@yielded/auth-persistence-drizzle 0.1.0-beta.1 → 0.1.0-beta.13

package/src/drizzle/mysql-sessions.ts

@@ -14,12 +14,15 @@ import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
 import type { SqlError } from "effect/sql/SqlError";
 
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type {
   AuthenticationAuthorityMapping,
   PendingAuthenticationMapping,
   SignedSessionValidityMapping,
   StatefulSessionMapping,
 } from "./session-model";
+import { CurrentSessionSql } from "./session-sql";
 import {
   coordinateTargetAuthenticationAuthority,
   coordinateTargetPendingAuthentication,
@@ -33,15 +36,20 @@ import {
   makeTargetSessionStepUpServices,
   coordinateTargetSessionStepUp,
 } from "./session-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
 type Transaction = Parameters<Parameters<Database["transaction"]>[0]>[0];
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientSessionStandaloneGuard(database),
+  standaloneGuard: sqlClientSessionStandaloneGuard(service),
 });
 
 export const makeMysqlAuthenticationAuthorityServices = <
@@ -52,9 +60,12 @@ export const makeMysqlAuthenticationAuthorityServices = <
   P extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,
-) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetAuthenticationAuthorityServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlPendingAuthenticationServices = <
   Claims,
@@ -64,9 +75,12 @@ export const makeMysqlPendingAuthenticationServices = <
   F extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,
-) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPendingAuthenticationServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlStatefulSessionServices = <
   Claims,
@@ -78,9 +92,12 @@ export const makeMysqlStatefulSessionServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,
-) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetStatefulSessionServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlSignedSessionValidityServices = <
   S extends AnyMySqlTable,
@@ -88,9 +105,12 @@ export const makeMysqlSignedSessionValidityServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,
-) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetSignedSessionValidityServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlAuthenticationAuthority<
   D extends Database,
@@ -183,7 +203,7 @@ export function coordinateMysqlAuthenticationAuthority<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly authenticationAuthority: AuthenticationAuthority["Service"] },
@@ -290,7 +310,7 @@ export function coordinateMysqlPendingAuthentication<
     coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly pendingAuthentication: PendingAuthentication<Claims> },
@@ -442,7 +462,7 @@ export function coordinateMysqlStatefulSessions<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: {
@@ -550,7 +570,7 @@ export function coordinateMysqlSignedSessionValidity<
     coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly signedSessionValidity: SignedSessionValidity },
@@ -579,10 +599,13 @@ export const makeMysqlSessionStepUpServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,
   target: Context.Service<Id, SessionStepUpPersistence<Claims>>,
-) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetSessionStepUpServices(mapping, target, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlSessionStepUp<
   Claims,
@@ -724,7 +747,7 @@ export function coordinateMysqlSessionStepUp<
       database,
       options.mapping,
       options.target,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Parameters<Parameters<D["transaction"]>[0]>[0],
         services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },

package/src/drizzle/native-database.ts

@@ -0,0 +1,22 @@
+import type {
+  TransactionNativeDatabase,
+  SessionSqlDatabase,
+  PasswordSqlDatabase,
+  EmailSqlDatabase,
+  ProofSqlDatabase,
+} from "@yielded/auth-persistence/Adapter";
+import { type Context, Effect } from "effect";
+
+/** Drizzle omits its captured $client from database class types, and only D1
+ * exposes batch. Its generic query builders implement the SQL kernel contracts
+ * through drizzleQueryOperations. The selected driver mode controls native calls. */
+export const nativeDatabase = <Id, Database>(databaseService: Context.Key<Id, Database>) =>
+  Effect.map(
+    Effect.service(databaseService),
+    (database) =>
+      database as unknown as TransactionNativeDatabase &
+        SessionSqlDatabase &
+        PasswordSqlDatabase &
+        EmailSqlDatabase &
+        ProofSqlDatabase,
+  );

package/src/drizzle/oauth-connected-drivers.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   OAuthConnectedPersistence,
@@ -9,6 +10,7 @@ import { Effect, Context } from "effect";
 
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
+import { nativeDatabase } from "./native-database";
 import type {
   OAuthConnectedMapping,
   OAuthConnectedRevocationMapping,
@@ -28,11 +30,13 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
 const unavailable = () => OAuthUnavailable.make({});
 
 export const makeOAuthConnectedTarget = <
+  DatabaseId,
   Database,
   Family extends Table,
   Extra = {},
   Synchronous extends boolean = false,
 >(
+  databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthConnected<
@@ -300,9 +304,11 @@ export const makeOAuthConnectedTarget = <
       N,
       J extends Family = never,
     >(
-      database: Database,
       mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,
-    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthConnectedServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     makeOAuthConnectedRevocationServices: <
       T extends Family,
       O extends Family,
@@ -313,15 +319,18 @@ export const makeOAuthConnectedTarget = <
       J extends Family,
       N,
     >(
-      database: Database,
       mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,
-    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     coordinateOAuthConnected,
     coordinateOAuthConnectedRevocations,
   };
 };
 
-export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(
+export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(
+  databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthConnected<
@@ -461,7 +470,10 @@ export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra
   }
 
   return {
-    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),
+    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(
+      databaseService,
+      configuration,
+    ),
     coordinateOAuthConnected,
     coordinateOAuthConnectedRevocations,
   };

package/src/drizzle/oauth-connected-settlement.ts

@@ -118,14 +118,16 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
     const claimed = yield* F.exact(mapping, input.claim);
 
     if (claimed === undefined) return { _tag: "Rejected" } as const;
+    const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+
     yield* F.terminal(
       mapping,
       input.claim,
-      out._tag,
-      out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+      state,
+      out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
     );
 
-    return { _tag: out._tag } as
+    return { _tag: state } as
       | { readonly _tag: "Cancelled" }
       | { readonly _tag: "Rejected" }
       | { readonly _tag: "Conflict" }

package/src/drizzle/oauth-connected-sign-in.ts

@@ -322,13 +322,17 @@ export const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
     const held = yield* exact(mapping, r);
 
     if (held === undefined) return { _tag: "Rejected" } as const;
+    // Unissued means the provider definitely returned no token. Resolve that
+    // reservation. A Rejected outcome can follow a real exchange, so it stays open.
+    const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+
     yield* owner.update(f.table, held.key, {
-      [f.state]: out._tag,
-      [f.work]: out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+      [f.state]: state,
+      [f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
       [f.version]: owner.marker,
     });
 
-    return { _tag: out._tag };
+    return { _tag: state };
   }
   const token = out.grant.context;
 

package/src/drizzle/oauth-connected-target.ts

@@ -1,4 +1,3 @@
-import { LifecycleHooks } from "@yielded/auth/Hooks";
 import * as M from "@yielded/auth/OAuth";
 import {
   OAuthConnectedPersistence,
@@ -185,32 +184,24 @@ export const makeRevocations = (
   );
 
 export const makeTargetOAuthConnectedServices = (
-  database: any,
   mapping: S.Mapping,
   configuration: OAuthTargetConfiguration,
 ) => {
   const retained = captured(mapping);
 
-  return Effect.map(LifecycleHooks, (hooks) => ({
-    oauthConnectedPersistence: makeConnected(
-      retained,
-      makeOAuthExecution(database, hooks, configuration),
-    ),
+  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+    oauthConnectedPersistence: makeConnected(retained, execution),
   }));
 };
 
 export const makeTargetOAuthConnectedRevocationServices = (
-  database: any,
   mapping: S.Revocations,
   configuration: OAuthTargetConfiguration,
 ) => {
   const retained = captured(mapping);
 
-  return Effect.map(LifecycleHooks, (hooks) => ({
-    oauthConnectedRevocations: makeRevocations(
-      retained,
-      makeOAuthExecution(database, hooks, configuration),
-    ),
+  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+    oauthConnectedRevocations: makeRevocations(retained, execution),
   }));
 };
 
@@ -256,16 +247,24 @@ export const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(
     owner,
   );
 
-export const oauthConnectedPersistenceLayer = (
-  services: ReturnType<typeof makeTargetOAuthConnectedServices>,
+export const oauthConnectedPersistenceLayer = <E, R>(
+  services: Effect.Effect<
+    Effect.Success<ReturnType<typeof makeTargetOAuthConnectedServices>>,
+    E,
+    R
+  >,
 ) =>
   Layer.effect(
     OAuthConnectedPersistence,
     Effect.map(services, (value) => value.oauthConnectedPersistence),
   );
 
-export const oauthConnectedRevocationsLayer = (
-  services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>,
+export const oauthConnectedRevocationsLayer = <E, R>(
+  services: Effect.Effect<
+    Effect.Success<ReturnType<typeof makeTargetOAuthConnectedRevocationServices>>,
+    E,
+    R
+  >,
 ) =>
   Layer.effect(
     OAuthConnectedRevocations,

package/src/drizzle/oauth-drivers.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   OAuthAccountsPersistence,
@@ -7,6 +8,7 @@ import {
 import type { Table } from "drizzle-orm";
 import { Effect, Context } from "effect";
 
+import { nativeDatabase } from "./native-database";
 import { makeOAuthConnectedTarget } from "./oauth-connected-drivers";
 import type {
   OAuthAccountsMapping,
@@ -35,7 +37,13 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
   : never;
 
 /** Driver-specific entry points instantiate both the database and table family. */
-export const makeOAuthTarget = <D, T extends Table, Synchronous extends boolean = false>(
+export const makeOAuthTarget = <
+  DatabaseId,
+  D,
+  T extends Table,
+  Synchronous extends boolean = false,
+>(
+  databaseService: Context.Service<DatabaseId, D>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthSignIn<
@@ -516,7 +524,7 @@ export const makeOAuthTarget = <D, T extends Table, Synchronous extends boolean
   }
 
   return {
-    ...makeOAuthConnectedTarget<D, T, {}, Synchronous>(configuration),
+    ...makeOAuthConnectedTarget<DatabaseId, D, T, {}, Synchronous>(databaseService, configuration),
     coordinateOAuthSignIn,
     coordinateOAuthRegistrationIntents,
     coordinateOAuthAccounts,
@@ -530,13 +538,17 @@ export const makeOAuthTarget = <D, T extends Table, Synchronous extends boolean
       U extends T,
       N,
     >(
-      database: D,
       mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>,
-    ) => makeTargetOAuthAccountsServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthAccountsServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     makeOAuthSignInServices: <S extends T, O extends T, C extends T, AC extends T, F extends T, N>(
-      database: D,
       mapping: OAuthSignInMapping<S, O, C, AC, F, N>,
-    ) => makeTargetOAuthSignInServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthSignInServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     makeOAuthRegistrationIntentServices: <
       S extends T,
       O extends T,
@@ -547,9 +559,11 @@ export const makeOAuthTarget = <D, T extends Table, Synchronous extends boolean
       I extends T,
       N,
     >(
-      database: D,
       mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>,
-    ) => makeTargetOAuthRegistrationIntentServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthRegistrationIntentServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     makeOAuthRegistrationServices: <
       Registration,
       S extends T,
@@ -561,9 +575,11 @@ export const makeOAuthTarget = <D, T extends Table, Synchronous extends boolean
       R extends T,
       N,
     >(
-      database: D,
       mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>,
-    ) => makeTargetOAuthRegistrationServices<Registration>(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthRegistrationServices<Registration>(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     coordinateOAuthRegistration,
   };
 };

package/src/drizzle/oauth-target.ts

@@ -1,3 +1,4 @@
+import type { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   OAuthAccountRevision,
@@ -83,17 +84,16 @@ export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnava
 export type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;
 
 export const sqlClientOAuthStandaloneGuard = (
-  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],
-) => sqlClientTransactionStandaloneGuard(unavailable, database);
+  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],
+) => sqlClientTransactionStandaloneGuard(unavailable, service);
 
-export const makeOAuthExecution = (
-  database: OAuthNativeDatabase,
-  hooks: LifecycleHooks["Service"],
+export const makeOAuthExecution = Effect.fnUntraced(function* (
   configuration: OAuthTargetConfiguration,
-): OAuthExecution => {
-  const execution = makeTransactionExecution(
+): Effect.fn.Return<OAuthExecution, never, LifecycleHooks | NativeDatabase> {
+  const hooks = yield* LifecycleHooks;
+
+  const execution = yield* makeTransactionExecution(
     CurrentOAuthTransaction,
-    database,
     configuration,
     unavailable,
     nonce,
@@ -104,7 +104,7 @@ export const makeOAuthExecution = (
     run: (operation, mutation) =>
       execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),
   };
-};
+});
 
 const prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>
   Effect.flatMap(CurrentOAuthTransaction, (owner) =>
@@ -388,47 +388,35 @@ export const makeOAuthRegistration = <Registration>(
   );
 
 export const makeTargetOAuthSignInServices = (
-  database: any,
   mapping: any,
   configuration: OAuthTargetConfiguration,
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(LifecycleHooks, (hooks) => ({
-    oauthSignInPersistence: makeOAuthSignIn(
-      captured,
-      makeOAuthExecution(database, hooks, configuration),
-    ),
+  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+    oauthSignInPersistence: makeOAuthSignIn(captured, execution),
   }));
 };
 
 export const makeTargetOAuthRegistrationIntentServices = (
-  database: any,
   mapping: any,
   configuration: OAuthTargetConfiguration,
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(LifecycleHooks, (hooks) => ({
-    oauthRegistrationIntents: makeOAuthRegistrationIntents(
-      captured,
-      makeOAuthExecution(database, hooks, configuration),
-    ),
+  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+    oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),
   }));
 };
 
 export const makeTargetOAuthRegistrationServices = <Registration>(
-  database: any,
   mapping: any,
   configuration: OAuthTargetConfiguration,
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(LifecycleHooks, (hooks) => ({
-    registrationAuthority: makeOAuthRegistration<Registration>(
-      captured,
-      makeOAuthExecution(database, hooks, configuration),
-    ),
+  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+    registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),
   }));
 };
 
@@ -698,50 +686,50 @@ export const makeOAuthAccounts = (
   );
 
 export const makeTargetOAuthAccountsServices = (
-  database: any,
   mapping: any,
   configuration: OAuthTargetConfiguration,
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(LifecycleHooks, (hooks) => ({
-    oauthAccountsPersistence: makeOAuthAccounts(
-      captured,
-      makeOAuthExecution(database, hooks, configuration),
-    ),
+  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+    oauthAccountsPersistence: makeOAuthAccounts(captured, execution),
   }));
 };
 
-export const oauthAccountsPersistenceLayer = (
-  services: ReturnType<typeof makeTargetOAuthAccountsServices>,
+export const oauthAccountsPersistenceLayer = <E, R>(
+  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthAccountsServices>>, E, R>,
 ) =>
   Layer.effect(
     OAuthAccountsPersistence,
     Effect.map(services, (value) => value.oauthAccountsPersistence),
   );
 
-export const oauthSignInPersistenceLayer = (
-  services: ReturnType<typeof makeTargetOAuthSignInServices>,
+export const oauthSignInPersistenceLayer = <E, R>(
+  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthSignInServices>>, E, R>,
 ) =>
   Layer.effect(
     OAuthSignInPersistence,
     Effect.map(services, (value) => value.oauthSignInPersistence),
   );
 
-export const oauthRegistrationIntentsLayer = (
-  services: ReturnType<typeof makeTargetOAuthRegistrationIntentServices>,
+export const oauthRegistrationIntentsLayer = <E, R>(
+  services: Effect.Effect<
+    Effect.Success<ReturnType<typeof makeTargetOAuthRegistrationIntentServices>>,
+    E,
+    R
+  >,
 ) =>
   Layer.effect(
     OAuthRegistrationIntents,
     Effect.map(services, (value) => value.oauthRegistrationIntents),
   );
 
-export const oauthRegistrationAuthorityLayer = <Id, Registration>(
+export const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(
   tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,
   services: Effect.Effect<
     { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },
-    never,
-    LifecycleHooks
+    E,
+    R
   >,
 ) =>
   Layer.effect(