@effect-auth/core 0.1.0-alpha.10 → 0.1.0-alpha.13

package/dist/OAuth.d.ts

@@ -4,7 +4,7 @@ import { Challenge } from "./Challenge.js";
 import type { ChallengeService } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
 import type { CryptoService } from "./Crypto.js";
-import { ChallengeId, Email, OAuthAccountId, OAuthProviderId, UnixMillis, UserId } from "./Identifiers.js";
+import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId } from "./Identifiers.js";
 import { JwtError, JwtVerifier, type JwksDocument, type JwtAudience, type JwtAlgorithm, type JwtClaims, type JwtHeader, type JwtKeyInfo, type JwtKeysService, type JwtVerifierService, type JwtVerificationFailureReason } from "./Jwt.js";
 export type OAuthStateToken = Brand.Branded<string, "auth/OAuthStateToken">;
 export declare const OAuthStateToken: Brand.Constructor<OAuthStateToken>;
@@ -27,8 +27,14 @@ export declare const defaultOAuthLinkConfirmationTtl: Duration.Duration;
 export declare const defaultOAuthJwksCacheTtl: Duration.Duration;
 export declare const defaultOAuthStateSecretBytes = 32;
 export declare const defaultOAuthCodeVerifierBytes = 32;
+export declare const defaultOAuthAuthorizationCodeBytes = 32;
+export declare const defaultOAuthAuthorizationCodeTtl: Duration.Duration;
 export declare const defaultOAuthLinkConfirmationSecretBytes = 32;
 export declare const defaultOAuthNonceBytes = 16;
+export declare const defaultOAuthProviderModeAccessTokenBytes = 32;
+export declare const defaultOAuthProviderModeRefreshTokenBytes = 32;
+export declare const defaultOAuthProviderModeAccessTokenTtl: Duration.Duration;
+export declare const defaultOAuthProviderModeRefreshTokenTtl: Duration.Duration;
 export declare const appleSignInProviderId: OAuthProviderId;
 export declare const appleSignInIssuer = "https://appleid.apple.com";
 export declare const appleSignInAuthorizationEndpoint = "https://appleid.apple.com/auth/authorize";
@@ -169,6 +175,799 @@ export declare class OAuthProviderError extends OAuthProviderError_base<{
 export interface OAuthProvidersService {
     readonly get: (id: OAuthProviderId) => Effect.Effect<OptionTypes.Option<OAuthProviderConfig>, OAuthProviderError>;
 }
+export type OAuthClientType = "public" | "confidential";
+export type OAuthClientStatus = "active" | "disabled";
+export type OAuthClientGrantType = "authorization_code" | "refresh_token" | "client_credentials";
+export type OAuthClientResponseType = "code";
+export type OAuthClientSecretAuthenticationMethod = "client_secret_basic" | "client_secret_post";
+export type OAuthClientSecretPrefix = Brand.Branded<string, "auth/OAuthClientSecretPrefix">;
+export declare const OAuthClientSecretPrefix: Brand.Constructor<OAuthClientSecretPrefix>;
+export type OAuthClientSecret = Brand.Branded<string, "auth/OAuthClientSecret">;
+export declare const OAuthClientSecret: Brand.Constructor<OAuthClientSecret>;
+export type OAuthClientSecretHash = Brand.Branded<string, "auth/OAuthClientSecretHash">;
+export declare const OAuthClientSecretHash: Brand.Constructor<OAuthClientSecretHash>;
+export declare const defaultOAuthClientSecretPrefixBytes = 8;
+export declare const defaultOAuthClientSecretBytes = 32;
+export interface OAuthClientRecord {
+    readonly id: OAuthClientId;
+    readonly type: OAuthClientType;
+    readonly status: OAuthClientStatus;
+    readonly name?: string;
+    readonly redirectUris: readonly string[];
+    readonly allowedGrantTypes: readonly OAuthClientGrantType[];
+    readonly allowedResponseTypes: readonly OAuthClientResponseType[];
+    readonly allowedScopes?: readonly string[];
+    readonly createdAt?: UnixMillis;
+    readonly updatedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthClientLookupInput {
+    readonly clientId: OAuthClientId;
+}
+export interface OAuthClientRedirectUriValidationInput extends OAuthClientLookupInput {
+    readonly redirectUri: string;
+    readonly responseType?: OAuthClientResponseType;
+    readonly grantType?: OAuthClientGrantType;
+}
+export type OAuthClientRedirectUriValidationFailureReason = "unknown_client" | "disabled_client" | "unsupported_response_type" | "unsupported_grant_type" | "redirect_uri_mismatch";
+export type OAuthClientRedirectUriValidationResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthClientRedirectUriValidationFailureReason;
+};
+export type OAuthClientRegistryOperation = "find" | "validate-redirect-uri";
+declare const OAuthClientRegistryError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientRegistryError";
+} & Readonly<A>;
+export declare class OAuthClientRegistryError extends OAuthClientRegistryError_base<{
+    readonly operation: OAuthClientRegistryOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientRegistryService {
+    readonly find: (input: OAuthClientLookupInput) => Effect.Effect<OptionTypes.Option<OAuthClientRecord>, OAuthClientRegistryError>;
+    readonly validateRedirectUri: (input: OAuthClientRedirectUriValidationInput) => Effect.Effect<OAuthClientRedirectUriValidationResult, OAuthClientRegistryError>;
+}
+declare const OAuthClientRegistry_base: Context.ServiceClass<OAuthClientRegistry, "auth/OAuthClientRegistry", OAuthClientRegistryService>;
+export declare class OAuthClientRegistry extends OAuthClientRegistry_base {
+}
+export declare namespace OAuthClientRegistry {
+    const make: (service: OAuthClientRegistryService) => OAuthClientRegistryService;
+}
+export interface OAuthClientStoreListInput {
+    readonly includeDisabled?: boolean;
+}
+export type OAuthClientStoreOperation = "upsert" | "find" | "list" | "validate-redirect-uri";
+declare const OAuthClientStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientStoreError";
+} & Readonly<A>;
+export declare class OAuthClientStoreError extends OAuthClientStoreError_base<{
+    readonly operation: OAuthClientStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientStoreService {
+    readonly upsert: (record: OAuthClientRecord) => Effect.Effect<void, OAuthClientStoreError>;
+    readonly find: (input: OAuthClientLookupInput) => Effect.Effect<OptionTypes.Option<OAuthClientRecord>, OAuthClientStoreError>;
+    readonly list: (input?: OAuthClientStoreListInput) => Effect.Effect<readonly OAuthClientRecord[], OAuthClientStoreError>;
+    readonly validateRedirectUri: (input: OAuthClientRedirectUriValidationInput) => Effect.Effect<OAuthClientRedirectUriValidationResult, OAuthClientStoreError>;
+}
+declare const OAuthClientStore_base: Context.ServiceClass<OAuthClientStore, "auth/OAuthClientStore", OAuthClientStoreService>;
+export declare class OAuthClientStore extends OAuthClientStore_base {
+}
+export declare namespace OAuthClientStore {
+    const make: (service: OAuthClientStoreService) => OAuthClientStoreService;
+}
+export interface OAuthConsentRecord {
+    readonly userId: UserId;
+    readonly clientId: OAuthClientId;
+    readonly scopes: readonly string[];
+    readonly grantedAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthConsentFindActiveInput {
+    readonly userId: UserId;
+    readonly clientId: OAuthClientId;
+    readonly scopes?: readonly string[];
+    readonly now: UnixMillis;
+}
+export interface OAuthConsentListForUserInput {
+    readonly userId: UserId;
+    readonly now: UnixMillis;
+    readonly includeInactive?: boolean;
+}
+export interface OAuthConsentRevokeInput {
+    readonly userId: UserId;
+    readonly clientId: OAuthClientId;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export interface OAuthConsentStoreDeleteInactiveCutoffs {
+    readonly beforeExpiresAt?: UnixMillis;
+    readonly beforeRevokedAt?: UnixMillis;
+}
+export type OAuthConsentStoreDeleteInactiveInput = (OAuthConsentStoreDeleteInactiveCutoffs & {
+    readonly beforeExpiresAt: UnixMillis;
+}) | (OAuthConsentStoreDeleteInactiveCutoffs & {
+    readonly beforeRevokedAt: UnixMillis;
+});
+export type OAuthConsentStoreOperation = "upsert" | "find-active" | "list-for-user" | "revoke" | "deleteInactive";
+declare const OAuthConsentStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthConsentStoreError";
+} & Readonly<A>;
+export declare class OAuthConsentStoreError extends OAuthConsentStoreError_base<{
+    readonly operation: OAuthConsentStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthConsentStoreService {
+    readonly upsert: (record: OAuthConsentRecord) => Effect.Effect<void, OAuthConsentStoreError>;
+    readonly findActive: (input: OAuthConsentFindActiveInput) => Effect.Effect<OptionTypes.Option<OAuthConsentRecord>, OAuthConsentStoreError>;
+    readonly listForUser: (input: OAuthConsentListForUserInput) => Effect.Effect<readonly OAuthConsentRecord[], OAuthConsentStoreError>;
+    readonly revoke: (input: OAuthConsentRevokeInput) => Effect.Effect<OptionTypes.Option<OAuthConsentRecord>, OAuthConsentStoreError>;
+    readonly deleteInactive: (input: OAuthConsentStoreDeleteInactiveInput) => Effect.Effect<number, OAuthConsentStoreError>;
+}
+declare const OAuthConsentStore_base: Context.ServiceClass<OAuthConsentStore, "auth/OAuthConsentStore", OAuthConsentStoreService>;
+export declare class OAuthConsentStore extends OAuthConsentStore_base {
+}
+export declare namespace OAuthConsentStore {
+    const make: (service: OAuthConsentStoreService) => OAuthConsentStoreService;
+}
+export type OAuthClientSecretOperation = "generate" | "parse" | "hash" | "verify";
+declare const OAuthClientSecretError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientSecretError";
+} & Readonly<A>;
+export declare class OAuthClientSecretError extends OAuthClientSecretError_base<{
+    readonly operation: OAuthClientSecretOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientSecretGenerateInput {
+    readonly prefixBytes?: number;
+    readonly secretBytes?: number;
+}
+export interface GeneratedOAuthClientSecret {
+    readonly prefix: OAuthClientSecretPrefix;
+    readonly secret: Redacted.Redacted<OAuthClientSecret>;
+}
+export interface OAuthClientSecretHashInput {
+    readonly secret: Redacted.Redacted<string>;
+}
+export interface OAuthClientSecretVerifyInput extends OAuthClientSecretHashInput {
+    readonly hash: OAuthClientSecretHash;
+}
+export interface OAuthClientSecretsService {
+    readonly generate: (input?: OAuthClientSecretGenerateInput) => Effect.Effect<GeneratedOAuthClientSecret, OAuthClientSecretError>;
+    readonly parse: (secret: Redacted.Redacted<string>) => Effect.Effect<OAuthClientSecretPrefix, OAuthClientSecretError>;
+    readonly hash: (input: OAuthClientSecretHashInput) => Effect.Effect<OAuthClientSecretHash, OAuthClientSecretError>;
+    readonly verify: (input: OAuthClientSecretVerifyInput) => Effect.Effect<boolean, OAuthClientSecretError>;
+}
+declare const OAuthClientSecrets_base: Context.ServiceClass<OAuthClientSecrets, "auth/OAuthClientSecrets", OAuthClientSecretsService>;
+export declare class OAuthClientSecrets extends OAuthClientSecrets_base {
+}
+export declare namespace OAuthClientSecrets {
+    const make: (service: OAuthClientSecretsService) => OAuthClientSecretsService;
+}
+export interface OAuthClientSecretsDependencies {
+    readonly crypto: CryptoService;
+}
+export interface OAuthClientSecretRecord {
+    readonly clientId: OAuthClientId;
+    readonly prefix: OAuthClientSecretPrefix;
+    readonly secretHash: OAuthClientSecretHash;
+    readonly authenticationMethods: readonly OAuthClientSecretAuthenticationMethod[];
+    readonly createdAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly lastUsedAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthClientSecretStoreLookupInput {
+    readonly clientId: OAuthClientId;
+    readonly prefix: OAuthClientSecretPrefix;
+}
+export interface OAuthClientSecretStoreMarkUsedInput extends OAuthClientSecretStoreLookupInput {
+    readonly lastUsedAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthClientSecretStoreRevokeInput extends OAuthClientSecretStoreLookupInput {
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export type OAuthClientSecretStoreOperation = "upsert" | "find" | "mark-used" | "revoke";
+declare const OAuthClientSecretStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientSecretStoreError";
+} & Readonly<A>;
+export declare class OAuthClientSecretStoreError extends OAuthClientSecretStoreError_base<{
+    readonly operation: OAuthClientSecretStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientSecretStoreService {
+    readonly upsert: (record: OAuthClientSecretRecord) => Effect.Effect<void, OAuthClientSecretStoreError>;
+    readonly findByClientIdAndPrefix: (input: OAuthClientSecretStoreLookupInput) => Effect.Effect<OptionTypes.Option<OAuthClientSecretRecord>, OAuthClientSecretStoreError>;
+    readonly markUsed: (input: OAuthClientSecretStoreMarkUsedInput) => Effect.Effect<OptionTypes.Option<OAuthClientSecretRecord>, OAuthClientSecretStoreError>;
+    readonly revoke: (input: OAuthClientSecretStoreRevokeInput) => Effect.Effect<OptionTypes.Option<OAuthClientSecretRecord>, OAuthClientSecretStoreError>;
+}
+declare const OAuthClientSecretStore_base: Context.ServiceClass<OAuthClientSecretStore, "auth/OAuthClientSecretStore", OAuthClientSecretStoreService>;
+export declare class OAuthClientSecretStore extends OAuthClientSecretStore_base {
+}
+export declare namespace OAuthClientSecretStore {
+    const make: (service: OAuthClientSecretStoreService) => OAuthClientSecretStoreService;
+}
+export interface OAuthClientSecretAuthenticateClientInput {
+    readonly clientId: OAuthClientId;
+    readonly method: OAuthClientSecretAuthenticationMethod;
+    readonly clientSecret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type OAuthClientSecretVerificationOperation = "authenticate-client";
+declare const OAuthClientSecretVerificationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientSecretVerificationError";
+} & Readonly<A>;
+export declare class OAuthClientSecretVerificationError extends OAuthClientSecretVerificationError_base<{
+    readonly operation: OAuthClientSecretVerificationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientSecretVerificationService {
+    readonly authenticateClient: (input: OAuthClientSecretAuthenticateClientInput) => Effect.Effect<boolean, OAuthClientSecretVerificationError>;
+}
+declare const OAuthClientSecretVerification_base: Context.ServiceClass<OAuthClientSecretVerification, "auth/OAuthClientSecretVerification", OAuthClientSecretVerificationService>;
+export declare class OAuthClientSecretVerification extends OAuthClientSecretVerification_base {
+}
+export declare namespace OAuthClientSecretVerification {
+    const make: (service: OAuthClientSecretVerificationService) => OAuthClientSecretVerificationService;
+}
+export interface OAuthClientSecretVerificationDependencies {
+    readonly clientSecrets: OAuthClientSecretsService;
+    readonly secretStore: OAuthClientSecretStoreService;
+}
+export interface OAuthAuthorizationCodeRecord {
+    readonly codeHash: string;
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly codeChallengeMethod?: "S256";
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly consumedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthIssuedAuthorizationCode {
+    readonly code: Redacted.Redacted<OAuthAuthorizationCode>;
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly codeChallengeMethod?: "S256";
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthConsumedAuthorizationCode {
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge;
+    readonly codeChallengeMethod?: "S256";
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly consumedAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthAuthorizationCodeIssueInput {
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly redirectUri: string;
+    readonly scopes?: readonly string[];
+    readonly codeChallenge?: OAuthCodeChallenge | string;
+    readonly codeChallengeMethod?: "S256";
+    readonly code?: Redacted.Redacted<OAuthAuthorizationCode | string>;
+    readonly issuedAt?: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly expiresIn?: Duration.Duration;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthAuthorizationCodeConsumeInput {
+    readonly code: Redacted.Redacted<OAuthAuthorizationCode | string>;
+    readonly clientId: OAuthClientId;
+    readonly redirectUri: string;
+    readonly codeVerifier?: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly now?: UnixMillis;
+}
+export type OAuthAuthorizationCodeConsumeFailureReason = "unknown_code" | "already_consumed" | "expired" | "client_mismatch" | "redirect_uri_mismatch" | "pkce_required" | "pkce_mismatch";
+export type OAuthAuthorizationCodeConsumeResult = {
+    readonly valid: true;
+    readonly code: OAuthConsumedAuthorizationCode;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthAuthorizationCodeConsumeFailureReason;
+};
+export interface OAuthAuthorizationCodeStoreLookupInput {
+    readonly codeHash: string;
+}
+export interface OAuthAuthorizationCodeStoreMarkConsumedInput extends OAuthAuthorizationCodeStoreLookupInput {
+    readonly consumedAt: UnixMillis;
+}
+export type OAuthAuthorizationCodeStoreMarkConsumedResult = {
+    readonly status: "missing";
+} | {
+    readonly status: "already_consumed";
+    readonly record: OAuthAuthorizationCodeRecord;
+} | {
+    readonly status: "consumed";
+    readonly record: OAuthAuthorizationCodeRecord;
+};
+export type OAuthAuthorizationCodeStoreOperation = "upsert" | "find" | "mark-consumed";
+declare const OAuthAuthorizationCodeStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeStoreError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeStoreError extends OAuthAuthorizationCodeStoreError_base<{
+    readonly operation: OAuthAuthorizationCodeStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeStoreService {
+    readonly upsert: (record: OAuthAuthorizationCodeRecord) => Effect.Effect<void, OAuthAuthorizationCodeStoreError>;
+    readonly findByHash: (input: OAuthAuthorizationCodeStoreLookupInput) => Effect.Effect<OptionTypes.Option<OAuthAuthorizationCodeRecord>, OAuthAuthorizationCodeStoreError>;
+    readonly markConsumed: (input: OAuthAuthorizationCodeStoreMarkConsumedInput) => Effect.Effect<OAuthAuthorizationCodeStoreMarkConsumedResult, OAuthAuthorizationCodeStoreError>;
+}
+declare const OAuthAuthorizationCodeStore_base: Context.ServiceClass<OAuthAuthorizationCodeStore, "auth/OAuthAuthorizationCodeStore", OAuthAuthorizationCodeStoreService>;
+export declare class OAuthAuthorizationCodeStore extends OAuthAuthorizationCodeStore_base {
+}
+export declare namespace OAuthAuthorizationCodeStore {
+    const make: (service: OAuthAuthorizationCodeStoreService) => OAuthAuthorizationCodeStoreService;
+}
+export type OAuthAuthorizationCodeGrantOperation = "issue" | "consume";
+declare const OAuthAuthorizationCodeGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeGrantError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeGrantError extends OAuthAuthorizationCodeGrantError_base<{
+    readonly operation: OAuthAuthorizationCodeGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeGrantService {
+    readonly issue: (input: OAuthAuthorizationCodeIssueInput) => Effect.Effect<OAuthIssuedAuthorizationCode, OAuthAuthorizationCodeGrantError>;
+    readonly consume: (input: OAuthAuthorizationCodeConsumeInput) => Effect.Effect<OAuthAuthorizationCodeConsumeResult, OAuthAuthorizationCodeGrantError>;
+}
+declare const OAuthAuthorizationCodeGrant_base: Context.ServiceClass<OAuthAuthorizationCodeGrant, "auth/OAuthAuthorizationCodeGrant", OAuthAuthorizationCodeGrantService>;
+export declare class OAuthAuthorizationCodeGrant extends OAuthAuthorizationCodeGrant_base {
+}
+export declare namespace OAuthAuthorizationCodeGrant {
+    const make: (service: OAuthAuthorizationCodeGrantService) => OAuthAuthorizationCodeGrantService;
+}
+export interface OAuthAuthorizationCodeTokenIssueInput {
+    readonly client: OAuthClientRecord;
+    readonly code: OAuthConsumedAuthorizationCode;
+    readonly now: UnixMillis;
+}
+export type OAuthAuthorizationCodeTokenIssuerOperation = "issue";
+declare const OAuthAuthorizationCodeTokenIssuerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeTokenIssuerError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeTokenIssuerError extends OAuthAuthorizationCodeTokenIssuerError_base<{
+    readonly operation: OAuthAuthorizationCodeTokenIssuerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeTokenIssuerService {
+    readonly issue: (input: OAuthAuthorizationCodeTokenIssueInput) => Effect.Effect<OAuthTokenResponse, OAuthAuthorizationCodeTokenIssuerError>;
+}
+declare const OAuthAuthorizationCodeTokenIssuer_base: Context.ServiceClass<OAuthAuthorizationCodeTokenIssuer, "auth/OAuthAuthorizationCodeTokenIssuer", OAuthAuthorizationCodeTokenIssuerService>;
+export declare class OAuthAuthorizationCodeTokenIssuer extends OAuthAuthorizationCodeTokenIssuer_base {
+}
+export declare namespace OAuthAuthorizationCodeTokenIssuer {
+    const make: (service: OAuthAuthorizationCodeTokenIssuerService) => OAuthAuthorizationCodeTokenIssuerService;
+}
+export interface OAuthAuthorizationCodeTokenGrantInput {
+    readonly grantType: string;
+    readonly code?: Redacted.Redacted<OAuthAuthorizationCode | string>;
+    readonly clientId?: OAuthClientId | string;
+    readonly redirectUri?: string;
+    readonly codeVerifier?: Redacted.Redacted<OAuthCodeVerifier | string>;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthAuthorizationCodeTokenGrantFailureReason = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type";
+export type OAuthAuthorizationCodeTokenGrantResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly code: OAuthConsumedAuthorizationCode;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthAuthorizationCodeTokenGrantFailureReason;
+};
+export type OAuthAuthorizationCodeTokenGrantOperation = "exchange";
+declare const OAuthAuthorizationCodeTokenGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthAuthorizationCodeTokenGrantError";
+} & Readonly<A>;
+export declare class OAuthAuthorizationCodeTokenGrantError extends OAuthAuthorizationCodeTokenGrantError_base<{
+    readonly operation: OAuthAuthorizationCodeTokenGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthAuthorizationCodeTokenGrantService {
+    readonly exchange: (input: OAuthAuthorizationCodeTokenGrantInput) => Effect.Effect<OAuthAuthorizationCodeTokenGrantResult, OAuthAuthorizationCodeTokenGrantError>;
+}
+declare const OAuthAuthorizationCodeTokenGrant_base: Context.ServiceClass<OAuthAuthorizationCodeTokenGrant, "auth/OAuthAuthorizationCodeTokenGrant", OAuthAuthorizationCodeTokenGrantService>;
+export declare class OAuthAuthorizationCodeTokenGrant extends OAuthAuthorizationCodeTokenGrant_base {
+}
+export declare namespace OAuthAuthorizationCodeTokenGrant {
+    const make: (service: OAuthAuthorizationCodeTokenGrantService) => OAuthAuthorizationCodeTokenGrantService;
+}
+export interface OAuthRefreshTokenIssueInput {
+    readonly client: OAuthClientRecord;
+    readonly refreshToken: Redacted.Redacted<OAuthRefreshToken | string>;
+    readonly scopes?: readonly string[];
+    readonly now: UnixMillis;
+}
+export type OAuthRefreshTokenIssueFailureReason = "invalid_grant" | "invalid_scope";
+export type OAuthRefreshTokenIssueResult = {
+    readonly valid: true;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthRefreshTokenIssueFailureReason;
+};
+export type OAuthRefreshTokenIssuerOperation = "issue";
+declare const OAuthRefreshTokenIssuerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthRefreshTokenIssuerError";
+} & Readonly<A>;
+export declare class OAuthRefreshTokenIssuerError extends OAuthRefreshTokenIssuerError_base<{
+    readonly operation: OAuthRefreshTokenIssuerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthRefreshTokenIssuerService {
+    readonly issue: (input: OAuthRefreshTokenIssueInput) => Effect.Effect<OAuthRefreshTokenIssueResult, OAuthRefreshTokenIssuerError>;
+}
+declare const OAuthRefreshTokenIssuer_base: Context.ServiceClass<OAuthRefreshTokenIssuer, "auth/OAuthRefreshTokenIssuer", OAuthRefreshTokenIssuerService>;
+export declare class OAuthRefreshTokenIssuer extends OAuthRefreshTokenIssuer_base {
+}
+export declare namespace OAuthRefreshTokenIssuer {
+    const make: (service: OAuthRefreshTokenIssuerService) => OAuthRefreshTokenIssuerService;
+}
+export interface OAuthRefreshTokenGrantInput {
+    readonly grantType: string;
+    readonly refreshToken?: Redacted.Redacted<OAuthRefreshToken | string>;
+    readonly clientId?: OAuthClientId | string;
+    readonly scopes?: readonly string[] | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthRefreshTokenGrantFailureReason = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type" | "invalid_scope";
+export type OAuthRefreshTokenGrantResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthRefreshTokenGrantFailureReason;
+};
+export type OAuthRefreshTokenGrantOperation = "exchange";
+declare const OAuthRefreshTokenGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthRefreshTokenGrantError";
+} & Readonly<A>;
+export declare class OAuthRefreshTokenGrantError extends OAuthRefreshTokenGrantError_base<{
+    readonly operation: OAuthRefreshTokenGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthRefreshTokenGrantService {
+    readonly exchange: (input: OAuthRefreshTokenGrantInput) => Effect.Effect<OAuthRefreshTokenGrantResult, OAuthRefreshTokenGrantError>;
+}
+declare const OAuthRefreshTokenGrant_base: Context.ServiceClass<OAuthRefreshTokenGrant, "auth/OAuthRefreshTokenGrant", OAuthRefreshTokenGrantService>;
+export declare class OAuthRefreshTokenGrant extends OAuthRefreshTokenGrant_base {
+}
+export declare namespace OAuthRefreshTokenGrant {
+    const make: (service: OAuthRefreshTokenGrantService) => OAuthRefreshTokenGrantService;
+}
+export interface OAuthClientCredentialsTokenIssueInput {
+    readonly client: OAuthClientRecord;
+    readonly scopes?: readonly string[];
+    readonly now: UnixMillis;
+}
+export type OAuthClientCredentialsTokenIssueFailureReason = "invalid_scope";
+export type OAuthClientCredentialsTokenIssueResult = {
+    readonly valid: true;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthClientCredentialsTokenIssueFailureReason;
+};
+export type OAuthClientCredentialsTokenIssuerOperation = "issue";
+declare const OAuthClientCredentialsTokenIssuerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientCredentialsTokenIssuerError";
+} & Readonly<A>;
+export declare class OAuthClientCredentialsTokenIssuerError extends OAuthClientCredentialsTokenIssuerError_base<{
+    readonly operation: OAuthClientCredentialsTokenIssuerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientCredentialsTokenIssuerService {
+    readonly issue: (input: OAuthClientCredentialsTokenIssueInput) => Effect.Effect<OAuthClientCredentialsTokenIssueResult, OAuthClientCredentialsTokenIssuerError>;
+}
+declare const OAuthClientCredentialsTokenIssuer_base: Context.ServiceClass<OAuthClientCredentialsTokenIssuer, "auth/OAuthClientCredentialsTokenIssuer", OAuthClientCredentialsTokenIssuerService>;
+export declare class OAuthClientCredentialsTokenIssuer extends OAuthClientCredentialsTokenIssuer_base {
+}
+export declare namespace OAuthClientCredentialsTokenIssuer {
+    const make: (service: OAuthClientCredentialsTokenIssuerService) => OAuthClientCredentialsTokenIssuerService;
+}
+export interface OAuthClientCredentialsGrantInput {
+    readonly grantType: string;
+    readonly clientId?: OAuthClientId | string;
+    readonly scopes?: readonly string[] | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthClientCredentialsGrantFailureReason = "invalid_request" | "invalid_client" | "unauthorized_client" | "unsupported_grant_type" | "invalid_scope";
+export type OAuthClientCredentialsGrantResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly tokens: OAuthTokenResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthClientCredentialsGrantFailureReason;
+};
+export type OAuthClientCredentialsGrantOperation = "exchange";
+declare const OAuthClientCredentialsGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthClientCredentialsGrantError";
+} & Readonly<A>;
+export declare class OAuthClientCredentialsGrantError extends OAuthClientCredentialsGrantError_base<{
+    readonly operation: OAuthClientCredentialsGrantOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthClientCredentialsGrantService {
+    readonly exchange: (input: OAuthClientCredentialsGrantInput) => Effect.Effect<OAuthClientCredentialsGrantResult, OAuthClientCredentialsGrantError>;
+}
+declare const OAuthClientCredentialsGrant_base: Context.ServiceClass<OAuthClientCredentialsGrant, "auth/OAuthClientCredentialsGrant", OAuthClientCredentialsGrantService>;
+export declare class OAuthClientCredentialsGrant extends OAuthClientCredentialsGrant_base {
+}
+export declare namespace OAuthClientCredentialsGrant {
+    const make: (service: OAuthClientCredentialsGrantService) => OAuthClientCredentialsGrantService;
+}
+export interface OAuthTokenRevokeInput {
+    readonly client: OAuthClientRecord;
+    readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: OAuthTokenRevocationHint;
+    readonly now: UnixMillis;
+}
+export type OAuthTokenRevokerOperation = "revoke";
+declare const OAuthTokenRevokerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenRevokerError";
+} & Readonly<A>;
+export declare class OAuthTokenRevokerError extends OAuthTokenRevokerError_base<{
+    readonly operation: OAuthTokenRevokerOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenRevokerService {
+    readonly revoke: (input: OAuthTokenRevokeInput) => Effect.Effect<void, OAuthTokenRevokerError>;
+}
+declare const OAuthTokenRevoker_base: Context.ServiceClass<OAuthTokenRevoker, "auth/OAuthTokenRevoker", OAuthTokenRevokerService>;
+export declare class OAuthTokenRevoker extends OAuthTokenRevoker_base {
+}
+export declare namespace OAuthTokenRevoker {
+    const make: (service: OAuthTokenRevokerService) => OAuthTokenRevokerService;
+}
+export interface OAuthTokenRevocationRequestInput {
+    readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: OAuthTokenRevocationHint | string;
+    readonly clientId?: OAuthClientId | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthTokenRevocationFailureReason = "invalid_request" | "invalid_client" | "unsupported_token_type";
+export type OAuthTokenRevocationResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthTokenRevocationFailureReason;
+};
+export type OAuthTokenRevocationOperation = "revoke";
+declare const OAuthTokenRevocationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenRevocationError";
+} & Readonly<A>;
+export declare class OAuthTokenRevocationError extends OAuthTokenRevocationError_base<{
+    readonly operation: OAuthTokenRevocationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenRevocationService {
+    readonly revoke: (input: OAuthTokenRevocationRequestInput) => Effect.Effect<OAuthTokenRevocationResult, OAuthTokenRevocationError>;
+}
+declare const OAuthTokenRevocation_base: Context.ServiceClass<OAuthTokenRevocation, "auth/OAuthTokenRevocation", OAuthTokenRevocationService>;
+export declare class OAuthTokenRevocation extends OAuthTokenRevocation_base {
+}
+export declare namespace OAuthTokenRevocation {
+    const make: (service: OAuthTokenRevocationService) => OAuthTokenRevocationService;
+}
+export interface OAuthTokenIntrospectInput {
+    readonly client: OAuthClientRecord;
+    readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: string;
+    readonly now: UnixMillis;
+}
+export type OAuthTokenIntrospectionResponse = {
+    readonly active: false;
+} | {
+    readonly active: true;
+    readonly scopes?: readonly string[];
+    readonly clientId?: OAuthClientId | string;
+    readonly username?: string;
+    readonly tokenType?: string;
+    readonly expiresAt?: UnixMillis;
+    readonly issuedAt?: UnixMillis;
+    readonly notBefore?: UnixMillis;
+    readonly subject?: string;
+    readonly audience?: string | readonly string[];
+    readonly issuer?: string;
+    readonly jwtId?: string;
+    readonly extra?: Readonly<Record<string, unknown>>;
+};
+export type OAuthTokenIntrospectorOperation = "introspect";
+declare const OAuthTokenIntrospectorError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenIntrospectorError";
+} & Readonly<A>;
+export declare class OAuthTokenIntrospectorError extends OAuthTokenIntrospectorError_base<{
+    readonly operation: OAuthTokenIntrospectorOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenIntrospectorService {
+    readonly introspect: (input: OAuthTokenIntrospectInput) => Effect.Effect<OAuthTokenIntrospectionResponse, OAuthTokenIntrospectorError>;
+}
+declare const OAuthTokenIntrospector_base: Context.ServiceClass<OAuthTokenIntrospector, "auth/OAuthTokenIntrospector", OAuthTokenIntrospectorService>;
+export declare class OAuthTokenIntrospector extends OAuthTokenIntrospector_base {
+}
+export declare namespace OAuthTokenIntrospector {
+    const make: (service: OAuthTokenIntrospectorService) => OAuthTokenIntrospectorService;
+}
+export interface OAuthTokenIntrospectionRequestInput {
+    readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
+    readonly tokenTypeHint?: string;
+    readonly clientId?: OAuthClientId | string;
+    readonly clientAuthenticated?: boolean;
+    readonly now?: UnixMillis;
+}
+export type OAuthTokenIntrospectionFailureReason = "invalid_request" | "invalid_client";
+export type OAuthTokenIntrospectionResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly introspection: OAuthTokenIntrospectionResponse;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthTokenIntrospectionFailureReason;
+};
+export type OAuthTokenIntrospectionOperation = "introspect";
+declare const OAuthTokenIntrospectionError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthTokenIntrospectionError";
+} & Readonly<A>;
+export declare class OAuthTokenIntrospectionError extends OAuthTokenIntrospectionError_base<{
+    readonly operation: OAuthTokenIntrospectionOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthTokenIntrospectionService {
+    readonly introspect: (input: OAuthTokenIntrospectionRequestInput) => Effect.Effect<OAuthTokenIntrospectionResult, OAuthTokenIntrospectionError>;
+}
+declare const OAuthTokenIntrospection_base: Context.ServiceClass<OAuthTokenIntrospection, "auth/OAuthTokenIntrospection", OAuthTokenIntrospectionService>;
+export declare class OAuthTokenIntrospection extends OAuthTokenIntrospection_base {
+}
+export declare namespace OAuthTokenIntrospection {
+    const make: (service: OAuthTokenIntrospectionService) => OAuthTokenIntrospectionService;
+}
+export interface OAuthProviderAuthorizationInput {
+    readonly responseType: string;
+    readonly clientId?: OAuthClientId | string;
+    readonly redirectUri?: string;
+    readonly scopes?: readonly string[] | string;
+    readonly state?: string;
+    readonly codeChallenge?: OAuthCodeChallenge | string;
+    readonly codeChallengeMethod?: string;
+    readonly now?: UnixMillis;
+}
+export type OAuthProviderAuthorizationFailureReason = "invalid_request" | "unauthorized_client" | "access_denied" | "unsupported_response_type" | "invalid_scope" | "login_required" | "consent_required";
+export interface OAuthProviderAuthorizationPolicyInput {
+    readonly client: OAuthClientRecord;
+    readonly requestedScopes: readonly string[];
+    readonly state?: string;
+    readonly request: OAuthProviderAuthorizationInput;
+}
+export type OAuthProviderAuthorizationDecision = {
+    readonly type: "allow";
+    readonly subject: string;
+    readonly scopes?: readonly string[];
+    readonly metadata?: Readonly<Record<string, unknown>>;
+} | {
+    readonly type: "deny";
+    readonly reason: OAuthProviderAuthorizationFailureReason;
+    readonly errorDescription?: string;
+};
+export type OAuthProviderAuthorizationPolicyOperation = "decide";
+declare const OAuthProviderAuthorizationPolicyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderAuthorizationPolicyError";
+} & Readonly<A>;
+export declare class OAuthProviderAuthorizationPolicyError extends OAuthProviderAuthorizationPolicyError_base<{
+    readonly operation: OAuthProviderAuthorizationPolicyOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderAuthorizationPolicyService {
+    readonly decide: (input: OAuthProviderAuthorizationPolicyInput) => Effect.Effect<OAuthProviderAuthorizationDecision, OAuthProviderAuthorizationPolicyError>;
+}
+declare const OAuthProviderAuthorizationPolicy_base: Context.ServiceClass<OAuthProviderAuthorizationPolicy, "auth/OAuthProviderAuthorizationPolicy", OAuthProviderAuthorizationPolicyService>;
+export declare class OAuthProviderAuthorizationPolicy extends OAuthProviderAuthorizationPolicy_base {
+}
+export declare namespace OAuthProviderAuthorizationPolicy {
+    const make: (service: OAuthProviderAuthorizationPolicyService) => OAuthProviderAuthorizationPolicyService;
+}
+export type OAuthProviderAuthorizationResult = {
+    readonly valid: true;
+    readonly client: OAuthClientRecord;
+    readonly redirectUri: string;
+    readonly state?: string;
+    readonly code: OAuthIssuedAuthorizationCode;
+} | {
+    readonly valid: false;
+    readonly reason: OAuthProviderAuthorizationFailureReason;
+    readonly redirectUri?: string;
+    readonly state?: string;
+    readonly client?: OAuthClientRecord;
+    readonly errorDescription?: string;
+};
+export type OAuthProviderAuthorizationOperation = "authorize";
+declare const OAuthProviderAuthorizationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderAuthorizationError";
+} & Readonly<A>;
+export declare class OAuthProviderAuthorizationError extends OAuthProviderAuthorizationError_base<{
+    readonly operation: OAuthProviderAuthorizationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderAuthorizationService {
+    readonly authorize: (input: OAuthProviderAuthorizationInput) => Effect.Effect<OAuthProviderAuthorizationResult, OAuthProviderAuthorizationError>;
+}
+declare const OAuthProviderAuthorization_base: Context.ServiceClass<OAuthProviderAuthorization, "auth/OAuthProviderAuthorization", OAuthProviderAuthorizationService>;
+export declare class OAuthProviderAuthorization extends OAuthProviderAuthorization_base {
+}
+export declare namespace OAuthProviderAuthorization {
+    const make: (service: OAuthProviderAuthorizationService) => OAuthProviderAuthorizationService;
+}
 export type OAuthClientAuthentication = {
     readonly method: "none";
 } | {
@@ -238,6 +1037,71 @@ export interface OAuthTokenResponse {
     readonly scopes?: readonly string[];
     readonly extra?: Readonly<Record<string, unknown>>;
 }
+export type OAuthProviderModeTokenType = "access_token" | "refresh_token";
+export interface OAuthProviderModeTokenRecord {
+    readonly tokenHash: string;
+    readonly tokenType: OAuthProviderModeTokenType;
+    readonly clientId: OAuthClientId;
+    readonly subject: string;
+    readonly scopes: readonly string[];
+    readonly issuedAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly issuer?: string;
+    readonly audience?: string | readonly string[];
+    readonly jwtId?: string;
+    readonly revokedAt?: UnixMillis;
+    readonly revocationReason?: string;
+    readonly rotatedAt?: UnixMillis;
+    readonly replacedByTokenHash?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface OAuthProviderModeTokenStoreLookupInput {
+    readonly tokenHash: string;
+}
+export interface OAuthProviderModeTokenStoreRevokeInput extends OAuthProviderModeTokenStoreLookupInput {
+    readonly tokenTypeHint?: OAuthProviderModeTokenType;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export interface OAuthProviderModeTokenStoreRotateInput extends OAuthProviderModeTokenStoreLookupInput {
+    readonly replacedByTokenHash: string;
+    readonly rotatedAt: UnixMillis;
+}
+export interface OAuthProviderModeTokenStoreDeleteRetiredCutoffs {
+    readonly beforeExpiresAt?: UnixMillis;
+    readonly beforeRevokedAt?: UnixMillis;
+    readonly beforeRotatedAt?: UnixMillis;
+}
+export type OAuthProviderModeTokenStoreDeleteRetiredInput = (OAuthProviderModeTokenStoreDeleteRetiredCutoffs & {
+    readonly beforeExpiresAt: UnixMillis;
+}) | (OAuthProviderModeTokenStoreDeleteRetiredCutoffs & {
+    readonly beforeRevokedAt: UnixMillis;
+}) | (OAuthProviderModeTokenStoreDeleteRetiredCutoffs & {
+    readonly beforeRotatedAt: UnixMillis;
+});
+export type OAuthProviderModeTokenStoreOperation = "upsert" | "find" | "revoke" | "rotate" | "deleteRetired";
+declare const OAuthProviderModeTokenStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderModeTokenStoreError";
+} & Readonly<A>;
+export declare class OAuthProviderModeTokenStoreError extends OAuthProviderModeTokenStoreError_base<{
+    readonly operation: OAuthProviderModeTokenStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthProviderModeTokenStoreService {
+    readonly upsert: (record: OAuthProviderModeTokenRecord) => Effect.Effect<void, OAuthProviderModeTokenStoreError>;
+    readonly findByHash: (input: OAuthProviderModeTokenStoreLookupInput) => Effect.Effect<OptionTypes.Option<OAuthProviderModeTokenRecord>, OAuthProviderModeTokenStoreError>;
+    readonly revokeByHash: (input: OAuthProviderModeTokenStoreRevokeInput) => Effect.Effect<OptionTypes.Option<OAuthProviderModeTokenRecord>, OAuthProviderModeTokenStoreError>;
+    readonly rotateRefreshToken: (input: OAuthProviderModeTokenStoreRotateInput) => Effect.Effect<OptionTypes.Option<OAuthProviderModeTokenRecord>, OAuthProviderModeTokenStoreError>;
+    readonly deleteRetired: (input: OAuthProviderModeTokenStoreDeleteRetiredInput) => Effect.Effect<number, OAuthProviderModeTokenStoreError>;
+}
+declare const OAuthProviderModeTokenStore_base: Context.ServiceClass<OAuthProviderModeTokenStore, "auth/OAuthProviderModeTokenStore", OAuthProviderModeTokenStoreService>;
+export declare class OAuthProviderModeTokenStore extends OAuthProviderModeTokenStore_base {
+}
+export declare namespace OAuthProviderModeTokenStore {
+    const make: (service: OAuthProviderModeTokenStoreService) => OAuthProviderModeTokenStoreService;
+}
 export interface OAuthProviderTokenVaultRecord {
     readonly accountId: OAuthAccountId;
     readonly userId: UserId;
@@ -861,6 +1725,57 @@ export interface OAuthStateDependencies {
     readonly codeVerifierBytes?: number;
     readonly nonceBytes?: number;
 }
+export interface OAuthAuthorizationCodeGrantDependencies {
+    readonly crypto: CryptoService;
+    readonly store: OAuthAuthorizationCodeStoreService;
+    readonly codeBytes?: number;
+    readonly codeTtl?: Duration.Duration;
+}
+export interface OAuthAuthorizationCodeTokenGrantDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly authorizationCodes: OAuthAuthorizationCodeGrantService;
+    readonly issuer: OAuthAuthorizationCodeTokenIssuerService;
+}
+export interface OAuthRefreshTokenGrantDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly issuer: OAuthRefreshTokenIssuerService;
+}
+export interface OAuthClientCredentialsGrantDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly issuer: OAuthClientCredentialsTokenIssuerService;
+}
+export interface OAuthProviderModeOpaqueTokenIssuerDependencies {
+    readonly crypto: CryptoService;
+    readonly tokenStore: OAuthProviderModeTokenStoreService;
+    readonly accessTokenBytes?: number;
+    readonly refreshTokenBytes?: number;
+    readonly accessTokenTtl?: Duration.Duration;
+    readonly refreshTokenTtl?: Duration.Duration;
+    readonly issuer?: string;
+    readonly audience?: string | readonly string[];
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly clientCredentialsSubject?: (input: OAuthClientCredentialsTokenIssueInput) => string;
+}
+export interface OAuthProviderModeOpaqueTokenIssuerServices {
+    readonly authorizationCode: OAuthAuthorizationCodeTokenIssuerService;
+    readonly refreshToken: OAuthRefreshTokenIssuerService;
+    readonly clientCredentials: OAuthClientCredentialsTokenIssuerService;
+}
+export type OAuthProviderModeOpaqueTokenIssuerLiveOptions = Omit<OAuthProviderModeOpaqueTokenIssuerDependencies, "crypto" | "tokenStore">;
+export interface OAuthTokenRevocationDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly revoker: OAuthTokenRevokerService;
+}
+export interface OAuthTokenIntrospectionDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly introspector: OAuthTokenIntrospectorService;
+}
+export interface OAuthProviderAuthorizationDependencies {
+    readonly clients: OAuthClientRegistryService;
+    readonly authorizationCodes: OAuthAuthorizationCodeGrantService;
+    readonly policy: OAuthProviderAuthorizationPolicyService;
+}
+export declare const makeOAuthClientSecrets: (dependencies: OAuthClientSecretsDependencies) => OAuthClientSecretsService;
 export declare const makeAppleSignInProvider: (input: AppleSignInProviderOptions) => OAuthProviderConfig;
 export declare const makeGithubOAuthProvider: (input: GithubOAuthProviderOptions) => OAuthProviderConfig;
 export declare const makeGoogleOidcProvider: (input: GoogleOidcProviderOptions) => OAuthProviderConfig;
@@ -916,11 +1831,52 @@ export declare const makeOAuthLinkConfirmation: (dependencies: OAuthLinkConfirma
 export declare const startOAuthLinkConfirmation: (input: OAuthLinkConfirmationStartInput) => Effect.Effect<StartedOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
 export declare const inspectOAuthLinkConfirmation: (input: OAuthLinkConfirmationInspectInput) => Effect.Effect<PendingOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
 export declare const confirmOAuthLinkConfirmation: (input: OAuthLinkConfirmationConfirmInput) => Effect.Effect<ConfirmedOAuthLinkConfirmation, OAuthLinkConfirmationError, OAuthLinkConfirmation>;
+export declare const makeOAuthAuthorizationCodeGrant: (dependencies: OAuthAuthorizationCodeGrantDependencies) => OAuthAuthorizationCodeGrantService;
+export declare const makeOAuthAuthorizationCodeTokenGrant: (dependencies: OAuthAuthorizationCodeTokenGrantDependencies) => OAuthAuthorizationCodeTokenGrantService;
+export declare const makeOAuthRefreshTokenGrant: (dependencies: OAuthRefreshTokenGrantDependencies) => OAuthRefreshTokenGrantService;
+export declare const makeOAuthClientCredentialsGrant: (dependencies: OAuthClientCredentialsGrantDependencies) => OAuthClientCredentialsGrantService;
+export declare const makeOAuthProviderModeOpaqueTokenIssuer: (dependencies: OAuthProviderModeOpaqueTokenIssuerDependencies) => OAuthProviderModeOpaqueTokenIssuerServices;
+export declare const makeOAuthClientSecretVerification: (dependencies: OAuthClientSecretVerificationDependencies) => OAuthClientSecretVerificationService;
+export declare const makeOAuthTokenRevocation: (dependencies: OAuthTokenRevocationDependencies) => OAuthTokenRevocationService;
+export declare const makeOAuthTokenIntrospection: (dependencies: OAuthTokenIntrospectionDependencies) => OAuthTokenIntrospectionService;
+export declare const makeOAuthProviderAuthorization: (dependencies: OAuthProviderAuthorizationDependencies) => OAuthProviderAuthorizationService;
+export declare const issueOAuthAuthorizationCode: (input: OAuthAuthorizationCodeIssueInput) => Effect.Effect<OAuthIssuedAuthorizationCode, OAuthAuthorizationCodeGrantError, OAuthAuthorizationCodeGrant>;
+export declare const consumeOAuthAuthorizationCode: (input: OAuthAuthorizationCodeConsumeInput) => Effect.Effect<OAuthAuthorizationCodeConsumeResult, OAuthAuthorizationCodeGrantError, OAuthAuthorizationCodeGrant>;
+export declare const exchangeOAuthAuthorizationCodeToken: (input: OAuthAuthorizationCodeTokenGrantInput) => Effect.Effect<OAuthAuthorizationCodeTokenGrantResult, OAuthAuthorizationCodeTokenGrantError, OAuthAuthorizationCodeTokenGrant>;
+export declare const exchangeOAuthRefreshToken: (input: OAuthRefreshTokenGrantInput) => Effect.Effect<OAuthRefreshTokenGrantResult, OAuthRefreshTokenGrantError, OAuthRefreshTokenGrant>;
+export declare const exchangeOAuthClientCredentialsToken: (input: OAuthClientCredentialsGrantInput) => Effect.Effect<OAuthClientCredentialsGrantResult, OAuthClientCredentialsGrantError, OAuthClientCredentialsGrant>;
+export declare const revokeOAuthToken: (input: OAuthTokenRevocationRequestInput) => Effect.Effect<OAuthTokenRevocationResult, OAuthTokenRevocationError, OAuthTokenRevocation>;
+export declare const introspectOAuthToken: (input: OAuthTokenIntrospectionRequestInput) => Effect.Effect<OAuthTokenIntrospectionResult, OAuthTokenIntrospectionError, OAuthTokenIntrospection>;
+export declare const authorizeOAuthProviderAuthorization: (input: OAuthProviderAuthorizationInput) => Effect.Effect<OAuthProviderAuthorizationResult, OAuthProviderAuthorizationError, OAuthProviderAuthorization>;
 export declare const makeOAuthPkce: (input?: OAuthPkceInput) => Effect.Effect<OAuthPkce, OAuthStateError, Crypto>;
 export declare const makeOAuthState: (dependencies: OAuthStateDependencies) => OAuthStateService;
 export declare const OAuthStateLive: Layer.Layer<OAuthState, never, Crypto | Challenge>;
+export declare const OAuthAuthorizationCodeGrantLive: Layer.Layer<OAuthAuthorizationCodeGrant, never, Crypto | OAuthAuthorizationCodeStore>;
+export declare const OAuthAuthorizationCodeTokenGrantLive: Layer.Layer<OAuthAuthorizationCodeTokenGrant, never, OAuthClientRegistry | OAuthAuthorizationCodeGrant | OAuthAuthorizationCodeTokenIssuer>;
+export declare const OAuthRefreshTokenGrantLive: Layer.Layer<OAuthRefreshTokenGrant, never, OAuthClientRegistry | OAuthRefreshTokenIssuer>;
+export declare const OAuthClientCredentialsGrantLive: Layer.Layer<OAuthClientCredentialsGrant, never, OAuthClientRegistry | OAuthClientCredentialsTokenIssuer>;
+export declare const OAuthProviderModeOpaqueTokenIssuerLive: (options?: OAuthProviderModeOpaqueTokenIssuerLiveOptions) => Layer.Layer<OAuthAuthorizationCodeTokenIssuer | OAuthRefreshTokenIssuer | OAuthClientCredentialsTokenIssuer, never, Crypto | OAuthProviderModeTokenStore>;
+export declare const OAuthTokenRevocationLive: Layer.Layer<OAuthTokenRevocation, never, OAuthClientRegistry | OAuthTokenRevoker>;
+export declare const OAuthTokenIntrospectionLive: Layer.Layer<OAuthTokenIntrospection, never, OAuthClientRegistry | OAuthTokenIntrospector>;
+export declare const OAuthProviderAuthorizationLive: Layer.Layer<OAuthProviderAuthorization, never, OAuthClientRegistry | OAuthAuthorizationCodeGrant | OAuthProviderAuthorizationPolicy>;
 export declare const makeOAuthProviders: (providers: readonly OAuthProviderConfig[]) => OAuthProvidersService;
 export declare const OAuthProvidersLive: (providers: readonly OAuthProviderConfig[]) => Layer.Layer<OAuthProviders, never, never>;
+export declare const OAuthClientSecretsLive: Layer.Layer<OAuthClientSecrets, never, Crypto>;
+export declare const OAuthClientSecretVerificationLive: Layer.Layer<OAuthClientSecretVerification, never, OAuthClientSecrets | OAuthClientSecretStore>;
+export declare const makeOAuthClientRegistryFromStore: (store: OAuthClientStoreService) => OAuthClientRegistryService;
+export declare const OAuthClientRegistryFromStoreLive: Layer.Layer<OAuthClientRegistry, never, OAuthClientStore>;
+export declare const makeOAuthClientRegistryMemory: (clients?: readonly OAuthClientRecord[]) => OAuthClientRegistryService;
+export declare const OAuthClientRegistryMemoryLive: (clients?: readonly OAuthClientRecord[]) => Layer.Layer<OAuthClientRegistry, never, never>;
+export declare const makeOAuthClientStoreMemory: (clients?: readonly OAuthClientRecord[]) => OAuthClientStoreService;
+export declare const OAuthClientStoreMemoryLive: (clients?: readonly OAuthClientRecord[]) => Layer.Layer<OAuthClientStore, never, never>;
+export declare const makeOAuthConsentStoreMemory: (records?: readonly OAuthConsentRecord[]) => OAuthConsentStoreService;
+export declare const OAuthConsentStoreMemoryLive: (records?: readonly OAuthConsentRecord[]) => Layer.Layer<OAuthConsentStore, never, never>;
+export declare const makeOAuthClientSecretStoreMemory: () => OAuthClientSecretStoreService;
+export declare const OAuthClientSecretStoreMemoryLive: Layer.Layer<OAuthClientSecretStore, never, never>;
+export declare const makeOAuthAuthorizationCodeStoreMemory: () => OAuthAuthorizationCodeStoreService;
+export declare const OAuthAuthorizationCodeStoreMemoryLive: Layer.Layer<OAuthAuthorizationCodeStore, never, never>;
+export declare const makeOAuthProviderModeTokenStoreMemory: () => OAuthProviderModeTokenStoreService;
+export declare const OAuthProviderModeTokenStoreMemoryLive: Layer.Layer<OAuthProviderModeTokenStore, never, never>;
 export declare const OidcIdTokenVerifierLive: Layer.Layer<OidcIdTokenVerifier, never, JwtVerifier>;
 export declare const OAuthOidcProfileNormalizerLive: Layer.Layer<OAuthProfileNormalizer, never, never>;
 export declare const OAuthAccountLinkingLive: Layer.Layer<OAuthAccountLinking, never, OAuthAccountStore>;