@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/OAuth.js

@@ -0,0 +1,3063 @@
+import { Brand, Context, Data, Duration, Effect, Encoding, Layer, Option, Redacted, } from "effect";
+import { Challenge } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId, } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { JwtAlgorithms, JwtError, JwtKeyId, JwtKeys, JwtVerifier, } from "./Jwt.js";
+export const OAuthStateToken = Brand.nominal();
+export const OAuthCodeVerifier = Brand.nominal();
+export const OAuthCodeChallenge = Brand.nominal();
+export const OAuthNonce = Brand.nominal();
+export const OAuthAuthorizationCode = Brand.nominal();
+export const OAuthAccessToken = Brand.nominal();
+export const OAuthRefreshToken = Brand.nominal();
+export const OAuthIdToken = Brand.nominal();
+export const defaultOAuthStateTtl = Duration.minutes(10);
+export const defaultOAuthLinkConfirmationTtl = Duration.minutes(15);
+export const defaultOAuthJwksCacheTtl = Duration.minutes(10);
+export const defaultOAuthStateSecretBytes = 32;
+export const defaultOAuthCodeVerifierBytes = 32;
+export const defaultOAuthAuthorizationCodeBytes = 32;
+export const defaultOAuthAuthorizationCodeTtl = Duration.minutes(5);
+export const defaultOAuthLinkConfirmationSecretBytes = 32;
+export const defaultOAuthNonceBytes = 16;
+export const defaultOAuthProviderModeAccessTokenBytes = 32;
+export const defaultOAuthProviderModeRefreshTokenBytes = 32;
+export const defaultOAuthProviderModeAccessTokenTtl = Duration.hours(1);
+export const defaultOAuthProviderModeRefreshTokenTtl = Duration.days(30);
+export const appleSignInProviderId = OAuthProviderId("apple");
+export const appleSignInIssuer = "https://appleid.apple.com";
+export const appleSignInAuthorizationEndpoint = "https://appleid.apple.com/auth/authorize";
+export const appleSignInTokenEndpoint = "https://appleid.apple.com/auth/token";
+export const appleSignInRevocationEndpoint = "https://appleid.apple.com/auth/revoke";
+export const appleSignInJwksUri = "https://appleid.apple.com/auth/keys";
+export const appleSignInPrivateRelayDomain = "privaterelay.appleid.com";
+export const appleSignInDefaultScopes = ["openid", "email", "name"];
+export const appleSignInDefaultAuthorizationParams = {
+    response_mode: "form_post",
+};
+export const githubOAuthProviderId = OAuthProviderId("github");
+export const githubOAuthAuthorizationEndpoint = "https://github.com/login/oauth/authorize";
+export const githubOAuthTokenEndpoint = "https://github.com/login/oauth/access_token";
+export const githubOAuthUserEndpoint = "https://api.github.com/user";
+export const githubOAuthEmailsEndpoint = "https://api.github.com/user/emails";
+export const githubOAuthDefaultScopes = ["read:user", "user:email"];
+export const githubOAuthApiVersion = "2022-11-28";
+export const githubOAuthApiVersionHeader = {
+    "x-github-api-version": githubOAuthApiVersion,
+};
+export const googleOidcProviderId = OAuthProviderId("google");
+export const googleOidcIssuer = "https://accounts.google.com";
+export const googleOidcAuthorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+export const googleOidcTokenEndpoint = "https://oauth2.googleapis.com/token";
+export const googleOidcRevocationEndpoint = "https://oauth2.googleapis.com/revoke";
+export const googleOidcUserInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+export const googleOidcJwksUri = "https://www.googleapis.com/oauth2/v3/certs";
+export const googleOidcDefaultScopes = ["openid", "email", "profile"];
+export const googleOidcOfflineAccessAuthorizationParams = {
+    access_type: "offline",
+    prompt: "consent",
+};
+export const microsoftOidcProviderId = OAuthProviderId("microsoft");
+export const microsoftOidcLoginBaseUrl = "https://login.microsoftonline.com";
+export const microsoftOidcUserInfoEndpoint = "https://graph.microsoft.com/oidc/userinfo";
+export const microsoftOidcDefaultScopes = ["openid", "email", "profile"];
+export const microsoftOidcOfflineAccessScopes = [
+    "openid",
+    "email",
+    "profile",
+    "offline_access",
+];
+export const genericOidcDefaultScopes = ["openid", "email", "profile"];
+const microsoftOidcTenantPathSegment = (tenant) => encodeURIComponent(tenant.trim());
+export const microsoftOidcAuthorizationEndpoint = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/oauth2/v2.0/authorize`;
+export const microsoftOidcTokenEndpoint = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/oauth2/v2.0/token`;
+export const microsoftOidcJwksUri = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/discovery/v2.0/keys`;
+export const microsoftOidcIssuer = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/v2.0`;
+export class OAuthProviderError extends Data.TaggedError("OAuthProviderError") {
+}
+export const OAuthClientSecretPrefix = Brand.nominal();
+export const OAuthClientSecret = Brand.nominal();
+export const OAuthClientSecretHash = Brand.nominal();
+export const defaultOAuthClientSecretPrefixBytes = 8;
+export const defaultOAuthClientSecretBytes = 32;
+export class OAuthClientRegistryError extends Data.TaggedError("OAuthClientRegistryError") {
+}
+export class OAuthClientRegistry extends Context.Service()("auth/OAuthClientRegistry") {
+}
+(function (OAuthClientRegistry) {
+    OAuthClientRegistry.make = (service) => OAuthClientRegistry.of(service);
+})(OAuthClientRegistry || (OAuthClientRegistry = {}));
+export class OAuthClientStoreError extends Data.TaggedError("OAuthClientStoreError") {
+}
+export class OAuthClientStore extends Context.Service()("auth/OAuthClientStore") {
+}
+(function (OAuthClientStore) {
+    OAuthClientStore.make = (service) => OAuthClientStore.of(service);
+})(OAuthClientStore || (OAuthClientStore = {}));
+export class OAuthConsentStoreError extends Data.TaggedError("OAuthConsentStoreError") {
+}
+export class OAuthConsentStore extends Context.Service()("auth/OAuthConsentStore") {
+}
+(function (OAuthConsentStore) {
+    OAuthConsentStore.make = (service) => OAuthConsentStore.of(service);
+})(OAuthConsentStore || (OAuthConsentStore = {}));
+export class OAuthClientSecretError extends Data.TaggedError("OAuthClientSecretError") {
+}
+export class OAuthClientSecrets extends Context.Service()("auth/OAuthClientSecrets") {
+}
+(function (OAuthClientSecrets) {
+    OAuthClientSecrets.make = (service) => OAuthClientSecrets.of(service);
+})(OAuthClientSecrets || (OAuthClientSecrets = {}));
+export class OAuthClientSecretStoreError extends Data.TaggedError("OAuthClientSecretStoreError") {
+}
+export class OAuthClientSecretStore extends Context.Service()("auth/OAuthClientSecretStore") {
+}
+(function (OAuthClientSecretStore) {
+    OAuthClientSecretStore.make = (service) => OAuthClientSecretStore.of(service);
+})(OAuthClientSecretStore || (OAuthClientSecretStore = {}));
+export class OAuthClientSecretVerificationError extends Data.TaggedError("OAuthClientSecretVerificationError") {
+}
+export class OAuthClientSecretVerification extends Context.Service()("auth/OAuthClientSecretVerification") {
+}
+(function (OAuthClientSecretVerification) {
+    OAuthClientSecretVerification.make = (service) => OAuthClientSecretVerification.of(service);
+})(OAuthClientSecretVerification || (OAuthClientSecretVerification = {}));
+export class OAuthAuthorizationCodeStoreError extends Data.TaggedError("OAuthAuthorizationCodeStoreError") {
+}
+export class OAuthAuthorizationCodeStore extends Context.Service()("auth/OAuthAuthorizationCodeStore") {
+}
+(function (OAuthAuthorizationCodeStore) {
+    OAuthAuthorizationCodeStore.make = (service) => OAuthAuthorizationCodeStore.of(service);
+})(OAuthAuthorizationCodeStore || (OAuthAuthorizationCodeStore = {}));
+export class OAuthAuthorizationCodeGrantError extends Data.TaggedError("OAuthAuthorizationCodeGrantError") {
+}
+export class OAuthAuthorizationCodeGrant extends Context.Service()("auth/OAuthAuthorizationCodeGrant") {
+}
+(function (OAuthAuthorizationCodeGrant) {
+    OAuthAuthorizationCodeGrant.make = (service) => OAuthAuthorizationCodeGrant.of(service);
+})(OAuthAuthorizationCodeGrant || (OAuthAuthorizationCodeGrant = {}));
+export class OAuthAuthorizationCodeTokenIssuerError extends Data.TaggedError("OAuthAuthorizationCodeTokenIssuerError") {
+}
+export class OAuthAuthorizationCodeTokenIssuer extends Context.Service()("auth/OAuthAuthorizationCodeTokenIssuer") {
+}
+(function (OAuthAuthorizationCodeTokenIssuer) {
+    OAuthAuthorizationCodeTokenIssuer.make = (service) => OAuthAuthorizationCodeTokenIssuer.of(service);
+})(OAuthAuthorizationCodeTokenIssuer || (OAuthAuthorizationCodeTokenIssuer = {}));
+export class OAuthAuthorizationCodeTokenGrantError extends Data.TaggedError("OAuthAuthorizationCodeTokenGrantError") {
+}
+export class OAuthAuthorizationCodeTokenGrant extends Context.Service()("auth/OAuthAuthorizationCodeTokenGrant") {
+}
+(function (OAuthAuthorizationCodeTokenGrant) {
+    OAuthAuthorizationCodeTokenGrant.make = (service) => OAuthAuthorizationCodeTokenGrant.of(service);
+})(OAuthAuthorizationCodeTokenGrant || (OAuthAuthorizationCodeTokenGrant = {}));
+export class OAuthRefreshTokenIssuerError extends Data.TaggedError("OAuthRefreshTokenIssuerError") {
+}
+export class OAuthRefreshTokenIssuer extends Context.Service()("auth/OAuthRefreshTokenIssuer") {
+}
+(function (OAuthRefreshTokenIssuer) {
+    OAuthRefreshTokenIssuer.make = (service) => OAuthRefreshTokenIssuer.of(service);
+})(OAuthRefreshTokenIssuer || (OAuthRefreshTokenIssuer = {}));
+export class OAuthRefreshTokenGrantError extends Data.TaggedError("OAuthRefreshTokenGrantError") {
+}
+export class OAuthRefreshTokenGrant extends Context.Service()("auth/OAuthRefreshTokenGrant") {
+}
+(function (OAuthRefreshTokenGrant) {
+    OAuthRefreshTokenGrant.make = (service) => OAuthRefreshTokenGrant.of(service);
+})(OAuthRefreshTokenGrant || (OAuthRefreshTokenGrant = {}));
+export class OAuthClientCredentialsTokenIssuerError extends Data.TaggedError("OAuthClientCredentialsTokenIssuerError") {
+}
+export class OAuthClientCredentialsTokenIssuer extends Context.Service()("auth/OAuthClientCredentialsTokenIssuer") {
+}
+(function (OAuthClientCredentialsTokenIssuer) {
+    OAuthClientCredentialsTokenIssuer.make = (service) => OAuthClientCredentialsTokenIssuer.of(service);
+})(OAuthClientCredentialsTokenIssuer || (OAuthClientCredentialsTokenIssuer = {}));
+export class OAuthClientCredentialsGrantError extends Data.TaggedError("OAuthClientCredentialsGrantError") {
+}
+export class OAuthClientCredentialsGrant extends Context.Service()("auth/OAuthClientCredentialsGrant") {
+}
+(function (OAuthClientCredentialsGrant) {
+    OAuthClientCredentialsGrant.make = (service) => OAuthClientCredentialsGrant.of(service);
+})(OAuthClientCredentialsGrant || (OAuthClientCredentialsGrant = {}));
+export class OAuthTokenRevokerError extends Data.TaggedError("OAuthTokenRevokerError") {
+}
+export class OAuthTokenRevoker extends Context.Service()("auth/OAuthTokenRevoker") {
+}
+(function (OAuthTokenRevoker) {
+    OAuthTokenRevoker.make = (service) => OAuthTokenRevoker.of(service);
+})(OAuthTokenRevoker || (OAuthTokenRevoker = {}));
+export class OAuthTokenRevocationError extends Data.TaggedError("OAuthTokenRevocationError") {
+}
+export class OAuthTokenRevocation extends Context.Service()("auth/OAuthTokenRevocation") {
+}
+(function (OAuthTokenRevocation) {
+    OAuthTokenRevocation.make = (service) => OAuthTokenRevocation.of(service);
+})(OAuthTokenRevocation || (OAuthTokenRevocation = {}));
+export class OAuthTokenIntrospectorError extends Data.TaggedError("OAuthTokenIntrospectorError") {
+}
+export class OAuthTokenIntrospector extends Context.Service()("auth/OAuthTokenIntrospector") {
+}
+(function (OAuthTokenIntrospector) {
+    OAuthTokenIntrospector.make = (service) => OAuthTokenIntrospector.of(service);
+})(OAuthTokenIntrospector || (OAuthTokenIntrospector = {}));
+export class OAuthTokenIntrospectionError extends Data.TaggedError("OAuthTokenIntrospectionError") {
+}
+export class OAuthTokenIntrospection extends Context.Service()("auth/OAuthTokenIntrospection") {
+}
+(function (OAuthTokenIntrospection) {
+    OAuthTokenIntrospection.make = (service) => OAuthTokenIntrospection.of(service);
+})(OAuthTokenIntrospection || (OAuthTokenIntrospection = {}));
+export class OAuthProviderAuthorizationPolicyError extends Data.TaggedError("OAuthProviderAuthorizationPolicyError") {
+}
+export class OAuthProviderAuthorizationPolicy extends Context.Service()("auth/OAuthProviderAuthorizationPolicy") {
+}
+(function (OAuthProviderAuthorizationPolicy) {
+    OAuthProviderAuthorizationPolicy.make = (service) => OAuthProviderAuthorizationPolicy.of(service);
+})(OAuthProviderAuthorizationPolicy || (OAuthProviderAuthorizationPolicy = {}));
+export class OAuthProviderAuthorizationError extends Data.TaggedError("OAuthProviderAuthorizationError") {
+}
+export class OAuthProviderAuthorization extends Context.Service()("auth/OAuthProviderAuthorization") {
+}
+(function (OAuthProviderAuthorization) {
+    OAuthProviderAuthorization.make = (service) => OAuthProviderAuthorization.of(service);
+})(OAuthProviderAuthorization || (OAuthProviderAuthorization = {}));
+export class OAuthUserInfoError extends Data.TaggedError("OAuthUserInfoError") {
+}
+export class OAuthProviderModeTokenStoreError extends Data.TaggedError("OAuthProviderModeTokenStoreError") {
+}
+export class OAuthProviderModeTokenStore extends Context.Service()("auth/OAuthProviderModeTokenStore") {
+}
+(function (OAuthProviderModeTokenStore) {
+    OAuthProviderModeTokenStore.make = (service) => OAuthProviderModeTokenStore.of(service);
+})(OAuthProviderModeTokenStore || (OAuthProviderModeTokenStore = {}));
+export class OAuthProviderTokenVaultError extends Data.TaggedError("OAuthProviderTokenVaultError") {
+}
+export class OAuthProviderTokenVault extends Context.Service()("auth/OAuthProviderTokenVault") {
+}
+(function (OAuthProviderTokenVault) {
+    OAuthProviderTokenVault.make = (service) => OAuthProviderTokenVault.of(service);
+})(OAuthProviderTokenVault || (OAuthProviderTokenVault = {}));
+export class OAuthProviderTokenLifecycleError extends Data.TaggedError("OAuthProviderTokenLifecycleError") {
+}
+export class OAuthProviderTokenLifecycle extends Context.Service()("auth/OAuthProviderTokenLifecycle") {
+}
+(function (OAuthProviderTokenLifecycle) {
+    OAuthProviderTokenLifecycle.make = (service) => OAuthProviderTokenLifecycle.of(service);
+})(OAuthProviderTokenLifecycle || (OAuthProviderTokenLifecycle = {}));
+export class OidcIdTokenVerifierError extends Data.TaggedError("OidcIdTokenVerifierError") {
+}
+export class OidcIdTokenVerifier extends Context.Service()("auth/OidcIdTokenVerifier") {
+}
+(function (OidcIdTokenVerifier) {
+    OidcIdTokenVerifier.make = (service) => OidcIdTokenVerifier.of(service);
+})(OidcIdTokenVerifier || (OidcIdTokenVerifier = {}));
+export class OAuthProfileNormalizationError extends Data.TaggedError("OAuthProfileNormalizationError") {
+}
+export class OAuthProfileNormalizer extends Context.Service()("auth/OAuthProfileNormalizer") {
+}
+(function (OAuthProfileNormalizer) {
+    OAuthProfileNormalizer.make = (service) => OAuthProfileNormalizer.of(service);
+})(OAuthProfileNormalizer || (OAuthProfileNormalizer = {}));
+export class OAuthTokenExchangeError extends Data.TaggedError("OAuthTokenExchangeError") {
+}
+export class OAuthTokenExchange extends Context.Service()("auth/OAuthTokenExchange") {
+}
+(function (OAuthTokenExchange) {
+    OAuthTokenExchange.make = (service) => OAuthTokenExchange.of(service);
+})(OAuthTokenExchange || (OAuthTokenExchange = {}));
+export class OAuthProviders extends Context.Service()("auth/OAuthProviders") {
+}
+(function (OAuthProviders) {
+    OAuthProviders.make = (service) => OAuthProviders.of(service);
+})(OAuthProviders || (OAuthProviders = {}));
+export class OAuthStateError extends Data.TaggedError("OAuthStateError") {
+}
+export class OAuthState extends Context.Service()("auth/OAuthState") {
+}
+(function (OAuthState) {
+    OAuthState.make = (service) => OAuthState.of(service);
+})(OAuthState || (OAuthState = {}));
+export class OAuthAccountStoreError extends Data.TaggedError("OAuthAccountStoreError") {
+}
+export class OAuthAccountStore extends Context.Service()("auth/OAuthAccountStore") {
+}
+(function (OAuthAccountStore) {
+    OAuthAccountStore.make = (service) => OAuthAccountStore.of(service);
+})(OAuthAccountStore || (OAuthAccountStore = {}));
+export class OAuthAccountLinkingError extends Data.TaggedError("OAuthAccountLinkingError") {
+}
+export class OAuthAccountLinking extends Context.Service()("auth/OAuthAccountLinking") {
+}
+(function (OAuthAccountLinking) {
+    OAuthAccountLinking.make = (service) => OAuthAccountLinking.of(service);
+})(OAuthAccountLinking || (OAuthAccountLinking = {}));
+export class OAuthAccountUnlinkingError extends Data.TaggedError("OAuthAccountUnlinkingError") {
+}
+export class OAuthAccountUnlinking extends Context.Service()("auth/OAuthAccountUnlinking") {
+}
+(function (OAuthAccountUnlinking) {
+    OAuthAccountUnlinking.make = (service) => OAuthAccountUnlinking.of(service);
+})(OAuthAccountUnlinking || (OAuthAccountUnlinking = {}));
+export class OAuthLinkConfirmationError extends Data.TaggedError("OAuthLinkConfirmationError") {
+}
+export class OAuthLinkConfirmation extends Context.Service()("auth/OAuthLinkConfirmation") {
+}
+(function (OAuthLinkConfirmation) {
+    OAuthLinkConfirmation.make = (service) => OAuthLinkConfirmation.of(service);
+})(OAuthLinkConfirmation || (OAuthLinkConfirmation = {}));
+const oauthStateError = (operation, message, cause) => new OAuthStateError({ operation, message, cause });
+const oauthAuthorizationCodeGrantError = (operation, message, cause) => new OAuthAuthorizationCodeGrantError({ operation, message, cause });
+const oauthAuthorizationCodeTokenGrantError = (operation, message, cause) => new OAuthAuthorizationCodeTokenGrantError({ operation, message, cause });
+const oauthAuthorizationCodeTokenIssuerError = (message, cause) => new OAuthAuthorizationCodeTokenIssuerError({
+    operation: "issue",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthRefreshTokenGrantError = (operation, message, cause) => new OAuthRefreshTokenGrantError({ operation, message, cause });
+const oauthRefreshTokenIssuerError = (message, cause) => new OAuthRefreshTokenIssuerError({
+    operation: "issue",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientCredentialsGrantError = (operation, message, cause) => new OAuthClientCredentialsGrantError({ operation, message, cause });
+const oauthClientCredentialsTokenIssuerError = (message, cause) => new OAuthClientCredentialsTokenIssuerError({
+    operation: "issue",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientRegistryError = (operation, message, cause) => new OAuthClientRegistryError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientSecretError = (operation, message, cause) => new OAuthClientSecretError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientSecretVerificationError = (message, cause) => new OAuthClientSecretVerificationError({
+    operation: "authenticate-client",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthTokenRevocationError = (operation, message, cause) => new OAuthTokenRevocationError({ operation, message, cause });
+const oauthTokenIntrospectionError = (operation, message, cause) => new OAuthTokenIntrospectionError({ operation, message, cause });
+const oauthProviderAuthorizationError = (operation, message, cause) => new OAuthProviderAuthorizationError({ operation, message, cause });
+const oauthTokenExchangeError = (operation, message, cause) => new OAuthTokenExchangeError({ operation, message, cause });
+const oauthProviderTokenLifecycleError = (operation, message, cause) => new OAuthProviderTokenLifecycleError({ operation, message, cause });
+const oidcIdTokenVerifierError = (operation, message, cause) => new OidcIdTokenVerifierError({ operation, message, cause });
+const oauthAccountLinkingError = (operation, message, cause) => new OAuthAccountLinkingError({ operation, message, cause });
+const oauthAccountUnlinkingError = (operation, message, cause) => new OAuthAccountUnlinkingError({ operation, message, cause });
+const oauthLinkConfirmationError = (operation, message, cause) => new OAuthLinkConfirmationError({ operation, message, cause });
+const oauthProfileNormalizationError = (reason, message, cause) => new OAuthProfileNormalizationError({
+    operation: "normalize",
+    reason,
+    message,
+    cause,
+});
+const oauthJwksJwtError = (message, cause) => new JwtError({
+    operation: "keys",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthUserInfoError = (operation, message, cause) => new OAuthUserInfoError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const textEncoder = new TextEncoder();
+const oauthJwksPrivateMembers = new Set([
+    "d",
+    "p",
+    "q",
+    "dp",
+    "dq",
+    "qi",
+    "oth",
+    "k",
+]);
+const validateByteLength = (value, operation, label) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthStateError(operation, `${label} byte length must be an integer between 16 and 128`));
+const validateOAuthLinkConfirmationSecretBytes = (value) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthLinkConfirmationError("start", "OAuth link confirmation secret byte length must be an integer between 16 and 128"));
+const validateOAuthAuthorizationCodeBytes = (value) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthAuthorizationCodeGrantError("issue", "OAuth authorization code byte length must be an integer between 16 and 128"));
+const metadataValue = (value) => value === undefined ? undefined : structuredClone(value);
+const validateOAuthClientSecretByteLength = (value, operation, label) => Number.isInteger(value) && value >= 4 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthClientSecretError(operation, `${label} byte length must be an integer between 4 and 128`));
+const parseOAuthClientSecretValue = (secret) => {
+    const value = secret.trim();
+    const parts = value.split(".");
+    if (parts.length !== 2 || parts[0] === "" || parts[1] === "") {
+        return Effect.fail(oauthClientSecretError("parse", "OAuth client secret must use '<prefix>.<secret>' format"));
+    }
+    return Effect.succeed(OAuthClientSecretPrefix(parts[0]));
+};
+const hashOAuthClientSecretValue = (dependencies, secret, operation) => dependencies.crypto.digestSha256({ data: `oauth-client-secret:${secret}` }).pipe(Effect.map((hash) => OAuthClientSecretHash(`sha256:${hash}`)), Effect.mapError((cause) => oauthClientSecretError(operation, "Failed to hash OAuth client secret", cause)));
+export const makeOAuthClientSecrets = (dependencies) => OAuthClientSecrets.make({
+    generate: Effect.fn("auth.oauth.client_secret.generate")(function* (input) {
+        const prefixBytes = yield* validateOAuthClientSecretByteLength(input?.prefixBytes ?? defaultOAuthClientSecretPrefixBytes, "generate", "OAuth client secret prefix");
+        const secretBytes = yield* validateOAuthClientSecretByteLength(input?.secretBytes ?? defaultOAuthClientSecretBytes, "generate", "OAuth client secret");
+        const prefix = yield* dependencies.crypto.randomToken(prefixBytes).pipe(Effect.map(OAuthClientSecretPrefix), Effect.mapError((cause) => oauthClientSecretError("generate", "Failed to generate OAuth client secret prefix", cause)));
+        const secret = yield* dependencies.crypto.randomToken(secretBytes).pipe(Effect.map((value) => OAuthClientSecret(`${prefix}.${value}`)), Effect.mapError((cause) => oauthClientSecretError("generate", "Failed to generate OAuth client secret", cause)));
+        return {
+            prefix,
+            secret: Redacted.make(secret),
+        };
+    }),
+    parse: Effect.fn("auth.oauth.client_secret.parse")(function* (secret) {
+        return yield* parseOAuthClientSecretValue(Redacted.value(secret));
+    }),
+    hash: Effect.fn("auth.oauth.client_secret.hash")(function* (input) {
+        const secret = Redacted.value(input.secret).trim();
+        yield* parseOAuthClientSecretValue(secret).pipe(Effect.mapError((cause) => oauthClientSecretError("hash", "Cannot hash malformed OAuth client secret", cause)));
+        return yield* hashOAuthClientSecretValue(dependencies, secret, "hash");
+    }),
+    verify: Effect.fn("auth.oauth.client_secret.verify")(function* (input) {
+        const secret = Redacted.value(input.secret).trim();
+        const prefix = yield* parseOAuthClientSecretValue(secret).pipe(Effect.catchTag("OAuthClientSecretError", () => Effect.succeed(undefined)));
+        if (prefix === undefined) {
+            return false;
+        }
+        const hash = yield* hashOAuthClientSecretValue(dependencies, secret, "verify");
+        return yield* dependencies.crypto
+            .timingSafeEqual({
+            left: textEncoder.encode(hash),
+            right: textEncoder.encode(input.hash),
+        })
+            .pipe(Effect.mapError((cause) => oauthClientSecretError("verify", "Failed to compare OAuth client secret hashes", cause)));
+    }),
+});
+export const makeAppleSignInProvider = (input) => ({
+    id: input.id ?? appleSignInProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: appleSignInAuthorizationEndpoint,
+    tokenEndpoint: appleSignInTokenEndpoint,
+    revocationEndpoint: appleSignInRevocationEndpoint,
+    jwksUri: appleSignInJwksUri,
+    issuer: appleSignInIssuer,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? appleSignInDefaultScopes)],
+    authorizationParams: {
+        ...appleSignInDefaultAuthorizationParams,
+        ...input.authorizationParams,
+    },
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeGithubOAuthProvider = (input) => ({
+    id: input.id ?? githubOAuthProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: githubOAuthAuthorizationEndpoint,
+    tokenEndpoint: githubOAuthTokenEndpoint,
+    userInfoEndpoint: githubOAuthUserEndpoint,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? githubOAuthDefaultScopes)],
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeGoogleOidcProvider = (input) => ({
+    id: input.id ?? googleOidcProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: googleOidcAuthorizationEndpoint,
+    tokenEndpoint: googleOidcTokenEndpoint,
+    revocationEndpoint: googleOidcRevocationEndpoint,
+    userInfoEndpoint: googleOidcUserInfoEndpoint,
+    jwksUri: googleOidcJwksUri,
+    issuer: googleOidcIssuer,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? googleOidcDefaultScopes)],
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeMicrosoftOidcProvider = (input) => ({
+    id: input.id ?? microsoftOidcProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: microsoftOidcAuthorizationEndpoint(input.tenant),
+    tokenEndpoint: microsoftOidcTokenEndpoint(input.tenant),
+    userInfoEndpoint: microsoftOidcUserInfoEndpoint,
+    jwksUri: microsoftOidcJwksUri(input.tenant),
+    issuer: microsoftOidcIssuer(input.tenant),
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? microsoftOidcDefaultScopes)],
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeGenericOidcProvider = (input) => ({
+    id: input.id,
+    clientId: input.clientId,
+    authorizationEndpoint: input.authorizationEndpoint,
+    tokenEndpoint: input.tokenEndpoint,
+    issuer: input.issuer,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? genericOidcDefaultScopes)],
+    ...(input.userInfoEndpoint === undefined
+        ? {}
+        : { userInfoEndpoint: input.userInfoEndpoint }),
+    ...(input.jwksUri === undefined ? {} : { jwksUri: input.jwksUri }),
+    ...(input.revocationEndpoint === undefined
+        ? {}
+        : { revocationEndpoint: input.revocationEndpoint }),
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+const oauthClientSecretPost = (clientSecret) => ({
+    method: "client_secret_post",
+    clientSecret,
+});
+export const makeGoogleOidcProviderTokenRefreshInput = (input) => ({
+    accountId: input.accountId,
+    userId: input.userId,
+    providerId: input.provider.id,
+    providerAccountId: input.providerAccountId,
+    provider: input.provider,
+    scopes: [...(input.scopes ?? googleOidcDefaultScopes)],
+    ...(input.now === undefined ? {} : { now: input.now }),
+    ...(input.clientSecret === undefined
+        ? {}
+        : { clientAuthentication: oauthClientSecretPost(input.clientSecret) }),
+    ...(input.params === undefined ? {} : { params: input.params }),
+});
+export const makeGoogleOidcProviderTokenRevokeInput = (input) => ({
+    accountId: input.accountId,
+    provider: input.provider,
+    reason: input.reason,
+    ...(input.now === undefined ? {} : { now: input.now }),
+    ...(input.clientSecret === undefined
+        ? {}
+        : { clientAuthentication: oauthClientSecretPost(input.clientSecret) }),
+    ...(input.params === undefined ? {} : { params: input.params }),
+});
+export const makeMicrosoftOidcProviderTokenRefreshInput = (input) => ({
+    accountId: input.accountId,
+    userId: input.userId,
+    providerId: input.provider.id,
+    providerAccountId: input.providerAccountId,
+    provider: input.provider,
+    scopes: [...(input.scopes ?? microsoftOidcOfflineAccessScopes)],
+    ...(input.now === undefined ? {} : { now: input.now }),
+    ...(input.clientSecret === undefined
+        ? {}
+        : { clientAuthentication: oauthClientSecretPost(input.clientSecret) }),
+    ...(input.params === undefined ? {} : { params: input.params }),
+});
+export const makeAppleSignInProviderTokenRefreshInput = (input) => ({
+    accountId: input.accountId,
+    userId: input.userId,
+    providerId: input.provider.id,
+    providerAccountId: input.providerAccountId,
+    provider: input.provider,
+    clientAuthentication: oauthClientSecretPost(input.clientSecret),
+    ...(input.scopes === undefined ? {} : { scopes: input.scopes }),
+    ...(input.now === undefined ? {} : { now: input.now }),
+    ...(input.params === undefined ? {} : { params: input.params }),
+});
+export const makeAppleSignInProviderTokenRevokeInput = (input) => ({
+    accountId: input.accountId,
+    provider: input.provider,
+    reason: input.reason,
+    clientAuthentication: oauthClientSecretPost(input.clientSecret),
+    ...(input.now === undefined ? {} : { now: input.now }),
+    ...(input.params === undefined ? {} : { params: input.params }),
+});
+const cloneProviderConfig = (provider) => ({
+    ...provider,
+    ...(provider.scopes === undefined ? {} : { scopes: [...provider.scopes] }),
+    ...(provider.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...provider.authorizationParams } }),
+    ...(provider.metadata === undefined ? {} : { metadata: metadataValue(provider.metadata) }),
+});
+const cloneOAuthClientRecord = (client) => ({
+    ...client,
+    redirectUris: [...client.redirectUris],
+    allowedGrantTypes: [...client.allowedGrantTypes],
+    allowedResponseTypes: [...client.allowedResponseTypes],
+    ...(client.allowedScopes === undefined
+        ? {}
+        : { allowedScopes: [...client.allowedScopes] }),
+    ...(client.metadata === undefined ? {} : { metadata: metadataValue(client.metadata) }),
+});
+const validateOAuthClientRedirectUriRecord = (client, input) => {
+    if (client === undefined) {
+        return { valid: false, reason: "unknown_client" };
+    }
+    if (client.status !== "active") {
+        return { valid: false, reason: "disabled_client" };
+    }
+    const responseType = input.responseType ?? "code";
+    if (!client.allowedResponseTypes.includes(responseType)) {
+        return { valid: false, reason: "unsupported_response_type" };
+    }
+    if (input.grantType !== undefined &&
+        !client.allowedGrantTypes.includes(input.grantType)) {
+        return { valid: false, reason: "unsupported_grant_type" };
+    }
+    if (!client.redirectUris.includes(input.redirectUri)) {
+        return { valid: false, reason: "redirect_uri_mismatch" };
+    }
+    return {
+        valid: true,
+        client: cloneOAuthClientRecord(client),
+    };
+};
+const cloneOAuthConsentRecord = (record) => ({
+    userId: record.userId,
+    clientId: record.clientId,
+    scopes: [...record.scopes],
+    grantedAt: record.grantedAt,
+    ...(record.expiresAt === undefined ? {} : { expiresAt: record.expiresAt }),
+    ...(record.revokedAt === undefined ? {} : { revokedAt: record.revokedAt }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
+});
+const oauthConsentCoversScopes = (record, scopes = []) => scopes.every((scope) => record.scopes.includes(scope));
+const isOAuthConsentActive = (record, now, scopes = []) => record.revokedAt === undefined &&
+    (record.expiresAt === undefined || Number(record.expiresAt) > Number(now)) &&
+    oauthConsentCoversScopes(record, scopes);
+const cloneOAuthClientSecretRecord = (record) => ({
+    ...record,
+    authenticationMethods: [...record.authenticationMethods],
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const cloneAuthorizationCodeRecord = (record) => ({
+    ...record,
+    scopes: [...record.scopes],
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const cloneOAuthTokenResponse = (tokens) => ({
+    accessToken: tokens.accessToken,
+    tokenType: tokens.tokenType,
+    ...(tokens.expiresIn === undefined ? {} : { expiresIn: tokens.expiresIn }),
+    ...(tokens.refreshToken === undefined ? {} : { refreshToken: tokens.refreshToken }),
+    ...(tokens.idToken === undefined ? {} : { idToken: tokens.idToken }),
+    ...(tokens.scopes === undefined ? {} : { scopes: [...tokens.scopes] }),
+    ...(tokens.extra === undefined ? {} : { extra: metadataValue(tokens.extra) }),
+});
+const cloneOAuthTokenIntrospectionResponse = (response) => response.active
+    ? {
+        active: true,
+        ...(response.scopes === undefined ? {} : { scopes: [...response.scopes] }),
+        ...(response.clientId === undefined ? {} : { clientId: response.clientId }),
+        ...(response.username === undefined ? {} : { username: response.username }),
+        ...(response.tokenType === undefined ? {} : { tokenType: response.tokenType }),
+        ...(response.expiresAt === undefined ? {} : { expiresAt: response.expiresAt }),
+        ...(response.issuedAt === undefined ? {} : { issuedAt: response.issuedAt }),
+        ...(response.notBefore === undefined ? {} : { notBefore: response.notBefore }),
+        ...(response.subject === undefined ? {} : { subject: response.subject }),
+        ...(response.audience === undefined
+            ? {}
+            : {
+                audience: Array.isArray(response.audience)
+                    ? [...response.audience]
+                    : response.audience,
+            }),
+        ...(response.issuer === undefined ? {} : { issuer: response.issuer }),
+        ...(response.jwtId === undefined ? {} : { jwtId: response.jwtId }),
+        ...(response.extra === undefined ? {} : { extra: metadataValue(response.extra) }),
+    }
+    : { active: false };
+const cloneOAuthProviderModeTokenRecord = (record) => ({
+    ...record,
+    scopes: [...record.scopes],
+    ...(record.audience === undefined
+        ? {}
+        : {
+            audience: Array.isArray(record.audience)
+                ? [...record.audience]
+                : record.audience,
+        }),
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const consumedAuthorizationCode = (record, consumedAt) => ({
+    clientId: record.clientId,
+    subject: record.subject,
+    redirectUri: record.redirectUri,
+    scopes: [...record.scopes],
+    ...(record.codeChallenge === undefined
+        ? {}
+        : { codeChallenge: record.codeChallenge }),
+    ...(record.codeChallengeMethod === undefined
+        ? {}
+        : { codeChallengeMethod: record.codeChallengeMethod }),
+    issuedAt: record.issuedAt,
+    expiresAt: record.expiresAt,
+    consumedAt,
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const issuedAuthorizationCode = (input) => ({
+    code: Redacted.make(input.code),
+    clientId: input.record.clientId,
+    subject: input.record.subject,
+    redirectUri: input.record.redirectUri,
+    scopes: [...input.record.scopes],
+    ...(input.record.codeChallenge === undefined
+        ? {}
+        : { codeChallenge: input.record.codeChallenge }),
+    ...(input.record.codeChallengeMethod === undefined
+        ? {}
+        : { codeChallengeMethod: input.record.codeChallengeMethod }),
+    issuedAt: input.record.issuedAt,
+    expiresAt: input.record.expiresAt,
+    ...(input.record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.record.metadata) }),
+});
+const encodeOAuthState = (input) => OAuthStateToken(`${input.challengeId}.${Redacted.value(input.secret)}`);
+export const parseOAuthState = (state) => {
+    const parts = String(state).split(".");
+    return parts.length === 2 && parts[0] !== "" && parts[1] !== ""
+        ? Effect.succeed({
+            challengeId: ChallengeId(parts[0]),
+            secret: Redacted.make(parts[1]),
+        })
+        : Effect.fail(oauthStateError("parse", "OAuth state must use '<id>.<secret>' format"));
+};
+const stringArrayFromUnknown = (value) => Array.isArray(value) && value.every((item) => typeof item === "string")
+    ? value
+    : [];
+const stringFromUnknown = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+const nonEmptyStringFromUnknown = (value) => typeof value === "string" && value.trim() !== "" ? value : undefined;
+export const githubOAuthVerifiedEmail = (emails) => {
+    for (const email of emails) {
+        if (email.primary === true && email.verified === true) {
+            const value = nonEmptyStringFromUnknown(email.email);
+            if (value !== undefined) {
+                return value;
+            }
+        }
+    }
+    for (const email of emails) {
+        if (email.verified === true) {
+            const value = nonEmptyStringFromUnknown(email.email);
+            if (value !== undefined) {
+                return value;
+            }
+        }
+    }
+    return undefined;
+};
+export const googleOidcHostedDomain = (value) => nonEmptyStringFromUnknown(value.hd);
+export const microsoftOidcTenantId = (value) => nonEmptyStringFromUnknown(value.tid);
+export const microsoftOidcObjectId = (value) => nonEmptyStringFromUnknown(value.oid);
+export const microsoftOidcAccountId = (value) => {
+    const tenantId = microsoftOidcTenantId(value);
+    const objectId = microsoftOidcObjectId(value);
+    return tenantId === undefined || objectId === undefined
+        ? undefined
+        : `${tenantId}:${objectId}`;
+};
+const optionalRecord = (value) => (Object.keys(value).length === 0 ? undefined : value);
+const recordFromUnknown = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+const isJwtAlgorithm = (value) => typeof value === "string" && JwtAlgorithms.includes(value);
+const isPublicJwksAlgorithm = (value) => isJwtAlgorithm(value) && value !== "HS256";
+const booleanFromUnknown = (value) => typeof value === "boolean" ? value : undefined;
+const emailFromUnknown = (value) => {
+    const email = nonEmptyStringFromUnknown(value);
+    return email === undefined ? undefined : Email(email);
+};
+const appleSignInBooleanClaim = (value) => {
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (value === "true") {
+        return true;
+    }
+    if (value === "false") {
+        return false;
+    }
+    return undefined;
+};
+export const decodeAppleSignInAuthorizationUser = (value) => {
+    const decoded = typeof value === "string"
+        ? (() => {
+            try {
+                return JSON.parse(value);
+            }
+            catch {
+                return undefined;
+            }
+        })()
+        : value;
+    const record = recordFromUnknown(decoded);
+    if (record === undefined) {
+        return undefined;
+    }
+    const nameRecord = recordFromUnknown(record.name);
+    const firstName = nonEmptyStringFromUnknown(nameRecord?.firstName);
+    const lastName = nonEmptyStringFromUnknown(nameRecord?.lastName);
+    const name = firstName === undefined && lastName === undefined
+        ? undefined
+        : {
+            ...(firstName === undefined ? {} : { firstName }),
+            ...(lastName === undefined ? {} : { lastName }),
+        };
+    const email = nonEmptyStringFromUnknown(record.email);
+    return email === undefined && name === undefined
+        ? undefined
+        : {
+            ...(email === undefined ? {} : { email }),
+            ...(name === undefined ? {} : { name }),
+        };
+};
+export const appleSignInAuthorizationUserFullName = (user) => {
+    const firstName = nonEmptyStringFromUnknown(user?.name?.firstName);
+    const lastName = nonEmptyStringFromUnknown(user?.name?.lastName);
+    const parts = [firstName, lastName].filter((part) => part !== undefined);
+    return parts.length === 0 ? undefined : parts.join(" ");
+};
+export const appleSignInAuthorizationUserEmail = (user) => emailFromUnknown(user?.email);
+export const appleSignInIsPrivateEmail = (input) => {
+    const claimValue = appleSignInBooleanClaim(input.claims?.is_private_email);
+    if (claimValue !== undefined) {
+        return claimValue;
+    }
+    const email = nonEmptyStringFromUnknown(input.email);
+    return email === undefined
+        ? undefined
+        : email.toLowerCase().endsWith(`@${appleSignInPrivateRelayDomain}`);
+};
+const firstString = (...values) => {
+    for (const value of values) {
+        const stringValue = nonEmptyStringFromUnknown(value);
+        if (stringValue !== undefined) {
+            return stringValue;
+        }
+    }
+    return undefined;
+};
+const optionalStringArrayFromUnknown = (value) => Array.isArray(value) && value.every((item) => typeof item === "string")
+    ? value
+    : undefined;
+const numberFromUnknown = (value) => {
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+};
+const isTokenResponseRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const scopeValues = (value) => {
+    if (typeof value !== "string" || value.trim() === "") {
+        return undefined;
+    }
+    return value.trim().split(/\s+/);
+};
+const audienceValues = (value) => {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+        return value;
+    }
+    return [];
+};
+const oidcIdTokenClaims = (claims, input) => {
+    if (nonEmptyStringFromUnknown(claims.sub) === undefined) {
+        return "missing_subject";
+    }
+    if (typeof claims.exp !== "number" || !Number.isFinite(claims.exp)) {
+        return "missing_expiration";
+    }
+    if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)) {
+        return "missing_issued_at";
+    }
+    const audiences = audienceValues(claims.aud);
+    const authorizedParty = input.authorizedParty ?? input.provider.clientId;
+    if (audiences.length > 1 && claims.azp === undefined) {
+        return "missing_authorized_party";
+    }
+    if (claims.azp !== undefined && claims.azp !== authorizedParty) {
+        return "authorized_party_mismatch";
+    }
+    if (input.nonce !== undefined && claims.nonce !== String(input.nonce)) {
+        return "nonce_mismatch";
+    }
+    return claims;
+};
+const tokenResponseExtra = (value) => {
+    const extra = Object.fromEntries(Object.entries(value).filter(([key]) => ![
+        "access_token",
+        "token_type",
+        "expires_in",
+        "refresh_token",
+        "id_token",
+        "scope",
+    ].includes(key)));
+    return Object.keys(extra).length === 0 ? undefined : extra;
+};
+const cloneVerifiedOAuthIdentity = (identity) => ({
+    ...identity,
+    ...(identity.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(identity.metadata) }),
+});
+const oauthLinkConfirmationChallengeType = "oauth-link-confirmation";
+const oauthLinkConfirmationMetadata = (input) => ({
+    userId: input.userId,
+    providerId: input.identity.providerId,
+    providerAccountId: input.identity.providerAccountId,
+    ...(input.identity.email === undefined ? {} : { email: input.identity.email }),
+    ...(input.identity.emailVerified === undefined
+        ? {}
+        : { emailVerified: input.identity.emailVerified }),
+    ...(input.identity.metadata === undefined
+        ? {}
+        : { identityMetadata: metadataValue(input.identity.metadata) }),
+    reason: input.reason,
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+const pendingOAuthLinkConfirmationFromChallenge = (challenge, operation) => {
+    const metadata = challenge.metadata ?? {};
+    const userId = stringFromUnknown(metadata.userId);
+    const providerId = stringFromUnknown(metadata.providerId);
+    const providerAccountId = stringFromUnknown(metadata.providerAccountId);
+    if (userId === undefined ||
+        userId !== challenge.subject ||
+        providerId === undefined ||
+        providerAccountId === undefined) {
+        return Effect.fail(oauthLinkConfirmationError(operation, "OAuth link confirmation challenge is missing required metadata"));
+    }
+    const email = emailFromUnknown(metadata.email);
+    const emailVerified = booleanFromUnknown(metadata.emailVerified);
+    const identityMetadata = recordFromUnknown(metadata.identityMetadata);
+    const appMetadata = recordFromUnknown(metadata.metadata);
+    return Effect.succeed({
+        challengeId: challenge.id,
+        userId: UserId(userId),
+        identity: {
+            providerId: OAuthProviderId(providerId),
+            providerAccountId,
+            ...(email === undefined ? {} : { email }),
+            ...(emailVerified === undefined ? {} : { emailVerified }),
+            ...(identityMetadata === undefined
+                ? {}
+                : { metadata: metadataValue(identityMetadata) }),
+        },
+        reason: stringFromUnknown(metadata.reason) ??
+            "manual",
+        expiresAt: challenge.expiresAt,
+        ...(appMetadata === undefined ? {} : { metadata: metadataValue(appMetadata) }),
+    });
+};
+const confirmedOAuthLinkConfirmationFromPending = (input) => ({
+    challengeId: input.pending.challengeId,
+    userId: input.pending.userId,
+    identity: cloneVerifiedOAuthIdentity(input.pending.identity),
+    reason: input.pending.reason,
+    ...(input.existingAccount === undefined
+        ? {}
+        : { existingAccount: input.existingAccount }),
+    ...(input.pending.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.pending.metadata) }),
+});
+const userInfoRecord = (value) => {
+    if (value === undefined) {
+        return Effect.succeed(undefined);
+    }
+    const record = recordFromUnknown(value);
+    return record === undefined
+        ? Effect.fail(oauthProfileNormalizationError("invalid_userinfo", "OIDC userinfo response must be an object"))
+        : Effect.succeed(record);
+};
+const makeOAuthProfile = (input) => ({
+    providerId: input.providerId,
+    providerAccountId: input.providerAccountId,
+    ...(input.email === undefined ? {} : { email: input.email }),
+    ...(input.emailVerified === undefined
+        ? {}
+        : { emailVerified: input.emailVerified }),
+    ...(input.name === undefined ? {} : { name: input.name }),
+    ...(input.username === undefined ? {} : { username: input.username }),
+    ...(input.avatarUrl === undefined ? {} : { avatarUrl: input.avatarUrl }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+const oauthJwksPublicJwkFromUnknown = (value) => {
+    const record = recordFromUnknown(value);
+    const kty = record === undefined ? undefined : nonEmptyStringFromUnknown(record.kty);
+    if (record === undefined || kty === undefined) {
+        return undefined;
+    }
+    const jwk = {};
+    for (const [name, member] of Object.entries(record)) {
+        if (!oauthJwksPrivateMembers.has(name) && member !== undefined) {
+            jwk[name] = member;
+        }
+    }
+    return {
+        ...jwk,
+        kty,
+    };
+};
+const oauthJwksAllowsSignatureUse = (jwk) => {
+    const use = nonEmptyStringFromUnknown(jwk.use);
+    const keyOps = optionalStringArrayFromUnknown(jwk.key_ops);
+    return ((use === undefined || use === "sig") &&
+        (keyOps === undefined || keyOps.includes("verify")));
+};
+const oauthJwksDefaultAlgorithms = (jwk) => {
+    switch (jwk.kty) {
+        case "RSA": {
+            return ["RS256"];
+        }
+        case "EC": {
+            return ["ES256"];
+        }
+        case "OKP": {
+            return ["EdDSA"];
+        }
+        default: {
+            return [];
+        }
+    }
+};
+const oauthJwksAlgorithms = (jwk, allowedAlgorithms) => {
+    const jwkAlgorithm = nonEmptyStringFromUnknown(jwk.alg);
+    const algorithms = jwkAlgorithm === undefined
+        ? oauthJwksDefaultAlgorithms(jwk)
+        : isPublicJwksAlgorithm(jwkAlgorithm)
+            ? [jwkAlgorithm]
+            : [];
+    if (allowedAlgorithms === undefined) {
+        return algorithms;
+    }
+    return algorithms.filter((algorithm) => allowedAlgorithms.includes(algorithm));
+};
+const oauthJwksRecordsFromDocument = (provider, document, allowedAlgorithms) => document.keys.flatMap((jwk) => {
+    const kid = nonEmptyStringFromUnknown(jwk.kid);
+    if (kid === undefined || !oauthJwksAllowsSignatureUse(jwk)) {
+        return [];
+    }
+    return oauthJwksAlgorithms(jwk, allowedAlgorithms).map((alg) => ({
+        id: JwtKeyId(kid),
+        alg,
+        status: "active",
+        publicJwk: {
+            ...jwk,
+            kid,
+            alg,
+            use: nonEmptyStringFromUnknown(jwk.use) ?? "sig",
+        },
+        metadata: {
+            providerId: provider.id,
+        },
+    }));
+});
+const oauthJwksKeyUsableAt = (key, now) => now === undefined || key.expiresAt === undefined || Number(now) < Number(key.expiresAt);
+const oauthJwksVerificationKeyMatches = (key, input) => key.id === input.kid &&
+    key.status !== "disabled" &&
+    key.publicJwk !== undefined &&
+    (input.alg === undefined || key.alg === input.alg) &&
+    oauthJwksKeyUsableAt(key, input.now);
+const oauthJwksNow = (now) => now === undefined ? currentUnixMillis : Effect.succeed(now);
+const formUrlEncode = (value) => new URLSearchParams([["", value]]).toString().slice(1);
+const clientSecretBasic = (provider, secret) => `Basic ${Encoding.encodeBase64(textEncoder.encode(`${formUrlEncode(provider.clientId)}:${formUrlEncode(secret)}`))}`;
+const oauthTokenRequestHeaders = () => ({
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json",
+});
+const oauthRequestHeadersWithoutAuthorization = (headers) => {
+    const value = {};
+    for (const [name, headerValue] of Object.entries(headers ?? {})) {
+        if (name.toLowerCase() !== "authorization") {
+            value[name] = headerValue;
+        }
+    }
+    return value;
+};
+const applyOAuthClientAuthentication = (input) => {
+    const clientAuthentication = input.clientAuthentication ?? { method: "none" };
+    if (clientAuthentication.method === "client_secret_basic") {
+        input.body.delete("client_id");
+        input.body.delete("client_secret");
+        input.headers.authorization = clientSecretBasic(input.provider, Redacted.value(clientAuthentication.clientSecret));
+    }
+    else {
+        input.body.set("client_id", input.provider.clientId);
+    }
+    if (clientAuthentication.method === "client_secret_post") {
+        input.body.set("client_secret", Redacted.value(clientAuthentication.clientSecret));
+    }
+};
+export const makeOAuthTokenRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.tokenEndpoint === undefined) {
+            throw new Error("OAuth provider tokenEndpoint is required");
+        }
+        const body = new URLSearchParams(input.params);
+        const headers = oauthTokenRequestHeaders();
+        body.set("grant_type", "authorization_code");
+        body.set("code", String(input.code));
+        body.set("redirect_uri", input.redirectUri ?? input.provider.redirectUri);
+        body.set("code_verifier", Redacted.value(input.codeVerifier));
+        applyOAuthClientAuthentication({
+            provider: input.provider,
+            body,
+            headers,
+            clientAuthentication: input.clientAuthentication,
+        });
+        return {
+            url: input.provider.tokenEndpoint,
+            method: "POST",
+            headers,
+            body: body.toString(),
+        };
+    },
+    catch: (cause) => oauthTokenExchangeError("token-request", "Failed to build OAuth token request", cause),
+});
+export const makeOAuthRefreshTokenRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.tokenEndpoint === undefined) {
+            throw new Error("OAuth provider tokenEndpoint is required");
+        }
+        const body = new URLSearchParams(input.params);
+        const headers = oauthTokenRequestHeaders();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", Redacted.value(input.refreshToken));
+        if (input.scopes !== undefined) {
+            body.set("scope", input.scopes.join(" "));
+        }
+        applyOAuthClientAuthentication({
+            provider: input.provider,
+            body,
+            headers,
+            clientAuthentication: input.clientAuthentication,
+        });
+        return {
+            url: input.provider.tokenEndpoint,
+            method: "POST",
+            headers,
+            body: body.toString(),
+        };
+    },
+    catch: (cause) => oauthTokenExchangeError("refresh-token-request", "Failed to build OAuth refresh token request", cause),
+});
+export const makeOAuthTokenRevocationRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.revocationEndpoint === undefined) {
+            throw new Error("OAuth provider revocationEndpoint is required");
+        }
+        const body = new URLSearchParams(input.params);
+        const headers = oauthTokenRequestHeaders();
+        body.set("token", Redacted.value(input.token));
+        if (input.tokenTypeHint !== undefined) {
+            body.set("token_type_hint", input.tokenTypeHint);
+        }
+        applyOAuthClientAuthentication({
+            provider: input.provider,
+            body,
+            headers,
+            clientAuthentication: input.clientAuthentication,
+        });
+        return {
+            url: input.provider.revocationEndpoint,
+            method: "POST",
+            headers,
+            body: body.toString(),
+        };
+    },
+    catch: (cause) => oauthTokenExchangeError("revocation-request", "Failed to build OAuth token revocation request", cause),
+});
+export const makeOAuthUserInfoRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.userInfoEndpoint === undefined) {
+            throw new Error("OAuth provider userInfoEndpoint is required");
+        }
+        const url = new URL(input.provider.userInfoEndpoint);
+        for (const [name, value] of Object.entries(input.params ?? {})) {
+            url.searchParams.set(name, value);
+        }
+        return {
+            url: url.toString(),
+            method: "GET",
+            headers: {
+                accept: "application/json",
+                ...oauthRequestHeadersWithoutAuthorization(input.headers),
+                authorization: `Bearer ${Redacted.value(input.accessToken)}`,
+            },
+        };
+    },
+    catch: (cause) => oauthUserInfoError("request", "Failed to build OAuth userinfo request", cause),
+});
+export const decodeOAuthUserInfoResponse = (value) => {
+    const record = recordFromUnknown(value);
+    return record === undefined
+        ? Effect.fail(oauthUserInfoError("decode", "OAuth userinfo response must be an object"))
+        : Effect.succeed(metadataValue(record) ?? {});
+};
+export const decodeOAuthTokenResponse = (value) => Effect.gen(function* () {
+    if (!isTokenResponseRecord(value)) {
+        return yield* oauthTokenExchangeError("decode-token-response", "OAuth token response must be an object");
+    }
+    const accessToken = stringFromUnknown(value.access_token);
+    const tokenType = stringFromUnknown(value.token_type);
+    if (accessToken === undefined) {
+        return yield* oauthTokenExchangeError("decode-token-response", "OAuth token response is missing access_token");
+    }
+    if (tokenType === undefined) {
+        return yield* oauthTokenExchangeError("decode-token-response", "OAuth token response is missing token_type");
+    }
+    const refreshToken = stringFromUnknown(value.refresh_token);
+    const idToken = stringFromUnknown(value.id_token);
+    return {
+        accessToken: Redacted.make(OAuthAccessToken(accessToken)),
+        tokenType,
+        expiresIn: numberFromUnknown(value.expires_in),
+        ...(refreshToken === undefined
+            ? {}
+            : { refreshToken: Redacted.make(OAuthRefreshToken(refreshToken)) }),
+        ...(idToken === undefined
+            ? {}
+            : { idToken: Redacted.make(OAuthIdToken(idToken)) }),
+        scopes: scopeValues(value.scope),
+        extra: tokenResponseExtra(value),
+    };
+});
+export const makeOidcIdTokenVerifier = (dependencies) => OidcIdTokenVerifier.make({
+    verify: Effect.fn("auth.oidc_id_token.verify")(function* (input) {
+        const { provider } = input;
+        const { issuer } = provider;
+        if (issuer === undefined) {
+            return {
+                valid: false,
+                reason: "missing_provider_issuer",
+            };
+        }
+        const verified = yield* dependencies.jwtVerifier
+            .verify({
+            token: Redacted.make(Redacted.value(input.idToken)),
+            issuer,
+            audience: input.audience ?? provider.clientId,
+            now: input.now,
+            clockTolerance: input.clockTolerance,
+        })
+            .pipe(Effect.mapError((cause) => oidcIdTokenVerifierError("verify", "Failed to verify OIDC ID token JWT", cause)));
+        if (!verified.valid) {
+            return verified;
+        }
+        const claims = oidcIdTokenClaims(verified.claims, input);
+        if (typeof claims === "string") {
+            return { valid: false, reason: claims };
+        }
+        return {
+            valid: true,
+            header: verified.header,
+            claims,
+            key: verified.key,
+        };
+    }),
+});
+export const verifyOidcIdToken = (input) => OidcIdTokenVerifier.use((verifier) => verifier.verify(input));
+export const decodeOAuthJwksDocument = (input) => Effect.gen(function* () {
+    const record = recordFromUnknown(input);
+    if (record === undefined || !Array.isArray(record.keys)) {
+        return yield* oauthJwksJwtError("OAuth JWKS document must contain keys");
+    }
+    const keys = [];
+    for (const key of record.keys) {
+        const publicJwk = oauthJwksPublicJwkFromUnknown(key);
+        if (publicJwk === undefined) {
+            return yield* oauthJwksJwtError("OAuth JWKS key must be a public JWK");
+        }
+        keys.push(publicJwk);
+    }
+    return { keys };
+});
+export const makeOAuthJwksJwtKeys = (dependencies) => {
+    const cacheTtlMillis = Math.max(0, Duration.toMillis(dependencies.cacheTtl ?? defaultOAuthJwksCacheTtl));
+    const allowedAlgorithms = dependencies.allowedAlgorithms?.filter(isPublicJwksAlgorithm);
+    let cache;
+    const loadRecords = (now) => Effect.gen(function* () {
+        if (cache !== undefined && Number(now) < Number(cache.expiresAt)) {
+            return cache.records;
+        }
+        const url = nonEmptyStringFromUnknown(dependencies.provider.jwksUri);
+        if (url === undefined) {
+            return yield* oauthJwksJwtError("OAuth provider JWKS URI is required");
+        }
+        const rawDocument = yield* dependencies.fetch({
+            provider: dependencies.provider,
+            url,
+        });
+        const document = yield* decodeOAuthJwksDocument(rawDocument);
+        const records = oauthJwksRecordsFromDocument(dependencies.provider, document, allowedAlgorithms);
+        cache = {
+            records,
+            expiresAt: UnixMillis(Number(now) + cacheTtlMillis),
+        };
+        return records;
+    });
+    return JwtKeys.make({
+        selectSigningKey: () => Effect.succeed(Option.none()),
+        findVerificationKey: Effect.fn("auth.oauth_jwks.find_verification_key")(function* (input) {
+            const now = yield* oauthJwksNow(input.now);
+            const records = yield* loadRecords(now);
+            const key = records.find((record) => oauthJwksVerificationKeyMatches(record, { ...input, now }));
+            return key === undefined ? Option.none() : Option.some(key);
+        }),
+        listPublicJwks: Effect.fn("auth.oauth_jwks.list_public_jwks")(function* (input) {
+            const now = yield* oauthJwksNow(input?.now);
+            const records = yield* loadRecords(now);
+            return records.flatMap((record) => record.publicJwk === undefined || !oauthJwksKeyUsableAt(record, now)
+                ? []
+                : [record.publicJwk]);
+        }),
+    });
+};
+export const normalizeOidcProfile = (input) => Effect.gen(function* () {
+    const { claims, provider } = input;
+    if (claims === undefined) {
+        return yield* oauthProfileNormalizationError("missing_claims", "OIDC ID token claims are required to normalize an OAuth profile");
+    }
+    const subject = nonEmptyStringFromUnknown(claims.sub);
+    if (subject === undefined) {
+        return yield* oauthProfileNormalizationError("missing_subject", "OIDC profile is missing subject");
+    }
+    const userInfo = yield* userInfoRecord(input.userInfo);
+    const userInfoSubject = userInfo === undefined ? undefined : nonEmptyStringFromUnknown(userInfo.sub);
+    if (userInfoSubject !== undefined && userInfoSubject !== subject) {
+        return yield* oauthProfileNormalizationError("subject_mismatch", "OIDC userinfo subject does not match ID token subject");
+    }
+    const email = emailFromUnknown(userInfo?.email) ?? emailFromUnknown(claims.email);
+    const emailVerified = booleanFromUnknown(userInfo?.email_verified) ??
+        booleanFromUnknown(claims.email_verified);
+    const metadata = optionalRecord({
+        ...(input.metadata === undefined ? {} : input.metadata),
+    });
+    return makeOAuthProfile({
+        providerId: provider.id,
+        providerAccountId: subject,
+        email,
+        emailVerified,
+        name: firstString(userInfo?.name, claims.name),
+        username: firstString(userInfo?.preferred_username, claims.preferred_username),
+        avatarUrl: firstString(userInfo?.picture, claims.picture),
+        metadata,
+    });
+});
+export const makeOidcOAuthProfileNormalizer = () => OAuthProfileNormalizer.make({
+    normalize: Effect.fn("auth.oauth_profile.normalize_oidc")(normalizeOidcProfile),
+});
+export const normalizeOAuthProfile = (input) => OAuthProfileNormalizer.use((normalizer) => normalizer.normalize(input));
+export const verifiedOAuthIdentityFromProfile = (profile) => {
+    const metadata = optionalRecord({
+        ...(profile.name === undefined ? {} : { name: profile.name }),
+        ...(profile.username === undefined ? {} : { username: profile.username }),
+        ...(profile.avatarUrl === undefined ? {} : { avatarUrl: profile.avatarUrl }),
+        ...(profile.metadata === undefined ? {} : profile.metadata),
+    });
+    return {
+        providerId: profile.providerId,
+        providerAccountId: profile.providerAccountId,
+        ...(profile.email === undefined ? {} : { email: profile.email }),
+        ...(profile.emailVerified === undefined
+            ? {}
+            : { emailVerified: profile.emailVerified }),
+        ...(metadata === undefined ? {} : { metadata: metadataValue(metadata) }),
+    };
+};
+export const makeOAuthTokenExchange = (dependencies) => OAuthTokenExchange.make({
+    exchangeAuthorizationCode: Effect.fn("auth.oauth_token.exchange_code")(function* (input) {
+        const request = yield* makeOAuthTokenRequest(input);
+        const response = yield* dependencies.request(request);
+        return yield* decodeOAuthTokenResponse(response).pipe(Effect.mapError((cause) => oauthTokenExchangeError("exchange-code", "Failed to decode OAuth token exchange response", cause)));
+    }),
+});
+const oauthProviderTokenString = (token) => Redacted.make(String(Redacted.value(token)));
+const oauthProviderTokenExpiresAt = (input) => input.expiresIn === undefined
+    ? undefined
+    : UnixMillis(Number(input.now) + input.expiresIn * 1000);
+const storeOAuthProviderTokenResponse = (dependencies, input, operation) => Effect.gen(function* () {
+    const now = input.now ?? (yield* currentUnixMillis);
+    const accessTokenCiphertext = yield* dependencies
+        .encryptToken(oauthProviderTokenString(input.tokens.accessToken))
+        .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError(operation, "Failed to encrypt OAuth provider access token", cause)));
+    const refreshTokenCiphertext = input.tokens.refreshToken === undefined
+        ? input.fallbackRefreshTokenCiphertext
+        : yield* dependencies
+            .encryptToken(oauthProviderTokenString(input.tokens.refreshToken))
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError(operation, "Failed to encrypt OAuth provider refresh token", cause)));
+    const idTokenCiphertext = input.tokens.idToken === undefined
+        ? undefined
+        : yield* dependencies
+            .encryptToken(oauthProviderTokenString(input.tokens.idToken))
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError(operation, "Failed to encrypt OAuth provider ID token", cause)));
+    const expiresAt = oauthProviderTokenExpiresAt({
+        now,
+        expiresIn: input.tokens.expiresIn,
+    });
+    yield* dependencies.tokenVault
+        .upsert({
+        accountId: input.accountId,
+        userId: input.userId,
+        providerId: input.providerId,
+        providerAccountId: input.providerAccountId,
+        accessTokenCiphertext,
+        tokenType: input.tokens.tokenType,
+        updatedAt: now,
+        ...(refreshTokenCiphertext === undefined ? {} : { refreshTokenCiphertext }),
+        ...(idTokenCiphertext === undefined ? {} : { idTokenCiphertext }),
+        ...(input.tokens.scopes === undefined ? {} : { scopes: input.tokens.scopes }),
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+    })
+        .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError(operation, "Failed to store OAuth provider token ciphertext", cause)));
+    return {
+        accountId: input.accountId,
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+        hasRefreshToken: refreshTokenCiphertext !== undefined,
+        scopes: [...(input.tokens.scopes ?? [])],
+    };
+});
+const revokeOAuthProviderTokenCiphertext = (dependencies, input, tokenCiphertext, tokenTypeHint) => Effect.gen(function* () {
+    const token = yield* dependencies.decryptToken(tokenCiphertext).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", `Failed to decrypt OAuth provider ${tokenTypeHint}`, cause)));
+    const request = yield* makeOAuthTokenRevocationRequest({
+        provider: input.provider,
+        token,
+        tokenTypeHint,
+        ...(input.clientAuthentication === undefined
+            ? {}
+            : { clientAuthentication: input.clientAuthentication }),
+        ...(input.params === undefined ? {} : { params: input.params }),
+    }).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to build OAuth provider token revocation request", cause)));
+    yield* dependencies.request(request).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to execute OAuth provider token revocation request", cause)));
+});
+export const makeOAuthProviderTokenLifecycle = (dependencies) => OAuthProviderTokenLifecycle.make({
+    store: Effect.fn("auth.oauth_provider_token_lifecycle.store")(function* (input) {
+        return yield* storeOAuthProviderTokenResponse(dependencies, input, "store");
+    }),
+    refresh: Effect.fn("auth.oauth_provider_token_lifecycle.refresh")(function* (input) {
+        const refreshTokenCiphertext = yield* dependencies.tokenVault
+            .refreshTokenForAccount({ accountId: input.accountId })
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to load OAuth provider refresh token ciphertext", cause)));
+        if (Option.isNone(refreshTokenCiphertext)) {
+            return {
+                status: "missing-refresh-token",
+                accountId: input.accountId,
+            };
+        }
+        const refreshToken = yield* dependencies
+            .decryptToken(refreshTokenCiphertext.value)
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to decrypt OAuth provider refresh token", cause)));
+        const request = yield* makeOAuthRefreshTokenRequest({
+            provider: input.provider,
+            refreshToken,
+            ...(input.scopes === undefined ? {} : { scopes: input.scopes }),
+            ...(input.clientAuthentication === undefined
+                ? {}
+                : { clientAuthentication: input.clientAuthentication }),
+            ...(input.params === undefined ? {} : { params: input.params }),
+        }).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to build OAuth provider token refresh request", cause)));
+        const rawResponse = yield* dependencies.request(request).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to execute OAuth provider token refresh request", cause)));
+        const tokens = yield* decodeOAuthTokenResponse(rawResponse).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to decode OAuth provider token refresh response", cause)));
+        const stored = yield* storeOAuthProviderTokenResponse(dependencies, {
+            accountId: input.accountId,
+            userId: input.userId,
+            providerId: input.providerId,
+            providerAccountId: input.providerAccountId,
+            tokens,
+            fallbackRefreshTokenCiphertext: refreshTokenCiphertext.value,
+            now: input.now,
+        }, "refresh");
+        return {
+            status: "refreshed",
+            ...stored,
+        };
+    }),
+    revoke: Effect.fn("auth.oauth_provider_token_lifecycle.revoke")(function* (input) {
+        const tokens = yield* dependencies.tokenVault
+            .tokensForAccount({ accountId: input.accountId })
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to load OAuth provider token ciphertext", cause)));
+        if (Option.isNone(tokens)) {
+            return {
+                status: "missing-tokens",
+                accountId: input.accountId,
+            };
+        }
+        yield* revokeOAuthProviderTokenCiphertext(dependencies, input, tokens.value.accessTokenCiphertext, "access_token");
+        if (tokens.value.refreshTokenCiphertext !== undefined) {
+            yield* revokeOAuthProviderTokenCiphertext(dependencies, input, tokens.value.refreshTokenCiphertext, "refresh_token");
+        }
+        const revokedAt = input.now ?? (yield* currentUnixMillis);
+        yield* dependencies.tokenVault
+            .markRevoked({
+            accountId: input.accountId,
+            revokedAt,
+            reason: input.reason,
+        })
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to mark OAuth provider tokens revoked", cause)));
+        return {
+            status: "revoked",
+            accountId: input.accountId,
+            revokedAt,
+        };
+    }),
+});
+export const OAuthProviderTokenLifecycleLive = (options) => Layer.effect(OAuthProviderTokenLifecycle)(Effect.gen(function* () {
+    const tokenVault = yield* OAuthProviderTokenVault;
+    return makeOAuthProviderTokenLifecycle({
+        tokenVault,
+        ...options,
+    });
+}));
+export const storeOAuthProviderTokens = (input) => OAuthProviderTokenLifecycle.use((lifecycle) => lifecycle.store(input));
+export const refreshOAuthProviderTokens = (input) => OAuthProviderTokenLifecycle.use((lifecycle) => lifecycle.refresh(input));
+export const revokeOAuthProviderTokens = (input) => OAuthProviderTokenLifecycle.use((lifecycle) => lifecycle.revoke(input));
+export const completeOAuthCallback = (input) => Effect.gen(function* () {
+    const oauthState = yield* OAuthState;
+    const tokenExchange = yield* OAuthTokenExchange;
+    const verifiedState = yield* oauthState.verify({ state: input.state });
+    if (verifiedState.providerId !== input.provider.id) {
+        return yield* oauthStateError("verify", "OAuth callback provider does not match verified state");
+    }
+    const tokens = yield* tokenExchange.exchangeAuthorizationCode({
+        provider: input.provider,
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        redirectUri: input.redirectUri ?? verifiedState.redirectUri ?? input.provider.redirectUri,
+        clientAuthentication: input.clientAuthentication,
+        params: input.tokenParams,
+    });
+    return { state: verifiedState, tokens };
+});
+export const makeOAuthAccountLinkingPolicy = (dependencies) => OAuthAccountLinking.make({
+    resolve: Effect.fn("auth.oauth_account_linking.resolve")(function* (input) {
+        const identity = cloneVerifiedOAuthIdentity(input.identity);
+        const linked = yield* dependencies.accounts
+            .findByProviderAccount({
+            providerId: identity.providerId,
+            providerAccountId: identity.providerAccountId,
+        })
+            .pipe(Effect.mapError((cause) => oauthAccountLinkingError("resolve", "Failed to look up OAuth provider account", cause)));
+        if (Option.isSome(linked)) {
+            const account = linked.value;
+            if (input.currentUserId !== undefined &&
+                account.userId !== input.currentUserId) {
+                return {
+                    type: "deny",
+                    reason: "provider-account-linked-to-different-user",
+                    identity,
+                    account,
+                    currentUserId: input.currentUserId,
+                };
+            }
+            return {
+                type: "sign-in",
+                reason: "linked-account",
+                userId: account.userId,
+                account,
+            };
+        }
+        if (input.currentUserId !== undefined) {
+            return {
+                type: "link-existing-user",
+                reason: "current-user",
+                userId: input.currentUserId,
+                identity,
+            };
+        }
+        if (input.matchedUserId !== undefined) {
+            if (dependencies.autoLinkVerifiedEmail === true &&
+                identity.emailVerified === true) {
+                return {
+                    type: "link-existing-user",
+                    reason: "verified-email",
+                    userId: input.matchedUserId,
+                    identity,
+                };
+            }
+            return {
+                type: "require-explicit-linking",
+                reason: identity.emailVerified === true ? "matched-email" : "unverified-email",
+                identity,
+                matchedUserId: input.matchedUserId,
+            };
+        }
+        return {
+            type: "require-explicit-linking",
+            reason: "no-linked-account",
+            identity,
+        };
+    }),
+});
+export const resolveOAuthAccountLinking = (input) => OAuthAccountLinking.use((linking) => linking.resolve(input));
+export const makeOAuthAccountUnlinkingPolicy = (dependencies) => OAuthAccountUnlinking.make({
+    resolve: Effect.fn("auth.oauth_account_unlinking.resolve")(function* (input) {
+        const account = yield* dependencies.accounts
+            .findByProviderAccount({
+            providerId: input.providerId,
+            providerAccountId: input.providerAccountId,
+        })
+            .pipe(Effect.mapError((cause) => oauthAccountUnlinkingError("resolve", "Failed to look up OAuth provider account", cause)));
+        if (Option.isNone(account)) {
+            return {
+                type: "deny-not-found",
+                reason: "provider-account-not-found",
+                userId: input.userId,
+                providerId: input.providerId,
+                providerAccountId: input.providerAccountId,
+            };
+        }
+        const linkedAccount = account.value;
+        if (linkedAccount.userId !== input.userId) {
+            return {
+                type: "deny-not-owner",
+                reason: "provider-account-linked-to-different-user",
+                userId: input.userId,
+                account: linkedAccount,
+            };
+        }
+        const remainingAccounts = yield* dependencies.accounts
+            .listByUser({ userId: input.userId })
+            .pipe(Effect.map((accounts) => accounts.filter((linked) => linked.id !== linkedAccount.id)), Effect.mapError((cause) => oauthAccountUnlinkingError("resolve", "Failed to list OAuth provider accounts for user", cause)));
+        if (dependencies.allowLastAccount !== true && remainingAccounts.length === 0) {
+            return {
+                type: "deny-last-account",
+                reason: "last-linked-account",
+                userId: input.userId,
+                account: linkedAccount,
+            };
+        }
+        if (dependencies.requireStepUp === true && input.stepUpSatisfied !== true) {
+            return {
+                type: "requires-step-up",
+                reason: "step-up-required",
+                userId: input.userId,
+                account: linkedAccount,
+                remainingAccounts,
+            };
+        }
+        return {
+            type: "allow",
+            reason: "owned-account",
+            userId: input.userId,
+            account: linkedAccount,
+            remainingAccounts,
+        };
+    }),
+});
+export const resolveOAuthAccountUnlinking = (input) => OAuthAccountUnlinking.use((unlinking) => unlinking.resolve(input));
+const findOAuthLinkConfirmationExistingAccount = (dependencies, input) => dependencies.accounts
+    .findByProviderAccount({
+    providerId: input.identity.providerId,
+    providerAccountId: input.identity.providerAccountId,
+})
+    .pipe(Effect.mapError((cause) => oauthLinkConfirmationError(input.operation, "Failed to look up OAuth provider account", cause)), Effect.flatMap((account) => {
+    if (Option.isNone(account)) {
+        return Effect.succeed(account);
+    }
+    if (account.value.userId !== input.userId) {
+        return Effect.fail(oauthLinkConfirmationError(input.operation, "OAuth provider account is linked to a different user"));
+    }
+    return Effect.succeed(account);
+}));
+export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation.make({
+    start: Effect.fn("auth.oauth_link_confirmation.start")(function* (input) {
+        const identity = cloneVerifiedOAuthIdentity(input.identity);
+        const reason = input.reason ?? "manual";
+        const existing = yield* findOAuthLinkConfirmationExistingAccount(dependencies, {
+            operation: "start",
+            userId: input.userId,
+            identity,
+        });
+        if (Option.isSome(existing)) {
+            return yield* oauthLinkConfirmationError("start", "OAuth provider account is already linked to this user");
+        }
+        const secret = input.secret ??
+            (yield* dependencies.crypto
+                .randomToken(yield* validateOAuthLinkConfirmationSecretBytes(dependencies.secretBytes ?? defaultOAuthLinkConfirmationSecretBytes))
+                .pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthLinkConfirmationError("start", "Failed to generate OAuth link confirmation secret", cause))));
+        const issued = yield* dependencies.challenge
+            .issue({
+            type: oauthLinkConfirmationChallengeType,
+            subject: input.userId,
+            ttl: input.ttl ?? defaultOAuthLinkConfirmationTtl,
+            secret,
+            metadata: oauthLinkConfirmationMetadata({
+                userId: input.userId,
+                identity,
+                reason,
+                metadata: input.metadata,
+            }),
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("start", "Failed to issue OAuth link confirmation challenge", cause)));
+        return {
+            challengeId: issued.id,
+            userId: input.userId,
+            identity,
+            reason,
+            secret,
+            expiresAt: issued.expiresAt,
+            ...(input.metadata === undefined
+                ? {}
+                : { metadata: metadataValue(input.metadata) }),
+        };
+    }),
+    inspect: Effect.fn("auth.oauth_link_confirmation.inspect")(function* (input) {
+        const inspected = yield* dependencies.challenge
+            .inspect({
+            challengeId: input.challengeId,
+            type: oauthLinkConfirmationChallengeType,
+            secret: input.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("inspect", "Invalid OAuth link confirmation challenge", cause)));
+        const pending = yield* pendingOAuthLinkConfirmationFromChallenge(inspected, "inspect");
+        yield* findOAuthLinkConfirmationExistingAccount(dependencies, {
+            operation: "inspect",
+            userId: pending.userId,
+            identity: pending.identity,
+        });
+        return pending;
+    }),
+    confirm: Effect.fn("auth.oauth_link_confirmation.confirm")(function* (input) {
+        const inspected = yield* dependencies.challenge
+            .inspect({
+            challengeId: input.challengeId,
+            type: oauthLinkConfirmationChallengeType,
+            secret: input.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("confirm", "Invalid OAuth link confirmation challenge", cause)));
+        const pending = yield* pendingOAuthLinkConfirmationFromChallenge(inspected, "confirm");
+        if (input.currentUserId !== undefined && input.currentUserId !== pending.userId) {
+            return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation does not match current user");
+        }
+        if (input.expectedProviderId !== undefined &&
+            input.expectedProviderId !== pending.identity.providerId) {
+            return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation provider mismatch");
+        }
+        if (input.expectedProviderAccountId !== undefined &&
+            input.expectedProviderAccountId !== pending.identity.providerAccountId) {
+            return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation provider account mismatch");
+        }
+        const existing = yield* findOAuthLinkConfirmationExistingAccount(dependencies, {
+            operation: "confirm",
+            userId: pending.userId,
+            identity: pending.identity,
+        });
+        yield* dependencies.challenge
+            .verify({
+            challengeId: input.challengeId,
+            type: oauthLinkConfirmationChallengeType,
+            secret: input.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("confirm", "Failed to consume OAuth link confirmation challenge", cause)));
+        return confirmedOAuthLinkConfirmationFromPending({
+            pending,
+            ...(Option.isSome(existing) ? { existingAccount: existing.value } : {}),
+        });
+    }),
+});
+export const startOAuthLinkConfirmation = (input) => OAuthLinkConfirmation.use((confirmation) => confirmation.start(input));
+export const inspectOAuthLinkConfirmation = (input) => OAuthLinkConfirmation.use((confirmation) => confirmation.inspect(input));
+export const confirmOAuthLinkConfirmation = (input) => OAuthLinkConfirmation.use((confirmation) => confirmation.confirm(input));
+const makeOAuthPkceWithCrypto = (dependencies, input) => Effect.gen(function* () {
+    const verifier = input?.codeVerifier === undefined
+        ? yield* dependencies.crypto
+            .randomToken(yield* validateByteLength(input?.verifierBytes ??
+            dependencies.codeVerifierBytes ??
+            defaultOAuthCodeVerifierBytes, "pkce", "OAuth code verifier"))
+            .pipe(Effect.map(OAuthCodeVerifier), Effect.mapError((cause) => oauthStateError("pkce", "Failed to generate OAuth code verifier", cause)))
+        : OAuthCodeVerifier(Redacted.value(input.codeVerifier));
+    const codeChallenge = yield* dependencies.crypto
+        .digestSha256({ data: verifier })
+        .pipe(Effect.map(OAuthCodeChallenge), Effect.mapError((cause) => oauthStateError("pkce", "Failed to calculate OAuth PKCE challenge", cause)));
+    return {
+        codeVerifier: Redacted.make(verifier),
+        codeChallenge,
+        codeChallengeMethod: "S256",
+    };
+});
+const authorizationCodeHash = (crypto, code, operation) => crypto.digestSha256({ data: String(code) }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError(operation, "Failed to hash OAuth authorization code", cause)));
+const pkceChallengeForVerifier = (crypto, verifier) => crypto.digestSha256({ data: Redacted.value(verifier) }).pipe(Effect.map(OAuthCodeChallenge), Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to calculate OAuth PKCE challenge", cause)));
+const timingSafeEqualString = (crypto, left, right) => crypto
+    .timingSafeEqual({
+    left: textEncoder.encode(left),
+    right: textEncoder.encode(right),
+})
+    .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to compare OAuth PKCE challenge", cause)));
+const authorizationCodeValue = (code) => OAuthAuthorizationCode(String(Redacted.value(code)).trim());
+const authorizationCodeExpiresAt = (input, issuedAt, defaultTtl) => input.expiresAt ??
+    UnixMillis(Number(issuedAt) + Duration.toMillis(input.expiresIn ?? defaultTtl));
+export const makeOAuthAuthorizationCodeGrant = (dependencies) => {
+    const codeBytes = dependencies.codeBytes ?? defaultOAuthAuthorizationCodeBytes;
+    const codeTtl = dependencies.codeTtl ?? defaultOAuthAuthorizationCodeTtl;
+    return OAuthAuthorizationCodeGrant.make({
+        issue: Effect.fn("auth.oauth.authorization_code.issue")(function* (input) {
+            const issuedAt = input.issuedAt ?? (yield* currentUnixMillis);
+            const expiresAt = authorizationCodeExpiresAt(input, issuedAt, codeTtl);
+            const code = input.code === undefined
+                ? OAuthAuthorizationCode(yield* Effect.gen(function* () {
+                    const validatedCodeBytes = yield* validateOAuthAuthorizationCodeBytes(codeBytes);
+                    return yield* dependencies.crypto
+                        .randomToken(validatedCodeBytes)
+                        .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("issue", "Failed to generate OAuth authorization code", cause)));
+                }))
+                : authorizationCodeValue(input.code);
+            const codeHash = yield* authorizationCodeHash(dependencies.crypto, code, "issue");
+            const codeChallenge = input.codeChallenge === undefined
+                ? undefined
+                : OAuthCodeChallenge(String(input.codeChallenge));
+            const record = {
+                codeHash,
+                clientId: input.clientId,
+                subject: input.subject,
+                redirectUri: input.redirectUri,
+                scopes: [...(input.scopes ?? [])],
+                ...(codeChallenge === undefined
+                    ? {}
+                    : {
+                        codeChallenge,
+                        codeChallengeMethod: input.codeChallengeMethod ?? "S256",
+                    }),
+                issuedAt,
+                expiresAt,
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: metadataValue(input.metadata) }),
+            };
+            yield* dependencies.store.upsert(record).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("issue", "Failed to store OAuth authorization code", cause)));
+            return issuedAuthorizationCode({ code, record });
+        }),
+        consume: Effect.fn("auth.oauth.authorization_code.consume")(function* (input) {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const codeHash = yield* authorizationCodeHash(dependencies.crypto, authorizationCodeValue(input.code), "consume");
+            const recordOption = yield* dependencies.store.findByHash({ codeHash }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to load OAuth authorization code", cause)));
+            if (Option.isNone(recordOption)) {
+                return { valid: false, reason: "unknown_code" };
+            }
+            const record = recordOption.value;
+            if (record.consumedAt !== undefined) {
+                return { valid: false, reason: "already_consumed" };
+            }
+            if (Number(now) >= Number(record.expiresAt)) {
+                return { valid: false, reason: "expired" };
+            }
+            if (record.clientId !== input.clientId) {
+                return { valid: false, reason: "client_mismatch" };
+            }
+            if (record.redirectUri !== input.redirectUri) {
+                return { valid: false, reason: "redirect_uri_mismatch" };
+            }
+            if (record.codeChallenge !== undefined) {
+                if (input.codeVerifier === undefined) {
+                    return { valid: false, reason: "pkce_required" };
+                }
+                const actualChallenge = yield* pkceChallengeForVerifier(dependencies.crypto, input.codeVerifier);
+                const pkceMatches = yield* timingSafeEqualString(dependencies.crypto, record.codeChallenge, actualChallenge);
+                if (!pkceMatches) {
+                    return { valid: false, reason: "pkce_mismatch" };
+                }
+            }
+            const consumed = yield* dependencies.store
+                .markConsumed({ codeHash, consumedAt: now })
+                .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to consume OAuth authorization code", cause)));
+            if (consumed.status === "missing") {
+                return { valid: false, reason: "unknown_code" };
+            }
+            if (consumed.status === "already_consumed") {
+                return { valid: false, reason: "already_consumed" };
+            }
+            return {
+                valid: true,
+                code: consumedAuthorizationCode(consumed.record, now),
+            };
+        }),
+    });
+};
+const oauthAuthorizationCodeTokenInvalid = (reason) => ({ valid: false, reason });
+const oauthRefreshTokenInvalid = (reason) => ({ valid: false, reason });
+const oauthRefreshTokenIssueInvalid = (reason) => ({ valid: false, reason });
+const oauthClientCredentialsInvalid = (reason) => ({ valid: false, reason });
+const oauthClientCredentialsIssueInvalid = (reason) => ({ valid: false, reason });
+const oauthTokenRevocationInvalid = (reason) => ({ valid: false, reason });
+const oauthTokenIntrospectionInvalid = (reason) => ({ valid: false, reason });
+const oauthTokenGrantString = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+const oauthTokenGrantScopes = (scopes) => {
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : scopes ?? [];
+    const unique = new Set();
+    for (const value of values) {
+        const scope = value.trim();
+        if (scope !== "") {
+            unique.add(scope);
+        }
+    }
+    return [...unique];
+};
+const oauthTokenGrantScopesAllowed = (scopes, allowedScopes) => allowedScopes === undefined || scopes.every((scope) => allowedScopes.includes(scope));
+const validateOAuthProviderModeOpaqueTokenBytes = (value, label, error) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(error(`${label} byte length must be an integer between 16 and 128`));
+const generateOAuthProviderModeOpaqueToken = (crypto, byteLength, brand, label, error) => Effect.gen(function* () {
+    const validByteLength = yield* validateOAuthProviderModeOpaqueTokenBytes(byteLength, label, error);
+    const token = yield* crypto.randomToken(validByteLength).pipe(Effect.mapError((cause) => error(`Failed to generate OAuth ${label} token`, cause)));
+    return Redacted.make(brand(token));
+});
+const oauthProviderModeOpaqueTokenHash = (crypto, token, error) => crypto.digestSha256({ data: Redacted.value(token) }).pipe(Effect.map((digest) => `sha256:${digest}`), Effect.mapError((cause) => error("Failed to hash OAuth provider-mode token", cause)));
+const oauthProviderModeOpaqueTokenAudience = (audience) => audience === undefined ? undefined : Array.isArray(audience) ? [...audience] : audience;
+const oauthProviderModeOpaqueTokenRecord = (dependencies, input) => ({
+    tokenHash: input.tokenHash,
+    tokenType: input.tokenType,
+    clientId: input.clientId,
+    subject: input.subject,
+    scopes: [...input.scopes],
+    issuedAt: input.issuedAt,
+    expiresAt: input.expiresAt,
+    ...(dependencies.issuer === undefined ? {} : { issuer: dependencies.issuer }),
+    ...(dependencies.audience === undefined
+        ? {}
+        : { audience: oauthProviderModeOpaqueTokenAudience(dependencies.audience) }),
+    ...(dependencies.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(dependencies.metadata) }),
+});
+const oauthProviderModeOpaqueExpiresAt = (issuedAt, ttl) => UnixMillis(Number(issuedAt) + Duration.toMillis(ttl));
+const oauthProviderModeOpaqueExpiresInSeconds = (issuedAt, expiresAt) => Math.max(0, Math.floor((Number(expiresAt) - Number(issuedAt)) / 1000));
+const oauthProviderModeOpaqueTokenResponse = (input) => ({
+    accessToken: input.accessToken,
+    tokenType: "Bearer",
+    expiresIn: oauthProviderModeOpaqueExpiresInSeconds(input.accessTokenIssuedAt, input.accessTokenExpiresAt),
+    ...(input.refreshToken === undefined
+        ? {}
+        : { refreshToken: input.refreshToken }),
+    ...(input.scopes.length === 0 ? {} : { scopes: [...input.scopes] }),
+});
+const oauthProviderModeOpaqueStoreToken = (store, record, error) => store.upsert(record).pipe(Effect.mapError((cause) => error("Failed to store OAuth provider-mode token", cause)));
+const oauthProviderModeScopesSubset = (scopes, grantedScopes) => scopes.every((scope) => grantedScopes.includes(scope));
+const oauthTokenGrantClientId = (value) => {
+    const clientId = oauthTokenGrantString(value === undefined ? undefined : String(value));
+    return clientId === undefined ? undefined : OAuthClientId(clientId);
+};
+const oauthAuthorizationCodeConsumeFailureToTokenFailure = (reason) => {
+    switch (reason) {
+        case "unknown_code":
+        case "already_consumed":
+        case "expired":
+        case "client_mismatch":
+        case "redirect_uri_mismatch":
+        case "pkce_required":
+        case "pkce_mismatch": {
+            return "invalid_grant";
+        }
+    }
+};
+export const makeOAuthAuthorizationCodeTokenGrant = (dependencies) => OAuthAuthorizationCodeTokenGrant.make({
+    exchange: Effect.fn("auth.oauth.authorization_code_token.exchange")(function* (input) {
+        if (input.grantType !== "authorization_code") {
+            return oauthAuthorizationCodeTokenInvalid("unsupported_grant_type");
+        }
+        const { code } = input;
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        const redirectUri = oauthTokenGrantString(input.redirectUri);
+        if (code === undefined || clientId === undefined || redirectUri === undefined) {
+            return oauthAuthorizationCodeTokenInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthAuthorizationCodeTokenInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (!client.allowedGrantTypes.includes("authorization_code")) {
+            return oauthAuthorizationCodeTokenInvalid("unauthorized_client");
+        }
+        if (client.type === "confidential" && input.clientAuthenticated !== true) {
+            return oauthAuthorizationCodeTokenInvalid("invalid_client");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const consumed = yield* dependencies.authorizationCodes
+            .consume({
+            code,
+            clientId,
+            redirectUri,
+            ...(input.codeVerifier === undefined
+                ? {}
+                : { codeVerifier: input.codeVerifier }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to consume OAuth authorization code", cause)));
+        if (!consumed.valid) {
+            return oauthAuthorizationCodeTokenInvalid(oauthAuthorizationCodeConsumeFailureToTokenFailure(consumed.reason));
+        }
+        const tokens = yield* dependencies.issuer
+            .issue({ client, code: consumed.code, now })
+            .pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to issue OAuth tokens", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            code: consumed.code,
+            tokens: cloneOAuthTokenResponse(tokens),
+        };
+    }),
+});
+export const makeOAuthRefreshTokenGrant = (dependencies) => OAuthRefreshTokenGrant.make({
+    exchange: Effect.fn("auth.oauth.refresh_token.exchange")(function* (input) {
+        if (input.grantType !== "refresh_token") {
+            return oauthRefreshTokenInvalid("unsupported_grant_type");
+        }
+        const { refreshToken } = input;
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        if (refreshToken === undefined || clientId === undefined) {
+            return oauthRefreshTokenInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthRefreshTokenGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthRefreshTokenInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (!client.allowedGrantTypes.includes("refresh_token")) {
+            return oauthRefreshTokenInvalid("unauthorized_client");
+        }
+        if (client.type === "confidential" && input.clientAuthenticated !== true) {
+            return oauthRefreshTokenInvalid("invalid_client");
+        }
+        const scopes = oauthTokenGrantScopes(input.scopes);
+        if (!oauthTokenGrantScopesAllowed(scopes, client.allowedScopes)) {
+            return oauthRefreshTokenInvalid("invalid_scope");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const issued = yield* dependencies.issuer
+            .issue({
+            client,
+            refreshToken,
+            ...(scopes.length === 0 ? {} : { scopes }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthRefreshTokenGrantError("exchange", "Failed to issue OAuth tokens", cause)));
+        if (!issued.valid) {
+            return oauthRefreshTokenInvalid(issued.reason);
+        }
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            tokens: cloneOAuthTokenResponse(issued.tokens),
+        };
+    }),
+});
+export const makeOAuthClientCredentialsGrant = (dependencies) => OAuthClientCredentialsGrant.make({
+    exchange: Effect.fn("auth.oauth.client_credentials.exchange")(function* (input) {
+        if (input.grantType !== "client_credentials") {
+            return oauthClientCredentialsInvalid("unsupported_grant_type");
+        }
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        if (clientId === undefined) {
+            return oauthClientCredentialsInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthClientCredentialsGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthClientCredentialsInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (!client.allowedGrantTypes.includes("client_credentials")) {
+            return oauthClientCredentialsInvalid("unauthorized_client");
+        }
+        if (client.type !== "confidential") {
+            return oauthClientCredentialsInvalid("unauthorized_client");
+        }
+        if (input.clientAuthenticated !== true) {
+            return oauthClientCredentialsInvalid("invalid_client");
+        }
+        const scopes = oauthTokenGrantScopes(input.scopes);
+        if (!oauthTokenGrantScopesAllowed(scopes, client.allowedScopes)) {
+            return oauthClientCredentialsInvalid("invalid_scope");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const issued = yield* dependencies.issuer
+            .issue({
+            client,
+            ...(scopes.length === 0 ? {} : { scopes }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthClientCredentialsGrantError("exchange", "Failed to issue OAuth tokens", cause)));
+        if (!issued.valid) {
+            return oauthClientCredentialsInvalid(issued.reason);
+        }
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            tokens: cloneOAuthTokenResponse(issued.tokens),
+        };
+    }),
+});
+export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
+    const accessTokenBytes = dependencies.accessTokenBytes ?? defaultOAuthProviderModeAccessTokenBytes;
+    const refreshTokenBytes = dependencies.refreshTokenBytes ?? defaultOAuthProviderModeRefreshTokenBytes;
+    const accessTokenTtl = dependencies.accessTokenTtl ?? defaultOAuthProviderModeAccessTokenTtl;
+    const refreshTokenTtl = dependencies.refreshTokenTtl ?? defaultOAuthProviderModeRefreshTokenTtl;
+    return {
+        authorizationCode: OAuthAuthorizationCodeTokenIssuer.make({
+            issue: Effect.fn("auth.oauth.provider_mode_opaque.authorization_code.issue")(function* (input) {
+                const scopes = [...input.code.scopes];
+                const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthAuthorizationCodeTokenIssuerError);
+                const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthAuthorizationCodeTokenIssuerError);
+                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                const accessTokenRecord = oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    clientId: input.client.id,
+                    subject: input.code.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: accessTokenExpiresAt,
+                });
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, accessTokenRecord, oauthAuthorizationCodeTokenIssuerError);
+                if (!input.client.allowedGrantTypes.includes("refresh_token")) {
+                    return oauthProviderModeOpaqueTokenResponse({
+                        accessToken,
+                        accessTokenIssuedAt: input.now,
+                        accessTokenExpiresAt,
+                        scopes,
+                    });
+                }
+                const refreshToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, refreshTokenBytes, OAuthRefreshToken, "refresh", oauthAuthorizationCodeTokenIssuerError);
+                const refreshTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, refreshToken, oauthAuthorizationCodeTokenIssuerError);
+                const refreshTokenRecord = oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: refreshTokenHash,
+                    tokenType: "refresh_token",
+                    clientId: input.client.id,
+                    subject: input.code.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: oauthProviderModeOpaqueExpiresAt(input.now, refreshTokenTtl),
+                });
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, refreshTokenRecord, oauthAuthorizationCodeTokenIssuerError);
+                return oauthProviderModeOpaqueTokenResponse({
+                    accessToken,
+                    accessTokenIssuedAt: input.now,
+                    accessTokenExpiresAt,
+                    refreshToken,
+                    scopes,
+                });
+            }),
+        }),
+        refreshToken: OAuthRefreshTokenIssuer.make({
+            issue: Effect.fn("auth.oauth.provider_mode_opaque.refresh_token.issue")(function* (input) {
+                const tokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, input.refreshToken, oauthRefreshTokenIssuerError);
+                const recordOption = yield* dependencies.tokenStore
+                    .findByHash({ tokenHash })
+                    .pipe(Effect.mapError((cause) => oauthRefreshTokenIssuerError("Failed to load OAuth provider-mode refresh token", cause)));
+                if (Option.isNone(recordOption)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_grant");
+                }
+                const record = recordOption.value;
+                if (record.tokenType !== "refresh_token" ||
+                    record.clientId !== input.client.id ||
+                    record.revokedAt !== undefined ||
+                    record.rotatedAt !== undefined ||
+                    Number(input.now) >= Number(record.expiresAt)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_grant");
+                }
+                const requestedScopes = oauthTokenGrantScopes(input.scopes);
+                if (!oauthTokenGrantScopesAllowed(requestedScopes, input.client.allowedScopes) ||
+                    !oauthProviderModeScopesSubset(requestedScopes, record.scopes)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_scope");
+                }
+                const scopes = requestedScopes.length === 0 ? [...record.scopes] : requestedScopes;
+                const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthRefreshTokenIssuerError);
+                const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthRefreshTokenIssuerError);
+                const refreshToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, refreshTokenBytes, OAuthRefreshToken, "refresh", oauthRefreshTokenIssuerError);
+                const refreshTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, refreshToken, oauthRefreshTokenIssuerError);
+                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    clientId: input.client.id,
+                    subject: record.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: accessTokenExpiresAt,
+                }), oauthRefreshTokenIssuerError);
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: refreshTokenHash,
+                    tokenType: "refresh_token",
+                    clientId: input.client.id,
+                    subject: record.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: oauthProviderModeOpaqueExpiresAt(input.now, refreshTokenTtl),
+                }), oauthRefreshTokenIssuerError);
+                const rotated = yield* dependencies.tokenStore
+                    .rotateRefreshToken({
+                    tokenHash,
+                    replacedByTokenHash: refreshTokenHash,
+                    rotatedAt: input.now,
+                })
+                    .pipe(Effect.mapError((cause) => oauthRefreshTokenIssuerError("Failed to rotate OAuth provider-mode refresh token", cause)));
+                if (Option.isNone(rotated)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_grant");
+                }
+                return {
+                    valid: true,
+                    tokens: oauthProviderModeOpaqueTokenResponse({
+                        accessToken,
+                        accessTokenIssuedAt: input.now,
+                        accessTokenExpiresAt,
+                        refreshToken,
+                        scopes,
+                    }),
+                };
+            }),
+        }),
+        clientCredentials: OAuthClientCredentialsTokenIssuer.make({
+            issue: Effect.fn("auth.oauth.provider_mode_opaque.client_credentials.issue")(function* (input) {
+                const scopes = [...(input.scopes ?? [])];
+                if (!oauthTokenGrantScopesAllowed(scopes, input.client.allowedScopes)) {
+                    return oauthClientCredentialsIssueInvalid("invalid_scope");
+                }
+                const subject = yield* Effect.try({
+                    try: () => dependencies.clientCredentialsSubject === undefined
+                        ? String(input.client.id)
+                        : dependencies.clientCredentialsSubject(input),
+                    catch: (cause) => oauthClientCredentialsTokenIssuerError("Failed to resolve OAuth client credentials subject", cause),
+                }).pipe(Effect.flatMap((value) => {
+                    const resolvedSubject = oauthTokenGrantString(value);
+                    return resolvedSubject === undefined
+                        ? Effect.fail(oauthClientCredentialsTokenIssuerError("OAuth client credentials subject must not be empty"))
+                        : Effect.succeed(resolvedSubject);
+                }));
+                const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthClientCredentialsTokenIssuerError);
+                const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthClientCredentialsTokenIssuerError);
+                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    clientId: input.client.id,
+                    subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: accessTokenExpiresAt,
+                }), oauthClientCredentialsTokenIssuerError);
+                return {
+                    valid: true,
+                    tokens: oauthProviderModeOpaqueTokenResponse({
+                        accessToken,
+                        accessTokenIssuedAt: input.now,
+                        accessTokenExpiresAt,
+                        scopes,
+                    }),
+                };
+            }),
+        }),
+    };
+};
+export const makeOAuthClientSecretVerification = (dependencies) => OAuthClientSecretVerification.make({
+    authenticateClient: Effect.fn("auth.oauth.client_secret.authenticate_client")(function* (input) {
+        const prefix = yield* dependencies.clientSecrets.parse(input.clientSecret).pipe(Effect.catchTag("OAuthClientSecretError", () => Effect.succeed(undefined)));
+        if (prefix === undefined) {
+            return false;
+        }
+        const secret = yield* dependencies.secretStore
+            .findByClientIdAndPrefix({ clientId: input.clientId, prefix })
+            .pipe(Effect.mapError((cause) => oauthClientSecretVerificationError("Failed to load OAuth client secret", cause)));
+        if (Option.isNone(secret) || secret.value.revokedAt !== undefined) {
+            return false;
+        }
+        if (!secret.value.authenticationMethods.includes(input.method)) {
+            return false;
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        if (secret.value.expiresAt !== undefined &&
+            Number(secret.value.expiresAt) <= Number(now)) {
+            return false;
+        }
+        const valid = yield* dependencies.clientSecrets
+            .verify({ secret: input.clientSecret, hash: secret.value.secretHash })
+            .pipe(Effect.mapError((cause) => oauthClientSecretVerificationError("Failed to verify OAuth client secret", cause)));
+        if (!valid) {
+            return false;
+        }
+        const updated = yield* dependencies.secretStore
+            .markUsed({
+            clientId: input.clientId,
+            prefix,
+            lastUsedAt: now,
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        })
+            .pipe(Effect.mapError((cause) => oauthClientSecretVerificationError("Failed to mark OAuth client secret as used", cause)));
+        return Option.isSome(updated);
+    }),
+});
+export const makeOAuthTokenRevocation = (dependencies) => OAuthTokenRevocation.make({
+    revoke: Effect.fn("auth.oauth.token_revocation.revoke")(function* (input) {
+        const { token } = input;
+        const tokenValue = token === undefined ? undefined : String(Redacted.value(token)).trim();
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        const tokenTypeHint = oauthTokenGrantString(input.tokenTypeHint);
+        if (token === undefined || tokenValue === undefined || clientId === undefined) {
+            return oauthTokenRevocationInvalid("invalid_request");
+        }
+        if (tokenTypeHint !== undefined &&
+            tokenTypeHint !== "access_token" &&
+            tokenTypeHint !== "refresh_token") {
+            return oauthTokenRevocationInvalid("unsupported_token_type");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthTokenRevocationError("revoke", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthTokenRevocationInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (client.type !== "confidential" || input.clientAuthenticated !== true) {
+            return oauthTokenRevocationInvalid("invalid_client");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        yield* dependencies.revoker
+            .revoke({
+            client,
+            token,
+            ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthTokenRevocationError("revoke", "Failed to revoke OAuth token", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+        };
+    }),
+});
+export const makeOAuthTokenIntrospection = (dependencies) => OAuthTokenIntrospection.make({
+    introspect: Effect.fn("auth.oauth.token_introspection.introspect")(function* (input) {
+        const { token } = input;
+        const tokenValue = token === undefined ? undefined : String(Redacted.value(token)).trim();
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        const tokenTypeHint = oauthTokenGrantString(input.tokenTypeHint);
+        if (token === undefined || tokenValue === undefined || clientId === undefined) {
+            return oauthTokenIntrospectionInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthTokenIntrospectionError("introspect", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthTokenIntrospectionInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (client.type !== "confidential" || input.clientAuthenticated !== true) {
+            return oauthTokenIntrospectionInvalid("invalid_client");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const introspection = yield* dependencies.introspector
+            .introspect({
+            client,
+            token,
+            ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthTokenIntrospectionError("introspect", "Failed to introspect OAuth token", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            introspection: cloneOAuthTokenIntrospectionResponse(introspection),
+        };
+    }),
+});
+const oauthProviderAuthorizationInvalid = (reason, input) => ({
+    valid: false,
+    reason,
+    ...(input?.redirectUri === undefined ? {} : { redirectUri: input.redirectUri }),
+    ...(input?.state === undefined ? {} : { state: input.state }),
+    ...(input?.client === undefined
+        ? {}
+        : { client: cloneOAuthClientRecord(input.client) }),
+    ...(input?.errorDescription === undefined
+        ? {}
+        : { errorDescription: input.errorDescription }),
+});
+const oauthProviderAuthorizationString = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+const oauthProviderAuthorizationClientId = (value) => {
+    const clientId = oauthProviderAuthorizationString(value === undefined ? undefined : String(value));
+    return clientId === undefined ? undefined : OAuthClientId(clientId);
+};
+const oauthProviderAuthorizationScopes = (scopes) => {
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : scopes ?? [];
+    const unique = new Set();
+    for (const value of values) {
+        const scope = value.trim();
+        if (scope !== "") {
+            unique.add(scope);
+        }
+    }
+    return [...unique];
+};
+const oauthProviderAuthorizationScopeAllowed = (scopes, allowedScopes) => allowedScopes === undefined || scopes.every((scope) => allowedScopes.includes(scope));
+const oauthProviderAuthorizationScopeSubset = (scopes, requestedScopes) => scopes.every((scope) => requestedScopes.includes(scope));
+const oauthProviderAuthorizationClientAllowsCode = (client) => client.allowedResponseTypes.includes("code") &&
+    client.allowedGrantTypes.includes("authorization_code");
+const oauthProviderAuthorizationGrantedScopesValid = (scopes, requestedScopes, allowedScopes) => oauthProviderAuthorizationScopeSubset(scopes, requestedScopes) &&
+    oauthProviderAuthorizationScopeAllowed(scopes, allowedScopes);
+export const makeOAuthProviderAuthorization = (dependencies) => OAuthProviderAuthorization.make({
+    authorize: Effect.fn("auth.oauth.provider_authorization.authorize")(function* (input) {
+        const state = oauthProviderAuthorizationString(input.state);
+        const clientId = oauthProviderAuthorizationClientId(input.clientId);
+        const redirectUri = oauthProviderAuthorizationString(input.redirectUri);
+        if (clientId === undefined || redirectUri === undefined) {
+            return oauthProviderAuthorizationInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthProviderAuthorizationInvalid("invalid_request");
+        }
+        const client = clientOption.value;
+        if (!client.redirectUris.includes(redirectUri)) {
+            return oauthProviderAuthorizationInvalid("invalid_request");
+        }
+        const redirectError = (reason, errorDescription) => oauthProviderAuthorizationInvalid(reason, {
+            client,
+            redirectUri,
+            state,
+            ...(errorDescription === undefined ? {} : { errorDescription }),
+        });
+        if (input.responseType !== "code") {
+            return redirectError("unsupported_response_type");
+        }
+        if (!oauthProviderAuthorizationClientAllowsCode(client)) {
+            return redirectError("unauthorized_client");
+        }
+        const codeChallenge = oauthProviderAuthorizationString(input.codeChallenge === undefined ? undefined : String(input.codeChallenge));
+        if (codeChallenge === undefined ||
+            oauthProviderAuthorizationString(input.codeChallengeMethod) !== "S256") {
+            return redirectError("invalid_request");
+        }
+        const requestedScopes = oauthProviderAuthorizationScopes(input.scopes);
+        if (!oauthProviderAuthorizationScopeAllowed(requestedScopes, client.allowedScopes)) {
+            return redirectError("invalid_scope");
+        }
+        const decision = yield* dependencies.policy
+            .decide({
+            client: cloneOAuthClientRecord(client),
+            requestedScopes,
+            ...(state === undefined ? {} : { state }),
+            request: input,
+        })
+            .pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to decide OAuth authorization request", cause)));
+        if (decision.type === "deny") {
+            return redirectError(decision.reason, decision.errorDescription);
+        }
+        const scopes = oauthProviderAuthorizationScopes(decision.scopes ?? requestedScopes);
+        if (!oauthProviderAuthorizationGrantedScopesValid(scopes, requestedScopes, client.allowedScopes)) {
+            return redirectError("invalid_scope");
+        }
+        const code = yield* dependencies.authorizationCodes
+            .issue({
+            clientId,
+            subject: decision.subject,
+            redirectUri,
+            scopes,
+            codeChallenge: OAuthCodeChallenge(codeChallenge),
+            codeChallengeMethod: "S256",
+            ...(input.now === undefined ? {} : { issuedAt: input.now }),
+            ...(decision.metadata === undefined
+                ? {}
+                : { metadata: decision.metadata }),
+        })
+            .pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to issue OAuth authorization code", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            redirectUri,
+            ...(state === undefined ? {} : { state }),
+            code,
+        };
+    }),
+});
+export const issueOAuthAuthorizationCode = (input) => OAuthAuthorizationCodeGrant.use((grant) => grant.issue(input));
+export const consumeOAuthAuthorizationCode = (input) => OAuthAuthorizationCodeGrant.use((grant) => grant.consume(input));
+export const exchangeOAuthAuthorizationCodeToken = (input) => OAuthAuthorizationCodeTokenGrant.use((grant) => grant.exchange(input));
+export const exchangeOAuthRefreshToken = (input) => OAuthRefreshTokenGrant.use((grant) => grant.exchange(input));
+export const exchangeOAuthClientCredentialsToken = (input) => OAuthClientCredentialsGrant.use((grant) => grant.exchange(input));
+export const revokeOAuthToken = (input) => OAuthTokenRevocation.use((revocation) => revocation.revoke(input));
+export const introspectOAuthToken = (input) => OAuthTokenIntrospection.use((introspection) => introspection.introspect(input));
+export const authorizeOAuthProviderAuthorization = (input) => OAuthProviderAuthorization.use((authorization) => authorization.authorize(input));
+export const makeOAuthPkce = (input) => Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    return yield* makeOAuthPkceWithCrypto({ crypto }, input);
+});
+const appendParams = (url, params) => {
+    if (params === undefined) {
+        return;
+    }
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined) {
+            url.searchParams.set(key, value);
+        }
+    }
+};
+const makeAuthorizationUrl = (input) => Effect.try({
+    try: () => {
+        const url = new URL(input.provider.authorizationEndpoint);
+        appendParams(url, input.provider.authorizationParams);
+        appendParams(url, input.params);
+        appendParams(url, {
+            response_type: "code",
+            client_id: input.provider.clientId,
+            redirect_uri: input.redirectUri,
+            scope: input.scopes.length === 0 ? undefined : input.scopes.join(" "),
+            state: input.state,
+            code_challenge: input.pkce.codeChallenge,
+            code_challenge_method: input.pkce.codeChallengeMethod,
+            nonce: input.nonce,
+        });
+        return url.toString();
+    },
+    catch: (cause) => oauthStateError("authorization-url", "Failed to build OAuth authorization URL", cause),
+});
+export const makeOAuthState = (dependencies) => OAuthState.make({
+    start: Effect.fn("auth.oauth_state.start")(function* (input) {
+        const stateSecretBytes = yield* validateByteLength(dependencies.stateSecretBytes ?? defaultOAuthStateSecretBytes, "start", "OAuth state secret");
+        const stateSecret = yield* dependencies.crypto.randomToken(stateSecretBytes).pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthStateError("start", "Failed to generate OAuth state secret", cause)));
+        const pkce = yield* makeOAuthPkceWithCrypto(dependencies, {
+            codeVerifier: input.codeVerifier,
+            verifierBytes: dependencies.codeVerifierBytes,
+        });
+        const includeNonce = input.includeNonce ?? input.provider.issuer !== undefined;
+        const nonce = input.nonce === undefined && !includeNonce
+            ? undefined
+            : input.nonce === undefined
+                ? yield* dependencies.crypto
+                    .randomToken(dependencies.nonceBytes ?? defaultOAuthNonceBytes)
+                    .pipe(Effect.map(OAuthNonce), Effect.mapError((cause) => oauthStateError("start", "Failed to generate OAuth nonce", cause)))
+                : OAuthNonce(input.nonce);
+        const redirectUri = input.redirectUri ?? input.provider.redirectUri;
+        const scopes = input.scopes ?? input.provider.scopes ?? [];
+        const issued = yield* dependencies.challenge
+            .issue({
+            type: "oauth-state",
+            subject: input.provider.id,
+            ttl: input.ttl ?? defaultOAuthStateTtl,
+            secret: stateSecret,
+            metadata: {
+                providerId: input.provider.id,
+                redirectUri,
+                scopes,
+                codeChallenge: pkce.codeChallenge,
+                ...(nonce === undefined ? {} : { nonce }),
+                ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+            },
+        })
+            .pipe(Effect.mapError((cause) => oauthStateError("start", "Failed to issue OAuth state challenge", cause)));
+        const state = encodeOAuthState({ challengeId: issued.id, secret: stateSecret });
+        const authorizationUrl = yield* makeAuthorizationUrl({
+            provider: input.provider,
+            redirectUri,
+            scopes,
+            params: input.authorizationParams,
+            state,
+            pkce,
+            nonce,
+        });
+        return {
+            providerId: input.provider.id,
+            authorizationUrl,
+            state,
+            challengeId: issued.id,
+            expiresAt: issued.expiresAt,
+            codeVerifier: pkce.codeVerifier,
+            codeChallenge: pkce.codeChallenge,
+            codeChallengeMethod: pkce.codeChallengeMethod,
+            ...(nonce === undefined ? {} : { nonce }),
+            redirectUri,
+            scopes,
+        };
+    }),
+    verify: Effect.fn("auth.oauth_state.verify")(function* (input) {
+        const parsed = yield* parseOAuthState(input.state);
+        const verified = yield* dependencies.challenge
+            .verify({
+            challengeId: parsed.challengeId,
+            type: "oauth-state",
+            secret: parsed.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthStateError("verify", "Failed to verify OAuth state challenge", cause)));
+        const metadata = verified.metadata ?? {};
+        const appMetadata = metadataValue(typeof metadata.metadata === "object" && metadata.metadata !== null
+            ? metadata.metadata
+            : undefined);
+        const codeChallenge = stringFromUnknown(metadata.codeChallenge);
+        const nonce = stringFromUnknown(metadata.nonce);
+        return {
+            challengeId: parsed.challengeId,
+            providerId: OAuthProviderId(verified.subject),
+            redirectUri: stringFromUnknown(metadata.redirectUri),
+            scopes: stringArrayFromUnknown(metadata.scopes),
+            ...(codeChallenge === undefined
+                ? {}
+                : { codeChallenge: OAuthCodeChallenge(codeChallenge) }),
+            ...(nonce === undefined ? {} : { nonce: OAuthNonce(nonce) }),
+            ...(appMetadata === undefined ? {} : { metadata: appMetadata }),
+        };
+    }),
+});
+export const OAuthStateLive = Layer.effect(OAuthState)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const challenge = yield* Challenge;
+    return makeOAuthState({ crypto, challenge });
+}));
+export const OAuthAuthorizationCodeGrantLive = Layer.effect(OAuthAuthorizationCodeGrant)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const store = yield* OAuthAuthorizationCodeStore;
+    return makeOAuthAuthorizationCodeGrant({ crypto, store });
+}));
+export const OAuthAuthorizationCodeTokenGrantLive = Layer.effect(OAuthAuthorizationCodeTokenGrant)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const authorizationCodes = yield* OAuthAuthorizationCodeGrant;
+    const issuer = yield* OAuthAuthorizationCodeTokenIssuer;
+    return makeOAuthAuthorizationCodeTokenGrant({
+        clients,
+        authorizationCodes,
+        issuer,
+    });
+}));
+export const OAuthRefreshTokenGrantLive = Layer.effect(OAuthRefreshTokenGrant)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const issuer = yield* OAuthRefreshTokenIssuer;
+    return makeOAuthRefreshTokenGrant({ clients, issuer });
+}));
+export const OAuthClientCredentialsGrantLive = Layer.effect(OAuthClientCredentialsGrant)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const issuer = yield* OAuthClientCredentialsTokenIssuer;
+    return makeOAuthClientCredentialsGrant({ clients, issuer });
+}));
+export const OAuthProviderModeOpaqueTokenIssuerLive = (options = {}) => Layer.mergeAll(Layer.effect(OAuthAuthorizationCodeTokenIssuer)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    return makeOAuthProviderModeOpaqueTokenIssuer({
+        ...options,
+        crypto,
+        tokenStore,
+    }).authorizationCode;
+})), Layer.effect(OAuthRefreshTokenIssuer)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    return makeOAuthProviderModeOpaqueTokenIssuer({
+        ...options,
+        crypto,
+        tokenStore,
+    }).refreshToken;
+})), Layer.effect(OAuthClientCredentialsTokenIssuer)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    return makeOAuthProviderModeOpaqueTokenIssuer({
+        ...options,
+        crypto,
+        tokenStore,
+    }).clientCredentials;
+})));
+export const OAuthTokenRevocationLive = Layer.effect(OAuthTokenRevocation)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const revoker = yield* OAuthTokenRevoker;
+    return makeOAuthTokenRevocation({ clients, revoker });
+}));
+export const OAuthTokenIntrospectionLive = Layer.effect(OAuthTokenIntrospection)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const introspector = yield* OAuthTokenIntrospector;
+    return makeOAuthTokenIntrospection({ clients, introspector });
+}));
+export const OAuthProviderAuthorizationLive = Layer.effect(OAuthProviderAuthorization)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const authorizationCodes = yield* OAuthAuthorizationCodeGrant;
+    const policy = yield* OAuthProviderAuthorizationPolicy;
+    return makeOAuthProviderAuthorization({ clients, authorizationCodes, policy });
+}));
+export const makeOAuthProviders = (providers) => {
+    const providersById = new Map(providers.map((provider) => [provider.id, cloneProviderConfig(provider)]));
+    return OAuthProviders.make({
+        get: (id) => Effect.sync(() => {
+            const provider = providersById.get(id);
+            return provider === undefined
+                ? Option.none()
+                : Option.some(cloneProviderConfig(provider));
+        }),
+    });
+};
+export const OAuthProvidersLive = (providers) => Layer.succeed(OAuthProviders)(makeOAuthProviders(providers));
+export const OAuthClientSecretsLive = Layer.effect(OAuthClientSecrets)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    return makeOAuthClientSecrets({ crypto });
+}));
+export const OAuthClientSecretVerificationLive = Layer.effect(OAuthClientSecretVerification)(Effect.gen(function* () {
+    const clientSecrets = yield* OAuthClientSecrets;
+    const secretStore = yield* OAuthClientSecretStore;
+    return makeOAuthClientSecretVerification({ clientSecrets, secretStore });
+}));
+export const makeOAuthClientRegistryFromStore = (store) => OAuthClientRegistry.make({
+    find: (input) => store.find(input).pipe(Effect.mapError((cause) => oauthClientRegistryError("find", "Failed to load OAuth client", cause))),
+    validateRedirectUri: (input) => store.validateRedirectUri(input).pipe(Effect.mapError((cause) => oauthClientRegistryError("validate-redirect-uri", "Failed to validate OAuth client redirect URI", cause))),
+});
+export const OAuthClientRegistryFromStoreLive = Layer.effect(OAuthClientRegistry)(Effect.gen(function* () {
+    const store = yield* OAuthClientStore;
+    return makeOAuthClientRegistryFromStore(store);
+}));
+export const makeOAuthClientRegistryMemory = (clients = []) => {
+    const clientsById = new Map(clients.map((client) => [client.id, cloneOAuthClientRecord(client)]));
+    return OAuthClientRegistry.make({
+        find: (input) => Effect.sync(() => {
+            const client = clientsById.get(input.clientId);
+            return client === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthClientRecord(client));
+        }),
+        validateRedirectUri: (input) => Effect.sync(() => {
+            const client = clientsById.get(input.clientId);
+            return validateOAuthClientRedirectUriRecord(client, input);
+        }),
+    });
+};
+export const OAuthClientRegistryMemoryLive = (clients = []) => Layer.succeed(OAuthClientRegistry)(makeOAuthClientRegistryMemory(clients));
+export const makeOAuthClientStoreMemory = (clients = []) => {
+    const clientsById = new Map(clients.map((client) => [client.id, cloneOAuthClientRecord(client)]));
+    return OAuthClientStore.make({
+        upsert: (record) => Effect.sync(() => {
+            clientsById.set(record.id, cloneOAuthClientRecord(record));
+        }),
+        find: (input) => Effect.sync(() => {
+            const client = clientsById.get(input.clientId);
+            return client === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthClientRecord(client));
+        }),
+        list: (input = {}) => Effect.sync(() => [...clientsById.values()]
+            .filter((client) => input.includeDisabled === true || client.status === "active")
+            .map(cloneOAuthClientRecord)),
+        validateRedirectUri: (input) => Effect.sync(() => validateOAuthClientRedirectUriRecord(clientsById.get(input.clientId), input)),
+    });
+};
+export const OAuthClientStoreMemoryLive = (clients = []) => Layer.succeed(OAuthClientStore)(makeOAuthClientStoreMemory(clients));
+const oauthConsentMemoryKey = (input) => `${input.userId}\u0000${input.clientId}`;
+export const makeOAuthConsentStoreMemory = (records = []) => {
+    const recordsByKey = new Map(records.map((record) => [
+        oauthConsentMemoryKey(record),
+        cloneOAuthConsentRecord(record),
+    ]));
+    return OAuthConsentStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByKey.set(oauthConsentMemoryKey(record), cloneOAuthConsentRecord(record));
+        }),
+        findActive: (input) => Effect.sync(() => {
+            const record = recordsByKey.get(oauthConsentMemoryKey(input));
+            return record === undefined ||
+                !isOAuthConsentActive(record, input.now, input.scopes)
+                ? Option.none()
+                : Option.some(cloneOAuthConsentRecord(record));
+        }),
+        listForUser: (input) => Effect.sync(() => [...recordsByKey.values()]
+            .filter((record) => record.userId === input.userId)
+            .filter((record) => input.includeInactive === true ||
+            isOAuthConsentActive(record, input.now))
+            .map(cloneOAuthConsentRecord)),
+        revoke: (input) => Effect.sync(() => {
+            const key = oauthConsentMemoryKey(input);
+            const record = recordsByKey.get(key);
+            if (record === undefined) {
+                return Option.none();
+            }
+            const updated = cloneOAuthConsentRecord({
+                ...record,
+                revokedAt: record.revokedAt ?? input.revokedAt,
+                metadata: input.reason === undefined
+                    ? record.metadata
+                    : { ...record.metadata, revokeReason: input.reason },
+            });
+            recordsByKey.set(key, updated);
+            return Option.some(cloneOAuthConsentRecord(updated));
+        }),
+        deleteInactive: (input) => Effect.sync(() => {
+            let deleted = 0;
+            for (const [key, record] of recordsByKey) {
+                const expired = input.beforeExpiresAt !== undefined &&
+                    record.expiresAt !== undefined &&
+                    Number(record.expiresAt) < Number(input.beforeExpiresAt);
+                const revoked = input.beforeRevokedAt !== undefined &&
+                    record.revokedAt !== undefined &&
+                    Number(record.revokedAt) < Number(input.beforeRevokedAt);
+                if (expired || revoked) {
+                    recordsByKey.delete(key);
+                    deleted += 1;
+                }
+            }
+            return deleted;
+        }),
+    });
+};
+export const OAuthConsentStoreMemoryLive = (records = []) => Layer.succeed(OAuthConsentStore)(makeOAuthConsentStoreMemory(records));
+const oauthClientSecretMemoryKey = (input) => `${input.clientId}\u0000${input.prefix}`;
+export const makeOAuthClientSecretStoreMemory = () => {
+    const recordsByKey = new Map();
+    return OAuthClientSecretStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByKey.set(oauthClientSecretMemoryKey(record), cloneOAuthClientSecretRecord(record));
+        }),
+        findByClientIdAndPrefix: (input) => Effect.sync(() => {
+            const record = recordsByKey.get(oauthClientSecretMemoryKey(input));
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthClientSecretRecord(record));
+        }),
+        markUsed: (input) => Effect.sync(() => {
+            const key = oauthClientSecretMemoryKey(input);
+            const record = recordsByKey.get(key);
+            if (record === undefined || record.revokedAt !== undefined) {
+                return Option.none();
+            }
+            const updated = cloneOAuthClientSecretRecord({
+                ...record,
+                lastUsedAt: input.lastUsedAt,
+                metadata: input.metadata ?? record.metadata,
+            });
+            recordsByKey.set(key, updated);
+            return Option.some(cloneOAuthClientSecretRecord(updated));
+        }),
+        revoke: (input) => Effect.sync(() => {
+            const key = oauthClientSecretMemoryKey(input);
+            const record = recordsByKey.get(key);
+            if (record === undefined) {
+                return Option.none();
+            }
+            const updated = cloneOAuthClientSecretRecord({
+                ...record,
+                revokedAt: input.revokedAt,
+                metadata: input.reason === undefined
+                    ? record.metadata
+                    : { ...record.metadata, revokeReason: input.reason },
+            });
+            recordsByKey.set(key, updated);
+            return Option.some(cloneOAuthClientSecretRecord(updated));
+        }),
+    });
+};
+export const OAuthClientSecretStoreMemoryLive = Layer.sync(OAuthClientSecretStore)(makeOAuthClientSecretStoreMemory);
+export const makeOAuthAuthorizationCodeStoreMemory = () => {
+    const recordsByHash = new Map();
+    return OAuthAuthorizationCodeStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByHash.set(record.codeHash, cloneAuthorizationCodeRecord(record));
+        }),
+        findByHash: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.codeHash);
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneAuthorizationCodeRecord(record));
+        }),
+        markConsumed: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.codeHash);
+            if (record === undefined) {
+                return { status: "missing" };
+            }
+            if (record.consumedAt !== undefined) {
+                return {
+                    status: "already_consumed",
+                    record: cloneAuthorizationCodeRecord(record),
+                };
+            }
+            const consumed = cloneAuthorizationCodeRecord({
+                ...record,
+                consumedAt: input.consumedAt,
+            });
+            recordsByHash.set(input.codeHash, consumed);
+            return {
+                status: "consumed",
+                record: cloneAuthorizationCodeRecord(consumed),
+            };
+        }),
+    });
+};
+export const OAuthAuthorizationCodeStoreMemoryLive = Layer.sync(OAuthAuthorizationCodeStore)(makeOAuthAuthorizationCodeStoreMemory);
+export const makeOAuthProviderModeTokenStoreMemory = () => {
+    const recordsByHash = new Map();
+    return OAuthProviderModeTokenStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByHash.set(record.tokenHash, cloneOAuthProviderModeTokenRecord(record));
+        }),
+        findByHash: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.tokenHash);
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthProviderModeTokenRecord(record));
+        }),
+        revokeByHash: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.tokenHash);
+            if (record === undefined ||
+                (input.tokenTypeHint !== undefined &&
+                    record.tokenType !== input.tokenTypeHint)) {
+                return Option.none();
+            }
+            const revoked = cloneOAuthProviderModeTokenRecord({
+                ...record,
+                revokedAt: record.revokedAt ?? input.revokedAt,
+                revocationReason: record.revocationReason ?? input.reason,
+            });
+            recordsByHash.set(input.tokenHash, revoked);
+            return Option.some(cloneOAuthProviderModeTokenRecord(revoked));
+        }),
+        rotateRefreshToken: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.tokenHash);
+            if (record === undefined ||
+                record.tokenType !== "refresh_token" ||
+                record.revokedAt !== undefined ||
+                record.rotatedAt !== undefined) {
+                return Option.none();
+            }
+            const rotated = cloneOAuthProviderModeTokenRecord({
+                ...record,
+                rotatedAt: input.rotatedAt,
+                replacedByTokenHash: input.replacedByTokenHash,
+            });
+            recordsByHash.set(input.tokenHash, rotated);
+            return Option.some(cloneOAuthProviderModeTokenRecord(rotated));
+        }),
+        deleteRetired: (input) => Effect.sync(() => {
+            let deleted = 0;
+            for (const [tokenHash, record] of recordsByHash) {
+                const expired = input.beforeExpiresAt !== undefined &&
+                    Number(record.expiresAt) < Number(input.beforeExpiresAt);
+                const revoked = input.beforeRevokedAt !== undefined &&
+                    record.revokedAt !== undefined &&
+                    Number(record.revokedAt) < Number(input.beforeRevokedAt);
+                const rotated = input.beforeRotatedAt !== undefined &&
+                    record.rotatedAt !== undefined &&
+                    Number(record.rotatedAt) < Number(input.beforeRotatedAt);
+                if (expired || revoked || rotated) {
+                    recordsByHash.delete(tokenHash);
+                    deleted += 1;
+                }
+            }
+            return deleted;
+        }),
+    });
+};
+export const OAuthProviderModeTokenStoreMemoryLive = Layer.sync(OAuthProviderModeTokenStore)(makeOAuthProviderModeTokenStoreMemory);
+export const OidcIdTokenVerifierLive = Layer.effect(OidcIdTokenVerifier)(Effect.gen(function* () {
+    const jwtVerifier = yield* JwtVerifier;
+    return makeOidcIdTokenVerifier({ jwtVerifier });
+}));
+export const OAuthOidcProfileNormalizerLive = Layer.succeed(OAuthProfileNormalizer, makeOidcOAuthProfileNormalizer());
+export const OAuthAccountLinkingLive = Layer.effect(OAuthAccountLinking)(Effect.gen(function* () {
+    const accounts = yield* OAuthAccountStore;
+    return makeOAuthAccountLinkingPolicy({ accounts });
+}));
+export const OAuthAccountUnlinkingLive = Layer.effect(OAuthAccountUnlinking)(Effect.gen(function* () {
+    const accounts = yield* OAuthAccountStore;
+    return makeOAuthAccountUnlinkingPolicy({ accounts });
+}));
+export const OAuthLinkConfirmationLive = Layer.effect(OAuthLinkConfirmation)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    const accounts = yield* OAuthAccountStore;
+    const crypto = yield* Crypto;
+    return makeOAuthLinkConfirmation({ challenge, accounts, crypto });
+}));
+const accountKey = (input) => `${input.providerId}:${input.providerAccountId}`;
+const cloneOAuthAccountRecord = (record) => ({
+    ...record,
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const cloneProviderTokenVaultRecord = (record) => ({
+    ...record,
+    ...(record.scopes === undefined ? {} : { scopes: [...record.scopes] }),
+});
+const providerTokenVaultTokens = (record) => ({
+    accessTokenCiphertext: record.accessTokenCiphertext,
+    ...(record.refreshTokenCiphertext === undefined
+        ? {}
+        : { refreshTokenCiphertext: record.refreshTokenCiphertext }),
+    ...(record.idTokenCiphertext === undefined
+        ? {}
+        : { idTokenCiphertext: record.idTokenCiphertext }),
+    tokenType: record.tokenType,
+    ...(record.scopes === undefined ? {} : { scopes: [...record.scopes] }),
+    ...(record.expiresAt === undefined ? {} : { expiresAt: record.expiresAt }),
+});
+const activeProviderTokenRecord = (record) => record === undefined || record.revokedAt !== undefined ? undefined : record;
+const includeAccount = (record, includeUnlinked) => includeUnlinked === true || record.unlinkedAt === undefined;
+export const makeOAuthProviderTokenVaultMemory = () => {
+    const recordsByAccountId = new Map();
+    return OAuthProviderTokenVault.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByAccountId.set(record.accountId, cloneProviderTokenVaultRecord(record));
+        }),
+        refreshTokenForAccount: (input) => Effect.sync(() => {
+            const record = activeProviderTokenRecord(recordsByAccountId.get(input.accountId));
+            return record?.refreshTokenCiphertext === undefined
+                ? Option.none()
+                : Option.some(record.refreshTokenCiphertext);
+        }),
+        tokensForAccount: (input) => Effect.sync(() => {
+            const record = activeProviderTokenRecord(recordsByAccountId.get(input.accountId));
+            return record === undefined
+                ? Option.none()
+                : Option.some(providerTokenVaultTokens(record));
+        }),
+        markRevoked: (input) => Effect.sync(() => {
+            const record = recordsByAccountId.get(input.accountId);
+            if (record === undefined) {
+                return Option.none();
+            }
+            const revoked = cloneProviderTokenVaultRecord({
+                ...record,
+                revokedAt: input.revokedAt,
+                revocationReason: input.reason,
+            });
+            recordsByAccountId.set(input.accountId, revoked);
+            return Option.some(cloneProviderTokenVaultRecord(revoked));
+        }),
+    });
+};
+export const OAuthProviderTokenVaultMemoryLive = Layer.sync(OAuthProviderTokenVault)(makeOAuthProviderTokenVaultMemory);
+export const makeOAuthAccountStoreMemory = () => {
+    const accountsById = new Map();
+    const idByProviderAccount = new Map();
+    return OAuthAccountStore.make({
+        insert: (row) => Effect.sync(() => {
+            const cloned = cloneOAuthAccountRecord(row);
+            accountsById.set(row.id, cloned);
+            idByProviderAccount.set(accountKey(row), row.id);
+        }),
+        findById: (id) => Effect.sync(() => {
+            const row = accountsById.get(id);
+            return row === undefined ? Option.none() : Option.some(cloneOAuthAccountRecord(row));
+        }),
+        findByProviderAccount: (input) => Effect.sync(() => {
+            const id = idByProviderAccount.get(accountKey(input));
+            const row = id === undefined ? undefined : accountsById.get(id);
+            return row === undefined || !includeAccount(row, input.includeUnlinked)
+                ? Option.none()
+                : Option.some(cloneOAuthAccountRecord(row));
+        }),
+        listByUser: (input) => Effect.sync(() => [...accountsById.values()]
+            .filter((row) => row.userId === input.userId && includeAccount(row, input.includeUnlinked))
+            .map(cloneOAuthAccountRecord)),
+        unlink: (input) => Effect.sync(() => {
+            const id = idByProviderAccount.get(accountKey(input));
+            const row = id === undefined ? undefined : accountsById.get(id);
+            if (row === undefined) {
+                return Option.none();
+            }
+            const updated = {
+                ...row,
+                unlinkedAt: input.unlinkedAt,
+                metadata: input.reason === undefined
+                    ? row.metadata
+                    : { ...row.metadata, unlinkReason: input.reason },
+            };
+            accountsById.set(row.id, updated);
+            return Option.some(cloneOAuthAccountRecord(updated));
+        }),
+    });
+};
+export const OAuthAccountStoreMemoryLive = Layer.sync(OAuthAccountStore)(makeOAuthAccountStoreMemory);
+//# sourceMappingURL=OAuth.js.map