@effect-auth/core 0.1.0-alpha.10 → 0.1.0-alpha.14

package/dist/OAuth.js

@@ -1,7 +1,7 @@
 import { Brand, Context, Data, Duration, Effect, Encoding, Layer, Option, Redacted, } from "effect";
 import { Challenge } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
-import { ChallengeId, Email, OAuthAccountId, OAuthProviderId, UnixMillis, UserId, } from "./Identifiers.js";
+import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId, } from "./Identifiers.js";
 import { currentUnixMillis } from "./Internal.js";
 import { JwtAlgorithms, JwtError, JwtKeyId, JwtKeys, JwtVerifier, } from "./Jwt.js";
 export const OAuthStateToken = Brand.nominal();
@@ -17,8 +17,14 @@ export const defaultOAuthLinkConfirmationTtl = Duration.minutes(15);
 export const defaultOAuthJwksCacheTtl = Duration.minutes(10);
 export const defaultOAuthStateSecretBytes = 32;
 export const defaultOAuthCodeVerifierBytes = 32;
+export const defaultOAuthAuthorizationCodeBytes = 32;
+export const defaultOAuthAuthorizationCodeTtl = Duration.minutes(5);
 export const defaultOAuthLinkConfirmationSecretBytes = 32;
 export const defaultOAuthNonceBytes = 16;
+export const defaultOAuthProviderModeAccessTokenBytes = 32;
+export const defaultOAuthProviderModeRefreshTokenBytes = 32;
+export const defaultOAuthProviderModeAccessTokenTtl = Duration.hours(1);
+export const defaultOAuthProviderModeRefreshTokenTtl = Duration.days(30);
 export const appleSignInProviderId = OAuthProviderId("apple");
 export const appleSignInIssuer = "https://appleid.apple.com";
 export const appleSignInAuthorizationEndpoint = "https://appleid.apple.com/auth/authorize";
@@ -70,8 +76,160 @@ export const microsoftOidcJwksUri = (tenant) => `${microsoftOidcLoginBaseUrl}/${
 export const microsoftOidcIssuer = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/v2.0`;
 export class OAuthProviderError extends Data.TaggedError("OAuthProviderError") {
 }
+export const OAuthClientSecretPrefix = Brand.nominal();
+export const OAuthClientSecret = Brand.nominal();
+export const OAuthClientSecretHash = Brand.nominal();
+export const defaultOAuthClientSecretPrefixBytes = 8;
+export const defaultOAuthClientSecretBytes = 32;
+export class OAuthClientRegistryError extends Data.TaggedError("OAuthClientRegistryError") {
+}
+export class OAuthClientRegistry extends Context.Service()("auth/OAuthClientRegistry") {
+}
+(function (OAuthClientRegistry) {
+    OAuthClientRegistry.make = (service) => OAuthClientRegistry.of(service);
+})(OAuthClientRegistry || (OAuthClientRegistry = {}));
+export class OAuthClientStoreError extends Data.TaggedError("OAuthClientStoreError") {
+}
+export class OAuthClientStore extends Context.Service()("auth/OAuthClientStore") {
+}
+(function (OAuthClientStore) {
+    OAuthClientStore.make = (service) => OAuthClientStore.of(service);
+})(OAuthClientStore || (OAuthClientStore = {}));
+export class OAuthConsentStoreError extends Data.TaggedError("OAuthConsentStoreError") {
+}
+export class OAuthConsentStore extends Context.Service()("auth/OAuthConsentStore") {
+}
+(function (OAuthConsentStore) {
+    OAuthConsentStore.make = (service) => OAuthConsentStore.of(service);
+})(OAuthConsentStore || (OAuthConsentStore = {}));
+export class OAuthClientSecretError extends Data.TaggedError("OAuthClientSecretError") {
+}
+export class OAuthClientSecrets extends Context.Service()("auth/OAuthClientSecrets") {
+}
+(function (OAuthClientSecrets) {
+    OAuthClientSecrets.make = (service) => OAuthClientSecrets.of(service);
+})(OAuthClientSecrets || (OAuthClientSecrets = {}));
+export class OAuthClientSecretStoreError extends Data.TaggedError("OAuthClientSecretStoreError") {
+}
+export class OAuthClientSecretStore extends Context.Service()("auth/OAuthClientSecretStore") {
+}
+(function (OAuthClientSecretStore) {
+    OAuthClientSecretStore.make = (service) => OAuthClientSecretStore.of(service);
+})(OAuthClientSecretStore || (OAuthClientSecretStore = {}));
+export class OAuthClientSecretVerificationError extends Data.TaggedError("OAuthClientSecretVerificationError") {
+}
+export class OAuthClientSecretVerification extends Context.Service()("auth/OAuthClientSecretVerification") {
+}
+(function (OAuthClientSecretVerification) {
+    OAuthClientSecretVerification.make = (service) => OAuthClientSecretVerification.of(service);
+})(OAuthClientSecretVerification || (OAuthClientSecretVerification = {}));
+export class OAuthAuthorizationCodeStoreError extends Data.TaggedError("OAuthAuthorizationCodeStoreError") {
+}
+export class OAuthAuthorizationCodeStore extends Context.Service()("auth/OAuthAuthorizationCodeStore") {
+}
+(function (OAuthAuthorizationCodeStore) {
+    OAuthAuthorizationCodeStore.make = (service) => OAuthAuthorizationCodeStore.of(service);
+})(OAuthAuthorizationCodeStore || (OAuthAuthorizationCodeStore = {}));
+export class OAuthAuthorizationCodeGrantError extends Data.TaggedError("OAuthAuthorizationCodeGrantError") {
+}
+export class OAuthAuthorizationCodeGrant extends Context.Service()("auth/OAuthAuthorizationCodeGrant") {
+}
+(function (OAuthAuthorizationCodeGrant) {
+    OAuthAuthorizationCodeGrant.make = (service) => OAuthAuthorizationCodeGrant.of(service);
+})(OAuthAuthorizationCodeGrant || (OAuthAuthorizationCodeGrant = {}));
+export class OAuthAuthorizationCodeTokenIssuerError extends Data.TaggedError("OAuthAuthorizationCodeTokenIssuerError") {
+}
+export class OAuthAuthorizationCodeTokenIssuer extends Context.Service()("auth/OAuthAuthorizationCodeTokenIssuer") {
+}
+(function (OAuthAuthorizationCodeTokenIssuer) {
+    OAuthAuthorizationCodeTokenIssuer.make = (service) => OAuthAuthorizationCodeTokenIssuer.of(service);
+})(OAuthAuthorizationCodeTokenIssuer || (OAuthAuthorizationCodeTokenIssuer = {}));
+export class OAuthAuthorizationCodeTokenGrantError extends Data.TaggedError("OAuthAuthorizationCodeTokenGrantError") {
+}
+export class OAuthAuthorizationCodeTokenGrant extends Context.Service()("auth/OAuthAuthorizationCodeTokenGrant") {
+}
+(function (OAuthAuthorizationCodeTokenGrant) {
+    OAuthAuthorizationCodeTokenGrant.make = (service) => OAuthAuthorizationCodeTokenGrant.of(service);
+})(OAuthAuthorizationCodeTokenGrant || (OAuthAuthorizationCodeTokenGrant = {}));
+export class OAuthRefreshTokenIssuerError extends Data.TaggedError("OAuthRefreshTokenIssuerError") {
+}
+export class OAuthRefreshTokenIssuer extends Context.Service()("auth/OAuthRefreshTokenIssuer") {
+}
+(function (OAuthRefreshTokenIssuer) {
+    OAuthRefreshTokenIssuer.make = (service) => OAuthRefreshTokenIssuer.of(service);
+})(OAuthRefreshTokenIssuer || (OAuthRefreshTokenIssuer = {}));
+export class OAuthRefreshTokenGrantError extends Data.TaggedError("OAuthRefreshTokenGrantError") {
+}
+export class OAuthRefreshTokenGrant extends Context.Service()("auth/OAuthRefreshTokenGrant") {
+}
+(function (OAuthRefreshTokenGrant) {
+    OAuthRefreshTokenGrant.make = (service) => OAuthRefreshTokenGrant.of(service);
+})(OAuthRefreshTokenGrant || (OAuthRefreshTokenGrant = {}));
+export class OAuthClientCredentialsTokenIssuerError extends Data.TaggedError("OAuthClientCredentialsTokenIssuerError") {
+}
+export class OAuthClientCredentialsTokenIssuer extends Context.Service()("auth/OAuthClientCredentialsTokenIssuer") {
+}
+(function (OAuthClientCredentialsTokenIssuer) {
+    OAuthClientCredentialsTokenIssuer.make = (service) => OAuthClientCredentialsTokenIssuer.of(service);
+})(OAuthClientCredentialsTokenIssuer || (OAuthClientCredentialsTokenIssuer = {}));
+export class OAuthClientCredentialsGrantError extends Data.TaggedError("OAuthClientCredentialsGrantError") {
+}
+export class OAuthClientCredentialsGrant extends Context.Service()("auth/OAuthClientCredentialsGrant") {
+}
+(function (OAuthClientCredentialsGrant) {
+    OAuthClientCredentialsGrant.make = (service) => OAuthClientCredentialsGrant.of(service);
+})(OAuthClientCredentialsGrant || (OAuthClientCredentialsGrant = {}));
+export class OAuthTokenRevokerError extends Data.TaggedError("OAuthTokenRevokerError") {
+}
+export class OAuthTokenRevoker extends Context.Service()("auth/OAuthTokenRevoker") {
+}
+(function (OAuthTokenRevoker) {
+    OAuthTokenRevoker.make = (service) => OAuthTokenRevoker.of(service);
+})(OAuthTokenRevoker || (OAuthTokenRevoker = {}));
+export class OAuthTokenRevocationError extends Data.TaggedError("OAuthTokenRevocationError") {
+}
+export class OAuthTokenRevocation extends Context.Service()("auth/OAuthTokenRevocation") {
+}
+(function (OAuthTokenRevocation) {
+    OAuthTokenRevocation.make = (service) => OAuthTokenRevocation.of(service);
+})(OAuthTokenRevocation || (OAuthTokenRevocation = {}));
+export class OAuthTokenIntrospectorError extends Data.TaggedError("OAuthTokenIntrospectorError") {
+}
+export class OAuthTokenIntrospector extends Context.Service()("auth/OAuthTokenIntrospector") {
+}
+(function (OAuthTokenIntrospector) {
+    OAuthTokenIntrospector.make = (service) => OAuthTokenIntrospector.of(service);
+})(OAuthTokenIntrospector || (OAuthTokenIntrospector = {}));
+export class OAuthTokenIntrospectionError extends Data.TaggedError("OAuthTokenIntrospectionError") {
+}
+export class OAuthTokenIntrospection extends Context.Service()("auth/OAuthTokenIntrospection") {
+}
+(function (OAuthTokenIntrospection) {
+    OAuthTokenIntrospection.make = (service) => OAuthTokenIntrospection.of(service);
+})(OAuthTokenIntrospection || (OAuthTokenIntrospection = {}));
+export class OAuthProviderAuthorizationPolicyError extends Data.TaggedError("OAuthProviderAuthorizationPolicyError") {
+}
+export class OAuthProviderAuthorizationPolicy extends Context.Service()("auth/OAuthProviderAuthorizationPolicy") {
+}
+(function (OAuthProviderAuthorizationPolicy) {
+    OAuthProviderAuthorizationPolicy.make = (service) => OAuthProviderAuthorizationPolicy.of(service);
+})(OAuthProviderAuthorizationPolicy || (OAuthProviderAuthorizationPolicy = {}));
+export class OAuthProviderAuthorizationError extends Data.TaggedError("OAuthProviderAuthorizationError") {
+}
+export class OAuthProviderAuthorization extends Context.Service()("auth/OAuthProviderAuthorization") {
+}
+(function (OAuthProviderAuthorization) {
+    OAuthProviderAuthorization.make = (service) => OAuthProviderAuthorization.of(service);
+})(OAuthProviderAuthorization || (OAuthProviderAuthorization = {}));
 export class OAuthUserInfoError extends Data.TaggedError("OAuthUserInfoError") {
 }
+export class OAuthProviderModeTokenStoreError extends Data.TaggedError("OAuthProviderModeTokenStoreError") {
+}
+export class OAuthProviderModeTokenStore extends Context.Service()("auth/OAuthProviderModeTokenStore") {
+}
+(function (OAuthProviderModeTokenStore) {
+    OAuthProviderModeTokenStore.make = (service) => OAuthProviderModeTokenStore.of(service);
+})(OAuthProviderModeTokenStore || (OAuthProviderModeTokenStore = {}));
 export class OAuthProviderTokenVaultError extends Data.TaggedError("OAuthProviderTokenVaultError") {
 }
 export class OAuthProviderTokenVault extends Context.Service()("auth/OAuthProviderTokenVault") {
@@ -148,6 +306,43 @@ export class OAuthLinkConfirmation extends Context.Service()("auth/OAuthLinkConf
     OAuthLinkConfirmation.make = (service) => OAuthLinkConfirmation.of(service);
 })(OAuthLinkConfirmation || (OAuthLinkConfirmation = {}));
 const oauthStateError = (operation, message, cause) => new OAuthStateError({ operation, message, cause });
+const oauthAuthorizationCodeGrantError = (operation, message, cause) => new OAuthAuthorizationCodeGrantError({ operation, message, cause });
+const oauthAuthorizationCodeTokenGrantError = (operation, message, cause) => new OAuthAuthorizationCodeTokenGrantError({ operation, message, cause });
+const oauthAuthorizationCodeTokenIssuerError = (message, cause) => new OAuthAuthorizationCodeTokenIssuerError({
+    operation: "issue",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthRefreshTokenGrantError = (operation, message, cause) => new OAuthRefreshTokenGrantError({ operation, message, cause });
+const oauthRefreshTokenIssuerError = (message, cause) => new OAuthRefreshTokenIssuerError({
+    operation: "issue",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientCredentialsGrantError = (operation, message, cause) => new OAuthClientCredentialsGrantError({ operation, message, cause });
+const oauthClientCredentialsTokenIssuerError = (message, cause) => new OAuthClientCredentialsTokenIssuerError({
+    operation: "issue",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientRegistryError = (operation, message, cause) => new OAuthClientRegistryError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientSecretError = (operation, message, cause) => new OAuthClientSecretError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthClientSecretVerificationError = (message, cause) => new OAuthClientSecretVerificationError({
+    operation: "authenticate-client",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthTokenRevocationError = (operation, message, cause) => new OAuthTokenRevocationError({ operation, message, cause });
+const oauthTokenIntrospectionError = (operation, message, cause) => new OAuthTokenIntrospectionError({ operation, message, cause });
+const oauthProviderAuthorizationError = (operation, message, cause) => new OAuthProviderAuthorizationError({ operation, message, cause });
 const oauthTokenExchangeError = (operation, message, cause) => new OAuthTokenExchangeError({ operation, message, cause });
 const oauthProviderTokenLifecycleError = (operation, message, cause) => new OAuthProviderTokenLifecycleError({ operation, message, cause });
 const oidcIdTokenVerifierError = (operation, message, cause) => new OidcIdTokenVerifierError({ operation, message, cause });
@@ -187,7 +382,56 @@ const validateByteLength = (value, operation, label) => Number.isInteger(value)
 const validateOAuthLinkConfirmationSecretBytes = (value) => Number.isInteger(value) && value >= 16 && value <= 128
     ? Effect.succeed(value)
     : Effect.fail(oauthLinkConfirmationError("start", "OAuth link confirmation secret byte length must be an integer between 16 and 128"));
+const validateOAuthAuthorizationCodeBytes = (value) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthAuthorizationCodeGrantError("issue", "OAuth authorization code byte length must be an integer between 16 and 128"));
 const metadataValue = (value) => value === undefined ? undefined : structuredClone(value);
+const validateOAuthClientSecretByteLength = (value, operation, label) => Number.isInteger(value) && value >= 4 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthClientSecretError(operation, `${label} byte length must be an integer between 4 and 128`));
+const parseOAuthClientSecretValue = (secret) => {
+    const value = secret.trim();
+    const parts = value.split(".");
+    if (parts.length !== 2 || parts[0] === "" || parts[1] === "") {
+        return Effect.fail(oauthClientSecretError("parse", "OAuth client secret must use '<prefix>.<secret>' format"));
+    }
+    return Effect.succeed(OAuthClientSecretPrefix(parts[0]));
+};
+const hashOAuthClientSecretValue = (dependencies, secret, operation) => dependencies.crypto.digestSha256({ data: `oauth-client-secret:${secret}` }).pipe(Effect.map((hash) => OAuthClientSecretHash(`sha256:${hash}`)), Effect.mapError((cause) => oauthClientSecretError(operation, "Failed to hash OAuth client secret", cause)));
+export const makeOAuthClientSecrets = (dependencies) => OAuthClientSecrets.make({
+    generate: Effect.fn("auth.oauth.client_secret.generate")(function* (input) {
+        const prefixBytes = yield* validateOAuthClientSecretByteLength(input?.prefixBytes ?? defaultOAuthClientSecretPrefixBytes, "generate", "OAuth client secret prefix");
+        const secretBytes = yield* validateOAuthClientSecretByteLength(input?.secretBytes ?? defaultOAuthClientSecretBytes, "generate", "OAuth client secret");
+        const prefix = yield* dependencies.crypto.randomToken(prefixBytes).pipe(Effect.map(OAuthClientSecretPrefix), Effect.mapError((cause) => oauthClientSecretError("generate", "Failed to generate OAuth client secret prefix", cause)));
+        const secret = yield* dependencies.crypto.randomToken(secretBytes).pipe(Effect.map((value) => OAuthClientSecret(`${prefix}.${value}`)), Effect.mapError((cause) => oauthClientSecretError("generate", "Failed to generate OAuth client secret", cause)));
+        return {
+            prefix,
+            secret: Redacted.make(secret),
+        };
+    }),
+    parse: Effect.fn("auth.oauth.client_secret.parse")(function* (secret) {
+        return yield* parseOAuthClientSecretValue(Redacted.value(secret));
+    }),
+    hash: Effect.fn("auth.oauth.client_secret.hash")(function* (input) {
+        const secret = Redacted.value(input.secret).trim();
+        yield* parseOAuthClientSecretValue(secret).pipe(Effect.mapError((cause) => oauthClientSecretError("hash", "Cannot hash malformed OAuth client secret", cause)));
+        return yield* hashOAuthClientSecretValue(dependencies, secret, "hash");
+    }),
+    verify: Effect.fn("auth.oauth.client_secret.verify")(function* (input) {
+        const secret = Redacted.value(input.secret).trim();
+        const prefix = yield* parseOAuthClientSecretValue(secret).pipe(Effect.catchTag("OAuthClientSecretError", () => Effect.succeed(undefined)));
+        if (prefix === undefined) {
+            return false;
+        }
+        const hash = yield* hashOAuthClientSecretValue(dependencies, secret, "verify");
+        return yield* dependencies.crypto
+            .timingSafeEqual({
+            left: textEncoder.encode(hash),
+            right: textEncoder.encode(input.hash),
+        })
+            .pipe(Effect.mapError((cause) => oauthClientSecretError("verify", "Failed to compare OAuth client secret hashes", cause)));
+    }),
+});
 export const makeAppleSignInProvider = (input) => ({
     id: input.id ?? appleSignInProviderId,
     clientId: input.clientId,
@@ -335,6 +579,142 @@ const cloneProviderConfig = (provider) => ({
         : { authorizationParams: { ...provider.authorizationParams } }),
     ...(provider.metadata === undefined ? {} : { metadata: metadataValue(provider.metadata) }),
 });
+const cloneOAuthClientRecord = (client) => ({
+    ...client,
+    redirectUris: [...client.redirectUris],
+    allowedGrantTypes: [...client.allowedGrantTypes],
+    allowedResponseTypes: [...client.allowedResponseTypes],
+    ...(client.allowedScopes === undefined
+        ? {}
+        : { allowedScopes: [...client.allowedScopes] }),
+    ...(client.metadata === undefined ? {} : { metadata: metadataValue(client.metadata) }),
+});
+const validateOAuthClientRedirectUriRecord = (client, input) => {
+    if (client === undefined) {
+        return { valid: false, reason: "unknown_client" };
+    }
+    if (client.status !== "active") {
+        return { valid: false, reason: "disabled_client" };
+    }
+    const responseType = input.responseType ?? "code";
+    if (!client.allowedResponseTypes.includes(responseType)) {
+        return { valid: false, reason: "unsupported_response_type" };
+    }
+    if (input.grantType !== undefined &&
+        !client.allowedGrantTypes.includes(input.grantType)) {
+        return { valid: false, reason: "unsupported_grant_type" };
+    }
+    if (!client.redirectUris.includes(input.redirectUri)) {
+        return { valid: false, reason: "redirect_uri_mismatch" };
+    }
+    return {
+        valid: true,
+        client: cloneOAuthClientRecord(client),
+    };
+};
+const cloneOAuthConsentRecord = (record) => ({
+    userId: record.userId,
+    clientId: record.clientId,
+    scopes: [...record.scopes],
+    grantedAt: record.grantedAt,
+    ...(record.expiresAt === undefined ? {} : { expiresAt: record.expiresAt }),
+    ...(record.revokedAt === undefined ? {} : { revokedAt: record.revokedAt }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
+});
+const oauthConsentCoversScopes = (record, scopes = []) => scopes.every((scope) => record.scopes.includes(scope));
+const isOAuthConsentActive = (record, now, scopes = []) => record.revokedAt === undefined &&
+    (record.expiresAt === undefined || Number(record.expiresAt) > Number(now)) &&
+    oauthConsentCoversScopes(record, scopes);
+const cloneOAuthClientSecretRecord = (record) => ({
+    ...record,
+    authenticationMethods: [...record.authenticationMethods],
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const cloneAuthorizationCodeRecord = (record) => ({
+    ...record,
+    scopes: [...record.scopes],
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const cloneOAuthTokenResponse = (tokens) => ({
+    accessToken: tokens.accessToken,
+    tokenType: tokens.tokenType,
+    ...(tokens.expiresIn === undefined ? {} : { expiresIn: tokens.expiresIn }),
+    ...(tokens.refreshToken === undefined ? {} : { refreshToken: tokens.refreshToken }),
+    ...(tokens.idToken === undefined ? {} : { idToken: tokens.idToken }),
+    ...(tokens.scopes === undefined ? {} : { scopes: [...tokens.scopes] }),
+    ...(tokens.extra === undefined ? {} : { extra: metadataValue(tokens.extra) }),
+});
+const cloneOAuthTokenIntrospectionResponse = (response) => response.active
+    ? {
+        active: true,
+        ...(response.scopes === undefined ? {} : { scopes: [...response.scopes] }),
+        ...(response.clientId === undefined ? {} : { clientId: response.clientId }),
+        ...(response.username === undefined ? {} : { username: response.username }),
+        ...(response.tokenType === undefined ? {} : { tokenType: response.tokenType }),
+        ...(response.expiresAt === undefined ? {} : { expiresAt: response.expiresAt }),
+        ...(response.issuedAt === undefined ? {} : { issuedAt: response.issuedAt }),
+        ...(response.notBefore === undefined ? {} : { notBefore: response.notBefore }),
+        ...(response.subject === undefined ? {} : { subject: response.subject }),
+        ...(response.audience === undefined
+            ? {}
+            : {
+                audience: Array.isArray(response.audience)
+                    ? [...response.audience]
+                    : response.audience,
+            }),
+        ...(response.issuer === undefined ? {} : { issuer: response.issuer }),
+        ...(response.jwtId === undefined ? {} : { jwtId: response.jwtId }),
+        ...(response.extra === undefined ? {} : { extra: metadataValue(response.extra) }),
+    }
+    : { active: false };
+const cloneOAuthProviderModeTokenRecord = (record) => ({
+    ...record,
+    scopes: [...record.scopes],
+    ...(record.audience === undefined
+        ? {}
+        : {
+            audience: Array.isArray(record.audience)
+                ? [...record.audience]
+                : record.audience,
+        }),
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const consumedAuthorizationCode = (record, consumedAt) => ({
+    clientId: record.clientId,
+    subject: record.subject,
+    redirectUri: record.redirectUri,
+    scopes: [...record.scopes],
+    ...(record.codeChallenge === undefined
+        ? {}
+        : { codeChallenge: record.codeChallenge }),
+    ...(record.codeChallengeMethod === undefined
+        ? {}
+        : { codeChallengeMethod: record.codeChallengeMethod }),
+    issuedAt: record.issuedAt,
+    expiresAt: record.expiresAt,
+    consumedAt,
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const issuedAuthorizationCode = (input) => ({
+    code: Redacted.make(input.code),
+    clientId: input.record.clientId,
+    subject: input.record.subject,
+    redirectUri: input.record.redirectUri,
+    scopes: [...input.record.scopes],
+    ...(input.record.codeChallenge === undefined
+        ? {}
+        : { codeChallenge: input.record.codeChallenge }),
+    ...(input.record.codeChallengeMethod === undefined
+        ? {}
+        : { codeChallengeMethod: input.record.codeChallengeMethod }),
+    issuedAt: input.record.issuedAt,
+    expiresAt: input.record.expiresAt,
+    ...(input.record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.record.metadata) }),
+});
 const encodeOAuthState = (input) => OAuthStateToken(`${input.challengeId}.${Redacted.value(input.secret)}`);
 export const parseOAuthState = (state) => {
     const parts = String(state).split(".");
@@ -1404,6 +1784,707 @@ const makeOAuthPkceWithCrypto = (dependencies, input) => Effect.gen(function* ()
         codeChallengeMethod: "S256",
     };
 });
+const authorizationCodeHash = (crypto, code, operation) => crypto.digestSha256({ data: String(code) }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError(operation, "Failed to hash OAuth authorization code", cause)));
+const pkceChallengeForVerifier = (crypto, verifier) => crypto.digestSha256({ data: Redacted.value(verifier) }).pipe(Effect.map(OAuthCodeChallenge), Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to calculate OAuth PKCE challenge", cause)));
+const timingSafeEqualString = (crypto, left, right) => crypto
+    .timingSafeEqual({
+    left: textEncoder.encode(left),
+    right: textEncoder.encode(right),
+})
+    .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to compare OAuth PKCE challenge", cause)));
+const authorizationCodeValue = (code) => OAuthAuthorizationCode(String(Redacted.value(code)).trim());
+const authorizationCodeExpiresAt = (input, issuedAt, defaultTtl) => input.expiresAt ??
+    UnixMillis(Number(issuedAt) + Duration.toMillis(input.expiresIn ?? defaultTtl));
+export const makeOAuthAuthorizationCodeGrant = (dependencies) => {
+    const codeBytes = dependencies.codeBytes ?? defaultOAuthAuthorizationCodeBytes;
+    const codeTtl = dependencies.codeTtl ?? defaultOAuthAuthorizationCodeTtl;
+    return OAuthAuthorizationCodeGrant.make({
+        issue: Effect.fn("auth.oauth.authorization_code.issue")(function* (input) {
+            const issuedAt = input.issuedAt ?? (yield* currentUnixMillis);
+            const expiresAt = authorizationCodeExpiresAt(input, issuedAt, codeTtl);
+            const code = input.code === undefined
+                ? OAuthAuthorizationCode(yield* Effect.gen(function* () {
+                    const validatedCodeBytes = yield* validateOAuthAuthorizationCodeBytes(codeBytes);
+                    return yield* dependencies.crypto
+                        .randomToken(validatedCodeBytes)
+                        .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("issue", "Failed to generate OAuth authorization code", cause)));
+                }))
+                : authorizationCodeValue(input.code);
+            const codeHash = yield* authorizationCodeHash(dependencies.crypto, code, "issue");
+            const codeChallenge = input.codeChallenge === undefined
+                ? undefined
+                : OAuthCodeChallenge(String(input.codeChallenge));
+            const record = {
+                codeHash,
+                clientId: input.clientId,
+                subject: input.subject,
+                redirectUri: input.redirectUri,
+                scopes: [...(input.scopes ?? [])],
+                ...(codeChallenge === undefined
+                    ? {}
+                    : {
+                        codeChallenge,
+                        codeChallengeMethod: input.codeChallengeMethod ?? "S256",
+                    }),
+                issuedAt,
+                expiresAt,
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: metadataValue(input.metadata) }),
+            };
+            yield* dependencies.store.upsert(record).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("issue", "Failed to store OAuth authorization code", cause)));
+            return issuedAuthorizationCode({ code, record });
+        }),
+        consume: Effect.fn("auth.oauth.authorization_code.consume")(function* (input) {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const codeHash = yield* authorizationCodeHash(dependencies.crypto, authorizationCodeValue(input.code), "consume");
+            const recordOption = yield* dependencies.store.findByHash({ codeHash }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to load OAuth authorization code", cause)));
+            if (Option.isNone(recordOption)) {
+                return { valid: false, reason: "unknown_code" };
+            }
+            const record = recordOption.value;
+            if (record.consumedAt !== undefined) {
+                return { valid: false, reason: "already_consumed" };
+            }
+            if (Number(now) >= Number(record.expiresAt)) {
+                return { valid: false, reason: "expired" };
+            }
+            if (record.clientId !== input.clientId) {
+                return { valid: false, reason: "client_mismatch" };
+            }
+            if (record.redirectUri !== input.redirectUri) {
+                return { valid: false, reason: "redirect_uri_mismatch" };
+            }
+            if (record.codeChallenge !== undefined) {
+                if (input.codeVerifier === undefined) {
+                    return { valid: false, reason: "pkce_required" };
+                }
+                const actualChallenge = yield* pkceChallengeForVerifier(dependencies.crypto, input.codeVerifier);
+                const pkceMatches = yield* timingSafeEqualString(dependencies.crypto, record.codeChallenge, actualChallenge);
+                if (!pkceMatches) {
+                    return { valid: false, reason: "pkce_mismatch" };
+                }
+            }
+            const consumed = yield* dependencies.store
+                .markConsumed({ codeHash, consumedAt: now })
+                .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to consume OAuth authorization code", cause)));
+            if (consumed.status === "missing") {
+                return { valid: false, reason: "unknown_code" };
+            }
+            if (consumed.status === "already_consumed") {
+                return { valid: false, reason: "already_consumed" };
+            }
+            return {
+                valid: true,
+                code: consumedAuthorizationCode(consumed.record, now),
+            };
+        }),
+    });
+};
+const oauthAuthorizationCodeTokenInvalid = (reason) => ({ valid: false, reason });
+const oauthRefreshTokenInvalid = (reason) => ({ valid: false, reason });
+const oauthRefreshTokenIssueInvalid = (reason) => ({ valid: false, reason });
+const oauthClientCredentialsInvalid = (reason) => ({ valid: false, reason });
+const oauthClientCredentialsIssueInvalid = (reason) => ({ valid: false, reason });
+const oauthTokenRevocationInvalid = (reason) => ({ valid: false, reason });
+const oauthTokenIntrospectionInvalid = (reason) => ({ valid: false, reason });
+const oauthTokenGrantString = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+const oauthTokenGrantScopes = (scopes) => {
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : scopes ?? [];
+    const unique = new Set();
+    for (const value of values) {
+        const scope = value.trim();
+        if (scope !== "") {
+            unique.add(scope);
+        }
+    }
+    return [...unique];
+};
+const oauthTokenGrantScopesAllowed = (scopes, allowedScopes) => allowedScopes === undefined || scopes.every((scope) => allowedScopes.includes(scope));
+const validateOAuthProviderModeOpaqueTokenBytes = (value, label, error) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(error(`${label} byte length must be an integer between 16 and 128`));
+const generateOAuthProviderModeOpaqueToken = (crypto, byteLength, brand, label, error) => Effect.gen(function* () {
+    const validByteLength = yield* validateOAuthProviderModeOpaqueTokenBytes(byteLength, label, error);
+    const token = yield* crypto.randomToken(validByteLength).pipe(Effect.mapError((cause) => error(`Failed to generate OAuth ${label} token`, cause)));
+    return Redacted.make(brand(token));
+});
+const oauthProviderModeOpaqueTokenHash = (crypto, token, error) => crypto.digestSha256({ data: Redacted.value(token) }).pipe(Effect.map((digest) => `sha256:${digest}`), Effect.mapError((cause) => error("Failed to hash OAuth provider-mode token", cause)));
+const oauthProviderModeOpaqueTokenAudience = (audience) => audience === undefined ? undefined : Array.isArray(audience) ? [...audience] : audience;
+const oauthProviderModeOpaqueTokenRecord = (dependencies, input) => ({
+    tokenHash: input.tokenHash,
+    tokenType: input.tokenType,
+    clientId: input.clientId,
+    subject: input.subject,
+    scopes: [...input.scopes],
+    issuedAt: input.issuedAt,
+    expiresAt: input.expiresAt,
+    ...(dependencies.issuer === undefined ? {} : { issuer: dependencies.issuer }),
+    ...(dependencies.audience === undefined
+        ? {}
+        : { audience: oauthProviderModeOpaqueTokenAudience(dependencies.audience) }),
+    ...(dependencies.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(dependencies.metadata) }),
+});
+const oauthProviderModeOpaqueExpiresAt = (issuedAt, ttl) => UnixMillis(Number(issuedAt) + Duration.toMillis(ttl));
+const oauthProviderModeOpaqueExpiresInSeconds = (issuedAt, expiresAt) => Math.max(0, Math.floor((Number(expiresAt) - Number(issuedAt)) / 1000));
+const oauthProviderModeOpaqueTokenResponse = (input) => ({
+    accessToken: input.accessToken,
+    tokenType: "Bearer",
+    expiresIn: oauthProviderModeOpaqueExpiresInSeconds(input.accessTokenIssuedAt, input.accessTokenExpiresAt),
+    ...(input.refreshToken === undefined
+        ? {}
+        : { refreshToken: input.refreshToken }),
+    ...(input.scopes.length === 0 ? {} : { scopes: [...input.scopes] }),
+});
+const oauthProviderModeOpaqueStoreToken = (store, record, error) => store.upsert(record).pipe(Effect.mapError((cause) => error("Failed to store OAuth provider-mode token", cause)));
+const oauthProviderModeScopesSubset = (scopes, grantedScopes) => scopes.every((scope) => grantedScopes.includes(scope));
+const oauthTokenGrantClientId = (value) => {
+    const clientId = oauthTokenGrantString(value === undefined ? undefined : String(value));
+    return clientId === undefined ? undefined : OAuthClientId(clientId);
+};
+const oauthAuthorizationCodeConsumeFailureToTokenFailure = (reason) => {
+    switch (reason) {
+        case "unknown_code":
+        case "already_consumed":
+        case "expired":
+        case "client_mismatch":
+        case "redirect_uri_mismatch":
+        case "pkce_required":
+        case "pkce_mismatch": {
+            return "invalid_grant";
+        }
+    }
+};
+export const makeOAuthAuthorizationCodeTokenGrant = (dependencies) => OAuthAuthorizationCodeTokenGrant.make({
+    exchange: Effect.fn("auth.oauth.authorization_code_token.exchange")(function* (input) {
+        if (input.grantType !== "authorization_code") {
+            return oauthAuthorizationCodeTokenInvalid("unsupported_grant_type");
+        }
+        const { code } = input;
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        const redirectUri = oauthTokenGrantString(input.redirectUri);
+        if (code === undefined || clientId === undefined || redirectUri === undefined) {
+            return oauthAuthorizationCodeTokenInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthAuthorizationCodeTokenInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (!client.allowedGrantTypes.includes("authorization_code")) {
+            return oauthAuthorizationCodeTokenInvalid("unauthorized_client");
+        }
+        if (client.type === "confidential" && input.clientAuthenticated !== true) {
+            return oauthAuthorizationCodeTokenInvalid("invalid_client");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const consumed = yield* dependencies.authorizationCodes
+            .consume({
+            code,
+            clientId,
+            redirectUri,
+            ...(input.codeVerifier === undefined
+                ? {}
+                : { codeVerifier: input.codeVerifier }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to consume OAuth authorization code", cause)));
+        if (!consumed.valid) {
+            return oauthAuthorizationCodeTokenInvalid(oauthAuthorizationCodeConsumeFailureToTokenFailure(consumed.reason));
+        }
+        const tokens = yield* dependencies.issuer
+            .issue({ client, code: consumed.code, now })
+            .pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to issue OAuth tokens", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            code: consumed.code,
+            tokens: cloneOAuthTokenResponse(tokens),
+        };
+    }),
+});
+export const makeOAuthRefreshTokenGrant = (dependencies) => OAuthRefreshTokenGrant.make({
+    exchange: Effect.fn("auth.oauth.refresh_token.exchange")(function* (input) {
+        if (input.grantType !== "refresh_token") {
+            return oauthRefreshTokenInvalid("unsupported_grant_type");
+        }
+        const { refreshToken } = input;
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        if (refreshToken === undefined || clientId === undefined) {
+            return oauthRefreshTokenInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthRefreshTokenGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthRefreshTokenInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (!client.allowedGrantTypes.includes("refresh_token")) {
+            return oauthRefreshTokenInvalid("unauthorized_client");
+        }
+        if (client.type === "confidential" && input.clientAuthenticated !== true) {
+            return oauthRefreshTokenInvalid("invalid_client");
+        }
+        const scopes = oauthTokenGrantScopes(input.scopes);
+        if (!oauthTokenGrantScopesAllowed(scopes, client.allowedScopes)) {
+            return oauthRefreshTokenInvalid("invalid_scope");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const issued = yield* dependencies.issuer
+            .issue({
+            client,
+            refreshToken,
+            ...(scopes.length === 0 ? {} : { scopes }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthRefreshTokenGrantError("exchange", "Failed to issue OAuth tokens", cause)));
+        if (!issued.valid) {
+            return oauthRefreshTokenInvalid(issued.reason);
+        }
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            tokens: cloneOAuthTokenResponse(issued.tokens),
+        };
+    }),
+});
+export const makeOAuthClientCredentialsGrant = (dependencies) => OAuthClientCredentialsGrant.make({
+    exchange: Effect.fn("auth.oauth.client_credentials.exchange")(function* (input) {
+        if (input.grantType !== "client_credentials") {
+            return oauthClientCredentialsInvalid("unsupported_grant_type");
+        }
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        if (clientId === undefined) {
+            return oauthClientCredentialsInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthClientCredentialsGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthClientCredentialsInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (!client.allowedGrantTypes.includes("client_credentials")) {
+            return oauthClientCredentialsInvalid("unauthorized_client");
+        }
+        if (client.type !== "confidential") {
+            return oauthClientCredentialsInvalid("unauthorized_client");
+        }
+        if (input.clientAuthenticated !== true) {
+            return oauthClientCredentialsInvalid("invalid_client");
+        }
+        const scopes = oauthTokenGrantScopes(input.scopes);
+        if (!oauthTokenGrantScopesAllowed(scopes, client.allowedScopes)) {
+            return oauthClientCredentialsInvalid("invalid_scope");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const issued = yield* dependencies.issuer
+            .issue({
+            client,
+            ...(scopes.length === 0 ? {} : { scopes }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthClientCredentialsGrantError("exchange", "Failed to issue OAuth tokens", cause)));
+        if (!issued.valid) {
+            return oauthClientCredentialsInvalid(issued.reason);
+        }
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            tokens: cloneOAuthTokenResponse(issued.tokens),
+        };
+    }),
+});
+export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
+    const accessTokenBytes = dependencies.accessTokenBytes ?? defaultOAuthProviderModeAccessTokenBytes;
+    const refreshTokenBytes = dependencies.refreshTokenBytes ?? defaultOAuthProviderModeRefreshTokenBytes;
+    const accessTokenTtl = dependencies.accessTokenTtl ?? defaultOAuthProviderModeAccessTokenTtl;
+    const refreshTokenTtl = dependencies.refreshTokenTtl ?? defaultOAuthProviderModeRefreshTokenTtl;
+    return {
+        authorizationCode: OAuthAuthorizationCodeTokenIssuer.make({
+            issue: Effect.fn("auth.oauth.provider_mode_opaque.authorization_code.issue")(function* (input) {
+                const scopes = [...input.code.scopes];
+                const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthAuthorizationCodeTokenIssuerError);
+                const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthAuthorizationCodeTokenIssuerError);
+                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                const accessTokenRecord = oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    clientId: input.client.id,
+                    subject: input.code.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: accessTokenExpiresAt,
+                });
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, accessTokenRecord, oauthAuthorizationCodeTokenIssuerError);
+                if (!input.client.allowedGrantTypes.includes("refresh_token")) {
+                    return oauthProviderModeOpaqueTokenResponse({
+                        accessToken,
+                        accessTokenIssuedAt: input.now,
+                        accessTokenExpiresAt,
+                        scopes,
+                    });
+                }
+                const refreshToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, refreshTokenBytes, OAuthRefreshToken, "refresh", oauthAuthorizationCodeTokenIssuerError);
+                const refreshTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, refreshToken, oauthAuthorizationCodeTokenIssuerError);
+                const refreshTokenRecord = oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: refreshTokenHash,
+                    tokenType: "refresh_token",
+                    clientId: input.client.id,
+                    subject: input.code.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: oauthProviderModeOpaqueExpiresAt(input.now, refreshTokenTtl),
+                });
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, refreshTokenRecord, oauthAuthorizationCodeTokenIssuerError);
+                return oauthProviderModeOpaqueTokenResponse({
+                    accessToken,
+                    accessTokenIssuedAt: input.now,
+                    accessTokenExpiresAt,
+                    refreshToken,
+                    scopes,
+                });
+            }),
+        }),
+        refreshToken: OAuthRefreshTokenIssuer.make({
+            issue: Effect.fn("auth.oauth.provider_mode_opaque.refresh_token.issue")(function* (input) {
+                const tokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, input.refreshToken, oauthRefreshTokenIssuerError);
+                const recordOption = yield* dependencies.tokenStore
+                    .findByHash({ tokenHash })
+                    .pipe(Effect.mapError((cause) => oauthRefreshTokenIssuerError("Failed to load OAuth provider-mode refresh token", cause)));
+                if (Option.isNone(recordOption)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_grant");
+                }
+                const record = recordOption.value;
+                if (record.tokenType !== "refresh_token" ||
+                    record.clientId !== input.client.id ||
+                    record.revokedAt !== undefined ||
+                    record.rotatedAt !== undefined ||
+                    Number(input.now) >= Number(record.expiresAt)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_grant");
+                }
+                const requestedScopes = oauthTokenGrantScopes(input.scopes);
+                if (!oauthTokenGrantScopesAllowed(requestedScopes, input.client.allowedScopes) ||
+                    !oauthProviderModeScopesSubset(requestedScopes, record.scopes)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_scope");
+                }
+                const scopes = requestedScopes.length === 0 ? [...record.scopes] : requestedScopes;
+                const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthRefreshTokenIssuerError);
+                const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthRefreshTokenIssuerError);
+                const refreshToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, refreshTokenBytes, OAuthRefreshToken, "refresh", oauthRefreshTokenIssuerError);
+                const refreshTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, refreshToken, oauthRefreshTokenIssuerError);
+                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    clientId: input.client.id,
+                    subject: record.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: accessTokenExpiresAt,
+                }), oauthRefreshTokenIssuerError);
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: refreshTokenHash,
+                    tokenType: "refresh_token",
+                    clientId: input.client.id,
+                    subject: record.subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: oauthProviderModeOpaqueExpiresAt(input.now, refreshTokenTtl),
+                }), oauthRefreshTokenIssuerError);
+                const rotated = yield* dependencies.tokenStore
+                    .rotateRefreshToken({
+                    tokenHash,
+                    replacedByTokenHash: refreshTokenHash,
+                    rotatedAt: input.now,
+                })
+                    .pipe(Effect.mapError((cause) => oauthRefreshTokenIssuerError("Failed to rotate OAuth provider-mode refresh token", cause)));
+                if (Option.isNone(rotated)) {
+                    return oauthRefreshTokenIssueInvalid("invalid_grant");
+                }
+                return {
+                    valid: true,
+                    tokens: oauthProviderModeOpaqueTokenResponse({
+                        accessToken,
+                        accessTokenIssuedAt: input.now,
+                        accessTokenExpiresAt,
+                        refreshToken,
+                        scopes,
+                    }),
+                };
+            }),
+        }),
+        clientCredentials: OAuthClientCredentialsTokenIssuer.make({
+            issue: Effect.fn("auth.oauth.provider_mode_opaque.client_credentials.issue")(function* (input) {
+                const scopes = [...(input.scopes ?? [])];
+                if (!oauthTokenGrantScopesAllowed(scopes, input.client.allowedScopes)) {
+                    return oauthClientCredentialsIssueInvalid("invalid_scope");
+                }
+                const subject = yield* Effect.try({
+                    try: () => dependencies.clientCredentialsSubject === undefined
+                        ? String(input.client.id)
+                        : dependencies.clientCredentialsSubject(input),
+                    catch: (cause) => oauthClientCredentialsTokenIssuerError("Failed to resolve OAuth client credentials subject", cause),
+                }).pipe(Effect.flatMap((value) => {
+                    const resolvedSubject = oauthTokenGrantString(value);
+                    return resolvedSubject === undefined
+                        ? Effect.fail(oauthClientCredentialsTokenIssuerError("OAuth client credentials subject must not be empty"))
+                        : Effect.succeed(resolvedSubject);
+                }));
+                const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthClientCredentialsTokenIssuerError);
+                const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthClientCredentialsTokenIssuerError);
+                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    clientId: input.client.id,
+                    subject,
+                    scopes,
+                    issuedAt: input.now,
+                    expiresAt: accessTokenExpiresAt,
+                }), oauthClientCredentialsTokenIssuerError);
+                return {
+                    valid: true,
+                    tokens: oauthProviderModeOpaqueTokenResponse({
+                        accessToken,
+                        accessTokenIssuedAt: input.now,
+                        accessTokenExpiresAt,
+                        scopes,
+                    }),
+                };
+            }),
+        }),
+    };
+};
+export const makeOAuthClientSecretVerification = (dependencies) => OAuthClientSecretVerification.make({
+    authenticateClient: Effect.fn("auth.oauth.client_secret.authenticate_client")(function* (input) {
+        const prefix = yield* dependencies.clientSecrets.parse(input.clientSecret).pipe(Effect.catchTag("OAuthClientSecretError", () => Effect.succeed(undefined)));
+        if (prefix === undefined) {
+            return false;
+        }
+        const secret = yield* dependencies.secretStore
+            .findByClientIdAndPrefix({ clientId: input.clientId, prefix })
+            .pipe(Effect.mapError((cause) => oauthClientSecretVerificationError("Failed to load OAuth client secret", cause)));
+        if (Option.isNone(secret) || secret.value.revokedAt !== undefined) {
+            return false;
+        }
+        if (!secret.value.authenticationMethods.includes(input.method)) {
+            return false;
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        if (secret.value.expiresAt !== undefined &&
+            Number(secret.value.expiresAt) <= Number(now)) {
+            return false;
+        }
+        const valid = yield* dependencies.clientSecrets
+            .verify({ secret: input.clientSecret, hash: secret.value.secretHash })
+            .pipe(Effect.mapError((cause) => oauthClientSecretVerificationError("Failed to verify OAuth client secret", cause)));
+        if (!valid) {
+            return false;
+        }
+        const updated = yield* dependencies.secretStore
+            .markUsed({
+            clientId: input.clientId,
+            prefix,
+            lastUsedAt: now,
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        })
+            .pipe(Effect.mapError((cause) => oauthClientSecretVerificationError("Failed to mark OAuth client secret as used", cause)));
+        return Option.isSome(updated);
+    }),
+});
+export const makeOAuthTokenRevocation = (dependencies) => OAuthTokenRevocation.make({
+    revoke: Effect.fn("auth.oauth.token_revocation.revoke")(function* (input) {
+        const { token } = input;
+        const tokenValue = token === undefined ? undefined : String(Redacted.value(token)).trim();
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        const tokenTypeHint = oauthTokenGrantString(input.tokenTypeHint);
+        if (token === undefined || tokenValue === undefined || clientId === undefined) {
+            return oauthTokenRevocationInvalid("invalid_request");
+        }
+        if (tokenTypeHint !== undefined &&
+            tokenTypeHint !== "access_token" &&
+            tokenTypeHint !== "refresh_token") {
+            return oauthTokenRevocationInvalid("unsupported_token_type");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthTokenRevocationError("revoke", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthTokenRevocationInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (client.type !== "confidential" || input.clientAuthenticated !== true) {
+            return oauthTokenRevocationInvalid("invalid_client");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        yield* dependencies.revoker
+            .revoke({
+            client,
+            token,
+            ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthTokenRevocationError("revoke", "Failed to revoke OAuth token", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+        };
+    }),
+});
+export const makeOAuthTokenIntrospection = (dependencies) => OAuthTokenIntrospection.make({
+    introspect: Effect.fn("auth.oauth.token_introspection.introspect")(function* (input) {
+        const { token } = input;
+        const tokenValue = token === undefined ? undefined : String(Redacted.value(token)).trim();
+        const clientId = oauthTokenGrantClientId(input.clientId);
+        const tokenTypeHint = oauthTokenGrantString(input.tokenTypeHint);
+        if (token === undefined || tokenValue === undefined || clientId === undefined) {
+            return oauthTokenIntrospectionInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthTokenIntrospectionError("introspect", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthTokenIntrospectionInvalid("invalid_client");
+        }
+        const client = clientOption.value;
+        if (client.type !== "confidential" || input.clientAuthenticated !== true) {
+            return oauthTokenIntrospectionInvalid("invalid_client");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const introspection = yield* dependencies.introspector
+            .introspect({
+            client,
+            token,
+            ...(tokenTypeHint === undefined ? {} : { tokenTypeHint }),
+            now,
+        })
+            .pipe(Effect.mapError((cause) => oauthTokenIntrospectionError("introspect", "Failed to introspect OAuth token", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            introspection: cloneOAuthTokenIntrospectionResponse(introspection),
+        };
+    }),
+});
+const oauthProviderAuthorizationInvalid = (reason, input) => ({
+    valid: false,
+    reason,
+    ...(input?.redirectUri === undefined ? {} : { redirectUri: input.redirectUri }),
+    ...(input?.state === undefined ? {} : { state: input.state }),
+    ...(input?.client === undefined
+        ? {}
+        : { client: cloneOAuthClientRecord(input.client) }),
+    ...(input?.errorDescription === undefined
+        ? {}
+        : { errorDescription: input.errorDescription }),
+});
+const oauthProviderAuthorizationString = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+const oauthProviderAuthorizationClientId = (value) => {
+    const clientId = oauthProviderAuthorizationString(value === undefined ? undefined : String(value));
+    return clientId === undefined ? undefined : OAuthClientId(clientId);
+};
+const oauthProviderAuthorizationScopes = (scopes) => {
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : scopes ?? [];
+    const unique = new Set();
+    for (const value of values) {
+        const scope = value.trim();
+        if (scope !== "") {
+            unique.add(scope);
+        }
+    }
+    return [...unique];
+};
+const oauthProviderAuthorizationScopeAllowed = (scopes, allowedScopes) => allowedScopes === undefined || scopes.every((scope) => allowedScopes.includes(scope));
+const oauthProviderAuthorizationScopeSubset = (scopes, requestedScopes) => scopes.every((scope) => requestedScopes.includes(scope));
+const oauthProviderAuthorizationClientAllowsCode = (client) => client.allowedResponseTypes.includes("code") &&
+    client.allowedGrantTypes.includes("authorization_code");
+const oauthProviderAuthorizationGrantedScopesValid = (scopes, requestedScopes, allowedScopes) => oauthProviderAuthorizationScopeSubset(scopes, requestedScopes) &&
+    oauthProviderAuthorizationScopeAllowed(scopes, allowedScopes);
+export const makeOAuthProviderAuthorization = (dependencies) => OAuthProviderAuthorization.make({
+    authorize: Effect.fn("auth.oauth.provider_authorization.authorize")(function* (input) {
+        const state = oauthProviderAuthorizationString(input.state);
+        const clientId = oauthProviderAuthorizationClientId(input.clientId);
+        const redirectUri = oauthProviderAuthorizationString(input.redirectUri);
+        if (clientId === undefined || redirectUri === undefined) {
+            return oauthProviderAuthorizationInvalid("invalid_request");
+        }
+        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+            return oauthProviderAuthorizationInvalid("invalid_request");
+        }
+        const client = clientOption.value;
+        if (!client.redirectUris.includes(redirectUri)) {
+            return oauthProviderAuthorizationInvalid("invalid_request");
+        }
+        const redirectError = (reason, errorDescription) => oauthProviderAuthorizationInvalid(reason, {
+            client,
+            redirectUri,
+            state,
+            ...(errorDescription === undefined ? {} : { errorDescription }),
+        });
+        if (input.responseType !== "code") {
+            return redirectError("unsupported_response_type");
+        }
+        if (!oauthProviderAuthorizationClientAllowsCode(client)) {
+            return redirectError("unauthorized_client");
+        }
+        const codeChallenge = oauthProviderAuthorizationString(input.codeChallenge === undefined ? undefined : String(input.codeChallenge));
+        if (codeChallenge === undefined ||
+            oauthProviderAuthorizationString(input.codeChallengeMethod) !== "S256") {
+            return redirectError("invalid_request");
+        }
+        const requestedScopes = oauthProviderAuthorizationScopes(input.scopes);
+        if (!oauthProviderAuthorizationScopeAllowed(requestedScopes, client.allowedScopes)) {
+            return redirectError("invalid_scope");
+        }
+        const decision = yield* dependencies.policy
+            .decide({
+            client: cloneOAuthClientRecord(client),
+            requestedScopes,
+            ...(state === undefined ? {} : { state }),
+            request: input,
+        })
+            .pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to decide OAuth authorization request", cause)));
+        if (decision.type === "deny") {
+            return redirectError(decision.reason, decision.errorDescription);
+        }
+        const scopes = oauthProviderAuthorizationScopes(decision.scopes ?? requestedScopes);
+        if (!oauthProviderAuthorizationGrantedScopesValid(scopes, requestedScopes, client.allowedScopes)) {
+            return redirectError("invalid_scope");
+        }
+        const code = yield* dependencies.authorizationCodes
+            .issue({
+            clientId,
+            subject: decision.subject,
+            redirectUri,
+            scopes,
+            codeChallenge: OAuthCodeChallenge(codeChallenge),
+            codeChallengeMethod: "S256",
+            ...(input.now === undefined ? {} : { issuedAt: input.now }),
+            ...(decision.metadata === undefined
+                ? {}
+                : { metadata: decision.metadata }),
+        })
+            .pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to issue OAuth authorization code", cause)));
+        return {
+            valid: true,
+            client: cloneOAuthClientRecord(client),
+            redirectUri,
+            ...(state === undefined ? {} : { state }),
+            code,
+        };
+    }),
+});
+export const issueOAuthAuthorizationCode = (input) => OAuthAuthorizationCodeGrant.use((grant) => grant.issue(input));
+export const consumeOAuthAuthorizationCode = (input) => OAuthAuthorizationCodeGrant.use((grant) => grant.consume(input));
+export const exchangeOAuthAuthorizationCodeToken = (input) => OAuthAuthorizationCodeTokenGrant.use((grant) => grant.exchange(input));
+export const exchangeOAuthRefreshToken = (input) => OAuthRefreshTokenGrant.use((grant) => grant.exchange(input));
+export const exchangeOAuthClientCredentialsToken = (input) => OAuthClientCredentialsGrant.use((grant) => grant.exchange(input));
+export const revokeOAuthToken = (input) => OAuthTokenRevocation.use((revocation) => revocation.revoke(input));
+export const introspectOAuthToken = (input) => OAuthTokenIntrospection.use((introspection) => introspection.introspect(input));
+export const authorizeOAuthProviderAuthorization = (input) => OAuthProviderAuthorization.use((authorization) => authorization.authorize(input));
 export const makeOAuthPkce = (input) => Effect.gen(function* () {
     const crypto = yield* Crypto;
     return yield* makeOAuthPkceWithCrypto({ crypto }, input);
@@ -1528,6 +2609,72 @@ export const OAuthStateLive = Layer.effect(OAuthState)(Effect.gen(function* () {
     const challenge = yield* Challenge;
     return makeOAuthState({ crypto, challenge });
 }));
+export const OAuthAuthorizationCodeGrantLive = Layer.effect(OAuthAuthorizationCodeGrant)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const store = yield* OAuthAuthorizationCodeStore;
+    return makeOAuthAuthorizationCodeGrant({ crypto, store });
+}));
+export const OAuthAuthorizationCodeTokenGrantLive = Layer.effect(OAuthAuthorizationCodeTokenGrant)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const authorizationCodes = yield* OAuthAuthorizationCodeGrant;
+    const issuer = yield* OAuthAuthorizationCodeTokenIssuer;
+    return makeOAuthAuthorizationCodeTokenGrant({
+        clients,
+        authorizationCodes,
+        issuer,
+    });
+}));
+export const OAuthRefreshTokenGrantLive = Layer.effect(OAuthRefreshTokenGrant)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const issuer = yield* OAuthRefreshTokenIssuer;
+    return makeOAuthRefreshTokenGrant({ clients, issuer });
+}));
+export const OAuthClientCredentialsGrantLive = Layer.effect(OAuthClientCredentialsGrant)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const issuer = yield* OAuthClientCredentialsTokenIssuer;
+    return makeOAuthClientCredentialsGrant({ clients, issuer });
+}));
+export const OAuthProviderModeOpaqueTokenIssuerLive = (options = {}) => Layer.mergeAll(Layer.effect(OAuthAuthorizationCodeTokenIssuer)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    return makeOAuthProviderModeOpaqueTokenIssuer({
+        ...options,
+        crypto,
+        tokenStore,
+    }).authorizationCode;
+})), Layer.effect(OAuthRefreshTokenIssuer)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    return makeOAuthProviderModeOpaqueTokenIssuer({
+        ...options,
+        crypto,
+        tokenStore,
+    }).refreshToken;
+})), Layer.effect(OAuthClientCredentialsTokenIssuer)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    return makeOAuthProviderModeOpaqueTokenIssuer({
+        ...options,
+        crypto,
+        tokenStore,
+    }).clientCredentials;
+})));
+export const OAuthTokenRevocationLive = Layer.effect(OAuthTokenRevocation)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const revoker = yield* OAuthTokenRevoker;
+    return makeOAuthTokenRevocation({ clients, revoker });
+}));
+export const OAuthTokenIntrospectionLive = Layer.effect(OAuthTokenIntrospection)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const introspector = yield* OAuthTokenIntrospector;
+    return makeOAuthTokenIntrospection({ clients, introspector });
+}));
+export const OAuthProviderAuthorizationLive = Layer.effect(OAuthProviderAuthorization)(Effect.gen(function* () {
+    const clients = yield* OAuthClientRegistry;
+    const authorizationCodes = yield* OAuthAuthorizationCodeGrant;
+    const policy = yield* OAuthProviderAuthorizationPolicy;
+    return makeOAuthProviderAuthorization({ clients, authorizationCodes, policy });
+}));
 export const makeOAuthProviders = (providers) => {
     const providersById = new Map(providers.map((provider) => [provider.id, cloneProviderConfig(provider)]));
     return OAuthProviders.make({
@@ -1540,6 +2687,261 @@ export const makeOAuthProviders = (providers) => {
     });
 };
 export const OAuthProvidersLive = (providers) => Layer.succeed(OAuthProviders)(makeOAuthProviders(providers));
+export const OAuthClientSecretsLive = Layer.effect(OAuthClientSecrets)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    return makeOAuthClientSecrets({ crypto });
+}));
+export const OAuthClientSecretVerificationLive = Layer.effect(OAuthClientSecretVerification)(Effect.gen(function* () {
+    const clientSecrets = yield* OAuthClientSecrets;
+    const secretStore = yield* OAuthClientSecretStore;
+    return makeOAuthClientSecretVerification({ clientSecrets, secretStore });
+}));
+export const makeOAuthClientRegistryFromStore = (store) => OAuthClientRegistry.make({
+    find: (input) => store.find(input).pipe(Effect.mapError((cause) => oauthClientRegistryError("find", "Failed to load OAuth client", cause))),
+    validateRedirectUri: (input) => store.validateRedirectUri(input).pipe(Effect.mapError((cause) => oauthClientRegistryError("validate-redirect-uri", "Failed to validate OAuth client redirect URI", cause))),
+});
+export const OAuthClientRegistryFromStoreLive = Layer.effect(OAuthClientRegistry)(Effect.gen(function* () {
+    const store = yield* OAuthClientStore;
+    return makeOAuthClientRegistryFromStore(store);
+}));
+export const makeOAuthClientRegistryMemory = (clients = []) => {
+    const clientsById = new Map(clients.map((client) => [client.id, cloneOAuthClientRecord(client)]));
+    return OAuthClientRegistry.make({
+        find: (input) => Effect.sync(() => {
+            const client = clientsById.get(input.clientId);
+            return client === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthClientRecord(client));
+        }),
+        validateRedirectUri: (input) => Effect.sync(() => {
+            const client = clientsById.get(input.clientId);
+            return validateOAuthClientRedirectUriRecord(client, input);
+        }),
+    });
+};
+export const OAuthClientRegistryMemoryLive = (clients = []) => Layer.succeed(OAuthClientRegistry)(makeOAuthClientRegistryMemory(clients));
+export const makeOAuthClientStoreMemory = (clients = []) => {
+    const clientsById = new Map(clients.map((client) => [client.id, cloneOAuthClientRecord(client)]));
+    return OAuthClientStore.make({
+        upsert: (record) => Effect.sync(() => {
+            clientsById.set(record.id, cloneOAuthClientRecord(record));
+        }),
+        find: (input) => Effect.sync(() => {
+            const client = clientsById.get(input.clientId);
+            return client === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthClientRecord(client));
+        }),
+        list: (input = {}) => Effect.sync(() => [...clientsById.values()]
+            .filter((client) => input.includeDisabled === true || client.status === "active")
+            .map(cloneOAuthClientRecord)),
+        validateRedirectUri: (input) => Effect.sync(() => validateOAuthClientRedirectUriRecord(clientsById.get(input.clientId), input)),
+    });
+};
+export const OAuthClientStoreMemoryLive = (clients = []) => Layer.succeed(OAuthClientStore)(makeOAuthClientStoreMemory(clients));
+const oauthConsentMemoryKey = (input) => `${input.userId}\u0000${input.clientId}`;
+export const makeOAuthConsentStoreMemory = (records = []) => {
+    const recordsByKey = new Map(records.map((record) => [
+        oauthConsentMemoryKey(record),
+        cloneOAuthConsentRecord(record),
+    ]));
+    return OAuthConsentStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByKey.set(oauthConsentMemoryKey(record), cloneOAuthConsentRecord(record));
+        }),
+        findActive: (input) => Effect.sync(() => {
+            const record = recordsByKey.get(oauthConsentMemoryKey(input));
+            return record === undefined ||
+                !isOAuthConsentActive(record, input.now, input.scopes)
+                ? Option.none()
+                : Option.some(cloneOAuthConsentRecord(record));
+        }),
+        listForUser: (input) => Effect.sync(() => [...recordsByKey.values()]
+            .filter((record) => record.userId === input.userId)
+            .filter((record) => input.includeInactive === true ||
+            isOAuthConsentActive(record, input.now))
+            .map(cloneOAuthConsentRecord)),
+        revoke: (input) => Effect.sync(() => {
+            const key = oauthConsentMemoryKey(input);
+            const record = recordsByKey.get(key);
+            if (record === undefined) {
+                return Option.none();
+            }
+            const updated = cloneOAuthConsentRecord({
+                ...record,
+                revokedAt: record.revokedAt ?? input.revokedAt,
+                metadata: input.reason === undefined
+                    ? record.metadata
+                    : { ...record.metadata, revokeReason: input.reason },
+            });
+            recordsByKey.set(key, updated);
+            return Option.some(cloneOAuthConsentRecord(updated));
+        }),
+        deleteInactive: (input) => Effect.sync(() => {
+            let deleted = 0;
+            for (const [key, record] of recordsByKey) {
+                const expired = input.beforeExpiresAt !== undefined &&
+                    record.expiresAt !== undefined &&
+                    Number(record.expiresAt) < Number(input.beforeExpiresAt);
+                const revoked = input.beforeRevokedAt !== undefined &&
+                    record.revokedAt !== undefined &&
+                    Number(record.revokedAt) < Number(input.beforeRevokedAt);
+                if (expired || revoked) {
+                    recordsByKey.delete(key);
+                    deleted += 1;
+                }
+            }
+            return deleted;
+        }),
+    });
+};
+export const OAuthConsentStoreMemoryLive = (records = []) => Layer.succeed(OAuthConsentStore)(makeOAuthConsentStoreMemory(records));
+const oauthClientSecretMemoryKey = (input) => `${input.clientId}\u0000${input.prefix}`;
+export const makeOAuthClientSecretStoreMemory = () => {
+    const recordsByKey = new Map();
+    return OAuthClientSecretStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByKey.set(oauthClientSecretMemoryKey(record), cloneOAuthClientSecretRecord(record));
+        }),
+        findByClientIdAndPrefix: (input) => Effect.sync(() => {
+            const record = recordsByKey.get(oauthClientSecretMemoryKey(input));
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthClientSecretRecord(record));
+        }),
+        markUsed: (input) => Effect.sync(() => {
+            const key = oauthClientSecretMemoryKey(input);
+            const record = recordsByKey.get(key);
+            if (record === undefined || record.revokedAt !== undefined) {
+                return Option.none();
+            }
+            const updated = cloneOAuthClientSecretRecord({
+                ...record,
+                lastUsedAt: input.lastUsedAt,
+                metadata: input.metadata ?? record.metadata,
+            });
+            recordsByKey.set(key, updated);
+            return Option.some(cloneOAuthClientSecretRecord(updated));
+        }),
+        revoke: (input) => Effect.sync(() => {
+            const key = oauthClientSecretMemoryKey(input);
+            const record = recordsByKey.get(key);
+            if (record === undefined) {
+                return Option.none();
+            }
+            const updated = cloneOAuthClientSecretRecord({
+                ...record,
+                revokedAt: input.revokedAt,
+                metadata: input.reason === undefined
+                    ? record.metadata
+                    : { ...record.metadata, revokeReason: input.reason },
+            });
+            recordsByKey.set(key, updated);
+            return Option.some(cloneOAuthClientSecretRecord(updated));
+        }),
+    });
+};
+export const OAuthClientSecretStoreMemoryLive = Layer.sync(OAuthClientSecretStore)(makeOAuthClientSecretStoreMemory);
+export const makeOAuthAuthorizationCodeStoreMemory = () => {
+    const recordsByHash = new Map();
+    return OAuthAuthorizationCodeStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByHash.set(record.codeHash, cloneAuthorizationCodeRecord(record));
+        }),
+        findByHash: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.codeHash);
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneAuthorizationCodeRecord(record));
+        }),
+        markConsumed: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.codeHash);
+            if (record === undefined) {
+                return { status: "missing" };
+            }
+            if (record.consumedAt !== undefined) {
+                return {
+                    status: "already_consumed",
+                    record: cloneAuthorizationCodeRecord(record),
+                };
+            }
+            const consumed = cloneAuthorizationCodeRecord({
+                ...record,
+                consumedAt: input.consumedAt,
+            });
+            recordsByHash.set(input.codeHash, consumed);
+            return {
+                status: "consumed",
+                record: cloneAuthorizationCodeRecord(consumed),
+            };
+        }),
+    });
+};
+export const OAuthAuthorizationCodeStoreMemoryLive = Layer.sync(OAuthAuthorizationCodeStore)(makeOAuthAuthorizationCodeStoreMemory);
+export const makeOAuthProviderModeTokenStoreMemory = () => {
+    const recordsByHash = new Map();
+    return OAuthProviderModeTokenStore.make({
+        upsert: (record) => Effect.sync(() => {
+            recordsByHash.set(record.tokenHash, cloneOAuthProviderModeTokenRecord(record));
+        }),
+        findByHash: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.tokenHash);
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthProviderModeTokenRecord(record));
+        }),
+        revokeByHash: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.tokenHash);
+            if (record === undefined ||
+                (input.tokenTypeHint !== undefined &&
+                    record.tokenType !== input.tokenTypeHint)) {
+                return Option.none();
+            }
+            const revoked = cloneOAuthProviderModeTokenRecord({
+                ...record,
+                revokedAt: record.revokedAt ?? input.revokedAt,
+                revocationReason: record.revocationReason ?? input.reason,
+            });
+            recordsByHash.set(input.tokenHash, revoked);
+            return Option.some(cloneOAuthProviderModeTokenRecord(revoked));
+        }),
+        rotateRefreshToken: (input) => Effect.sync(() => {
+            const record = recordsByHash.get(input.tokenHash);
+            if (record === undefined ||
+                record.tokenType !== "refresh_token" ||
+                record.revokedAt !== undefined ||
+                record.rotatedAt !== undefined) {
+                return Option.none();
+            }
+            const rotated = cloneOAuthProviderModeTokenRecord({
+                ...record,
+                rotatedAt: input.rotatedAt,
+                replacedByTokenHash: input.replacedByTokenHash,
+            });
+            recordsByHash.set(input.tokenHash, rotated);
+            return Option.some(cloneOAuthProviderModeTokenRecord(rotated));
+        }),
+        deleteRetired: (input) => Effect.sync(() => {
+            let deleted = 0;
+            for (const [tokenHash, record] of recordsByHash) {
+                const expired = input.beforeExpiresAt !== undefined &&
+                    Number(record.expiresAt) < Number(input.beforeExpiresAt);
+                const revoked = input.beforeRevokedAt !== undefined &&
+                    record.revokedAt !== undefined &&
+                    Number(record.revokedAt) < Number(input.beforeRevokedAt);
+                const rotated = input.beforeRotatedAt !== undefined &&
+                    record.rotatedAt !== undefined &&
+                    Number(record.rotatedAt) < Number(input.beforeRotatedAt);
+                if (expired || revoked || rotated) {
+                    recordsByHash.delete(tokenHash);
+                    deleted += 1;
+                }
+            }
+            return deleted;
+        }),
+    });
+};
+export const OAuthProviderModeTokenStoreMemoryLive = Layer.sync(OAuthProviderModeTokenStore)(makeOAuthProviderModeTokenStoreMemory);
 export const OidcIdTokenVerifierLive = Layer.effect(OidcIdTokenVerifier)(Effect.gen(function* () {
     const jwtVerifier = yield* JwtVerifier;
     return makeOidcIdTokenVerifier({ jwtVerifier });