: OAuthAuthorizationCodeTokenIssuerService;
+}
+export interface OAuthRefreshTokenGrantDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly issuer: OAuthRefreshTokenIssuerService;
+}
+export interface OAuthClientCredentialsGrantDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly issuer: OAuthClientCredentialsTokenIssuerService;
+}
+export interface OAuthProviderModeOpaqueTokenIssuerDependencies {
+    readonly crypto: CryptoService;
+    readonly tokenStore: OAuthProviderModeTokenStoreService;
+    readonly accessTokenBytes?: number;
+    readonly refreshTokenBytes?: number;
+    readonly accessTokenTtl?: Duration.Duration;
+    readonly refreshTokenTtl?: Duration.Duration;
+    readonly issuer?: string;
+    readonly audience?: string | readonly string[];
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly clientCredentialsSubject?: (input: OAuthClientCredentialsTokenIssueInput) => string;
+}
+export interface OAuthProviderModeOpaqueTokenIssuerServices {
+    readonly authorizationCode: OAuthAuthorizationCodeTokenIssuerService;
+    readonly refreshToken: OAuthRefreshTokenIssuerService;
+    readonly clientCredentials: OAuthClientCredentialsTokenIssuerService;
+}
+export type OAuthProviderModeOpaqueTokenIssuerLiveOptions = Omit<OAuthProviderModeOpaqueTokenIssuerDependencies, "crypto" | "tokenStore">;
+export interface OAuthTokenRevocationDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly revoker: OAuthTokenRevokerService;
+}
+export interface OAuthTokenIntrospectionDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly introspector: OAuthTokenIntrospectorService;
+}
+export interface OAuthProviderAuthorizationDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly authorizationCodes: OAuthAuthorizationCodeGrantService;
+    readonly policy: OAuthProviderAuthorizationPolicyService;
+}
+export declare const makeOAuthClientSecrets: (dependencies: OAuthClientSecretsDependencies) => OAuthClientSecretsService;
+export declare const makeAppleSignInProvider: (input: AppleSignInProviderOptions) => OAuthProviderConfig;
+export declare const makeGithubOAuthProvider: (input: GithubOAuthProviderOptions) => OAuthProviderConfig;
+export declare const makeGoogleOidcProvider: (input: GoogleOidcProviderOptions) => OAuthProviderConfig;
+export declare const makeMicrosoftOidcProvider: (input: MicrosoftOidcProviderOptions) => OAuthProviderConfig;
+export declare const makeGenericOidcProvider: (input: GenericOidcProviderOptions) => OAuthProviderConfig;
+export declare const makeGoogleOidcProviderTokenRefreshInput: (input: GoogleOidcProviderTokenRefreshInput) => OAuthProviderTokenLifecycleRefreshInput;
+export declare const makeGoogleOidcProviderTokenRevokeInput: (input: GoogleOidcProviderTokenRevokeInput) => OAuthProviderTokenLifecycleRevokeInput;
+export declare const makeMicrosoftOidcProviderTokenRefreshInput: (input: MicrosoftOidcProviderTokenRefreshInput) => OAuthProviderTokenLifecycleRefreshInput;
+export declare const makeAppleSignInProviderTokenRefreshInput: (input: AppleSignInProviderTokenRefreshInput) => OAuthProviderTokenLifecycleRefreshInput;
+export declare const makeAppleSignInProviderTokenRevokeInput: (input: AppleSignInProviderTokenRevokeInput) => OAuthProviderTokenLifecycleRevokeInput;
+export declare const parseOAuthState: (state: OAuthStateToken | string) => Effect.Effect<{
+    readonly challengeId: ChallengeId;
+    readonly secret: Redacted.Redacted<string>;
+}, OAuthStateError>;
+export declare const githubOAuthVerifiedEmail: (emails: readonly GithubOAuthEmailRecord[]) => string | undefined;
+export declare const googleOidcHostedDomain: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const microsoftOidcTenantId: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const microsoftOidcObjectId: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const microsoftOidcAccountId: (value: Readonly<Record<string, unknown>>) => string | undefined;
+export declare const decodeAppleSignInAuthorizationUser: (value: unknown) => AppleSignInAuthorizationUser | undefined;
+export declare const appleSignInAuthorizationUserFullName: (user: AppleSignInAuthorizationUser | undefined) => string | undefined;
+export declare const appleSignInAuthorizationUserEmail: (user: AppleSignInAuthorizationUser | undefined) => Email | undefined;
+export declare const appleSignInIsPrivateEmail: (input: {
+    readonly claims?: Readonly<Record<string, unknown>>;
+    readonly email?: Email | string;
+}) => boolean | undefined;
+export declare const makeOAuthTokenRequest: (input: OAuthAuthorizationCodeTokenInput) => Effect.Effect<OAuthTokenRequest, OAuthTokenExchangeError>;
+export declare const makeOAuthRefreshTokenRequest: (input: OAuthRefreshTokenInput) => Effect.Effect<OAuthTokenRequest, OAuthTokenExchangeError>;
+export declare const makeOAuthTokenRevocationRequest: (input: OAuthTokenRevocationInput) => Effect.Effect<OAuthTokenRequest, OAuthTokenExchangeError>;
+export declare const makeOAuthUserInfoRequest: (input: OAuthUserInfoRequestInput) => Effect.Effect<OAuthUserInfoRequest, OAuthUserInfoError>;
+export declare const decodeOAuthUserInfoResponse: (value: unknown) => Effect.Effect<OAuthUserInfo, OAuthUserInfoError>;
+export declare const decodeOAuthTokenResponse: (value: unknown) => Effect.Effect<OAuthTokenResponse, OAuthTokenExchangeError>;
+export declare const makeOidcIdTokenVerifier: (dependencies: OidcIdTokenVerifierDependencies) => OidcIdTokenVerifierService;
+export declare const verifyOidcIdToken: (input: OidcIdTokenVerifyInput) => Effect.Effect<OidcIdTokenVerificationResult, OidcIdTokenVerifierError, OidcIdTokenVerifier>;
+export declare const decodeOAuthJwksDocument: (input: unknown) => Effect.Effect<JwksDocument, JwtError>;
+export declare const makeOAuthJwksJwtKeys: (dependencies: OAuthJwksJwtKeysDependencies) => JwtKeysService;
+export declare const normalizeOidcProfile: (input: OAuthProfileNormalizeInput) => Effect.Effect<OAuthProfile, OAuthProfileNormalizationError>;
+export declare const makeOidcOAuthProfileNormalizer: () => OAuthProfileNormalizerService;
+export declare const normalizeOAuthProfile: (input: OAuthProfileNormalizeInput) => Effect.Effect<OAuthProfile, OAuthProfileNormalizationError, OAuthProfileNormalizer>;
+export declare const verifiedOAuthIdentityFromProfile: (profile: OAuthProfile) => VerifiedOAuthIdentity;
+export declare const makeOAuthTokenExchange: (dependencies: OAuthTokenExchangeDependencies) => OAuthTokenExchangeService;
+export declare const makeOAuthProviderTokenLifecycle: (dependencies: OAuthProviderTokenLifecycleDependencies) => OAuthProviderTokenLifecycleService;
+export declare const OAuthProviderTokenLifecycleLive: (options: OAuthProviderTokenLifecycleLiveOptions) => Layer.Layer<OAuthProviderTokenLifecycle, never, OAuthProviderTokenVault>;
+export declare const storeOAuthProviderTokens: (input: OAuthProviderTokenLifecycleStoreInput) => Effect.Effect<OAuthProviderTokenLifecycleStoreResult, OAuthProviderTokenLifecycleError, OAuthProviderTokenLifecycle>;
+export declare const refreshOAuthProviderTokens: (input: OAuthProviderTokenLifecycleRefreshInput) => Effect.Effect<OAuthProviderTokenLifecycleRefreshResult, OAuthProviderTokenLifecycleError, OAuthProviderTokenLifecycle>;
+export declare const revokeOAuthProviderTokens: (input: OAuthProviderTokenLifecycleRevokeInput) => Effect.Effect<OAuthProviderTokenLifecycleRevokeResult, OAuthProviderTokenLifecycleError, OAuthProviderTokenLifecycle>;
+export declare const completeOAuthCallback: (input: OAuthCallbackInput) => Effect.Effect<OAuthCallbackResult, OAuthStateError | OAuthTokenExchangeError, OAuthState | OAuthTokenExchange>;
+export declare const makeOAuthAccountLinkingPolicy: (dependencies: OAuthAccountLinkingPolicyDependencies) => OAuthAccountLinkingService;
+export declare const resolveOAuthAccountLinking: (input: OAuthAccountLinkingResolveInput) => Effect.Effect<OAuthAccountLinkingResolution, OAuthAccountLinkingError, OAuthAccountLinking>;
+export declare const makeOAuthAccountUnlinkingPolicy: (dependencies: OAuthAccountUnlinkingPolicyDependencies) => OAuthAccountUnlinkingService;
+export declare const resolveOAuthAccountUnlinking: (input: OAuthAccountUnlinkingResolveInput) => Effect.Effect<OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingError, OAuthAccountUnlinking>;
+export declare const makeOAuthLinkConfirmation: (dependencies: OAuthLinkConfirmationDependencies) => OAuthLinkConfirmationService;
+export declare const startOAuthLinkConfirmation: (input: OAuthLinkConfirmationStartInput) => Effect.Effect<StartedOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const inspectOAuthLinkConfirmation: (input: OAuthLinkConfirmationInspectInput) => Effect.Effect<PendingOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const confirmOAuthLinkConfirmation: (input: OAuthLinkConfirmationConfirmInput) => Effect.Effect<ConfirmedOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const makeOAuthAuthorizationCodeGrant: (dependencies: OAuthAuthorizationCodeGrantDependencies) => OAuthAuthorizationCodeGrantService;
+export declare const makeOAuthAuthorizationCodeTokenGrant: (dependencies: OAuthAuthorizationCodeTokenGrantDependencies) => OAuthAuthorizationCodeTokenGrantService;
+export declare const makeOAuthRefreshTokenGrant: (dependencies: OAuthRefreshTokenGrantDependencies) => OAuthRefreshTokenGrantService;
+export declare const makeOAuthClientCredentialsGrant: (dependencies: OAuthClientCredentialsGrantDependencies) => OAuthClientCredentialsGrantService;
+export declare const makeOAuthProviderModeOpaqueTokenIssuer: (dependencies: OAuthProviderModeOpaqueTokenIssuerDependencies) => OAuthProviderModeOpaqueTokenIssuerServices;
+export declare const makeOAuthClientSecretVerification: (dependencies: OAuthClientSecretVerificationDependencies) => OAuthClientSecretVerificationService;
+export declare const makeOAuthTokenRevocation: (dependencies: OAuthTokenRevocationDependencies) => OAuthTokenRevocationService;
+export declare const makeOAuthTokenIntrospection: (dependencies: OAuthTokenIntrospectionDependencies) => OAuthTokenIntrospectionService;
+export declare const makeOAuthProviderAuthorization: (dependencies: OAuthProviderAuthorizationDependencies) => OAuthProviderAuthorizationService;
+export declare const issueOAuthAuthorizationCode: (input: OAuthAuthorizationCodeIssueInput) => Effect.Effect<OAuthIssuedAuthorizationCode, OAuthAuthorizationCodeGrantError, OAuthAuthorizationCodeGrant>;
+export declare const consumeOAuthAuthorizationCode: (input: OAuthAuthorizationCodeConsumeInput) => Effect.Effect<OAuthAuthorizationCodeConsumeResult, OAuthAuthorizationCodeGrantError, OAuthAuthorizationCodeGrant>;
+export declare const exchangeOAuthAuthorizationCodeToken: (input: OAuthAuthorizationCodeTokenGrantInput) => Effect.Effect<OAuthAuthorizationCodeTokenGrantResult, OAuthAuthorizationCodeTokenGrantError, OAuthAuthorizationCodeTokenGrant>;
+export declare const exchangeOAuthRefreshToken: (input: OAuthRefreshTokenGrantInput) => Effect.Effect<OAuthRefreshTokenGrantResult, OAuthRefreshTokenGrantError, OAuthRefreshTokenGrant>;
+export declare const exchangeOAuthClientCredentialsToken: (input: OAuthClientCredentialsGrantInput) => Effect.Effect<OAuthClientCredentialsGrantResult, OAuthClientCredentialsGrantError, OAuthClientCredentialsGrant>;
+export declare const revokeOAuthToken: (input: OAuthTokenRevocationRequestInput) => Effect.Effect<OAuthTokenRevocationResult, OAuthTokenRevocationError, OAuthTokenRevocation>;
+export declare const introspectOAuthToken: (input: OAuthTokenIntrospectionRequestInput) => Effect.Effect<OAuthTokenIntrospectionResult, OAuthTokenIntrospectionError, OAuthTokenIntrospection>;
+export declare const authorizeOAuthProviderAuthorization: (input: OAuthProviderAuthorizationInput) => Effect.Effect<OAuthProviderAuthorizationResult, OAuthProviderAuthorizationError, OAuthProviderAuthorization>;
+export declare const makeOAuthPkce: (input?: OAuthPkceInput) => Effect.Effect<OAuthPkce, OAuthStateError, Crypto>;
+export declare const makeOAuthState: (dependencies: OAuthStateDependencies) => OAuthStateService;
+export declare const OAuthStateLive: Layer.Layer<OAuthState, never, Crypto | Challenge>;
+export declare const OAuthAuthorizationCodeGrantLive: Layer.Layer<OAuthAuthorizationCodeGrant, never, Crypto | OAuthAuthorizationCodeStore>;
+export declare const OAuthAuthorizationCodeTokenGrantLive: Layer.Layer<OAuthAuthorizationCodeTokenGrant, never, OAuthClientRegistry | OAuthAuthorizationCodeGrant | OAuthAuthorizationCodeTokenIssuer>;
+export declare const OAuthRefreshTokenGrantLive: Layer.Layer<OAuthRefreshTokenGrant, never, OAuthClientRegistry | OAuthRefreshTokenIssuer>;
+export declare const OAuthClientCredentialsGrantLive: Layer.Layer<OAuthClientCredentialsGrant, never, OAuthClientRegistry | OAuthClientCredentialsTokenIssuer>;
+export declare const OAuthProviderModeOpaqueTokenIssuerLive: (options?: OAuthProviderModeOpaqueTokenIssuerLiveOptions) => Layer.Layer<OAuthAuthorizationCodeTokenIssuer | OAuthRefreshTokenIssuer | OAuthClientCredentialsTokenIssuer, never, Crypto | OAuthProviderModeTokenStore>;
+export declare const OAuthTokenRevocationLive: Layer.Layer<OAuthTokenRevocation, never, OAuthClientRegistry | OAuthTokenRevoker>;
+export declare const OAuthTokenIntrospectionLive: Layer.Layer<OAuthTokenIntrospection, never, OAuthClientRegistry | OAuthTokenIntrospector>;
+export declare const OAuthProviderAuthorizationLive: Layer.Layer<OAuthProviderAuthorization, never, OAuthClientRegistry | OAuthAuthorizationCodeGrant | OAuthProviderAuthorizationPolicy>;
+export declare const makeOAuthProviders: (providers: readonly OAuthProviderConfig[]) => OAuthProvidersService;
+export declare const OAuthProvidersLive: (providers: readonly OAuthProviderConfig[]) => Layer.Layer<OAuthProviders, never, never>;
+export declare const OAuthClientSecretsLive: Layer.Layer<OAuthClientSecrets, never, Crypto>;
+export declare const OAuthClientSecretVerificationLive: Layer.Layer<OAuthClientSecretVerification, never, OAuthClientSecrets | OAuthClientSecretStore>;
+export declare const makeOAuthClientRegistryFromStore: (store: OAuthClientStoreService) => OAuthClientRegistryService;
+export declare const OAuthClientRegistryFromStoreLive: Layer.Layer<OAuthClientRegistry, never, OAuthClientStore>;
+export declare const makeOAuthClientRegistryMemory: (clients?: readonly OAuthClientRecord[]) => OAuthClientRegistryService;
+export declare const OAuthClientRegistryMemoryLive: (clients?: readonly OAuthClientRecord[]) => Layer.Layer<OAuthClientRegistry, never, never>;
+export declare const makeOAuthClientStoreMemory: (clients?: readonly OAuthClientRecord[]) => OAuthClientStoreService;
+export declare const OAuthClientStoreMemoryLive: (clients?: readonly OAuthClientRecord[]) => Layer.Layer<OAuthClientStore, never, never>;
+export declare const makeOAuthConsentStoreMemory: (records?: readonly OAuthConsentRecord[]) => OAuthConsentStoreService;
+export declare const OAuthConsentStoreMemoryLive: (records?: readonly OAuthConsentRecord[]) => Layer.Layer<OAuthConsentStore, never, never>;
+export declare const makeOAuthClientSecretStoreMemory: () => OAuthClientSecretStoreService;
+export declare const OAuthClientSecretStoreMemoryLive: Layer.Layer<OAuthClientSecretStore, never, never>;
+export declare const makeOAuthAuthorizationCodeStoreMemory: () => OAuthAuthorizationCodeStoreService;
+export declare const OAuthAuthorizationCodeStoreMemoryLive: Layer.Layer<OAuthAuthorizationCodeStore, never, never>;
+export declare const makeOAuthProviderModeTokenStoreMemory: () => OAuthProviderModeTokenStoreService;
+export declare const OAuthProviderModeTokenStoreMemoryLive: Layer.Layer<OAuthProviderModeTokenStore, never, never>;
+export declare const OidcIdTokenVerifierLive: Layer.Layer<OidcIdTokenVerifier, never, JwtVerifier>;
+export declare const OAuthOidcProfileNormalizerLive: Layer.Layer<OAuthProfileNormalizer, never, never>;
+export declare const OAuthAccountLinkingLive: Layer.Layer<OAuthAccountLinking, never, OAuthAccountStore>;
+export declare const OAuthAccountUnlinkingLive: Layer.Layer<OAuthAccountUnlinking, never, OAuthAccountStore>;
+export declare const OAuthLinkConfirmationLive: Layer.Layer<OAuthLinkConfirmation, never, Crypto | Challenge | OAuthAccountStore>;
+export declare const makeOAuthProviderTokenVaultMemory: () => OAuthProviderTokenVaultService;
+export declare const OAuthProviderTokenVaultMemoryLive: Layer.Layer<OAuthProviderTokenVault, never, never>;
+export declare const makeOAuthAccountStoreMemory: () => OAuthAccountStoreService;
+export declare const OAuthAccountStoreMemoryLive: Layer.Layer<OAuthAccountStore, never, never>;
+export {};
+//# sourceMappingURL=OAuth.d.ts.map