@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/OAuth.d.ts

@@ -5,7 +5,9 @@ import type { ChallengeService } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
 import type { CryptoService } from "./Crypto.js";
 import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId } from "./Identifiers.js";
+import type { NewUserIdentityRow, UserIdentityRow } from "./Identity.js";
 import { JwtError, JwtVerifier, type JwksDocument, type JwtAudience, type JwtAlgorithm, type JwtClaims, type JwtHeader, type JwtKeyInfo, type JwtKeysService, type JwtVerifierService, type JwtVerificationFailureReason } from "./Jwt.js";
+import type { IdentityStoreService, NewUserRow, UserRow } from "./Storage.js";
 export type OAuthStateToken = Brand.Branded<string, "auth/OAuthStateToken">;
 export declare const OAuthStateToken: Brand.Constructor<OAuthStateToken>;
 export type OAuthCodeVerifier = Brand.Branded<string, "auth/OAuthCodeVerifier">;
@@ -234,9 +236,6 @@ export interface OAuthClientRegistryService {
 declare const OAuthClientRegistry_base: Context.ServiceClass<OAuthClientRegistry, "auth/OAuthClientRegistry", OAuthClientRegistryService>;
 export declare class OAuthClientRegistry extends OAuthClientRegistry_base {
 }
-export declare namespace OAuthClientRegistry {
-    const make: (service: OAuthClientRegistryService) => OAuthClientRegistryService;
-}
 export interface OAuthClientStoreListInput {
     readonly includeDisabled?: boolean;
 }
@@ -259,9 +258,6 @@ export interface OAuthClientStoreService {
 declare const OAuthClientStore_base: Context.ServiceClass<OAuthClientStore, "auth/OAuthClientStore", OAuthClientStoreService>;
 export declare class OAuthClientStore extends OAuthClientStore_base {
 }
-export declare namespace OAuthClientStore {
-    const make: (service: OAuthClientStoreService) => OAuthClientStoreService;
-}
 export interface OAuthConsentRecord {
     readonly userId: UserId;
     readonly clientId: OAuthClientId;
@@ -317,9 +313,6 @@ export interface OAuthConsentStoreService {
 declare const OAuthConsentStore_base: Context.ServiceClass<OAuthConsentStore, "auth/OAuthConsentStore", OAuthConsentStoreService>;
 export declare class OAuthConsentStore extends OAuthConsentStore_base {
 }
-export declare namespace OAuthConsentStore {
-    const make: (service: OAuthConsentStoreService) => OAuthConsentStoreService;
-}
 export type OAuthClientSecretOperation = "generate" | "parse" | "hash" | "verify";
 declare const OAuthClientSecretError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthClientSecretError";
@@ -353,9 +346,6 @@ export interface OAuthClientSecretsService {
 declare const OAuthClientSecrets_base: Context.ServiceClass<OAuthClientSecrets, "auth/OAuthClientSecrets", OAuthClientSecretsService>;
 export declare class OAuthClientSecrets extends OAuthClientSecrets_base {
 }
-export declare namespace OAuthClientSecrets {
-    const make: (service: OAuthClientSecretsService) => OAuthClientSecretsService;
-}
 export interface OAuthClientSecretsDependencies {
     readonly crypto: CryptoService;
 }
@@ -401,9 +391,6 @@ export interface OAuthClientSecretStoreService {
 declare const OAuthClientSecretStore_base: Context.ServiceClass<OAuthClientSecretStore, "auth/OAuthClientSecretStore", OAuthClientSecretStoreService>;
 export declare class OAuthClientSecretStore extends OAuthClientSecretStore_base {
 }
-export declare namespace OAuthClientSecretStore {
-    const make: (service: OAuthClientSecretStoreService) => OAuthClientSecretStoreService;
-}
 export interface OAuthClientSecretAuthenticateClientInput {
     readonly clientId: OAuthClientId;
     readonly method: OAuthClientSecretAuthenticationMethod;
@@ -427,9 +414,6 @@ export interface OAuthClientSecretVerificationService {
 declare const OAuthClientSecretVerification_base: Context.ServiceClass<OAuthClientSecretVerification, "auth/OAuthClientSecretVerification", OAuthClientSecretVerificationService>;
 export declare class OAuthClientSecretVerification extends OAuthClientSecretVerification_base {
 }
-export declare namespace OAuthClientSecretVerification {
-    const make: (service: OAuthClientSecretVerificationService) => OAuthClientSecretVerificationService;
-}
 export interface OAuthClientSecretVerificationDependencies {
     readonly clientSecrets: OAuthClientSecretsService;
     readonly secretStore: OAuthClientSecretStoreService;
@@ -532,9 +516,6 @@ export interface OAuthAuthorizationCodeStoreService {
 declare const OAuthAuthorizationCodeStore_base: Context.ServiceClass<OAuthAuthorizationCodeStore, "auth/OAuthAuthorizationCodeStore", OAuthAuthorizationCodeStoreService>;
 export declare class OAuthAuthorizationCodeStore extends OAuthAuthorizationCodeStore_base {
 }
-export declare namespace OAuthAuthorizationCodeStore {
-    const make: (service: OAuthAuthorizationCodeStoreService) => OAuthAuthorizationCodeStoreService;
-}
 export type OAuthAuthorizationCodeGrantOperation = "issue" | "consume";
 declare const OAuthAuthorizationCodeGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthAuthorizationCodeGrantError";
@@ -552,9 +533,6 @@ export interface OAuthAuthorizationCodeGrantService {
 declare const OAuthAuthorizationCodeGrant_base: Context.ServiceClass<OAuthAuthorizationCodeGrant, "auth/OAuthAuthorizationCodeGrant", OAuthAuthorizationCodeGrantService>;
 export declare class OAuthAuthorizationCodeGrant extends OAuthAuthorizationCodeGrant_base {
 }
-export declare namespace OAuthAuthorizationCodeGrant {
-    const make: (service: OAuthAuthorizationCodeGrantService) => OAuthAuthorizationCodeGrantService;
-}
 export interface OAuthAuthorizationCodeTokenIssueInput {
     readonly client: OAuthClientRecord;
     readonly code: OAuthConsumedAuthorizationCode;
@@ -576,9 +554,6 @@ export interface OAuthAuthorizationCodeTokenIssuerService {
 declare const OAuthAuthorizationCodeTokenIssuer_base: Context.ServiceClass<OAuthAuthorizationCodeTokenIssuer, "auth/OAuthAuthorizationCodeTokenIssuer", OAuthAuthorizationCodeTokenIssuerService>;
 export declare class OAuthAuthorizationCodeTokenIssuer extends OAuthAuthorizationCodeTokenIssuer_base {
 }
-export declare namespace OAuthAuthorizationCodeTokenIssuer {
-    const make: (service: OAuthAuthorizationCodeTokenIssuerService) => OAuthAuthorizationCodeTokenIssuerService;
-}
 export interface OAuthAuthorizationCodeTokenGrantInput {
     readonly grantType: string;
     readonly code?: Redacted.Redacted<OAuthAuthorizationCode | string>;
@@ -614,9 +589,6 @@ export interface OAuthAuthorizationCodeTokenGrantService {
 declare const OAuthAuthorizationCodeTokenGrant_base: Context.ServiceClass<OAuthAuthorizationCodeTokenGrant, "auth/OAuthAuthorizationCodeTokenGrant", OAuthAuthorizationCodeTokenGrantService>;
 export declare class OAuthAuthorizationCodeTokenGrant extends OAuthAuthorizationCodeTokenGrant_base {
 }
-export declare namespace OAuthAuthorizationCodeTokenGrant {
-    const make: (service: OAuthAuthorizationCodeTokenGrantService) => OAuthAuthorizationCodeTokenGrantService;
-}
 export interface OAuthRefreshTokenIssueInput {
     readonly client: OAuthClientRecord;
     readonly refreshToken: Redacted.Redacted<OAuthRefreshToken | string>;
@@ -647,9 +619,6 @@ export interface OAuthRefreshTokenIssuerService {
 declare const OAuthRefreshTokenIssuer_base: Context.ServiceClass<OAuthRefreshTokenIssuer, "auth/OAuthRefreshTokenIssuer", OAuthRefreshTokenIssuerService>;
 export declare class OAuthRefreshTokenIssuer extends OAuthRefreshTokenIssuer_base {
 }
-export declare namespace OAuthRefreshTokenIssuer {
-    const make: (service: OAuthRefreshTokenIssuerService) => OAuthRefreshTokenIssuerService;
-}
 export interface OAuthRefreshTokenGrantInput {
     readonly grantType: string;
     readonly refreshToken?: Redacted.Redacted<OAuthRefreshToken | string>;
@@ -683,9 +652,6 @@ export interface OAuthRefreshTokenGrantService {
 declare const OAuthRefreshTokenGrant_base: Context.ServiceClass<OAuthRefreshTokenGrant, "auth/OAuthRefreshTokenGrant", OAuthRefreshTokenGrantService>;
 export declare class OAuthRefreshTokenGrant extends OAuthRefreshTokenGrant_base {
 }
-export declare namespace OAuthRefreshTokenGrant {
-    const make: (service: OAuthRefreshTokenGrantService) => OAuthRefreshTokenGrantService;
-}
 export interface OAuthClientCredentialsTokenIssueInput {
     readonly client: OAuthClientRecord;
     readonly scopes?: readonly string[];
@@ -715,9 +681,6 @@ export interface OAuthClientCredentialsTokenIssuerService {
 declare const OAuthClientCredentialsTokenIssuer_base: Context.ServiceClass<OAuthClientCredentialsTokenIssuer, "auth/OAuthClientCredentialsTokenIssuer", OAuthClientCredentialsTokenIssuerService>;
 export declare class OAuthClientCredentialsTokenIssuer extends OAuthClientCredentialsTokenIssuer_base {
 }
-export declare namespace OAuthClientCredentialsTokenIssuer {
-    const make: (service: OAuthClientCredentialsTokenIssuerService) => OAuthClientCredentialsTokenIssuerService;
-}
 export interface OAuthClientCredentialsGrantInput {
     readonly grantType: string;
     readonly clientId?: OAuthClientId | string;
@@ -750,9 +713,6 @@ export interface OAuthClientCredentialsGrantService {
 declare const OAuthClientCredentialsGrant_base: Context.ServiceClass<OAuthClientCredentialsGrant, "auth/OAuthClientCredentialsGrant", OAuthClientCredentialsGrantService>;
 export declare class OAuthClientCredentialsGrant extends OAuthClientCredentialsGrant_base {
 }
-export declare namespace OAuthClientCredentialsGrant {
-    const make: (service: OAuthClientCredentialsGrantService) => OAuthClientCredentialsGrantService;
-}
 export interface OAuthTokenRevokeInput {
     readonly client: OAuthClientRecord;
     readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
@@ -775,9 +735,6 @@ export interface OAuthTokenRevokerService {
 declare const OAuthTokenRevoker_base: Context.ServiceClass<OAuthTokenRevoker, "auth/OAuthTokenRevoker", OAuthTokenRevokerService>;
 export declare class OAuthTokenRevoker extends OAuthTokenRevoker_base {
 }
-export declare namespace OAuthTokenRevoker {
-    const make: (service: OAuthTokenRevokerService) => OAuthTokenRevokerService;
-}
 export interface OAuthTokenRevocationRequestInput {
     readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
     readonly tokenTypeHint?: OAuthTokenRevocationHint | string;
@@ -809,9 +766,6 @@ export interface OAuthTokenRevocationService {
 declare const OAuthTokenRevocation_base: Context.ServiceClass<OAuthTokenRevocation, "auth/OAuthTokenRevocation", OAuthTokenRevocationService>;
 export declare class OAuthTokenRevocation extends OAuthTokenRevocation_base {
 }
-export declare namespace OAuthTokenRevocation {
-    const make: (service: OAuthTokenRevocationService) => OAuthTokenRevocationService;
-}
 export interface OAuthTokenIntrospectInput {
     readonly client: OAuthClientRecord;
     readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
@@ -851,9 +805,6 @@ export interface OAuthTokenIntrospectorService {
 declare const OAuthTokenIntrospector_base: Context.ServiceClass<OAuthTokenIntrospector, "auth/OAuthTokenIntrospector", OAuthTokenIntrospectorService>;
 export declare class OAuthTokenIntrospector extends OAuthTokenIntrospector_base {
 }
-export declare namespace OAuthTokenIntrospector {
-    const make: (service: OAuthTokenIntrospectorService) => OAuthTokenIntrospectorService;
-}
 export interface OAuthTokenIntrospectionRequestInput {
     readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
     readonly tokenTypeHint?: string;
@@ -886,9 +837,6 @@ export interface OAuthTokenIntrospectionService {
 declare const OAuthTokenIntrospection_base: Context.ServiceClass<OAuthTokenIntrospection, "auth/OAuthTokenIntrospection", OAuthTokenIntrospectionService>;
 export declare class OAuthTokenIntrospection extends OAuthTokenIntrospection_base {
 }
-export declare namespace OAuthTokenIntrospection {
-    const make: (service: OAuthTokenIntrospectionService) => OAuthTokenIntrospectionService;
-}
 export interface OAuthProviderAuthorizationInput {
     readonly responseType: string;
     readonly clientId?: OAuthClientId | string;
@@ -932,9 +880,6 @@ export interface OAuthProviderAuthorizationPolicyService {
 declare const OAuthProviderAuthorizationPolicy_base: Context.ServiceClass<OAuthProviderAuthorizationPolicy, "auth/OAuthProviderAuthorizationPolicy", OAuthProviderAuthorizationPolicyService>;
 export declare class OAuthProviderAuthorizationPolicy extends OAuthProviderAuthorizationPolicy_base {
 }
-export declare namespace OAuthProviderAuthorizationPolicy {
-    const make: (service: OAuthProviderAuthorizationPolicyService) => OAuthProviderAuthorizationPolicyService;
-}
 export type OAuthProviderAuthorizationResult = {
     readonly valid: true;
     readonly client: OAuthClientRecord;
@@ -965,9 +910,6 @@ export interface OAuthProviderAuthorizationService {
 declare const OAuthProviderAuthorization_base: Context.ServiceClass<OAuthProviderAuthorization, "auth/OAuthProviderAuthorization", OAuthProviderAuthorizationService>;
 export declare class OAuthProviderAuthorization extends OAuthProviderAuthorization_base {
 }
-export declare namespace OAuthProviderAuthorization {
-    const make: (service: OAuthProviderAuthorizationService) => OAuthProviderAuthorizationService;
-}
 export type OAuthClientAuthentication = {
     readonly method: "none";
 } | {
@@ -1099,9 +1041,6 @@ export interface OAuthProviderModeTokenStoreService {
 declare const OAuthProviderModeTokenStore_base: Context.ServiceClass<OAuthProviderModeTokenStore, "auth/OAuthProviderModeTokenStore", OAuthProviderModeTokenStoreService>;
 export declare class OAuthProviderModeTokenStore extends OAuthProviderModeTokenStore_base {
 }
-export declare namespace OAuthProviderModeTokenStore {
-    const make: (service: OAuthProviderModeTokenStoreService) => OAuthProviderModeTokenStoreService;
-}
 export interface OAuthProviderTokenVaultRecord {
     readonly accountId: OAuthAccountId;
     readonly userId: UserId;
@@ -1152,9 +1091,6 @@ export interface OAuthProviderTokenVaultService {
 declare const OAuthProviderTokenVault_base: Context.ServiceClass<OAuthProviderTokenVault, "auth/OAuthProviderTokenVault", OAuthProviderTokenVaultService>;
 export declare class OAuthProviderTokenVault extends OAuthProviderTokenVault_base {
 }
-export declare namespace OAuthProviderTokenVault {
-    const make: (service: OAuthProviderTokenVaultService) => OAuthProviderTokenVaultService;
-}
 export interface OAuthProviderTokenLifecycleStoreInput {
     readonly accountId: OAuthAccountId;
     readonly userId: UserId;
@@ -1221,9 +1157,6 @@ export interface OAuthProviderTokenLifecycleService {
 declare const OAuthProviderTokenLifecycle_base: Context.ServiceClass<OAuthProviderTokenLifecycle, "auth/OAuthProviderTokenLifecycle", OAuthProviderTokenLifecycleService>;
 export declare class OAuthProviderTokenLifecycle extends OAuthProviderTokenLifecycle_base {
 }
-export declare namespace OAuthProviderTokenLifecycle {
-    const make: (service: OAuthProviderTokenLifecycleService) => OAuthProviderTokenLifecycleService;
-}
 export interface OAuthProviderTokenLifecycleDependencies {
     readonly tokenVault: OAuthProviderTokenVaultService;
     readonly encryptToken: (token: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<string>, unknown>;
@@ -1326,9 +1259,6 @@ export interface OidcIdTokenVerifierService {
 declare const OidcIdTokenVerifier_base: Context.ServiceClass<OidcIdTokenVerifier, "auth/OidcIdTokenVerifier", OidcIdTokenVerifierService>;
 export declare class OidcIdTokenVerifier extends OidcIdTokenVerifier_base {
 }
-export declare namespace OidcIdTokenVerifier {
-    const make: (service: OidcIdTokenVerifierService) => OidcIdTokenVerifierService;
-}
 export interface OidcIdTokenVerifierDependencies {
     readonly jwtVerifier: JwtVerifierService;
 }
@@ -1367,9 +1297,6 @@ export interface OAuthProfileNormalizerService {
 declare const OAuthProfileNormalizer_base: Context.ServiceClass<OAuthProfileNormalizer, "auth/OAuthProfileNormalizer", OAuthProfileNormalizerService>;
 export declare class OAuthProfileNormalizer extends OAuthProfileNormalizer_base {
 }
-export declare namespace OAuthProfileNormalizer {
-    const make: (service: OAuthProfileNormalizerService) => OAuthProfileNormalizerService;
-}
 export type OAuthTokenExchangeOperation = "token-request" | "refresh-token-request" | "revocation-request" | "decode-token-response" | "exchange-code";
 declare const OAuthTokenExchangeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthTokenExchangeError";
@@ -1386,18 +1313,12 @@ export interface OAuthTokenExchangeService {
 declare const OAuthTokenExchange_base: Context.ServiceClass<OAuthTokenExchange, "auth/OAuthTokenExchange", OAuthTokenExchangeService>;
 export declare class OAuthTokenExchange extends OAuthTokenExchange_base {
 }
-export declare namespace OAuthTokenExchange {
-    const make: (service: OAuthTokenExchangeService) => OAuthTokenExchangeService;
-}
 export interface OAuthTokenExchangeDependencies {
     readonly request: (request: OAuthTokenRequest) => Effect.Effect<unknown, OAuthTokenExchangeError>;
 }
 declare const OAuthProviders_base: Context.ServiceClass<OAuthProviders, "auth/OAuthProviders", OAuthProvidersService>;
 export declare class OAuthProviders extends OAuthProviders_base {
 }
-export declare namespace OAuthProviders {
-    const make: (service: OAuthProvidersService) => OAuthProvidersService;
-}
 export interface OAuthPkce {
     readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier>;
     readonly codeChallenge: OAuthCodeChallenge;
@@ -1473,9 +1394,6 @@ export interface OAuthStateService {
 declare const OAuthState_base: Context.ServiceClass<OAuthState, "auth/OAuthState", OAuthStateService>;
 export declare class OAuthState extends OAuthState_base {
 }
-export declare namespace OAuthState {
-    const make: (service: OAuthStateService) => OAuthStateService;
-}
 export interface OAuthAccountRecord {
     readonly id: OAuthAccountId;
     readonly providerId: OAuthProviderId;
@@ -1527,12 +1445,41 @@ export interface OAuthAccountStoreService {
     readonly listByUser: (input: OAuthAccountListByUserInput) => Effect.Effect<readonly OAuthAccountRecord[], OAuthAccountStoreError>;
     readonly unlink: (input: OAuthAccountUnlinkInput) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
 }
+export type OAuthIdentityBridgeConflictReason = "user-id" | "identity-id" | "identity-value" | "oauth-account-id" | "provider-account";
+declare const OAuthIdentityBridgeConflictError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthIdentityBridgeConflictError";
+} & Readonly<A>;
+export declare class OAuthIdentityBridgeConflictError extends OAuthIdentityBridgeConflictError_base<{
+    readonly reason: OAuthIdentityBridgeConflictReason;
+}> {
+}
+declare const OAuthIdentityBridgeStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthIdentityBridgeStoreError";
+} & Readonly<A>;
+export declare class OAuthIdentityBridgeStoreError extends OAuthIdentityBridgeStoreError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthIdentityBridgeCreateInput {
+    readonly user: NewUserRow;
+    readonly identity?: NewUserIdentityRow;
+    readonly account: OAuthAccountRecord;
+}
+export interface OAuthIdentityBridgeCreateResult {
+    readonly user: UserRow;
+    readonly identity?: UserIdentityRow;
+    readonly account: OAuthAccountRecord;
+}
+export interface OAuthIdentityBridgeStoreService {
+    readonly create: (input: OAuthIdentityBridgeCreateInput) => Effect.Effect<OAuthIdentityBridgeCreateResult, OAuthIdentityBridgeConflictError | OAuthIdentityBridgeStoreError>;
+}
+declare const OAuthIdentityBridgeStore_base: Context.ServiceClass<OAuthIdentityBridgeStore, "auth/OAuthIdentityBridgeStore", OAuthIdentityBridgeStoreService>;
+export declare class OAuthIdentityBridgeStore extends OAuthIdentityBridgeStore_base {
+}
 declare const OAuthAccountStore_base: Context.ServiceClass<OAuthAccountStore, "auth/OAuthAccountStore", OAuthAccountStoreService>;
 export declare class OAuthAccountStore extends OAuthAccountStore_base {
 }
-export declare namespace OAuthAccountStore {
-    const make: (service: OAuthAccountStoreService) => OAuthAccountStoreService;
-}
 export interface OAuthAccountLinkingResolveInput {
     readonly identity: VerifiedOAuthIdentity;
     readonly currentUserId?: UserId;
@@ -1576,15 +1523,69 @@ export interface OAuthAccountLinkingService {
 declare const OAuthAccountLinking_base: Context.ServiceClass<OAuthAccountLinking, "auth/OAuthAccountLinking", OAuthAccountLinkingService>;
 export declare class OAuthAccountLinking extends OAuthAccountLinking_base {
 }
-export declare namespace OAuthAccountLinking {
-    const make: (service: OAuthAccountLinkingService) => OAuthAccountLinkingService;
-}
 export interface OAuthAccountLinkingPolicyOptions {
     readonly autoLinkVerifiedEmail?: boolean;
 }
 export interface OAuthAccountLinkingPolicyDependencies extends OAuthAccountLinkingPolicyOptions {
     readonly accounts: OAuthAccountStoreService;
 }
+export interface OAuthIdentityBridgePolicyInput {
+    readonly identity: VerifiedOAuthIdentity;
+    readonly currentUserId?: UserId;
+}
+export type OAuthIdentityBridgePolicyDecision = {
+    readonly type: "allow";
+    readonly createUser: boolean;
+    readonly trustVerifiedEmail?: boolean;
+    readonly createEmailIdentity?: boolean;
+} | {
+    readonly type: "deny";
+    readonly reason: string;
+};
+export interface OAuthIdentityBridgePolicyService {
+    readonly decide: (input: OAuthIdentityBridgePolicyInput) => Effect.Effect<OAuthIdentityBridgePolicyDecision, OAuthIdentityBridgeError>;
+}
+declare const OAuthIdentityBridgePolicy_base: Context.ServiceClass<OAuthIdentityBridgePolicy, "auth/OAuthIdentityBridgePolicy", OAuthIdentityBridgePolicyService>;
+export declare class OAuthIdentityBridgePolicy extends OAuthIdentityBridgePolicy_base {
+}
+export interface OAuthIdentityBridgeResolveInput {
+    readonly identity: VerifiedOAuthIdentity;
+    readonly currentUserId?: UserId;
+    readonly makeUser: () => NewUserRow;
+    readonly makeAccount: (userId: UserId) => OAuthAccountRecord;
+    readonly makeEmailIdentity: (userId: UserId, email: Email, normalizedEmail: Email) => NewUserIdentityRow;
+}
+export type OAuthIdentityBridgeResolution = OAuthAccountLinkingResolution | {
+    readonly type: "created";
+    readonly reason: "new-provider-account";
+    readonly user: UserRow;
+    readonly identity?: UserIdentityRow;
+    readonly account: OAuthAccountRecord;
+} | {
+    readonly type: "deny";
+    readonly reason: string;
+    readonly identity: VerifiedOAuthIdentity;
+};
+declare const OAuthIdentityBridgeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthIdentityBridgeError";
+} & Readonly<A>;
+export declare class OAuthIdentityBridgeError extends OAuthIdentityBridgeError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthIdentityBridgeService {
+    readonly resolve: (input: OAuthIdentityBridgeResolveInput) => Effect.Effect<OAuthIdentityBridgeResolution, OAuthIdentityBridgeError>;
+}
+declare const OAuthIdentityBridge_base: Context.ServiceClass<OAuthIdentityBridge, "auth/OAuthIdentityBridge", OAuthIdentityBridgeService>;
+export declare class OAuthIdentityBridge extends OAuthIdentityBridge_base {
+}
+export interface OAuthIdentityBridgeDependencies {
+    readonly linking: OAuthAccountLinkingService;
+    readonly identities: IdentityStoreService;
+    readonly store: OAuthIdentityBridgeStoreService;
+    readonly policy: OAuthIdentityBridgePolicyService;
+}
 export interface OAuthAccountUnlinkingResolveInput {
     readonly userId: UserId;
     readonly providerId: OAuthProviderId;
@@ -1636,9 +1637,6 @@ export interface OAuthAccountUnlinkingService {
 declare const OAuthAccountUnlinking_base: Context.ServiceClass<OAuthAccountUnlinking, "auth/OAuthAccountUnlinking", OAuthAccountUnlinkingService>;
 export declare class OAuthAccountUnlinking extends OAuthAccountUnlinking_base {
 }
-export declare namespace OAuthAccountUnlinking {
-    const make: (service: OAuthAccountUnlinkingService) => OAuthAccountUnlinkingService;
-}
 export interface OAuthAccountUnlinkingPolicyOptions {
     readonly allowLastAccount?: boolean;
     readonly requireStepUp?: boolean;
@@ -1709,9 +1707,6 @@ export interface OAuthLinkConfirmationService {
 declare const OAuthLinkConfirmation_base: Context.ServiceClass<OAuthLinkConfirmation, "auth/OAuthLinkConfirmation", OAuthLinkConfirmationService>;
 export declare class OAuthLinkConfirmation extends OAuthLinkConfirmation_base {
 }
-export declare namespace OAuthLinkConfirmation {
-    const make: (service: OAuthLinkConfirmationService) => OAuthLinkConfirmationService;
-}
 export interface OAuthLinkConfirmationDependencies {
     readonly challenge: ChallengeService;
     readonly accounts: OAuthAccountStoreService;
@@ -1825,6 +1820,8 @@ export declare const revokeOAuthProviderTokens: (input: OAuthProviderTokenLifecy
 export declare const completeOAuthCallback: (input: OAuthCallbackInput) => Effect.Effect<OAuthCallbackResult, OAuthStateError | OAuthTokenExchangeError, OAuthState | OAuthTokenExchange>;
 export declare const makeOAuthAccountLinkingPolicy: (dependencies: OAuthAccountLinkingPolicyDependencies) => OAuthAccountLinkingService;
 export declare const resolveOAuthAccountLinking: (input: OAuthAccountLinkingResolveInput) => Effect.Effect<OAuthAccountLinkingResolution, OAuthAccountLinkingError, OAuthAccountLinking>;
+export declare const makeOAuthIdentityBridge: (dependencies: OAuthIdentityBridgeDependencies) => OAuthIdentityBridgeService;
+export declare const resolveOAuthIdentityBridge: (input: OAuthIdentityBridgeResolveInput) => Effect.Effect<OAuthIdentityBridgeResolution, OAuthIdentityBridgeError, OAuthIdentityBridge>;
 export declare const makeOAuthAccountUnlinkingPolicy: (dependencies: OAuthAccountUnlinkingPolicyDependencies) => OAuthAccountUnlinkingService;
 export declare const resolveOAuthAccountUnlinking: (input: OAuthAccountUnlinkingResolveInput) => Effect.Effect<OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingError, OAuthAccountUnlinking>;
 export declare const makeOAuthLinkConfirmation: (dependencies: OAuthLinkConfirmationDependencies) => OAuthLinkConfirmationService;
@@ -1850,19 +1847,19 @@ export declare const introspectOAuthToken: (input: OAuthTokenIntrospectionReques
 export declare const authorizeOAuthProviderAuthorization: (input: OAuthProviderAuthorizationInput) => Effect.Effect<OAuthProviderAuthorizationResult, OAuthProviderAuthorizationError, OAuthProviderAuthorization>;
 export declare const makeOAuthPkce: (input?: OAuthPkceInput) => Effect.Effect<OAuthPkce, OAuthStateError, Crypto>;
 export declare const makeOAuthState: (dependencies: OAuthStateDependencies) => OAuthStateService;
-export declare const OAuthStateLive: Layer.Layer<OAuthState, never, Crypto | Challenge>;
+export declare const OAuthStateLive: Layer.Layer<OAuthState, never, Challenge | Crypto>;
 export declare const OAuthAuthorizationCodeGrantLive: Layer.Layer<OAuthAuthorizationCodeGrant, never, Crypto | OAuthAuthorizationCodeStore>;
-export declare const OAuthAuthorizationCodeTokenGrantLive: Layer.Layer<OAuthAuthorizationCodeTokenGrant, never, OAuthClientRegistry | OAuthAuthorizationCodeGrant | OAuthAuthorizationCodeTokenIssuer>;
+export declare const OAuthAuthorizationCodeTokenGrantLive: Layer.Layer<OAuthAuthorizationCodeTokenGrant, never, OAuthAuthorizationCodeGrant | OAuthAuthorizationCodeTokenIssuer | OAuthClientRegistry>;
 export declare const OAuthRefreshTokenGrantLive: Layer.Layer<OAuthRefreshTokenGrant, never, OAuthClientRegistry | OAuthRefreshTokenIssuer>;
-export declare const OAuthClientCredentialsGrantLive: Layer.Layer<OAuthClientCredentialsGrant, never, OAuthClientRegistry | OAuthClientCredentialsTokenIssuer>;
-export declare const OAuthProviderModeOpaqueTokenIssuerLive: (options?: OAuthProviderModeOpaqueTokenIssuerLiveOptions) => Layer.Layer<OAuthAuthorizationCodeTokenIssuer | OAuthRefreshTokenIssuer | OAuthClientCredentialsTokenIssuer, never, Crypto | OAuthProviderModeTokenStore>;
+export declare const OAuthClientCredentialsGrantLive: Layer.Layer<OAuthClientCredentialsGrant, never, OAuthClientCredentialsTokenIssuer | OAuthClientRegistry>;
+export declare const OAuthProviderModeOpaqueTokenIssuerLive: (options?: OAuthProviderModeOpaqueTokenIssuerLiveOptions) => Layer.Layer<OAuthAuthorizationCodeTokenIssuer | OAuthClientCredentialsTokenIssuer | OAuthRefreshTokenIssuer, never, Crypto | OAuthProviderModeTokenStore>;
 export declare const OAuthTokenRevocationLive: Layer.Layer<OAuthTokenRevocation, never, OAuthClientRegistry | OAuthTokenRevoker>;
 export declare const OAuthTokenIntrospectionLive: Layer.Layer<OAuthTokenIntrospection, never, OAuthClientRegistry | OAuthTokenIntrospector>;
-export declare const OAuthProviderAuthorizationLive: Layer.Layer<OAuthProviderAuthorization, never, OAuthClientRegistry | OAuthAuthorizationCodeGrant | OAuthProviderAuthorizationPolicy>;
+export declare const OAuthProviderAuthorizationLive: Layer.Layer<OAuthProviderAuthorization, never, OAuthAuthorizationCodeGrant | OAuthClientRegistry | OAuthProviderAuthorizationPolicy>;
 export declare const makeOAuthProviders: (providers: readonly OAuthProviderConfig[]) => OAuthProvidersService;
 export declare const OAuthProvidersLive: (providers: readonly OAuthProviderConfig[]) => Layer.Layer<OAuthProviders, never, never>;
 export declare const OAuthClientSecretsLive: Layer.Layer<OAuthClientSecrets, never, Crypto>;
-export declare const OAuthClientSecretVerificationLive: Layer.Layer<OAuthClientSecretVerification, never, OAuthClientSecrets | OAuthClientSecretStore>;
+export declare const OAuthClientSecretVerificationLive: Layer.Layer<OAuthClientSecretVerification, never, OAuthClientSecretStore | OAuthClientSecrets>;
 export declare const makeOAuthClientRegistryFromStore: (store: OAuthClientStoreService) => OAuthClientRegistryService;
 export declare const OAuthClientRegistryFromStoreLive: Layer.Layer<OAuthClientRegistry, never, OAuthClientStore>;
 export declare const makeOAuthClientRegistryMemory: (clients?: readonly OAuthClientRecord[]) => OAuthClientRegistryService;
@@ -1881,7 +1878,7 @@ export declare const OidcIdTokenVerifierLive: Layer.Layer<OidcIdTokenVerifier, n
 export declare const OAuthOidcProfileNormalizerLive: Layer.Layer<OAuthProfileNormalizer, never, never>;
 export declare const OAuthAccountLinkingLive: Layer.Layer<OAuthAccountLinking, never, OAuthAccountStore>;
 export declare const OAuthAccountUnlinkingLive: Layer.Layer<OAuthAccountUnlinking, never, OAuthAccountStore>;
-export declare const OAuthLinkConfirmationLive: Layer.Layer<OAuthLinkConfirmation, never, Crypto | Challenge | OAuthAccountStore>;
+export declare const OAuthLinkConfirmationLive: Layer.Layer<OAuthLinkConfirmation, never, Challenge | Crypto | OAuthAccountStore>;
 export declare const makeOAuthProviderTokenVaultMemory: () => OAuthProviderTokenVaultService;
 export declare const OAuthProviderTokenVaultMemoryLive: Layer.Layer<OAuthProviderTokenVault, never, never>;
 export declare const makeOAuthAccountStoreMemory: () => OAuthAccountStoreService;