@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/OAuth.js

@@ -2,6 +2,7 @@ import { Brand, Context, Data, Duration, Effect, Encoding, Layer, Option, Redact
 import { Challenge } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
 import { ChallengeId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, UnixMillis, UserId, } from "./Identifiers.js";
+import { globalIdentityScope, normalizeEmail } from "./Identity.js";
 import { currentUnixMillis } from "./Internal.js";
 import { JwtAlgorithms, JwtError, JwtKeyId, JwtKeys, JwtVerifier, } from "./Jwt.js";
 export const OAuthStateToken = Brand.nominal();
@@ -61,7 +62,11 @@ export const googleOidcOfflineAccessAuthorizationParams = {
 export const microsoftOidcProviderId = OAuthProviderId("microsoft");
 export const microsoftOidcLoginBaseUrl = "https://login.microsoftonline.com";
 export const microsoftOidcUserInfoEndpoint = "https://graph.microsoft.com/oidc/userinfo";
-export const microsoftOidcDefaultScopes = ["openid", "email", "profile"];
+export const microsoftOidcDefaultScopes = [
+    "openid",
+    "email",
+    "profile",
+];
 export const microsoftOidcOfflineAccessScopes = [
     "openid",
     "email",
@@ -85,226 +90,146 @@ export class OAuthClientRegistryError extends Data.TaggedError("OAuthClientRegis
 }
 export class OAuthClientRegistry extends Context.Service()("auth/OAuthClientRegistry") {
 }
-(function (OAuthClientRegistry) {
-    OAuthClientRegistry.make = (service) => OAuthClientRegistry.of(service);
-})(OAuthClientRegistry || (OAuthClientRegistry = {}));
 export class OAuthClientStoreError extends Data.TaggedError("OAuthClientStoreError") {
 }
 export class OAuthClientStore extends Context.Service()("auth/OAuthClientStore") {
 }
-(function (OAuthClientStore) {
-    OAuthClientStore.make = (service) => OAuthClientStore.of(service);
-})(OAuthClientStore || (OAuthClientStore = {}));
 export class OAuthConsentStoreError extends Data.TaggedError("OAuthConsentStoreError") {
 }
 export class OAuthConsentStore extends Context.Service()("auth/OAuthConsentStore") {
 }
-(function (OAuthConsentStore) {
-    OAuthConsentStore.make = (service) => OAuthConsentStore.of(service);
-})(OAuthConsentStore || (OAuthConsentStore = {}));
 export class OAuthClientSecretError extends Data.TaggedError("OAuthClientSecretError") {
 }
 export class OAuthClientSecrets extends Context.Service()("auth/OAuthClientSecrets") {
 }
-(function (OAuthClientSecrets) {
-    OAuthClientSecrets.make = (service) => OAuthClientSecrets.of(service);
-})(OAuthClientSecrets || (OAuthClientSecrets = {}));
 export class OAuthClientSecretStoreError extends Data.TaggedError("OAuthClientSecretStoreError") {
 }
 export class OAuthClientSecretStore extends Context.Service()("auth/OAuthClientSecretStore") {
 }
-(function (OAuthClientSecretStore) {
-    OAuthClientSecretStore.make = (service) => OAuthClientSecretStore.of(service);
-})(OAuthClientSecretStore || (OAuthClientSecretStore = {}));
 export class OAuthClientSecretVerificationError extends Data.TaggedError("OAuthClientSecretVerificationError") {
 }
 export class OAuthClientSecretVerification extends Context.Service()("auth/OAuthClientSecretVerification") {
 }
-(function (OAuthClientSecretVerification) {
-    OAuthClientSecretVerification.make = (service) => OAuthClientSecretVerification.of(service);
-})(OAuthClientSecretVerification || (OAuthClientSecretVerification = {}));
 export class OAuthAuthorizationCodeStoreError extends Data.TaggedError("OAuthAuthorizationCodeStoreError") {
 }
 export class OAuthAuthorizationCodeStore extends Context.Service()("auth/OAuthAuthorizationCodeStore") {
 }
-(function (OAuthAuthorizationCodeStore) {
-    OAuthAuthorizationCodeStore.make = (service) => OAuthAuthorizationCodeStore.of(service);
-})(OAuthAuthorizationCodeStore || (OAuthAuthorizationCodeStore = {}));
 export class OAuthAuthorizationCodeGrantError extends Data.TaggedError("OAuthAuthorizationCodeGrantError") {
 }
 export class OAuthAuthorizationCodeGrant extends Context.Service()("auth/OAuthAuthorizationCodeGrant") {
 }
-(function (OAuthAuthorizationCodeGrant) {
-    OAuthAuthorizationCodeGrant.make = (service) => OAuthAuthorizationCodeGrant.of(service);
-})(OAuthAuthorizationCodeGrant || (OAuthAuthorizationCodeGrant = {}));
 export class OAuthAuthorizationCodeTokenIssuerError extends Data.TaggedError("OAuthAuthorizationCodeTokenIssuerError") {
 }
 export class OAuthAuthorizationCodeTokenIssuer extends Context.Service()("auth/OAuthAuthorizationCodeTokenIssuer") {
 }
-(function (OAuthAuthorizationCodeTokenIssuer) {
-    OAuthAuthorizationCodeTokenIssuer.make = (service) => OAuthAuthorizationCodeTokenIssuer.of(service);
-})(OAuthAuthorizationCodeTokenIssuer || (OAuthAuthorizationCodeTokenIssuer = {}));
 export class OAuthAuthorizationCodeTokenGrantError extends Data.TaggedError("OAuthAuthorizationCodeTokenGrantError") {
 }
 export class OAuthAuthorizationCodeTokenGrant extends Context.Service()("auth/OAuthAuthorizationCodeTokenGrant") {
 }
-(function (OAuthAuthorizationCodeTokenGrant) {
-    OAuthAuthorizationCodeTokenGrant.make = (service) => OAuthAuthorizationCodeTokenGrant.of(service);
-})(OAuthAuthorizationCodeTokenGrant || (OAuthAuthorizationCodeTokenGrant = {}));
 export class OAuthRefreshTokenIssuerError extends Data.TaggedError("OAuthRefreshTokenIssuerError") {
 }
 export class OAuthRefreshTokenIssuer extends Context.Service()("auth/OAuthRefreshTokenIssuer") {
 }
-(function (OAuthRefreshTokenIssuer) {
-    OAuthRefreshTokenIssuer.make = (service) => OAuthRefreshTokenIssuer.of(service);
-})(OAuthRefreshTokenIssuer || (OAuthRefreshTokenIssuer = {}));
 export class OAuthRefreshTokenGrantError extends Data.TaggedError("OAuthRefreshTokenGrantError") {
 }
 export class OAuthRefreshTokenGrant extends Context.Service()("auth/OAuthRefreshTokenGrant") {
 }
-(function (OAuthRefreshTokenGrant) {
-    OAuthRefreshTokenGrant.make = (service) => OAuthRefreshTokenGrant.of(service);
-})(OAuthRefreshTokenGrant || (OAuthRefreshTokenGrant = {}));
 export class OAuthClientCredentialsTokenIssuerError extends Data.TaggedError("OAuthClientCredentialsTokenIssuerError") {
 }
 export class OAuthClientCredentialsTokenIssuer extends Context.Service()("auth/OAuthClientCredentialsTokenIssuer") {
 }
-(function (OAuthClientCredentialsTokenIssuer) {
-    OAuthClientCredentialsTokenIssuer.make = (service) => OAuthClientCredentialsTokenIssuer.of(service);
-})(OAuthClientCredentialsTokenIssuer || (OAuthClientCredentialsTokenIssuer = {}));
 export class OAuthClientCredentialsGrantError extends Data.TaggedError("OAuthClientCredentialsGrantError") {
 }
 export class OAuthClientCredentialsGrant extends Context.Service()("auth/OAuthClientCredentialsGrant") {
 }
-(function (OAuthClientCredentialsGrant) {
-    OAuthClientCredentialsGrant.make = (service) => OAuthClientCredentialsGrant.of(service);
-})(OAuthClientCredentialsGrant || (OAuthClientCredentialsGrant = {}));
 export class OAuthTokenRevokerError extends Data.TaggedError("OAuthTokenRevokerError") {
 }
 export class OAuthTokenRevoker extends Context.Service()("auth/OAuthTokenRevoker") {
 }
-(function (OAuthTokenRevoker) {
-    OAuthTokenRevoker.make = (service) => OAuthTokenRevoker.of(service);
-})(OAuthTokenRevoker || (OAuthTokenRevoker = {}));
 export class OAuthTokenRevocationError extends Data.TaggedError("OAuthTokenRevocationError") {
 }
 export class OAuthTokenRevocation extends Context.Service()("auth/OAuthTokenRevocation") {
 }
-(function (OAuthTokenRevocation) {
-    OAuthTokenRevocation.make = (service) => OAuthTokenRevocation.of(service);
-})(OAuthTokenRevocation || (OAuthTokenRevocation = {}));
 export class OAuthTokenIntrospectorError extends Data.TaggedError("OAuthTokenIntrospectorError") {
 }
 export class OAuthTokenIntrospector extends Context.Service()("auth/OAuthTokenIntrospector") {
 }
-(function (OAuthTokenIntrospector) {
-    OAuthTokenIntrospector.make = (service) => OAuthTokenIntrospector.of(service);
-})(OAuthTokenIntrospector || (OAuthTokenIntrospector = {}));
 export class OAuthTokenIntrospectionError extends Data.TaggedError("OAuthTokenIntrospectionError") {
 }
 export class OAuthTokenIntrospection extends Context.Service()("auth/OAuthTokenIntrospection") {
 }
-(function (OAuthTokenIntrospection) {
-    OAuthTokenIntrospection.make = (service) => OAuthTokenIntrospection.of(service);
-})(OAuthTokenIntrospection || (OAuthTokenIntrospection = {}));
 export class OAuthProviderAuthorizationPolicyError extends Data.TaggedError("OAuthProviderAuthorizationPolicyError") {
 }
 export class OAuthProviderAuthorizationPolicy extends Context.Service()("auth/OAuthProviderAuthorizationPolicy") {
 }
-(function (OAuthProviderAuthorizationPolicy) {
-    OAuthProviderAuthorizationPolicy.make = (service) => OAuthProviderAuthorizationPolicy.of(service);
-})(OAuthProviderAuthorizationPolicy || (OAuthProviderAuthorizationPolicy = {}));
 export class OAuthProviderAuthorizationError extends Data.TaggedError("OAuthProviderAuthorizationError") {
 }
 export class OAuthProviderAuthorization extends Context.Service()("auth/OAuthProviderAuthorization") {
 }
-(function (OAuthProviderAuthorization) {
-    OAuthProviderAuthorization.make = (service) => OAuthProviderAuthorization.of(service);
-})(OAuthProviderAuthorization || (OAuthProviderAuthorization = {}));
 export class OAuthUserInfoError extends Data.TaggedError("OAuthUserInfoError") {
 }
 export class OAuthProviderModeTokenStoreError extends Data.TaggedError("OAuthProviderModeTokenStoreError") {
 }
 export class OAuthProviderModeTokenStore extends Context.Service()("auth/OAuthProviderModeTokenStore") {
 }
-(function (OAuthProviderModeTokenStore) {
-    OAuthProviderModeTokenStore.make = (service) => OAuthProviderModeTokenStore.of(service);
-})(OAuthProviderModeTokenStore || (OAuthProviderModeTokenStore = {}));
+export class OAuthProviderModeAccessTokenVerifierError extends Data.TaggedError("OAuthProviderModeAccessTokenVerifierError") {
+}
+export class OAuthProviderModeAccessTokenVerifier extends Context.Service()("auth/OAuthProviderModeAccessTokenVerifier") {
+}
 export class OAuthProviderTokenVaultError extends Data.TaggedError("OAuthProviderTokenVaultError") {
 }
 export class OAuthProviderTokenVault extends Context.Service()("auth/OAuthProviderTokenVault") {
 }
-(function (OAuthProviderTokenVault) {
-    OAuthProviderTokenVault.make = (service) => OAuthProviderTokenVault.of(service);
-})(OAuthProviderTokenVault || (OAuthProviderTokenVault = {}));
 export class OAuthProviderTokenLifecycleError extends Data.TaggedError("OAuthProviderTokenLifecycleError") {
 }
 export class OAuthProviderTokenLifecycle extends Context.Service()("auth/OAuthProviderTokenLifecycle") {
 }
-(function (OAuthProviderTokenLifecycle) {
-    OAuthProviderTokenLifecycle.make = (service) => OAuthProviderTokenLifecycle.of(service);
-})(OAuthProviderTokenLifecycle || (OAuthProviderTokenLifecycle = {}));
 export class OidcIdTokenVerifierError extends Data.TaggedError("OidcIdTokenVerifierError") {
 }
 export class OidcIdTokenVerifier extends Context.Service()("auth/OidcIdTokenVerifier") {
 }
-(function (OidcIdTokenVerifier) {
-    OidcIdTokenVerifier.make = (service) => OidcIdTokenVerifier.of(service);
-})(OidcIdTokenVerifier || (OidcIdTokenVerifier = {}));
 export class OAuthProfileNormalizationError extends Data.TaggedError("OAuthProfileNormalizationError") {
 }
 export class OAuthProfileNormalizer extends Context.Service()("auth/OAuthProfileNormalizer") {
 }
-(function (OAuthProfileNormalizer) {
-    OAuthProfileNormalizer.make = (service) => OAuthProfileNormalizer.of(service);
-})(OAuthProfileNormalizer || (OAuthProfileNormalizer = {}));
 export class OAuthTokenExchangeError extends Data.TaggedError("OAuthTokenExchangeError") {
 }
 export class OAuthTokenExchange extends Context.Service()("auth/OAuthTokenExchange") {
 }
-(function (OAuthTokenExchange) {
-    OAuthTokenExchange.make = (service) => OAuthTokenExchange.of(service);
-})(OAuthTokenExchange || (OAuthTokenExchange = {}));
 export class OAuthProviders extends Context.Service()("auth/OAuthProviders") {
 }
-(function (OAuthProviders) {
-    OAuthProviders.make = (service) => OAuthProviders.of(service);
-})(OAuthProviders || (OAuthProviders = {}));
 export class OAuthStateError extends Data.TaggedError("OAuthStateError") {
 }
 export class OAuthState extends Context.Service()("auth/OAuthState") {
 }
-(function (OAuthState) {
-    OAuthState.make = (service) => OAuthState.of(service);
-})(OAuthState || (OAuthState = {}));
 export class OAuthAccountStoreError extends Data.TaggedError("OAuthAccountStoreError") {
 }
+export class OAuthIdentityBridgeConflictError extends Data.TaggedError("OAuthIdentityBridgeConflictError") {
+}
+export class OAuthIdentityBridgeStoreError extends Data.TaggedError("OAuthIdentityBridgeStoreError") {
+}
+export class OAuthIdentityBridgeStore extends Context.Service()("auth/OAuthIdentityBridgeStore") {
+}
 export class OAuthAccountStore extends Context.Service()("auth/OAuthAccountStore") {
 }
-(function (OAuthAccountStore) {
-    OAuthAccountStore.make = (service) => OAuthAccountStore.of(service);
-})(OAuthAccountStore || (OAuthAccountStore = {}));
 export class OAuthAccountLinkingError extends Data.TaggedError("OAuthAccountLinkingError") {
 }
 export class OAuthAccountLinking extends Context.Service()("auth/OAuthAccountLinking") {
 }
-(function (OAuthAccountLinking) {
-    OAuthAccountLinking.make = (service) => OAuthAccountLinking.of(service);
-})(OAuthAccountLinking || (OAuthAccountLinking = {}));
+export class OAuthIdentityBridgePolicy extends Context.Service()("auth/OAuthIdentityBridgePolicy") {
+}
+export class OAuthIdentityBridgeError extends Data.TaggedError("OAuthIdentityBridgeError") {
+}
+export class OAuthIdentityBridge extends Context.Service()("auth/OAuthIdentityBridge") {
+}
 export class OAuthAccountUnlinkingError extends Data.TaggedError("OAuthAccountUnlinkingError") {
 }
 export class OAuthAccountUnlinking extends Context.Service()("auth/OAuthAccountUnlinking") {
 }
-(function (OAuthAccountUnlinking) {
-    OAuthAccountUnlinking.make = (service) => OAuthAccountUnlinking.of(service);
-})(OAuthAccountUnlinking || (OAuthAccountUnlinking = {}));
 export class OAuthLinkConfirmationError extends Data.TaggedError("OAuthLinkConfirmationError") {
 }
 export class OAuthLinkConfirmation extends Context.Service()("auth/OAuthLinkConfirmation") {
 }
-(function (OAuthLinkConfirmation) {
-    OAuthLinkConfirmation.make = (service) => OAuthLinkConfirmation.of(service);
-})(OAuthLinkConfirmation || (OAuthLinkConfirmation = {}));
 const oauthStateError = (operation, message, cause) => new OAuthStateError({ operation, message, cause });
 const oauthAuthorizationCodeGrantError = (operation, message, cause) => new OAuthAuthorizationCodeGrantError({ operation, message, cause });
 const oauthAuthorizationCodeTokenGrantError = (operation, message, cause) => new OAuthAuthorizationCodeTokenGrantError({ operation, message, cause });
@@ -330,6 +255,10 @@ const oauthClientRegistryError = (operation, message, cause) => new OAuthClientR
     message,
     ...(cause === undefined ? {} : { cause }),
 });
+const oauthProviderModeAccessTokenVerifierError = (message) => new OAuthProviderModeAccessTokenVerifierError({
+    operation: "verify",
+    message,
+});
 const oauthClientSecretError = (operation, message, cause) => new OAuthClientSecretError({
     operation,
     message,
@@ -397,8 +326,10 @@ const parseOAuthClientSecretValue = (secret) => {
     }
     return Effect.succeed(OAuthClientSecretPrefix(parts[0]));
 };
-const hashOAuthClientSecretValue = (dependencies, secret, operation) => dependencies.crypto.digestSha256({ data: `oauth-client-secret:${secret}` }).pipe(Effect.map((hash) => OAuthClientSecretHash(`sha256:${hash}`)), Effect.mapError((cause) => oauthClientSecretError(operation, "Failed to hash OAuth client secret", cause)));
-export const makeOAuthClientSecrets = (dependencies) => OAuthClientSecrets.make({
+const hashOAuthClientSecretValue = (dependencies, secret, operation) => dependencies.crypto
+    .digestSha256({ data: `oauth-client-secret:${secret}` })
+    .pipe(Effect.map((hash) => OAuthClientSecretHash(`sha256:${hash}`)), Effect.mapError((cause) => oauthClientSecretError(operation, "Failed to hash OAuth client secret", cause)));
+export const makeOAuthClientSecrets = (dependencies) => OAuthClientSecrets.of({
     generate: Effect.fn("auth.oauth.client_secret.generate")(function* (input) {
         const prefixBytes = yield* validateOAuthClientSecretByteLength(input?.prefixBytes ?? defaultOAuthClientSecretPrefixBytes, "generate", "OAuth client secret prefix");
         const secretBytes = yield* validateOAuthClientSecretByteLength(input?.secretBytes ?? defaultOAuthClientSecretBytes, "generate", "OAuth client secret");
@@ -446,7 +377,9 @@ export const makeAppleSignInProvider = (input) => ({
         ...appleSignInDefaultAuthorizationParams,
         ...input.authorizationParams,
     },
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 export const makeGithubOAuthProvider = (input) => ({
     id: input.id ?? githubOAuthProviderId,
@@ -459,7 +392,9 @@ export const makeGithubOAuthProvider = (input) => ({
     ...(input.authorizationParams === undefined
         ? {}
         : { authorizationParams: { ...input.authorizationParams } }),
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 export const makeGoogleOidcProvider = (input) => ({
     id: input.id ?? googleOidcProviderId,
@@ -475,7 +410,9 @@ export const makeGoogleOidcProvider = (input) => ({
     ...(input.authorizationParams === undefined
         ? {}
         : { authorizationParams: { ...input.authorizationParams } }),
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 export const makeMicrosoftOidcProvider = (input) => ({
     id: input.id ?? microsoftOidcProviderId,
@@ -490,7 +427,9 @@ export const makeMicrosoftOidcProvider = (input) => ({
     ...(input.authorizationParams === undefined
         ? {}
         : { authorizationParams: { ...input.authorizationParams } }),
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 export const makeGenericOidcProvider = (input) => ({
     id: input.id,
@@ -510,7 +449,9 @@ export const makeGenericOidcProvider = (input) => ({
     ...(input.authorizationParams === undefined
         ? {}
         : { authorizationParams: { ...input.authorizationParams } }),
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 const oauthClientSecretPost = (clientSecret) => ({
     method: "client_secret_post",
@@ -577,7 +518,9 @@ const cloneProviderConfig = (provider) => ({
     ...(provider.authorizationParams === undefined
         ? {}
         : { authorizationParams: { ...provider.authorizationParams } }),
-    ...(provider.metadata === undefined ? {} : { metadata: metadataValue(provider.metadata) }),
+    ...(provider.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(provider.metadata) }),
 });
 const cloneOAuthClientRecord = (client) => ({
     ...client,
@@ -587,7 +530,9 @@ const cloneOAuthClientRecord = (client) => ({
     ...(client.allowedScopes === undefined
         ? {}
         : { allowedScopes: [...client.allowedScopes] }),
-    ...(client.metadata === undefined ? {} : { metadata: metadataValue(client.metadata) }),
+    ...(client.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(client.metadata) }),
 });
 const validateOAuthClientRedirectUriRecord = (client, input) => {
     if (client === undefined) {
@@ -630,18 +575,24 @@ const isOAuthConsentActive = (record, now, scopes = []) => record.revokedAt ===
 const cloneOAuthClientSecretRecord = (record) => ({
     ...record,
     authenticationMethods: [...record.authenticationMethods],
-    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
 });
 const cloneAuthorizationCodeRecord = (record) => ({
     ...record,
     scopes: [...record.scopes],
-    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
 });
 const cloneOAuthTokenResponse = (tokens) => ({
     accessToken: tokens.accessToken,
     tokenType: tokens.tokenType,
     ...(tokens.expiresIn === undefined ? {} : { expiresIn: tokens.expiresIn }),
-    ...(tokens.refreshToken === undefined ? {} : { refreshToken: tokens.refreshToken }),
+    ...(tokens.refreshToken === undefined
+        ? {}
+        : { refreshToken: tokens.refreshToken }),
     ...(tokens.idToken === undefined ? {} : { idToken: tokens.idToken }),
     ...(tokens.scopes === undefined ? {} : { scopes: [...tokens.scopes] }),
     ...(tokens.extra === undefined ? {} : { extra: metadataValue(tokens.extra) }),
@@ -649,14 +600,30 @@ const cloneOAuthTokenResponse = (tokens) => ({
 const cloneOAuthTokenIntrospectionResponse = (response) => response.active
     ? {
         active: true,
-        ...(response.scopes === undefined ? {} : { scopes: [...response.scopes] }),
-        ...(response.clientId === undefined ? {} : { clientId: response.clientId }),
-        ...(response.username === undefined ? {} : { username: response.username }),
-        ...(response.tokenType === undefined ? {} : { tokenType: response.tokenType }),
-        ...(response.expiresAt === undefined ? {} : { expiresAt: response.expiresAt }),
-        ...(response.issuedAt === undefined ? {} : { issuedAt: response.issuedAt }),
-        ...(response.notBefore === undefined ? {} : { notBefore: response.notBefore }),
-        ...(response.subject === undefined ? {} : { subject: response.subject }),
+        ...(response.scopes === undefined
+            ? {}
+            : { scopes: [...response.scopes] }),
+        ...(response.clientId === undefined
+            ? {}
+            : { clientId: response.clientId }),
+        ...(response.username === undefined
+            ? {}
+            : { username: response.username }),
+        ...(response.tokenType === undefined
+            ? {}
+            : { tokenType: response.tokenType }),
+        ...(response.expiresAt === undefined
+            ? {}
+            : { expiresAt: response.expiresAt }),
+        ...(response.issuedAt === undefined
+            ? {}
+            : { issuedAt: response.issuedAt }),
+        ...(response.notBefore === undefined
+            ? {}
+            : { notBefore: response.notBefore }),
+        ...(response.subject === undefined
+            ? {}
+            : { subject: response.subject }),
         ...(response.audience === undefined
             ? {}
             : {
@@ -666,7 +633,9 @@ const cloneOAuthTokenIntrospectionResponse = (response) => response.active
             }),
         ...(response.issuer === undefined ? {} : { issuer: response.issuer }),
         ...(response.jwtId === undefined ? {} : { jwtId: response.jwtId }),
-        ...(response.extra === undefined ? {} : { extra: metadataValue(response.extra) }),
+        ...(response.extra === undefined
+            ? {}
+            : { extra: metadataValue(response.extra) }),
     }
     : { active: false };
 const cloneOAuthProviderModeTokenRecord = (record) => ({
@@ -679,7 +648,29 @@ const cloneOAuthProviderModeTokenRecord = (record) => ({
                 ? [...record.audience]
                 : record.audience,
         }),
-    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
+});
+const activeOAuthProviderModeAccessTokenRecord = (record) => ({
+    clientId: record.clientId,
+    subject: record.subject,
+    scopes: [...record.scopes],
+    issuedAt: record.issuedAt,
+    expiresAt: record.expiresAt,
+    tokenType: "access_token",
+    ...(record.issuer === undefined ? {} : { issuer: record.issuer }),
+    ...(record.audience === undefined
+        ? {}
+        : {
+            audience: Array.isArray(record.audience)
+                ? [...record.audience]
+                : record.audience,
+        }),
+    ...(record.jwtId === undefined ? {} : { jwtId: record.jwtId }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
 });
 const consumedAuthorizationCode = (record, consumedAt) => ({
     clientId: record.clientId,
@@ -695,7 +686,9 @@ const consumedAuthorizationCode = (record, consumedAt) => ({
     issuedAt: record.issuedAt,
     expiresAt: record.expiresAt,
     consumedAt,
-    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
 });
 const issuedAuthorizationCode = (input) => ({
     code: Redacted.make(input.code),
@@ -914,7 +907,9 @@ const oauthLinkConfirmationMetadata = (input) => ({
     userId: input.userId,
     providerId: input.identity.providerId,
     providerAccountId: input.identity.providerAccountId,
-    ...(input.identity.email === undefined ? {} : { email: input.identity.email }),
+    ...(input.identity.email === undefined
+        ? {}
+        : { email: input.identity.email }),
     ...(input.identity.emailVerified === undefined
         ? {}
         : { emailVerified: input.identity.emailVerified }),
@@ -922,7 +917,9 @@ const oauthLinkConfirmationMetadata = (input) => ({
         ? {}
         : { identityMetadata: metadataValue(input.identity.metadata) }),
     reason: input.reason,
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 const pendingOAuthLinkConfirmationFromChallenge = (challenge, operation) => {
     const metadata = challenge.metadata ?? {};
@@ -951,10 +948,11 @@ const pendingOAuthLinkConfirmationFromChallenge = (challenge, operation) => {
                 ? {}
                 : { metadata: metadataValue(identityMetadata) }),
         },
-        reason: stringFromUnknown(metadata.reason) ??
-            "manual",
+        reason: stringFromUnknown(metadata.reason) ?? "manual",
         expiresAt: challenge.expiresAt,
-        ...(appMetadata === undefined ? {} : { metadata: metadataValue(appMetadata) }),
+        ...(appMetadata === undefined
+            ? {}
+            : { metadata: metadataValue(appMetadata) }),
     });
 };
 const confirmedOAuthLinkConfirmationFromPending = (input) => ({
@@ -988,7 +986,9 @@ const makeOAuthProfile = (input) => ({
     ...(input.name === undefined ? {} : { name: input.name }),
     ...(input.username === undefined ? {} : { username: input.username }),
     ...(input.avatarUrl === undefined ? {} : { avatarUrl: input.avatarUrl }),
-    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+    ...(input.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.metadata) }),
 });
 const oauthJwksPublicJwkFromUnknown = (value) => {
     const record = recordFromUnknown(value);
@@ -1061,7 +1061,9 @@ const oauthJwksRecordsFromDocument = (provider, document, allowedAlgorithms) =>
         },
     }));
 });
-const oauthJwksKeyUsableAt = (key, now) => now === undefined || key.expiresAt === undefined || Number(now) < Number(key.expiresAt);
+const oauthJwksKeyUsableAt = (key, now) => now === undefined ||
+    key.expiresAt === undefined ||
+    Number(now) < Number(key.expiresAt);
 const oauthJwksVerificationKeyMatches = (key, input) => key.id === input.kid &&
     key.status !== "disabled" &&
     key.publicJwk !== undefined &&
@@ -1231,7 +1233,7 @@ export const decodeOAuthTokenResponse = (value) => Effect.gen(function* () {
         extra: tokenResponseExtra(value),
     };
 });
-export const makeOidcIdTokenVerifier = (dependencies) => OidcIdTokenVerifier.make({
+export const makeOidcIdTokenVerifier = (dependencies) => OidcIdTokenVerifier.of({
     verify: Effect.fn("auth.oidc_id_token.verify")(function* (input) {
         const { provider } = input;
         const { issuer } = provider;
@@ -1255,7 +1257,10 @@ export const makeOidcIdTokenVerifier = (dependencies) => OidcIdTokenVerifier.mak
         }
         const claims = oidcIdTokenClaims(verified.claims, input);
         if (typeof claims === "string") {
-            return { valid: false, reason: claims };
+            return {
+                valid: false,
+                reason: claims,
+            };
         }
         return {
             valid: true,
@@ -1305,7 +1310,7 @@ export const makeOAuthJwksJwtKeys = (dependencies) => {
         };
         return records;
     });
-    return JwtKeys.make({
+    return JwtKeys.of({
         selectSigningKey: () => Effect.succeed(Option.none()),
         findVerificationKey: Effect.fn("auth.oauth_jwks.find_verification_key")(function* (input) {
             const now = yield* oauthJwksNow(input.now);
@@ -1332,7 +1337,9 @@ export const normalizeOidcProfile = (input) => Effect.gen(function* () {
         return yield* oauthProfileNormalizationError("missing_subject", "OIDC profile is missing subject");
     }
     const userInfo = yield* userInfoRecord(input.userInfo);
-    const userInfoSubject = userInfo === undefined ? undefined : nonEmptyStringFromUnknown(userInfo.sub);
+    const userInfoSubject = userInfo === undefined
+        ? undefined
+        : nonEmptyStringFromUnknown(userInfo.sub);
     if (userInfoSubject !== undefined && userInfoSubject !== subject) {
         return yield* oauthProfileNormalizationError("subject_mismatch", "OIDC userinfo subject does not match ID token subject");
     }
@@ -1353,7 +1360,7 @@ export const normalizeOidcProfile = (input) => Effect.gen(function* () {
         metadata,
     });
 });
-export const makeOidcOAuthProfileNormalizer = () => OAuthProfileNormalizer.make({
+export const makeOidcOAuthProfileNormalizer = () => OAuthProfileNormalizer.of({
     normalize: Effect.fn("auth.oauth_profile.normalize_oidc")(normalizeOidcProfile),
 });
 export const normalizeOAuthProfile = (input) => OAuthProfileNormalizer.use((normalizer) => normalizer.normalize(input));
@@ -1361,7 +1368,9 @@ export const verifiedOAuthIdentityFromProfile = (profile) => {
     const metadata = optionalRecord({
         ...(profile.name === undefined ? {} : { name: profile.name }),
         ...(profile.username === undefined ? {} : { username: profile.username }),
-        ...(profile.avatarUrl === undefined ? {} : { avatarUrl: profile.avatarUrl }),
+        ...(profile.avatarUrl === undefined
+            ? {}
+            : { avatarUrl: profile.avatarUrl }),
         ...(profile.metadata === undefined ? {} : profile.metadata),
     });
     return {
@@ -1374,7 +1383,7 @@ export const verifiedOAuthIdentityFromProfile = (profile) => {
         ...(metadata === undefined ? {} : { metadata: metadataValue(metadata) }),
     };
 };
-export const makeOAuthTokenExchange = (dependencies) => OAuthTokenExchange.make({
+export const makeOAuthTokenExchange = (dependencies) => OAuthTokenExchange.of({
     exchangeAuthorizationCode: Effect.fn("auth.oauth_token.exchange_code")(function* (input) {
         const request = yield* makeOAuthTokenRequest(input);
         const response = yield* dependencies.request(request);
@@ -1413,9 +1422,13 @@ const storeOAuthProviderTokenResponse = (dependencies, input, operation) => Effe
         accessTokenCiphertext,
         tokenType: input.tokens.tokenType,
         updatedAt: now,
-        ...(refreshTokenCiphertext === undefined ? {} : { refreshTokenCiphertext }),
+        ...(refreshTokenCiphertext === undefined
+            ? {}
+            : { refreshTokenCiphertext }),
         ...(idTokenCiphertext === undefined ? {} : { idTokenCiphertext }),
-        ...(input.tokens.scopes === undefined ? {} : { scopes: input.tokens.scopes }),
+        ...(input.tokens.scopes === undefined
+            ? {}
+            : { scopes: input.tokens.scopes }),
         ...(expiresAt === undefined ? {} : { expiresAt }),
     })
         .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError(operation, "Failed to store OAuth provider token ciphertext", cause)));
@@ -1427,7 +1440,9 @@ const storeOAuthProviderTokenResponse = (dependencies, input, operation) => Effe
     };
 });
 const revokeOAuthProviderTokenCiphertext = (dependencies, input, tokenCiphertext, tokenTypeHint) => Effect.gen(function* () {
-    const token = yield* dependencies.decryptToken(tokenCiphertext).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", `Failed to decrypt OAuth provider ${tokenTypeHint}`, cause)));
+    const token = yield* dependencies
+        .decryptToken(tokenCiphertext)
+        .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", `Failed to decrypt OAuth provider ${tokenTypeHint}`, cause)));
     const request = yield* makeOAuthTokenRevocationRequest({
         provider: input.provider,
         token,
@@ -1437,9 +1452,11 @@ const revokeOAuthProviderTokenCiphertext = (dependencies, input, tokenCiphertext
             : { clientAuthentication: input.clientAuthentication }),
         ...(input.params === undefined ? {} : { params: input.params }),
     }).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to build OAuth provider token revocation request", cause)));
-    yield* dependencies.request(request).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to execute OAuth provider token revocation request", cause)));
+    yield* dependencies
+        .request(request)
+        .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("revoke", "Failed to execute OAuth provider token revocation request", cause)));
 });
-export const makeOAuthProviderTokenLifecycle = (dependencies) => OAuthProviderTokenLifecycle.make({
+export const makeOAuthProviderTokenLifecycle = (dependencies) => OAuthProviderTokenLifecycle.of({
     store: Effect.fn("auth.oauth_provider_token_lifecycle.store")(function* (input) {
         return yield* storeOAuthProviderTokenResponse(dependencies, input, "store");
     }),
@@ -1465,7 +1482,9 @@ export const makeOAuthProviderTokenLifecycle = (dependencies) => OAuthProviderTo
                 : { clientAuthentication: input.clientAuthentication }),
             ...(input.params === undefined ? {} : { params: input.params }),
         }).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to build OAuth provider token refresh request", cause)));
-        const rawResponse = yield* dependencies.request(request).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to execute OAuth provider token refresh request", cause)));
+        const rawResponse = yield* dependencies
+            .request(request)
+            .pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to execute OAuth provider token refresh request", cause)));
         const tokens = yield* decodeOAuthTokenResponse(rawResponse).pipe(Effect.mapError((cause) => oauthProviderTokenLifecycleError("refresh", "Failed to decode OAuth provider token refresh response", cause)));
         const stored = yield* storeOAuthProviderTokenResponse(dependencies, {
             accountId: input.accountId,
@@ -1531,13 +1550,15 @@ export const completeOAuthCallback = (input) => Effect.gen(function* () {
         provider: input.provider,
         code: input.code,
         codeVerifier: input.codeVerifier,
-        redirectUri: input.redirectUri ?? verifiedState.redirectUri ?? input.provider.redirectUri,
+        redirectUri: input.redirectUri ??
+            verifiedState.redirectUri ??
+            input.provider.redirectUri,
         clientAuthentication: input.clientAuthentication,
         params: input.tokenParams,
     });
     return { state: verifiedState, tokens };
 });
-export const makeOAuthAccountLinkingPolicy = (dependencies) => OAuthAccountLinking.make({
+export const makeOAuthAccountLinkingPolicy = (dependencies) => OAuthAccountLinking.of({
     resolve: Effect.fn("auth.oauth_account_linking.resolve")(function* (input) {
         const identity = cloneVerifiedOAuthIdentity(input.identity);
         const linked = yield* dependencies.accounts
@@ -1585,7 +1606,9 @@ export const makeOAuthAccountLinkingPolicy = (dependencies) => OAuthAccountLinki
             }
             return {
                 type: "require-explicit-linking",
-                reason: identity.emailVerified === true ? "matched-email" : "unverified-email",
+                reason: identity.emailVerified === true
+                    ? "matched-email"
+                    : "unverified-email",
                 identity,
                 matchedUserId: input.matchedUserId,
             };
@@ -1598,7 +1621,119 @@ export const makeOAuthAccountLinkingPolicy = (dependencies) => OAuthAccountLinki
     }),
 });
 export const resolveOAuthAccountLinking = (input) => OAuthAccountLinking.use((linking) => linking.resolve(input));
-export const makeOAuthAccountUnlinkingPolicy = (dependencies) => OAuthAccountUnlinking.make({
+export const makeOAuthIdentityBridge = (dependencies) => OAuthIdentityBridge.of({
+    resolve: Effect.fn("auth.oauth_identity_bridge.resolve")(function* (input) {
+        const identity = cloneVerifiedOAuthIdentity(input.identity);
+        const mapError = (message) => (cause) => new OAuthIdentityBridgeError({ message, cause });
+        const initial = yield* dependencies.linking
+            .resolve({ identity, currentUserId: input.currentUserId })
+            .pipe(Effect.mapError(mapError("Failed to resolve OAuth account")));
+        if (initial.type !== "require-explicit-linking") {
+            return initial;
+        }
+        const decision = yield* dependencies.policy.decide({
+            identity,
+            currentUserId: input.currentUserId,
+        });
+        if (decision.type === "deny") {
+            return { type: "deny", reason: decision.reason, identity };
+        }
+        const trustedVerifiedEmail = decision.trustVerifiedEmail === true &&
+            identity.emailVerified === true &&
+            identity.email !== undefined;
+        const normalizedEmail = trustedVerifiedEmail
+            ? yield* normalizeEmail(identity.email).pipe(Effect.mapError(mapError("Provider returned an invalid email claim")))
+            : undefined;
+        const matched = normalizedEmail === undefined
+            ? Option.none()
+            : yield* dependencies.identities
+                .findByKindAndNormalizedValue({
+                scope: globalIdentityScope,
+                kind: "email",
+                normalizedValue: normalizedEmail,
+            })
+                .pipe(Effect.mapError(mapError("Failed to resolve provider email")));
+        const linking = Option.isNone(matched)
+            ? initial
+            : yield* dependencies.linking
+                .resolve({
+                identity,
+                currentUserId: input.currentUserId,
+                matchedUserId: matched.value.userId,
+            })
+                .pipe(Effect.mapError(mapError("Failed to resolve OAuth linking")));
+        if (linking.type !== "require-explicit-linking") {
+            return linking;
+        }
+        if (Option.isSome(matched)) {
+            return linking;
+        }
+        if (!decision.createUser) {
+            return {
+                type: "deny",
+                reason: "user-creation-not-permitted",
+                identity,
+            };
+        }
+        const user = input.makeUser();
+        const account = input.makeAccount(user.id);
+        if (account.userId !== user.id) {
+            return yield* new OAuthIdentityBridgeError({
+                message: "OAuth account user does not match the new user",
+            });
+        }
+        const emailIdentity = decision.createEmailIdentity === true && normalizedEmail !== undefined
+            ? input.makeEmailIdentity(user.id, identity.email, normalizedEmail)
+            : undefined;
+        if (emailIdentity !== undefined && emailIdentity.userId !== user.id) {
+            return yield* new OAuthIdentityBridgeError({
+                message: "Email identity user does not match the new user",
+            });
+        }
+        const created = yield* dependencies.store
+            .create({ user, account, identity: emailIdentity })
+            .pipe(Effect.catchTag("OAuthIdentityBridgeConflictError", (conflict) => {
+            if (conflict.reason === "provider-account" ||
+                conflict.reason === "oauth-account-id") {
+                return dependencies.linking
+                    .resolve({ identity, currentUserId: input.currentUserId })
+                    .pipe(Effect.mapError(mapError("Failed to resolve OAuth race")));
+            }
+            if (conflict.reason === "identity-value") {
+                return dependencies.identities
+                    .findByKindAndNormalizedValue({
+                    scope: globalIdentityScope,
+                    kind: "email",
+                    normalizedValue: normalizedEmail,
+                })
+                    .pipe(Effect.mapError(mapError("Failed to resolve email collision")), Effect.map((collision) => ({
+                    type: "require-explicit-linking",
+                    reason: "matched-email",
+                    identity,
+                    ...(Option.isSome(collision)
+                        ? { matchedUserId: collision.value.userId }
+                        : {}),
+                })));
+            }
+            return Effect.fail(new OAuthIdentityBridgeError({
+                message: `OAuth identity creation conflicted on ${conflict.reason}`,
+                cause: conflict,
+            }));
+        }), Effect.mapError((cause) => cause instanceof OAuthIdentityBridgeError
+            ? cause
+            : mapError("Failed to create OAuth identity")(cause)));
+        if ("type" in created) {
+            return created;
+        }
+        return {
+            type: "created",
+            reason: "new-provider-account",
+            ...created,
+        };
+    }),
+});
+export const resolveOAuthIdentityBridge = (input) => OAuthIdentityBridge.use((bridge) => bridge.resolve(input));
+export const makeOAuthAccountUnlinkingPolicy = (dependencies) => OAuthAccountUnlinking.of({
     resolve: Effect.fn("auth.oauth_account_unlinking.resolve")(function* (input) {
         const account = yield* dependencies.accounts
             .findByProviderAccount({
@@ -1627,7 +1762,8 @@ export const makeOAuthAccountUnlinkingPolicy = (dependencies) => OAuthAccountUnl
         const remainingAccounts = yield* dependencies.accounts
             .listByUser({ userId: input.userId })
             .pipe(Effect.map((accounts) => accounts.filter((linked) => linked.id !== linkedAccount.id)), Effect.mapError((cause) => oauthAccountUnlinkingError("resolve", "Failed to list OAuth provider accounts for user", cause)));
-        if (dependencies.allowLastAccount !== true && remainingAccounts.length === 0) {
+        if (dependencies.allowLastAccount !== true &&
+            remainingAccounts.length === 0) {
             return {
                 type: "deny-last-account",
                 reason: "last-linked-account",
@@ -1635,7 +1771,8 @@ export const makeOAuthAccountUnlinkingPolicy = (dependencies) => OAuthAccountUnl
                 account: linkedAccount,
             };
         }
-        if (dependencies.requireStepUp === true && input.stepUpSatisfied !== true) {
+        if (dependencies.requireStepUp === true &&
+            input.stepUpSatisfied !== true) {
             return {
                 type: "requires-step-up",
                 reason: "step-up-required",
@@ -1668,7 +1805,7 @@ const findOAuthLinkConfirmationExistingAccount = (dependencies, input) => depend
     }
     return Effect.succeed(account);
 }));
-export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation.make({
+export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation.of({
     start: Effect.fn("auth.oauth_link_confirmation.start")(function* (input) {
         const identity = cloneVerifiedOAuthIdentity(input.identity);
         const reason = input.reason ?? "manual";
@@ -1682,7 +1819,8 @@ export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation
         }
         const secret = input.secret ??
             (yield* dependencies.crypto
-                .randomToken(yield* validateOAuthLinkConfirmationSecretBytes(dependencies.secretBytes ?? defaultOAuthLinkConfirmationSecretBytes))
+                .randomToken(yield* validateOAuthLinkConfirmationSecretBytes(dependencies.secretBytes ??
+                defaultOAuthLinkConfirmationSecretBytes))
                 .pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthLinkConfirmationError("start", "Failed to generate OAuth link confirmation secret", cause))));
         const issued = yield* dependencies.challenge
             .issue({
@@ -1735,7 +1873,8 @@ export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation
         })
             .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("confirm", "Invalid OAuth link confirmation challenge", cause)));
         const pending = yield* pendingOAuthLinkConfirmationFromChallenge(inspected, "confirm");
-        if (input.currentUserId !== undefined && input.currentUserId !== pending.userId) {
+        if (input.currentUserId !== undefined &&
+            input.currentUserId !== pending.userId) {
             return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation does not match current user");
         }
         if (input.expectedProviderId !== undefined &&
@@ -1760,7 +1899,9 @@ export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation
             .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("confirm", "Failed to consume OAuth link confirmation challenge", cause)));
         return confirmedOAuthLinkConfirmationFromPending({
             pending,
-            ...(Option.isSome(existing) ? { existingAccount: existing.value } : {}),
+            ...(Option.isSome(existing)
+                ? { existingAccount: existing.value }
+                : {}),
         });
     }),
 });
@@ -1784,7 +1925,9 @@ const makeOAuthPkceWithCrypto = (dependencies, input) => Effect.gen(function* ()
         codeChallengeMethod: "S256",
     };
 });
-const authorizationCodeHash = (crypto, code, operation) => crypto.digestSha256({ data: String(code) }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError(operation, "Failed to hash OAuth authorization code", cause)));
+const authorizationCodeHash = (crypto, code, operation) => crypto
+    .digestSha256({ data: String(code) })
+    .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError(operation, "Failed to hash OAuth authorization code", cause)));
 const pkceChallengeForVerifier = (crypto, verifier) => crypto.digestSha256({ data: Redacted.value(verifier) }).pipe(Effect.map(OAuthCodeChallenge), Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to calculate OAuth PKCE challenge", cause)));
 const timingSafeEqualString = (crypto, left, right) => crypto
     .timingSafeEqual({
@@ -1798,7 +1941,7 @@ const authorizationCodeExpiresAt = (input, issuedAt, defaultTtl) => input.expire
 export const makeOAuthAuthorizationCodeGrant = (dependencies) => {
     const codeBytes = dependencies.codeBytes ?? defaultOAuthAuthorizationCodeBytes;
     const codeTtl = dependencies.codeTtl ?? defaultOAuthAuthorizationCodeTtl;
-    return OAuthAuthorizationCodeGrant.make({
+    return OAuthAuthorizationCodeGrant.of({
         issue: Effect.fn("auth.oauth.authorization_code.issue")(function* (input) {
             const issuedAt = input.issuedAt ?? (yield* currentUnixMillis);
             const expiresAt = authorizationCodeExpiresAt(input, issuedAt, codeTtl);
@@ -1832,13 +1975,17 @@ export const makeOAuthAuthorizationCodeGrant = (dependencies) => {
                     ? {}
                     : { metadata: metadataValue(input.metadata) }),
             };
-            yield* dependencies.store.upsert(record).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("issue", "Failed to store OAuth authorization code", cause)));
+            yield* dependencies.store
+                .upsert(record)
+                .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("issue", "Failed to store OAuth authorization code", cause)));
             return issuedAuthorizationCode({ code, record });
         }),
         consume: Effect.fn("auth.oauth.authorization_code.consume")(function* (input) {
             const now = input.now ?? (yield* currentUnixMillis);
             const codeHash = yield* authorizationCodeHash(dependencies.crypto, authorizationCodeValue(input.code), "consume");
-            const recordOption = yield* dependencies.store.findByHash({ codeHash }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to load OAuth authorization code", cause)));
+            const recordOption = yield* dependencies.store
+                .findByHash({ codeHash })
+                .pipe(Effect.mapError((cause) => oauthAuthorizationCodeGrantError("consume", "Failed to load OAuth authorization code", cause)));
             if (Option.isNone(recordOption)) {
                 return { valid: false, reason: "unknown_code" };
             }
@@ -1893,7 +2040,7 @@ const oauthTokenGrantString = (value) => {
     return trimmed === undefined || trimmed === "" ? undefined : trimmed;
 };
 const oauthTokenGrantScopes = (scopes) => {
-    const values = typeof scopes === "string" ? scopes.split(/\s+/) : scopes ?? [];
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : (scopes ?? []);
     const unique = new Set();
     for (const value of values) {
         const scope = value.trim();
@@ -1903,17 +2050,24 @@ const oauthTokenGrantScopes = (scopes) => {
     }
     return [...unique];
 };
-const oauthTokenGrantScopesAllowed = (scopes, allowedScopes) => allowedScopes === undefined || scopes.every((scope) => allowedScopes.includes(scope));
+const oauthTokenGrantScopesAllowed = (scopes, allowedScopes) => allowedScopes === undefined ||
+    scopes.every((scope) => allowedScopes.includes(scope));
 const validateOAuthProviderModeOpaqueTokenBytes = (value, label, error) => Number.isInteger(value) && value >= 16 && value <= 128
     ? Effect.succeed(value)
     : Effect.fail(error(`${label} byte length must be an integer between 16 and 128`));
 const generateOAuthProviderModeOpaqueToken = (crypto, byteLength, brand, label, error) => Effect.gen(function* () {
     const validByteLength = yield* validateOAuthProviderModeOpaqueTokenBytes(byteLength, label, error);
-    const token = yield* crypto.randomToken(validByteLength).pipe(Effect.mapError((cause) => error(`Failed to generate OAuth ${label} token`, cause)));
+    const token = yield* crypto
+        .randomToken(validByteLength)
+        .pipe(Effect.mapError((cause) => error(`Failed to generate OAuth ${label} token`, cause)));
     return Redacted.make(brand(token));
 });
 const oauthProviderModeOpaqueTokenHash = (crypto, token, error) => crypto.digestSha256({ data: Redacted.value(token) }).pipe(Effect.map((digest) => `sha256:${digest}`), Effect.mapError((cause) => error("Failed to hash OAuth provider-mode token", cause)));
-const oauthProviderModeOpaqueTokenAudience = (audience) => audience === undefined ? undefined : Array.isArray(audience) ? [...audience] : audience;
+const oauthProviderModeOpaqueTokenAudience = (audience) => audience === undefined
+    ? undefined
+    : Array.isArray(audience)
+        ? [...audience]
+        : audience;
 const oauthProviderModeOpaqueTokenRecord = (dependencies, input) => ({
     tokenHash: input.tokenHash,
     tokenType: input.tokenType,
@@ -1925,10 +2079,12 @@ const oauthProviderModeOpaqueTokenRecord = (dependencies, input) => ({
     ...(dependencies.issuer === undefined ? {} : { issuer: dependencies.issuer }),
     ...(dependencies.audience === undefined
         ? {}
-        : { audience: oauthProviderModeOpaqueTokenAudience(dependencies.audience) }),
-    ...(dependencies.metadata === undefined
+        : {
+            audience: oauthProviderModeOpaqueTokenAudience(dependencies.audience),
+        }),
+    ...(input.metadata === undefined && dependencies.metadata === undefined
         ? {}
-        : { metadata: metadataValue(dependencies.metadata) }),
+        : { metadata: metadataValue(input.metadata ?? dependencies.metadata) }),
 });
 const oauthProviderModeOpaqueExpiresAt = (issuedAt, ttl) => UnixMillis(Number(issuedAt) + Duration.toMillis(ttl));
 const oauthProviderModeOpaqueExpiresInSeconds = (issuedAt, expiresAt) => Math.max(0, Math.floor((Number(expiresAt) - Number(issuedAt)) / 1000));
@@ -1941,8 +2097,16 @@ const oauthProviderModeOpaqueTokenResponse = (input) => ({
         : { refreshToken: input.refreshToken }),
     ...(input.scopes.length === 0 ? {} : { scopes: [...input.scopes] }),
 });
-const oauthProviderModeOpaqueStoreToken = (store, record, error) => store.upsert(record).pipe(Effect.mapError((cause) => error("Failed to store OAuth provider-mode token", cause)));
+const oauthProviderModeOpaqueStoreToken = (store, record, error) => store
+    .upsert(record)
+    .pipe(Effect.mapError((cause) => error("Failed to store OAuth provider-mode token", cause)));
 const oauthProviderModeScopesSubset = (scopes, grantedScopes) => scopes.every((scope) => grantedScopes.includes(scope));
+const oauthProviderModeAudienceValues = (audience) => audience === undefined
+    ? []
+    : Array.isArray(audience)
+        ? audience
+        : [audience];
+const oauthProviderModeAccessTokenInvalid = (reason) => ({ valid: false, reason });
 const oauthTokenGrantClientId = (value) => {
     const clientId = oauthTokenGrantString(value === undefined ? undefined : String(value));
     return clientId === undefined ? undefined : OAuthClientId(clientId);
@@ -1960,7 +2124,7 @@ const oauthAuthorizationCodeConsumeFailureToTokenFailure = (reason) => {
         }
     }
 };
-export const makeOAuthAuthorizationCodeTokenGrant = (dependencies) => OAuthAuthorizationCodeTokenGrant.make({
+export const makeOAuthAuthorizationCodeTokenGrant = (dependencies) => OAuthAuthorizationCodeTokenGrant.of({
     exchange: Effect.fn("auth.oauth.authorization_code_token.exchange")(function* (input) {
         if (input.grantType !== "authorization_code") {
             return oauthAuthorizationCodeTokenInvalid("unsupported_grant_type");
@@ -1968,18 +2132,24 @@ export const makeOAuthAuthorizationCodeTokenGrant = (dependencies) => OAuthAutho
         const { code } = input;
         const clientId = oauthTokenGrantClientId(input.clientId);
         const redirectUri = oauthTokenGrantString(input.redirectUri);
-        if (code === undefined || clientId === undefined || redirectUri === undefined) {
+        if (code === undefined ||
+            clientId === undefined ||
+            redirectUri === undefined) {
             return oauthAuthorizationCodeTokenInvalid("invalid_request");
         }
-        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to load OAuth client", cause)));
-        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+        const clientOption = yield* dependencies.clients
+            .find({ clientId })
+            .pipe(Effect.mapError((cause) => oauthAuthorizationCodeTokenGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) ||
+            clientOption.value.status !== "active") {
             return oauthAuthorizationCodeTokenInvalid("invalid_client");
         }
         const client = clientOption.value;
         if (!client.allowedGrantTypes.includes("authorization_code")) {
             return oauthAuthorizationCodeTokenInvalid("unauthorized_client");
         }
-        if (client.type === "confidential" && input.clientAuthenticated !== true) {
+        if (client.type === "confidential" &&
+            input.clientAuthenticated !== true) {
             return oauthAuthorizationCodeTokenInvalid("invalid_client");
         }
         const now = input.now ?? (yield* currentUnixMillis);
@@ -2008,7 +2178,7 @@ export const makeOAuthAuthorizationCodeTokenGrant = (dependencies) => OAuthAutho
         };
     }),
 });
-export const makeOAuthRefreshTokenGrant = (dependencies) => OAuthRefreshTokenGrant.make({
+export const makeOAuthRefreshTokenGrant = (dependencies) => OAuthRefreshTokenGrant.of({
     exchange: Effect.fn("auth.oauth.refresh_token.exchange")(function* (input) {
         if (input.grantType !== "refresh_token") {
             return oauthRefreshTokenInvalid("unsupported_grant_type");
@@ -2018,15 +2188,19 @@ export const makeOAuthRefreshTokenGrant = (dependencies) => OAuthRefreshTokenGra
         if (refreshToken === undefined || clientId === undefined) {
             return oauthRefreshTokenInvalid("invalid_request");
         }
-        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthRefreshTokenGrantError("exchange", "Failed to load OAuth client", cause)));
-        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+        const clientOption = yield* dependencies.clients
+            .find({ clientId })
+            .pipe(Effect.mapError((cause) => oauthRefreshTokenGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) ||
+            clientOption.value.status !== "active") {
             return oauthRefreshTokenInvalid("invalid_client");
         }
         const client = clientOption.value;
         if (!client.allowedGrantTypes.includes("refresh_token")) {
             return oauthRefreshTokenInvalid("unauthorized_client");
         }
-        if (client.type === "confidential" && input.clientAuthenticated !== true) {
+        if (client.type === "confidential" &&
+            input.clientAuthenticated !== true) {
             return oauthRefreshTokenInvalid("invalid_client");
         }
         const scopes = oauthTokenGrantScopes(input.scopes);
@@ -2052,7 +2226,7 @@ export const makeOAuthRefreshTokenGrant = (dependencies) => OAuthRefreshTokenGra
         };
     }),
 });
-export const makeOAuthClientCredentialsGrant = (dependencies) => OAuthClientCredentialsGrant.make({
+export const makeOAuthClientCredentialsGrant = (dependencies) => OAuthClientCredentialsGrant.of({
     exchange: Effect.fn("auth.oauth.client_credentials.exchange")(function* (input) {
         if (input.grantType !== "client_credentials") {
             return oauthClientCredentialsInvalid("unsupported_grant_type");
@@ -2061,8 +2235,11 @@ export const makeOAuthClientCredentialsGrant = (dependencies) => OAuthClientCred
         if (clientId === undefined) {
             return oauthClientCredentialsInvalid("invalid_request");
         }
-        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthClientCredentialsGrantError("exchange", "Failed to load OAuth client", cause)));
-        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+        const clientOption = yield* dependencies.clients
+            .find({ clientId })
+            .pipe(Effect.mapError((cause) => oauthClientCredentialsGrantError("exchange", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) ||
+            clientOption.value.status !== "active") {
             return oauthClientCredentialsInvalid("invalid_client");
         }
         const client = clientOption.value;
@@ -2103,7 +2280,7 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
     const accessTokenTtl = dependencies.accessTokenTtl ?? defaultOAuthProviderModeAccessTokenTtl;
     const refreshTokenTtl = dependencies.refreshTokenTtl ?? defaultOAuthProviderModeRefreshTokenTtl;
     return {
-        authorizationCode: OAuthAuthorizationCodeTokenIssuer.make({
+        authorizationCode: OAuthAuthorizationCodeTokenIssuer.of({
             issue: Effect.fn("auth.oauth.provider_mode_opaque.authorization_code.issue")(function* (input) {
                 const scopes = [...input.code.scopes];
                 const accessToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, accessTokenBytes, OAuthAccessToken, "access", oauthAuthorizationCodeTokenIssuerError);
@@ -2148,7 +2325,7 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
                 });
             }),
         }),
-        refreshToken: OAuthRefreshTokenIssuer.make({
+        refreshToken: OAuthRefreshTokenIssuer.of({
             issue: Effect.fn("auth.oauth.provider_mode_opaque.refresh_token.issue")(function* (input) {
                 const tokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, input.refreshToken, oauthRefreshTokenIssuerError);
                 const recordOption = yield* dependencies.tokenStore
@@ -2175,7 +2352,7 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
                 const accessTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, oauthRefreshTokenIssuerError);
                 const refreshToken = yield* generateOAuthProviderModeOpaqueToken(dependencies.crypto, refreshTokenBytes, OAuthRefreshToken, "refresh", oauthRefreshTokenIssuerError);
                 const refreshTokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, refreshToken, oauthRefreshTokenIssuerError);
-                const accessTokenExpiresAt = oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl);
+                const accessTokenExpiresAt = UnixMillis(Math.min(Number(oauthProviderModeOpaqueExpiresAt(input.now, accessTokenTtl)), Number(record.expiresAt)));
                 yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
                     tokenHash: accessTokenHash,
                     tokenType: "access_token",
@@ -2184,6 +2361,9 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
                     scopes,
                     issuedAt: input.now,
                     expiresAt: accessTokenExpiresAt,
+                    ...(record.metadata === undefined
+                        ? {}
+                        : { metadata: record.metadata }),
                 }), oauthRefreshTokenIssuerError);
                 yield* oauthProviderModeOpaqueStoreToken(dependencies.tokenStore, oauthProviderModeOpaqueTokenRecord(dependencies, {
                     tokenHash: refreshTokenHash,
@@ -2192,7 +2372,10 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
                     subject: record.subject,
                     scopes,
                     issuedAt: input.now,
-                    expiresAt: oauthProviderModeOpaqueExpiresAt(input.now, refreshTokenTtl),
+                    expiresAt: record.expiresAt,
+                    ...(record.metadata === undefined
+                        ? {}
+                        : { metadata: record.metadata }),
                 }), oauthRefreshTokenIssuerError);
                 const rotated = yield* dependencies.tokenStore
                     .rotateRefreshToken({
@@ -2216,7 +2399,7 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
                 };
             }),
         }),
-        clientCredentials: OAuthClientCredentialsTokenIssuer.make({
+        clientCredentials: OAuthClientCredentialsTokenIssuer.of({
             issue: Effect.fn("auth.oauth.provider_mode_opaque.client_credentials.issue")(function* (input) {
                 const scopes = [...(input.scopes ?? [])];
                 if (!oauthTokenGrantScopesAllowed(scopes, input.client.allowedScopes)) {
@@ -2258,9 +2441,74 @@ export const makeOAuthProviderModeOpaqueTokenIssuer = (dependencies) => {
         }),
     };
 };
-export const makeOAuthClientSecretVerification = (dependencies) => OAuthClientSecretVerification.make({
+export const makeOAuthProviderModeAccessTokenVerifier = (dependencies) => OAuthProviderModeAccessTokenVerifier.of({
+    verify: Effect.fn("auth.oauth.provider_mode_access_token.verify")(function* (input) {
+        const accessToken = input?.accessToken;
+        if (accessToken === undefined) {
+            return oauthProviderModeAccessTokenInvalid("unknown_token");
+        }
+        const tokenValue = Redacted.value(accessToken);
+        if (typeof tokenValue !== "string" || tokenValue.trim() === "") {
+            return oauthProviderModeAccessTokenInvalid("unknown_token");
+        }
+        const tokenHash = yield* oauthProviderModeOpaqueTokenHash(dependencies.crypto, accessToken, () => oauthProviderModeAccessTokenVerifierError("Failed to hash OAuth provider-mode access token"));
+        const recordOption = yield* dependencies.tokenStore
+            .findByHash({ tokenHash })
+            .pipe(Effect.mapError(() => oauthProviderModeAccessTokenVerifierError("Failed to load OAuth provider-mode access token")));
+        if (Option.isNone(recordOption)) {
+            return oauthProviderModeAccessTokenInvalid("unknown_token");
+        }
+        const record = recordOption.value;
+        if (record.tokenType !== "access_token") {
+            return oauthProviderModeAccessTokenInvalid("wrong_token_type");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        if (Number(now) >= Number(record.expiresAt)) {
+            return oauthProviderModeAccessTokenInvalid("expired");
+        }
+        if (record.revokedAt !== undefined) {
+            return oauthProviderModeAccessTokenInvalid("revoked");
+        }
+        if (record.rotatedAt !== undefined) {
+            return oauthProviderModeAccessTokenInvalid("rotated");
+        }
+        const clientOption = yield* dependencies.clients
+            .find({ clientId: record.clientId })
+            .pipe(Effect.mapError(() => oauthProviderModeAccessTokenVerifierError("Failed to load OAuth access token client")));
+        if (Option.isNone(clientOption)) {
+            return oauthProviderModeAccessTokenInvalid("unknown_client");
+        }
+        if (clientOption.value.status !== "active") {
+            return oauthProviderModeAccessTokenInvalid("disabled_client");
+        }
+        if (input.issuer !== undefined && record.issuer !== input.issuer) {
+            return oauthProviderModeAccessTokenInvalid("issuer_mismatch");
+        }
+        if (input.audience !== undefined) {
+            const recordAudience = oauthProviderModeAudienceValues(record.audience);
+            const requiredAudience = oauthProviderModeAudienceValues(input.audience);
+            if (!requiredAudience.every((audience) => recordAudience.includes(audience))) {
+                return oauthProviderModeAccessTokenInvalid("audience_mismatch");
+            }
+        }
+        if (!oauthProviderModeScopesSubset(input.requiredScopes ?? [], record.scopes)) {
+            return oauthProviderModeAccessTokenInvalid("missing_scope");
+        }
+        const activeRecord = activeOAuthProviderModeAccessTokenRecord(record);
+        return {
+            valid: true,
+            record: activeRecord,
+            client: cloneOAuthClientRecord(clientOption.value),
+            subject: activeRecord.subject,
+            scopes: [...activeRecord.scopes],
+        };
+    }),
+});
+export const makeOAuthClientSecretVerification = (dependencies) => OAuthClientSecretVerification.of({
     authenticateClient: Effect.fn("auth.oauth.client_secret.authenticate_client")(function* (input) {
-        const prefix = yield* dependencies.clientSecrets.parse(input.clientSecret).pipe(Effect.catchTag("OAuthClientSecretError", () => Effect.succeed(undefined)));
+        const prefix = yield* dependencies.clientSecrets
+            .parse(input.clientSecret)
+            .pipe(Effect.catchTag("OAuthClientSecretError", () => Effect.succeed(undefined)));
         if (prefix === undefined) {
             return false;
         }
@@ -2295,13 +2543,15 @@ export const makeOAuthClientSecretVerification = (dependencies) => OAuthClientSe
         return Option.isSome(updated);
     }),
 });
-export const makeOAuthTokenRevocation = (dependencies) => OAuthTokenRevocation.make({
+export const makeOAuthTokenRevocation = (dependencies) => OAuthTokenRevocation.of({
     revoke: Effect.fn("auth.oauth.token_revocation.revoke")(function* (input) {
         const { token } = input;
         const tokenValue = token === undefined ? undefined : String(Redacted.value(token)).trim();
         const clientId = oauthTokenGrantClientId(input.clientId);
         const tokenTypeHint = oauthTokenGrantString(input.tokenTypeHint);
-        if (token === undefined || tokenValue === undefined || clientId === undefined) {
+        if (token === undefined ||
+            tokenValue === undefined ||
+            clientId === undefined) {
             return oauthTokenRevocationInvalid("invalid_request");
         }
         if (tokenTypeHint !== undefined &&
@@ -2309,12 +2559,16 @@ export const makeOAuthTokenRevocation = (dependencies) => OAuthTokenRevocation.m
             tokenTypeHint !== "refresh_token") {
             return oauthTokenRevocationInvalid("unsupported_token_type");
         }
-        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthTokenRevocationError("revoke", "Failed to load OAuth client", cause)));
-        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+        const clientOption = yield* dependencies.clients
+            .find({ clientId })
+            .pipe(Effect.mapError((cause) => oauthTokenRevocationError("revoke", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) ||
+            clientOption.value.status !== "active") {
             return oauthTokenRevocationInvalid("invalid_client");
         }
         const client = clientOption.value;
-        if (client.type !== "confidential" || input.clientAuthenticated !== true) {
+        if (client.type !== "confidential" ||
+            input.clientAuthenticated !== true) {
             return oauthTokenRevocationInvalid("invalid_client");
         }
         const now = input.now ?? (yield* currentUnixMillis);
@@ -2332,21 +2586,29 @@ export const makeOAuthTokenRevocation = (dependencies) => OAuthTokenRevocation.m
         };
     }),
 });
-export const makeOAuthTokenIntrospection = (dependencies) => OAuthTokenIntrospection.make({
+export const makeOAuthTokenIntrospection = (dependencies) => OAuthTokenIntrospection.of({
     introspect: Effect.fn("auth.oauth.token_introspection.introspect")(function* (input) {
         const { token } = input;
-        const tokenValue = token === undefined ? undefined : String(Redacted.value(token)).trim();
+        const tokenValue = token === undefined
+            ? undefined
+            : String(Redacted.value(token)).trim();
         const clientId = oauthTokenGrantClientId(input.clientId);
         const tokenTypeHint = oauthTokenGrantString(input.tokenTypeHint);
-        if (token === undefined || tokenValue === undefined || clientId === undefined) {
+        if (token === undefined ||
+            tokenValue === undefined ||
+            clientId === undefined) {
             return oauthTokenIntrospectionInvalid("invalid_request");
         }
-        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthTokenIntrospectionError("introspect", "Failed to load OAuth client", cause)));
-        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+        const clientOption = yield* dependencies.clients
+            .find({ clientId })
+            .pipe(Effect.mapError((cause) => oauthTokenIntrospectionError("introspect", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) ||
+            clientOption.value.status !== "active") {
             return oauthTokenIntrospectionInvalid("invalid_client");
         }
         const client = clientOption.value;
-        if (client.type !== "confidential" || input.clientAuthenticated !== true) {
+        if (client.type !== "confidential" ||
+            input.clientAuthenticated !== true) {
             return oauthTokenIntrospectionInvalid("invalid_client");
         }
         const now = input.now ?? (yield* currentUnixMillis);
@@ -2368,7 +2630,9 @@ export const makeOAuthTokenIntrospection = (dependencies) => OAuthTokenIntrospec
 const oauthProviderAuthorizationInvalid = (reason, input) => ({
     valid: false,
     reason,
-    ...(input?.redirectUri === undefined ? {} : { redirectUri: input.redirectUri }),
+    ...(input?.redirectUri === undefined
+        ? {}
+        : { redirectUri: input.redirectUri }),
     ...(input?.state === undefined ? {} : { state: input.state }),
     ...(input?.client === undefined
         ? {}
@@ -2386,7 +2650,7 @@ const oauthProviderAuthorizationClientId = (value) => {
     return clientId === undefined ? undefined : OAuthClientId(clientId);
 };
 const oauthProviderAuthorizationScopes = (scopes) => {
-    const values = typeof scopes === "string" ? scopes.split(/\s+/) : scopes ?? [];
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : (scopes ?? []);
     const unique = new Set();
     for (const value of values) {
         const scope = value.trim();
@@ -2396,13 +2660,14 @@ const oauthProviderAuthorizationScopes = (scopes) => {
     }
     return [...unique];
 };
-const oauthProviderAuthorizationScopeAllowed = (scopes, allowedScopes) => allowedScopes === undefined || scopes.every((scope) => allowedScopes.includes(scope));
+const oauthProviderAuthorizationScopeAllowed = (scopes, allowedScopes) => allowedScopes === undefined ||
+    scopes.every((scope) => allowedScopes.includes(scope));
 const oauthProviderAuthorizationScopeSubset = (scopes, requestedScopes) => scopes.every((scope) => requestedScopes.includes(scope));
 const oauthProviderAuthorizationClientAllowsCode = (client) => client.allowedResponseTypes.includes("code") &&
     client.allowedGrantTypes.includes("authorization_code");
 const oauthProviderAuthorizationGrantedScopesValid = (scopes, requestedScopes, allowedScopes) => oauthProviderAuthorizationScopeSubset(scopes, requestedScopes) &&
     oauthProviderAuthorizationScopeAllowed(scopes, allowedScopes);
-export const makeOAuthProviderAuthorization = (dependencies) => OAuthProviderAuthorization.make({
+export const makeOAuthProviderAuthorization = (dependencies) => OAuthProviderAuthorization.of({
     authorize: Effect.fn("auth.oauth.provider_authorization.authorize")(function* (input) {
         const state = oauthProviderAuthorizationString(input.state);
         const clientId = oauthProviderAuthorizationClientId(input.clientId);
@@ -2410,8 +2675,11 @@ export const makeOAuthProviderAuthorization = (dependencies) => OAuthProviderAut
         if (clientId === undefined || redirectUri === undefined) {
             return oauthProviderAuthorizationInvalid("invalid_request");
         }
-        const clientOption = yield* dependencies.clients.find({ clientId }).pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to load OAuth client", cause)));
-        if (Option.isNone(clientOption) || clientOption.value.status !== "active") {
+        const clientOption = yield* dependencies.clients
+            .find({ clientId })
+            .pipe(Effect.mapError((cause) => oauthProviderAuthorizationError("authorize", "Failed to load OAuth client", cause)));
+        if (Option.isNone(clientOption) ||
+            clientOption.value.status !== "active") {
             return oauthProviderAuthorizationInvalid("invalid_request");
         }
         const client = clientOption.value;
@@ -2430,7 +2698,9 @@ export const makeOAuthProviderAuthorization = (dependencies) => OAuthProviderAut
         if (!oauthProviderAuthorizationClientAllowsCode(client)) {
             return redirectError("unauthorized_client");
         }
-        const codeChallenge = oauthProviderAuthorizationString(input.codeChallenge === undefined ? undefined : String(input.codeChallenge));
+        const codeChallenge = oauthProviderAuthorizationString(input.codeChallenge === undefined
+            ? undefined
+            : String(input.codeChallenge));
         if (codeChallenge === undefined ||
             oauthProviderAuthorizationString(input.codeChallengeMethod) !== "S256") {
             return redirectError("invalid_request");
@@ -2484,6 +2754,7 @@ export const exchangeOAuthRefreshToken = (input) => OAuthRefreshTokenGrant.use((
 export const exchangeOAuthClientCredentialsToken = (input) => OAuthClientCredentialsGrant.use((grant) => grant.exchange(input));
 export const revokeOAuthToken = (input) => OAuthTokenRevocation.use((revocation) => revocation.revoke(input));
 export const introspectOAuthToken = (input) => OAuthTokenIntrospection.use((introspection) => introspection.introspect(input));
+export const verifyOAuthProviderModeAccessToken = (input) => OAuthProviderModeAccessTokenVerifier.use((verifier) => verifier.verify(input));
 export const authorizeOAuthProviderAuthorization = (input) => OAuthProviderAuthorization.use((authorization) => authorization.authorize(input));
 export const makeOAuthPkce = (input) => Effect.gen(function* () {
     const crypto = yield* Crypto;
@@ -2518,10 +2789,12 @@ const makeAuthorizationUrl = (input) => Effect.try({
     },
     catch: (cause) => oauthStateError("authorization-url", "Failed to build OAuth authorization URL", cause),
 });
-export const makeOAuthState = (dependencies) => OAuthState.make({
+export const makeOAuthState = (dependencies) => OAuthState.of({
     start: Effect.fn("auth.oauth_state.start")(function* (input) {
         const stateSecretBytes = yield* validateByteLength(dependencies.stateSecretBytes ?? defaultOAuthStateSecretBytes, "start", "OAuth state secret");
-        const stateSecret = yield* dependencies.crypto.randomToken(stateSecretBytes).pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthStateError("start", "Failed to generate OAuth state secret", cause)));
+        const stateSecret = yield* dependencies.crypto
+            .randomToken(stateSecretBytes)
+            .pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthStateError("start", "Failed to generate OAuth state secret", cause)));
         const pkce = yield* makeOAuthPkceWithCrypto(dependencies, {
             codeVerifier: input.codeVerifier,
             verifierBytes: dependencies.codeVerifierBytes,
@@ -2548,11 +2821,16 @@ export const makeOAuthState = (dependencies) => OAuthState.make({
                 scopes,
                 codeChallenge: pkce.codeChallenge,
                 ...(nonce === undefined ? {} : { nonce }),
-                ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: input.metadata }),
             },
         })
             .pipe(Effect.mapError((cause) => oauthStateError("start", "Failed to issue OAuth state challenge", cause)));
-        const state = encodeOAuthState({ challengeId: issued.id, secret: stateSecret });
+        const state = encodeOAuthState({
+            challengeId: issued.id,
+            secret: stateSecret,
+        });
         const authorizationUrl = yield* makeAuthorizationUrl({
             provider: input.provider,
             redirectUri,
@@ -2659,6 +2937,16 @@ export const OAuthProviderModeOpaqueTokenIssuerLive = (options = {}) => Layer.me
         tokenStore,
     }).clientCredentials;
 })));
+export const OAuthProviderModeAccessTokenVerifierLive = Layer.effect(OAuthProviderModeAccessTokenVerifier)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const tokenStore = yield* OAuthProviderModeTokenStore;
+    const clients = yield* OAuthClientRegistry;
+    return makeOAuthProviderModeAccessTokenVerifier({
+        crypto,
+        tokenStore,
+        clients,
+    });
+}));
 export const OAuthTokenRevocationLive = Layer.effect(OAuthTokenRevocation)(Effect.gen(function* () {
     const clients = yield* OAuthClientRegistry;
     const revoker = yield* OAuthTokenRevoker;
@@ -2673,11 +2961,15 @@ export const OAuthProviderAuthorizationLive = Layer.effect(OAuthProviderAuthoriz
     const clients = yield* OAuthClientRegistry;
     const authorizationCodes = yield* OAuthAuthorizationCodeGrant;
     const policy = yield* OAuthProviderAuthorizationPolicy;
-    return makeOAuthProviderAuthorization({ clients, authorizationCodes, policy });
+    return makeOAuthProviderAuthorization({
+        clients,
+        authorizationCodes,
+        policy,
+    });
 }));
 export const makeOAuthProviders = (providers) => {
     const providersById = new Map(providers.map((provider) => [provider.id, cloneProviderConfig(provider)]));
-    return OAuthProviders.make({
+    return OAuthProviders.of({
         get: (id) => Effect.sync(() => {
             const provider = providersById.get(id);
             return provider === undefined
@@ -2696,9 +2988,13 @@ export const OAuthClientSecretVerificationLive = Layer.effect(OAuthClientSecretV
     const secretStore = yield* OAuthClientSecretStore;
     return makeOAuthClientSecretVerification({ clientSecrets, secretStore });
 }));
-export const makeOAuthClientRegistryFromStore = (store) => OAuthClientRegistry.make({
-    find: (input) => store.find(input).pipe(Effect.mapError((cause) => oauthClientRegistryError("find", "Failed to load OAuth client", cause))),
-    validateRedirectUri: (input) => store.validateRedirectUri(input).pipe(Effect.mapError((cause) => oauthClientRegistryError("validate-redirect-uri", "Failed to validate OAuth client redirect URI", cause))),
+export const makeOAuthClientRegistryFromStore = (store) => OAuthClientRegistry.of({
+    find: (input) => store
+        .find(input)
+        .pipe(Effect.mapError((cause) => oauthClientRegistryError("find", "Failed to load OAuth client", cause))),
+    validateRedirectUri: (input) => store
+        .validateRedirectUri(input)
+        .pipe(Effect.mapError((cause) => oauthClientRegistryError("validate-redirect-uri", "Failed to validate OAuth client redirect URI", cause))),
 });
 export const OAuthClientRegistryFromStoreLive = Layer.effect(OAuthClientRegistry)(Effect.gen(function* () {
     const store = yield* OAuthClientStore;
@@ -2706,7 +3002,7 @@ export const OAuthClientRegistryFromStoreLive = Layer.effect(OAuthClientRegistry
 }));
 export const makeOAuthClientRegistryMemory = (clients = []) => {
     const clientsById = new Map(clients.map((client) => [client.id, cloneOAuthClientRecord(client)]));
-    return OAuthClientRegistry.make({
+    return OAuthClientRegistry.of({
         find: (input) => Effect.sync(() => {
             const client = clientsById.get(input.clientId);
             return client === undefined
@@ -2722,7 +3018,7 @@ export const makeOAuthClientRegistryMemory = (clients = []) => {
 export const OAuthClientRegistryMemoryLive = (clients = []) => Layer.succeed(OAuthClientRegistry)(makeOAuthClientRegistryMemory(clients));
 export const makeOAuthClientStoreMemory = (clients = []) => {
     const clientsById = new Map(clients.map((client) => [client.id, cloneOAuthClientRecord(client)]));
-    return OAuthClientStore.make({
+    return OAuthClientStore.of({
         upsert: (record) => Effect.sync(() => {
             clientsById.set(record.id, cloneOAuthClientRecord(record));
         }),
@@ -2738,14 +3034,14 @@ export const makeOAuthClientStoreMemory = (clients = []) => {
         validateRedirectUri: (input) => Effect.sync(() => validateOAuthClientRedirectUriRecord(clientsById.get(input.clientId), input)),
     });
 };
-export const OAuthClientStoreMemoryLive = (clients = []) => Layer.succeed(OAuthClientStore)(makeOAuthClientStoreMemory(clients));
+export const OAuthClientStoreMemoryLive = (clients = []) => Layer.sync(OAuthClientStore)(() => makeOAuthClientStoreMemory(clients));
 const oauthConsentMemoryKey = (input) => `${input.userId}\u0000${input.clientId}`;
 export const makeOAuthConsentStoreMemory = (records = []) => {
     const recordsByKey = new Map(records.map((record) => [
         oauthConsentMemoryKey(record),
         cloneOAuthConsentRecord(record),
     ]));
-    return OAuthConsentStore.make({
+    return OAuthConsentStore.of({
         upsert: (record) => Effect.sync(() => {
             recordsByKey.set(oauthConsentMemoryKey(record), cloneOAuthConsentRecord(record));
         }),
@@ -2795,11 +3091,11 @@ export const makeOAuthConsentStoreMemory = (records = []) => {
         }),
     });
 };
-export const OAuthConsentStoreMemoryLive = (records = []) => Layer.succeed(OAuthConsentStore)(makeOAuthConsentStoreMemory(records));
+export const OAuthConsentStoreMemoryLive = (records = []) => Layer.sync(OAuthConsentStore)(() => makeOAuthConsentStoreMemory(records));
 const oauthClientSecretMemoryKey = (input) => `${input.clientId}\u0000${input.prefix}`;
 export const makeOAuthClientSecretStoreMemory = () => {
     const recordsByKey = new Map();
-    return OAuthClientSecretStore.make({
+    return OAuthClientSecretStore.of({
         upsert: (record) => Effect.sync(() => {
             recordsByKey.set(oauthClientSecretMemoryKey(record), cloneOAuthClientSecretRecord(record));
         }),
@@ -2844,7 +3140,7 @@ export const makeOAuthClientSecretStoreMemory = () => {
 export const OAuthClientSecretStoreMemoryLive = Layer.sync(OAuthClientSecretStore)(makeOAuthClientSecretStoreMemory);
 export const makeOAuthAuthorizationCodeStoreMemory = () => {
     const recordsByHash = new Map();
-    return OAuthAuthorizationCodeStore.make({
+    return OAuthAuthorizationCodeStore.of({
         upsert: (record) => Effect.sync(() => {
             recordsByHash.set(record.codeHash, cloneAuthorizationCodeRecord(record));
         }),
@@ -2880,7 +3176,7 @@ export const makeOAuthAuthorizationCodeStoreMemory = () => {
 export const OAuthAuthorizationCodeStoreMemoryLive = Layer.sync(OAuthAuthorizationCodeStore)(makeOAuthAuthorizationCodeStoreMemory);
 export const makeOAuthProviderModeTokenStoreMemory = () => {
     const recordsByHash = new Map();
-    return OAuthProviderModeTokenStore.make({
+    return OAuthProviderModeTokenStore.of({
         upsert: (record) => Effect.sync(() => {
             recordsByHash.set(record.tokenHash, cloneOAuthProviderModeTokenRecord(record));
         }),
@@ -2964,7 +3260,9 @@ export const OAuthLinkConfirmationLive = Layer.effect(OAuthLinkConfirmation)(Eff
 const accountKey = (input) => `${input.providerId}:${input.providerAccountId}`;
 const cloneOAuthAccountRecord = (record) => ({
     ...record,
-    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(record.metadata) }),
 });
 const cloneProviderTokenVaultRecord = (record) => ({
     ...record,
@@ -2986,7 +3284,7 @@ const activeProviderTokenRecord = (record) => record === undefined || record.rev
 const includeAccount = (record, includeUnlinked) => includeUnlinked === true || record.unlinkedAt === undefined;
 export const makeOAuthProviderTokenVaultMemory = () => {
     const recordsByAccountId = new Map();
-    return OAuthProviderTokenVault.make({
+    return OAuthProviderTokenVault.of({
         upsert: (record) => Effect.sync(() => {
             recordsByAccountId.set(record.accountId, cloneProviderTokenVaultRecord(record));
         }),
@@ -3021,7 +3319,7 @@ export const OAuthProviderTokenVaultMemoryLive = Layer.sync(OAuthProviderTokenVa
 export const makeOAuthAccountStoreMemory = () => {
     const accountsById = new Map();
     const idByProviderAccount = new Map();
-    return OAuthAccountStore.make({
+    return OAuthAccountStore.of({
         insert: (row) => Effect.sync(() => {
             const cloned = cloneOAuthAccountRecord(row);
             accountsById.set(row.id, cloned);
@@ -3029,7 +3327,9 @@ export const makeOAuthAccountStoreMemory = () => {
         }),
         findById: (id) => Effect.sync(() => {
             const row = accountsById.get(id);
-            return row === undefined ? Option.none() : Option.some(cloneOAuthAccountRecord(row));
+            return row === undefined
+                ? Option.none()
+                : Option.some(cloneOAuthAccountRecord(row));
         }),
         findByProviderAccount: (input) => Effect.sync(() => {
             const id = idByProviderAccount.get(accountKey(input));
@@ -3039,7 +3339,8 @@ export const makeOAuthAccountStoreMemory = () => {
                 : Option.some(cloneOAuthAccountRecord(row));
         }),
         listByUser: (input) => Effect.sync(() => [...accountsById.values()]
-            .filter((row) => row.userId === input.userId && includeAccount(row, input.includeUnlinked))
+            .filter((row) => row.userId === input.userId &&
+            includeAccount(row, input.includeUnlinked))
             .map(cloneOAuthAccountRecord)),
         unlink: (input) => Effect.sync(() => {
             const id = idByProviderAccount.get(accountKey(input));