@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/OAuth.d.ts

@@ -5,7 +5,9 @@ import type { ChallengeService } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
 import type { CryptoService } from "./Crypto.js";
 import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId } from "./Identifiers.js";
+import type { NewUserIdentityRow, UserIdentityRow } from "./Identity.js";
 import { JwtError, JwtVerifier, type JwksDocument, type JwtAudience, type JwtAlgorithm, type JwtClaims, type JwtHeader, type JwtKeyInfo, type JwtKeysService, type JwtVerifierService, type JwtVerificationFailureReason } from "./Jwt.js";
+import type { IdentityStoreService, NewUserRow, UserRow } from "./Storage.js";
 export type OAuthStateToken = Brand.Branded<string, "auth/OAuthStateToken">;
 export declare const OAuthStateToken: Brand.Constructor<OAuthStateToken>;
 export type OAuthCodeVerifier = Brand.Branded<string, "auth/OAuthCodeVerifier">;
@@ -177,7 +179,7 @@ export interface OAuthProvidersService {
 }
 export type OAuthClientType = "public" | "confidential";
 export type OAuthClientStatus = "active" | "disabled";
-export type OAuthClientGrantType = "authorization_code" | "refresh_token" | "client_credentials";
+export type OAuthClientGrantType = "authorization_code" | "refresh_token" | "client_credentials" | "urn:ietf:params:oauth:grant-type:device_code";
 export type OAuthClientResponseType = "code";
 export type OAuthClientSecretAuthenticationMethod = "client_secret_basic" | "client_secret_post";
 export type OAuthClientSecretPrefix = Brand.Branded<string, "auth/OAuthClientSecretPrefix">;
@@ -234,9 +236,6 @@ export interface OAuthClientRegistryService {
 declare const OAuthClientRegistry_base: Context.ServiceClass<OAuthClientRegistry, "auth/OAuthClientRegistry", OAuthClientRegistryService>;
 export declare class OAuthClientRegistry extends OAuthClientRegistry_base {
 }
-export declare namespace OAuthClientRegistry {
-    const make: (service: OAuthClientRegistryService) => OAuthClientRegistryService;
-}
 export interface OAuthClientStoreListInput {
     readonly includeDisabled?: boolean;
 }
@@ -259,9 +258,6 @@ export interface OAuthClientStoreService {
 declare const OAuthClientStore_base: Context.ServiceClass<OAuthClientStore, "auth/OAuthClientStore", OAuthClientStoreService>;
 export declare class OAuthClientStore extends OAuthClientStore_base {
 }
-export declare namespace OAuthClientStore {
-    const make: (service: OAuthClientStoreService) => OAuthClientStoreService;
-}
 export interface OAuthConsentRecord {
     readonly userId: UserId;
     readonly clientId: OAuthClientId;
@@ -317,9 +313,6 @@ export interface OAuthConsentStoreService {
 declare const OAuthConsentStore_base: Context.ServiceClass<OAuthConsentStore, "auth/OAuthConsentStore", OAuthConsentStoreService>;
 export declare class OAuthConsentStore extends OAuthConsentStore_base {
 }
-export declare namespace OAuthConsentStore {
-    const make: (service: OAuthConsentStoreService) => OAuthConsentStoreService;
-}
 export type OAuthClientSecretOperation = "generate" | "parse" | "hash" | "verify";
 declare const OAuthClientSecretError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthClientSecretError";
@@ -353,9 +346,6 @@ export interface OAuthClientSecretsService {
 declare const OAuthClientSecrets_base: Context.ServiceClass<OAuthClientSecrets, "auth/OAuthClientSecrets", OAuthClientSecretsService>;
 export declare class OAuthClientSecrets extends OAuthClientSecrets_base {
 }
-export declare namespace OAuthClientSecrets {
-    const make: (service: OAuthClientSecretsService) => OAuthClientSecretsService;
-}
 export interface OAuthClientSecretsDependencies {
     readonly crypto: CryptoService;
 }
@@ -401,9 +391,6 @@ export interface OAuthClientSecretStoreService {
 declare const OAuthClientSecretStore_base: Context.ServiceClass<OAuthClientSecretStore, "auth/OAuthClientSecretStore", OAuthClientSecretStoreService>;
 export declare class OAuthClientSecretStore extends OAuthClientSecretStore_base {
 }
-export declare namespace OAuthClientSecretStore {
-    const make: (service: OAuthClientSecretStoreService) => OAuthClientSecretStoreService;
-}
 export interface OAuthClientSecretAuthenticateClientInput {
     readonly clientId: OAuthClientId;
     readonly method: OAuthClientSecretAuthenticationMethod;
@@ -427,9 +414,6 @@ export interface OAuthClientSecretVerificationService {
 declare const OAuthClientSecretVerification_base: Context.ServiceClass<OAuthClientSecretVerification, "auth/OAuthClientSecretVerification", OAuthClientSecretVerificationService>;
 export declare class OAuthClientSecretVerification extends OAuthClientSecretVerification_base {
 }
-export declare namespace OAuthClientSecretVerification {
-    const make: (service: OAuthClientSecretVerificationService) => OAuthClientSecretVerificationService;
-}
 export interface OAuthClientSecretVerificationDependencies {
     readonly clientSecrets: OAuthClientSecretsService;
     readonly secretStore: OAuthClientSecretStoreService;
@@ -532,9 +516,6 @@ export interface OAuthAuthorizationCodeStoreService {
 declare const OAuthAuthorizationCodeStore_base: Context.ServiceClass<OAuthAuthorizationCodeStore, "auth/OAuthAuthorizationCodeStore", OAuthAuthorizationCodeStoreService>;
 export declare class OAuthAuthorizationCodeStore extends OAuthAuthorizationCodeStore_base {
 }
-export declare namespace OAuthAuthorizationCodeStore {
-    const make: (service: OAuthAuthorizationCodeStoreService) => OAuthAuthorizationCodeStoreService;
-}
 export type OAuthAuthorizationCodeGrantOperation = "issue" | "consume";
 declare const OAuthAuthorizationCodeGrantError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthAuthorizationCodeGrantError";
@@ -552,9 +533,6 @@ export interface OAuthAuthorizationCodeGrantService {
 declare const OAuthAuthorizationCodeGrant_base: Context.ServiceClass<OAuthAuthorizationCodeGrant, "auth/OAuthAuthorizationCodeGrant", OAuthAuthorizationCodeGrantService>;
 export declare class OAuthAuthorizationCodeGrant extends OAuthAuthorizationCodeGrant_base {
 }
-export declare namespace OAuthAuthorizationCodeGrant {
-    const make: (service: OAuthAuthorizationCodeGrantService) => OAuthAuthorizationCodeGrantService;
-}
 export interface OAuthAuthorizationCodeTokenIssueInput {
     readonly client: OAuthClientRecord;
     readonly code: OAuthConsumedAuthorizationCode;
@@ -576,9 +554,6 @@ export interface OAuthAuthorizationCodeTokenIssuerService {
 declare const OAuthAuthorizationCodeTokenIssuer_base: Context.ServiceClass<OAuthAuthorizationCodeTokenIssuer, "auth/OAuthAuthorizationCodeTokenIssuer", OAuthAuthorizationCodeTokenIssuerService>;
 export declare class OAuthAuthorizationCodeTokenIssuer extends OAuthAuthorizationCodeTokenIssuer_base {
 }
-export declare namespace OAuthAuthorizationCodeTokenIssuer {
-    const make: (service: OAuthAuthorizationCodeTokenIssuerService) => OAuthAuthorizationCodeTokenIssuerService;
-}
 export interface OAuthAuthorizationCodeTokenGrantInput {
     readonly grantType: string;
     readonly code?: Redacted.Redacted<OAuthAuthorizationCode | string>;
@@ -614,9 +589,6 @@ export interface OAuthAuthorizationCodeTokenGrantService {
 declare const OAuthAuthorizationCodeTokenGrant_base: Context.ServiceClass<OAuthAuthorizationCodeTokenGrant, "auth/OAuthAuthorizationCodeTokenGrant", OAuthAuthorizationCodeTokenGrantService>;
 export declare class OAuthAuthorizationCodeTokenGrant extends OAuthAuthorizationCodeTokenGrant_base {
 }
-export declare namespace OAuthAuthorizationCodeTokenGrant {
-    const make: (service: OAuthAuthorizationCodeTokenGrantService) => OAuthAuthorizationCodeTokenGrantService;
-}
 export interface OAuthRefreshTokenIssueInput {
     readonly client: OAuthClientRecord;
     readonly refreshToken: Redacted.Redacted<OAuthRefreshToken | string>;
@@ -647,9 +619,6 @@ export interface OAuthRefreshTokenIssuerService {
 declare const OAuthRefreshTokenIssuer_base: Context.ServiceClass<OAuthRefreshTokenIssuer, "auth/OAuthRefreshTokenIssuer", OAuthRefreshTokenIssuerService>;
 export declare class OAuthRefreshTokenIssuer extends OAuthRefreshTokenIssuer_base {
 }
-export declare namespace OAuthRefreshTokenIssuer {
-    const make: (service: OAuthRefreshTokenIssuerService) => OAuthRefreshTokenIssuerService;
-}
 export interface OAuthRefreshTokenGrantInput {
     readonly grantType: string;
     readonly refreshToken?: Redacted.Redacted<OAuthRefreshToken | string>;
@@ -683,9 +652,6 @@ export interface OAuthRefreshTokenGrantService {
 declare const OAuthRefreshTokenGrant_base: Context.ServiceClass<OAuthRefreshTokenGrant, "auth/OAuthRefreshTokenGrant", OAuthRefreshTokenGrantService>;
 export declare class OAuthRefreshTokenGrant extends OAuthRefreshTokenGrant_base {
 }
-export declare namespace OAuthRefreshTokenGrant {
-    const make: (service: OAuthRefreshTokenGrantService) => OAuthRefreshTokenGrantService;
-}
 export interface OAuthClientCredentialsTokenIssueInput {
     readonly client: OAuthClientRecord;
     readonly scopes?: readonly string[];
@@ -715,9 +681,6 @@ export interface OAuthClientCredentialsTokenIssuerService {
 declare const OAuthClientCredentialsTokenIssuer_base: Context.ServiceClass<OAuthClientCredentialsTokenIssuer, "auth/OAuthClientCredentialsTokenIssuer", OAuthClientCredentialsTokenIssuerService>;
 export declare class OAuthClientCredentialsTokenIssuer extends OAuthClientCredentialsTokenIssuer_base {
 }
-export declare namespace OAuthClientCredentialsTokenIssuer {
-    const make: (service: OAuthClientCredentialsTokenIssuerService) => OAuthClientCredentialsTokenIssuerService;
-}
 export interface OAuthClientCredentialsGrantInput {
     readonly grantType: string;
     readonly clientId?: OAuthClientId | string;
@@ -750,9 +713,6 @@ export interface OAuthClientCredentialsGrantService {
 declare const OAuthClientCredentialsGrant_base: Context.ServiceClass<OAuthClientCredentialsGrant, "auth/OAuthClientCredentialsGrant", OAuthClientCredentialsGrantService>;
 export declare class OAuthClientCredentialsGrant extends OAuthClientCredentialsGrant_base {
 }
-export declare namespace OAuthClientCredentialsGrant {
-    const make: (service: OAuthClientCredentialsGrantService) => OAuthClientCredentialsGrantService;
-}
 export interface OAuthTokenRevokeInput {
     readonly client: OAuthClientRecord;
     readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
@@ -775,9 +735,6 @@ export interface OAuthTokenRevokerService {
 declare const OAuthTokenRevoker_base: Context.ServiceClass<OAuthTokenRevoker, "auth/OAuthTokenRevoker", OAuthTokenRevokerService>;
 export declare class OAuthTokenRevoker extends OAuthTokenRevoker_base {
 }
-export declare namespace OAuthTokenRevoker {
-    const make: (service: OAuthTokenRevokerService) => OAuthTokenRevokerService;
-}
 export interface OAuthTokenRevocationRequestInput {
     readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
     readonly tokenTypeHint?: OAuthTokenRevocationHint | string;
@@ -809,9 +766,6 @@ export interface OAuthTokenRevocationService {
 declare const OAuthTokenRevocation_base: Context.ServiceClass<OAuthTokenRevocation, "auth/OAuthTokenRevocation", OAuthTokenRevocationService>;
 export declare class OAuthTokenRevocation extends OAuthTokenRevocation_base {
 }
-export declare namespace OAuthTokenRevocation {
-    const make: (service: OAuthTokenRevocationService) => OAuthTokenRevocationService;
-}
 export interface OAuthTokenIntrospectInput {
     readonly client: OAuthClientRecord;
     readonly token: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
@@ -851,9 +805,6 @@ export interface OAuthTokenIntrospectorService {
 declare const OAuthTokenIntrospector_base: Context.ServiceClass<OAuthTokenIntrospector, "auth/OAuthTokenIntrospector", OAuthTokenIntrospectorService>;
 export declare class OAuthTokenIntrospector extends OAuthTokenIntrospector_base {
 }
-export declare namespace OAuthTokenIntrospector {
-    const make: (service: OAuthTokenIntrospectorService) => OAuthTokenIntrospectorService;
-}
 export interface OAuthTokenIntrospectionRequestInput {
     readonly token?: Redacted.Redacted<OAuthAccessToken | OAuthRefreshToken | string>;
     readonly tokenTypeHint?: string;
@@ -886,9 +837,6 @@ export interface OAuthTokenIntrospectionService {
 declare const OAuthTokenIntrospection_base: Context.ServiceClass<OAuthTokenIntrospection, "auth/OAuthTokenIntrospection", OAuthTokenIntrospectionService>;
 export declare class OAuthTokenIntrospection extends OAuthTokenIntrospection_base {
 }
-export declare namespace OAuthTokenIntrospection {
-    const make: (service: OAuthTokenIntrospectionService) => OAuthTokenIntrospectionService;
-}
 export interface OAuthProviderAuthorizationInput {
     readonly responseType: string;
     readonly clientId?: OAuthClientId | string;
@@ -932,9 +880,6 @@ export interface OAuthProviderAuthorizationPolicyService {
 declare const OAuthProviderAuthorizationPolicy_base: Context.ServiceClass<OAuthProviderAuthorizationPolicy, "auth/OAuthProviderAuthorizationPolicy", OAuthProviderAuthorizationPolicyService>;
 export declare class OAuthProviderAuthorizationPolicy extends OAuthProviderAuthorizationPolicy_base {
 }
-export declare namespace OAuthProviderAuthorizationPolicy {
-    const make: (service: OAuthProviderAuthorizationPolicyService) => OAuthProviderAuthorizationPolicyService;
-}
 export type OAuthProviderAuthorizationResult = {
     readonly valid: true;
     readonly client: OAuthClientRecord;
@@ -965,9 +910,6 @@ export interface OAuthProviderAuthorizationService {
 declare const OAuthProviderAuthorization_base: Context.ServiceClass<OAuthProviderAuthorization, "auth/OAuthProviderAuthorization", OAuthProviderAuthorizationService>;
 export declare class OAuthProviderAuthorization extends OAuthProviderAuthorization_base {
 }
-export declare namespace OAuthProviderAuthorization {
-    const make: (service: OAuthProviderAuthorizationService) => OAuthProviderAuthorizationService;
-}
 export type OAuthClientAuthentication = {
     readonly method: "none";
 } | {
@@ -1099,8 +1041,47 @@ export interface OAuthProviderModeTokenStoreService {
 declare const OAuthProviderModeTokenStore_base: Context.ServiceClass<OAuthProviderModeTokenStore, "auth/OAuthProviderModeTokenStore", OAuthProviderModeTokenStoreService>;
 export declare class OAuthProviderModeTokenStore extends OAuthProviderModeTokenStore_base {
 }
-export declare namespace OAuthProviderModeTokenStore {
-    const make: (service: OAuthProviderModeTokenStoreService) => OAuthProviderModeTokenStoreService;
+export interface OAuthProviderModeAccessTokenVerifyInput {
+    readonly accessToken: Redacted.Redacted<OAuthAccessToken | string>;
+    readonly requiredScopes?: readonly string[];
+    readonly issuer?: string;
+    /** Every required audience must be present in the token record audience. */
+    readonly audience?: string | readonly string[];
+    readonly now?: UnixMillis;
+}
+export type OAuthProviderModeAccessTokenVerificationFailureReason = "unknown_token" | "wrong_token_type" | "expired" | "revoked" | "rotated" | "unknown_client" | "disabled_client" | "issuer_mismatch" | "audience_mismatch" | "missing_scope";
+export type OAuthProviderModeActiveAccessTokenRecord = Omit<OAuthProviderModeTokenRecord, "tokenHash" | "tokenType" | "revokedAt" | "revocationReason" | "rotatedAt" | "replacedByTokenHash"> & {
+    readonly tokenType: "access_token";
+};
+export type OAuthProviderModeAccessTokenVerificationResult = {
+    readonly valid: true;
+    readonly record: OAuthProviderModeActiveAccessTokenRecord;
+    readonly client: OAuthClientRecord;
+    readonly subject: string;
+    readonly scopes: readonly string[];
+} | {
+    readonly valid: false;
+    readonly reason: OAuthProviderModeAccessTokenVerificationFailureReason;
+};
+export type OAuthProviderModeAccessTokenVerifierOperation = "verify";
+declare const OAuthProviderModeAccessTokenVerifierError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthProviderModeAccessTokenVerifierError";
+} & Readonly<A>;
+export declare class OAuthProviderModeAccessTokenVerifierError extends OAuthProviderModeAccessTokenVerifierError_base<{
+    readonly operation: OAuthProviderModeAccessTokenVerifierOperation;
+    readonly message: string;
+}> {
+}
+export interface OAuthProviderModeAccessTokenVerifierService {
+    readonly verify: (input: OAuthProviderModeAccessTokenVerifyInput) => Effect.Effect<OAuthProviderModeAccessTokenVerificationResult, OAuthProviderModeAccessTokenVerifierError>;
+}
+declare const OAuthProviderModeAccessTokenVerifier_base: Context.ServiceClass<OAuthProviderModeAccessTokenVerifier, "auth/OAuthProviderModeAccessTokenVerifier", OAuthProviderModeAccessTokenVerifierService>;
+export declare class OAuthProviderModeAccessTokenVerifier extends OAuthProviderModeAccessTokenVerifier_base {
+}
+export interface OAuthProviderModeAccessTokenVerifierDependencies {
+    readonly crypto: CryptoService;
+    readonly tokenStore: OAuthProviderModeTokenStoreService;
+    readonly clients: OAuthClientRegistryService;
 }
 export interface OAuthProviderTokenVaultRecord {
     readonly accountId: OAuthAccountId;
@@ -1152,9 +1133,6 @@ export interface OAuthProviderTokenVaultService {
 declare const OAuthProviderTokenVault_base: Context.ServiceClass<OAuthProviderTokenVault, "auth/OAuthProviderTokenVault", OAuthProviderTokenVaultService>;
 export declare class OAuthProviderTokenVault extends OAuthProviderTokenVault_base {
 }
-export declare namespace OAuthProviderTokenVault {
-    const make: (service: OAuthProviderTokenVaultService) => OAuthProviderTokenVaultService;
-}
 export interface OAuthProviderTokenLifecycleStoreInput {
     readonly accountId: OAuthAccountId;
     readonly userId: UserId;
@@ -1221,9 +1199,6 @@ export interface OAuthProviderTokenLifecycleService {
 declare const OAuthProviderTokenLifecycle_base: Context.ServiceClass<OAuthProviderTokenLifecycle, "auth/OAuthProviderTokenLifecycle", OAuthProviderTokenLifecycleService>;
 export declare class OAuthProviderTokenLifecycle extends OAuthProviderTokenLifecycle_base {
 }
-export declare namespace OAuthProviderTokenLifecycle {
-    const make: (service: OAuthProviderTokenLifecycleService) => OAuthProviderTokenLifecycleService;
-}
 export interface OAuthProviderTokenLifecycleDependencies {
     readonly tokenVault: OAuthProviderTokenVaultService;
     readonly encryptToken: (token: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<string>, unknown>;
@@ -1326,9 +1301,6 @@ export interface OidcIdTokenVerifierService {
 declare const OidcIdTokenVerifier_base: Context.ServiceClass<OidcIdTokenVerifier, "auth/OidcIdTokenVerifier", OidcIdTokenVerifierService>;
 export declare class OidcIdTokenVerifier extends OidcIdTokenVerifier_base {
 }
-export declare namespace OidcIdTokenVerifier {
-    const make: (service: OidcIdTokenVerifierService) => OidcIdTokenVerifierService;
-}
 export interface OidcIdTokenVerifierDependencies {
     readonly jwtVerifier: JwtVerifierService;
 }
@@ -1367,9 +1339,6 @@ export interface OAuthProfileNormalizerService {
 declare const OAuthProfileNormalizer_base: Context.ServiceClass<OAuthProfileNormalizer, "auth/OAuthProfileNormalizer", OAuthProfileNormalizerService>;
 export declare class OAuthProfileNormalizer extends OAuthProfileNormalizer_base {
 }
-export declare namespace OAuthProfileNormalizer {
-    const make: (service: OAuthProfileNormalizerService) => OAuthProfileNormalizerService;
-}
 export type OAuthTokenExchangeOperation = "token-request" | "refresh-token-request" | "revocation-request" | "decode-token-response" | "exchange-code";
 declare const OAuthTokenExchangeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthTokenExchangeError";
@@ -1386,18 +1355,12 @@ export interface OAuthTokenExchangeService {
 declare const OAuthTokenExchange_base: Context.ServiceClass<OAuthTokenExchange, "auth/OAuthTokenExchange", OAuthTokenExchangeService>;
 export declare class OAuthTokenExchange extends OAuthTokenExchange_base {
 }
-export declare namespace OAuthTokenExchange {
-    const make: (service: OAuthTokenExchangeService) => OAuthTokenExchangeService;
-}
 export interface OAuthTokenExchangeDependencies {
     readonly request: (request: OAuthTokenRequest) => Effect.Effect<unknown, OAuthTokenExchangeError>;
 }
 declare const OAuthProviders_base: Context.ServiceClass<OAuthProviders, "auth/OAuthProviders", OAuthProvidersService>;
 export declare class OAuthProviders extends OAuthProviders_base {
 }
-export declare namespace OAuthProviders {
-    const make: (service: OAuthProvidersService) => OAuthProvidersService;
-}
 export interface OAuthPkce {
     readonly codeVerifier: Redacted.Redacted<OAuthCodeVerifier>;
     readonly codeChallenge: OAuthCodeChallenge;
@@ -1473,9 +1436,6 @@ export interface OAuthStateService {
 declare const OAuthState_base: Context.ServiceClass<OAuthState, "auth/OAuthState", OAuthStateService>;
 export declare class OAuthState extends OAuthState_base {
 }
-export declare namespace OAuthState {
-    const make: (service: OAuthStateService) => OAuthStateService;
-}
 export interface OAuthAccountRecord {
     readonly id: OAuthAccountId;
     readonly providerId: OAuthProviderId;
@@ -1527,12 +1487,41 @@ export interface OAuthAccountStoreService {
     readonly listByUser: (input: OAuthAccountListByUserInput) => Effect.Effect<readonly OAuthAccountRecord[], OAuthAccountStoreError>;
     readonly unlink: (input: OAuthAccountUnlinkInput) => Effect.Effect<OptionTypes.Option<OAuthAccountRecord>, OAuthAccountStoreError>;
 }
+export type OAuthIdentityBridgeConflictReason = "user-id" | "identity-id" | "identity-value" | "oauth-account-id" | "provider-account";
+declare const OAuthIdentityBridgeConflictError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthIdentityBridgeConflictError";
+} & Readonly<A>;
+export declare class OAuthIdentityBridgeConflictError extends OAuthIdentityBridgeConflictError_base<{
+    readonly reason: OAuthIdentityBridgeConflictReason;
+}> {
+}
+declare const OAuthIdentityBridgeStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthIdentityBridgeStoreError";
+} & Readonly<A>;
+export declare class OAuthIdentityBridgeStoreError extends OAuthIdentityBridgeStoreError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthIdentityBridgeCreateInput {
+    readonly user: NewUserRow;
+    readonly identity?: NewUserIdentityRow;
+    readonly account: OAuthAccountRecord;
+}
+export interface OAuthIdentityBridgeCreateResult {
+    readonly user: UserRow;
+    readonly identity?: UserIdentityRow;
+    readonly account: OAuthAccountRecord;
+}
+export interface OAuthIdentityBridgeStoreService {
+    readonly create: (input: OAuthIdentityBridgeCreateInput) => Effect.Effect<OAuthIdentityBridgeCreateResult, OAuthIdentityBridgeConflictError | OAuthIdentityBridgeStoreError>;
+}
+declare const OAuthIdentityBridgeStore_base: Context.ServiceClass<OAuthIdentityBridgeStore, "auth/OAuthIdentityBridgeStore", OAuthIdentityBridgeStoreService>;
+export declare class OAuthIdentityBridgeStore extends OAuthIdentityBridgeStore_base {
+}
 declare const OAuthAccountStore_base: Context.ServiceClass<OAuthAccountStore, "auth/OAuthAccountStore", OAuthAccountStoreService>;
 export declare class OAuthAccountStore extends OAuthAccountStore_base {
 }
-export declare namespace OAuthAccountStore {
-    const make: (service: OAuthAccountStoreService) => OAuthAccountStoreService;
-}
 export interface OAuthAccountLinkingResolveInput {
     readonly identity: VerifiedOAuthIdentity;
     readonly currentUserId?: UserId;
@@ -1576,15 +1565,69 @@ export interface OAuthAccountLinkingService {
 declare const OAuthAccountLinking_base: Context.ServiceClass<OAuthAccountLinking, "auth/OAuthAccountLinking", OAuthAccountLinkingService>;
 export declare class OAuthAccountLinking extends OAuthAccountLinking_base {
 }
-export declare namespace OAuthAccountLinking {
-    const make: (service: OAuthAccountLinkingService) => OAuthAccountLinkingService;
-}
 export interface OAuthAccountLinkingPolicyOptions {
     readonly autoLinkVerifiedEmail?: boolean;
 }
 export interface OAuthAccountLinkingPolicyDependencies extends OAuthAccountLinkingPolicyOptions {
     readonly accounts: OAuthAccountStoreService;
 }
+export interface OAuthIdentityBridgePolicyInput {
+    readonly identity: VerifiedOAuthIdentity;
+    readonly currentUserId?: UserId;
+}
+export type OAuthIdentityBridgePolicyDecision = {
+    readonly type: "allow";
+    readonly createUser: boolean;
+    readonly trustVerifiedEmail?: boolean;
+    readonly createEmailIdentity?: boolean;
+} | {
+    readonly type: "deny";
+    readonly reason: string;
+};
+export interface OAuthIdentityBridgePolicyService {
+    readonly decide: (input: OAuthIdentityBridgePolicyInput) => Effect.Effect<OAuthIdentityBridgePolicyDecision, OAuthIdentityBridgeError>;
+}
+declare const OAuthIdentityBridgePolicy_base: Context.ServiceClass<OAuthIdentityBridgePolicy, "auth/OAuthIdentityBridgePolicy", OAuthIdentityBridgePolicyService>;
+export declare class OAuthIdentityBridgePolicy extends OAuthIdentityBridgePolicy_base {
+}
+export interface OAuthIdentityBridgeResolveInput {
+    readonly identity: VerifiedOAuthIdentity;
+    readonly currentUserId?: UserId;
+    readonly makeUser: () => NewUserRow;
+    readonly makeAccount: (userId: UserId) => OAuthAccountRecord;
+    readonly makeEmailIdentity: (userId: UserId, email: Email, normalizedEmail: Email) => NewUserIdentityRow;
+}
+export type OAuthIdentityBridgeResolution = OAuthAccountLinkingResolution | {
+    readonly type: "created";
+    readonly reason: "new-provider-account";
+    readonly user: UserRow;
+    readonly identity?: UserIdentityRow;
+    readonly account: OAuthAccountRecord;
+} | {
+    readonly type: "deny";
+    readonly reason: string;
+    readonly identity: VerifiedOAuthIdentity;
+};
+declare const OAuthIdentityBridgeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthIdentityBridgeError";
+} & Readonly<A>;
+export declare class OAuthIdentityBridgeError extends OAuthIdentityBridgeError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface OAuthIdentityBridgeService {
+    readonly resolve: (input: OAuthIdentityBridgeResolveInput) => Effect.Effect<OAuthIdentityBridgeResolution, OAuthIdentityBridgeError>;
+}
+declare const OAuthIdentityBridge_base: Context.ServiceClass<OAuthIdentityBridge, "auth/OAuthIdentityBridge", OAuthIdentityBridgeService>;
+export declare class OAuthIdentityBridge extends OAuthIdentityBridge_base {
+}
+export interface OAuthIdentityBridgeDependencies {
+    readonly linking: OAuthAccountLinkingService;
+    readonly identities: IdentityStoreService;
+    readonly store: OAuthIdentityBridgeStoreService;
+    readonly policy: OAuthIdentityBridgePolicyService;
+}
 export interface OAuthAccountUnlinkingResolveInput {
     readonly userId: UserId;
     readonly providerId: OAuthProviderId;
@@ -1636,9 +1679,6 @@ export interface OAuthAccountUnlinkingService {
 declare const OAuthAccountUnlinking_base: Context.ServiceClass<OAuthAccountUnlinking, "auth/OAuthAccountUnlinking", OAuthAccountUnlinkingService>;
 export declare class OAuthAccountUnlinking extends OAuthAccountUnlinking_base {
 }
-export declare namespace OAuthAccountUnlinking {
-    const make: (service: OAuthAccountUnlinkingService) => OAuthAccountUnlinkingService;
-}
 export interface OAuthAccountUnlinkingPolicyOptions {
     readonly allowLastAccount?: boolean;
     readonly requireStepUp?: boolean;
@@ -1709,9 +1749,6 @@ export interface OAuthLinkConfirmationService {
 declare const OAuthLinkConfirmation_base: Context.ServiceClass<OAuthLinkConfirmation, "auth/OAuthLinkConfirmation", OAuthLinkConfirmationService>;
 export declare class OAuthLinkConfirmation extends OAuthLinkConfirmation_base {
 }
-export declare namespace OAuthLinkConfirmation {
-    const make: (service: OAuthLinkConfirmationService) => OAuthLinkConfirmationService;
-}
 export interface OAuthLinkConfirmationDependencies {
     readonly challenge: ChallengeService;
     readonly accounts: OAuthAccountStoreService;
@@ -1825,6 +1862,8 @@ export declare const revokeOAuthProviderTokens: (input: OAuthProviderTokenLifecy
 export declare const completeOAuthCallback: (input: OAuthCallbackInput) => Effect.Effect<OAuthCallbackResult, OAuthStateError | OAuthTokenExchangeError, OAuthState | OAuthTokenExchange>;
 export declare const makeOAuthAccountLinkingPolicy: (dependencies: OAuthAccountLinkingPolicyDependencies) => OAuthAccountLinkingService;
 export declare const resolveOAuthAccountLinking: (input: OAuthAccountLinkingResolveInput) => Effect.Effect<OAuthAccountLinkingResolution, OAuthAccountLinkingError, OAuthAccountLinking>;
+export declare const makeOAuthIdentityBridge: (dependencies: OAuthIdentityBridgeDependencies) => OAuthIdentityBridgeService;
+export declare const resolveOAuthIdentityBridge: (input: OAuthIdentityBridgeResolveInput) => Effect.Effect<OAuthIdentityBridgeResolution, OAuthIdentityBridgeError, OAuthIdentityBridge>;
 export declare const makeOAuthAccountUnlinkingPolicy: (dependencies: OAuthAccountUnlinkingPolicyDependencies) => OAuthAccountUnlinkingService;
 export declare const resolveOAuthAccountUnlinking: (input: OAuthAccountUnlinkingResolveInput) => Effect.Effect<OAuthAccountUnlinkingResolution, OAuthAccountUnlinkingError, OAuthAccountUnlinking>;
 export declare const makeOAuthLinkConfirmation: (dependencies: OAuthLinkConfirmationDependencies) => OAuthLinkConfirmationService;
@@ -1836,6 +1875,7 @@ export declare const makeOAuthAuthorizationCodeTokenGrant: (dependencies: OAuthA
 export declare const makeOAuthRefreshTokenGrant: (dependencies: OAuthRefreshTokenGrantDependencies) => OAuthRefreshTokenGrantService;
 export declare const makeOAuthClientCredentialsGrant: (dependencies: OAuthClientCredentialsGrantDependencies) => OAuthClientCredentialsGrantService;
 export declare const makeOAuthProviderModeOpaqueTokenIssuer: (dependencies: OAuthProviderModeOpaqueTokenIssuerDependencies) => OAuthProviderModeOpaqueTokenIssuerServices;
+export declare const makeOAuthProviderModeAccessTokenVerifier: (dependencies: OAuthProviderModeAccessTokenVerifierDependencies) => OAuthProviderModeAccessTokenVerifierService;
 export declare const makeOAuthClientSecretVerification: (dependencies: OAuthClientSecretVerificationDependencies) => OAuthClientSecretVerificationService;
 export declare const makeOAuthTokenRevocation: (dependencies: OAuthTokenRevocationDependencies) => OAuthTokenRevocationService;
 export declare const makeOAuthTokenIntrospection: (dependencies: OAuthTokenIntrospectionDependencies) => OAuthTokenIntrospectionService;
@@ -1847,6 +1887,7 @@ export declare const exchangeOAuthRefreshToken: (input: OAuthRefreshTokenGrantIn
 export declare const exchangeOAuthClientCredentialsToken: (input: OAuthClientCredentialsGrantInput) => Effect.Effect<OAuthClientCredentialsGrantResult, OAuthClientCredentialsGrantError, OAuthClientCredentialsGrant>;
 export declare const revokeOAuthToken: (input: OAuthTokenRevocationRequestInput) => Effect.Effect<OAuthTokenRevocationResult, OAuthTokenRevocationError, OAuthTokenRevocation>;
 export declare const introspectOAuthToken: (input: OAuthTokenIntrospectionRequestInput) => Effect.Effect<OAuthTokenIntrospectionResult, OAuthTokenIntrospectionError, OAuthTokenIntrospection>;
+export declare const verifyOAuthProviderModeAccessToken: (input: OAuthProviderModeAccessTokenVerifyInput) => Effect.Effect<OAuthProviderModeAccessTokenVerificationResult, OAuthProviderModeAccessTokenVerifierError, OAuthProviderModeAccessTokenVerifier>;
 export declare const authorizeOAuthProviderAuthorization: (input: OAuthProviderAuthorizationInput) => Effect.Effect<OAuthProviderAuthorizationResult, OAuthProviderAuthorizationError, OAuthProviderAuthorization>;
 export declare const makeOAuthPkce: (input?: OAuthPkceInput) => Effect.Effect<OAuthPkce, OAuthStateError, Crypto>;
 export declare const makeOAuthState: (dependencies: OAuthStateDependencies) => OAuthStateService;
@@ -1856,6 +1897,7 @@ export declare const OAuthAuthorizationCodeTokenGrantLive: Layer.Layer<OAuthAuth
 export declare const OAuthRefreshTokenGrantLive: Layer.Layer<OAuthRefreshTokenGrant, never, OAuthClientRegistry | OAuthRefreshTokenIssuer>;
 export declare const OAuthClientCredentialsGrantLive: Layer.Layer<OAuthClientCredentialsGrant, never, OAuthClientCredentialsTokenIssuer | OAuthClientRegistry>;
 export declare const OAuthProviderModeOpaqueTokenIssuerLive: (options?: OAuthProviderModeOpaqueTokenIssuerLiveOptions) => Layer.Layer<OAuthAuthorizationCodeTokenIssuer | OAuthClientCredentialsTokenIssuer | OAuthRefreshTokenIssuer, never, Crypto | OAuthProviderModeTokenStore>;
+export declare const OAuthProviderModeAccessTokenVerifierLive: Layer.Layer<OAuthProviderModeAccessTokenVerifier, never, Crypto | OAuthClientRegistry | OAuthProviderModeTokenStore>;
 export declare const OAuthTokenRevocationLive: Layer.Layer<OAuthTokenRevocation, never, OAuthClientRegistry | OAuthTokenRevoker>;
 export declare const OAuthTokenIntrospectionLive: Layer.Layer<OAuthTokenIntrospection, never, OAuthClientRegistry | OAuthTokenIntrospector>;
 export declare const OAuthProviderAuthorizationLive: Layer.Layer<OAuthProviderAuthorization, never, OAuthAuthorizationCodeGrant | OAuthClientRegistry | OAuthProviderAuthorizationPolicy>;