@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/oauth/target.ts

@@ -1,803 +0,0 @@
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import {
-  OAuthAccountRevision,
-  OAuthLinkClaimDecision,
-  OAuthLinkDecision,
-  OAuthLinkIssueDecision,
-  OAuthLinkPendingFlow,
-  OAuthUnlinkDecision,
-  OAuthUnlinkInspection,
-  OAuthAccountsPersistence,
-  OAuthRegistrationIntents,
-  OAuthSignInPersistence,
-  type PrepareOAuthCommit,
-  OAuthRegistrationIntent,
-  OAuthRegistrationFingerprint,
-  OAuthClaim,
-  OAuthClaimDecision,
-  OAuthCleanupInput,
-  OAuthIssueDecision,
-  OAuthPendingFlow,
-  OAuthSettlementDecision,
-  OAuthVerifiedExternalIdentity,
-  OAuthCredentialSnapshot,
-  snapshotOAuthSync,
-  type OAuthUnavailable,
-} from "@yielded/auth/OAuth";
-import type { SecurityRevision } from "@yielded/auth/Sessions";
-import { type Crypto, Context, Effect, Layer } from "effect";
-import type { Statement } from "effect/sql/Statement";
-
-import type { PersistenceMappingError } from "../models/common";
-import type { OAuthRegistrationAuthority } from "../models/oauth-model";
-import type {
-  TransactionTargetConfiguration,
-  TransactionCoordinatorError,
-  TransactionExecution,
-} from "../transaction-execution-kernel";
-/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */
-import type { NativeDatabase } from "../transaction-kernel";
-import { OAuthAccounts } from "./accounts";
-import { OAuthFlow } from "./flow";
-import {
-  accountsInputs,
-  capturedOAuthService,
-  registrationInputs,
-  registrationIntentInputs,
-  signInInputs,
-} from "./input";
-import { OAuthTransactionExecution, CurrentOAuthTransaction } from "./owner";
-import type { OAuthNativeDatabase } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { OAuthRegistration } from "./registration";
-import type { RegistrationCallbacks } from "./registration";
-import { captureOAuthMapping, invariant, nonce, unavailable } from "./state";
-
-export type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
-
-export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;
-
-export type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const accounts = yield* OAuthAccounts;
-  const flow = yield* OAuthFlow;
-  const registration = yield* OAuthRegistration;
-  const execution = yield* OAuthTransactionExecution;
-
-  const { eq, sql } = operations;
-
-  const { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } =
-    accounts;
-
-  const {
-    claimFlow,
-    cleanupFlows,
-    discoverOwned,
-    exactClaim,
-    issueFlow,
-    matchesAccess,
-    readFlow,
-    resolveOwned,
-    terminalFlow,
-  } = flow;
-
-  const { both, col, equal } = operations;
-
-  const {
-    inspectIntent,
-    register,
-    registrationData,
-    registrationResources,
-    settleRegistrationIntent,
-  } = registration;
-
-  const { coordinateTransactionOwner, makeTransactionExecution } = execution;
-
-  const makeOAuthExecution = Effect.fnUntraced(function* (
-    configuration: OAuthTargetConfiguration,
-    mapping: unknown,
-  ): Effect.fn.Return<
-    OAuthExecution,
-    OAuthUnavailable,
-    LifecycleHooks | NativeDatabase | Crypto.Crypto
-  > {
-    const hooks = yield* LifecycleHooks;
-
-    yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
-      Effect.mapError(unavailable),
-    );
-
-    const execution = yield* makeTransactionExecution(
-      CurrentOAuthTransaction,
-      configuration,
-      unavailable,
-      nonce,
-    );
-
-    return {
-      ...execution,
-      run: (operation, mutation) =>
-        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),
-    };
-  });
-
-  const prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.sync(() => {
-        owner.guards.push(owner.journal.prepare(undefined));
-
-        return prepare(value, owner.journal);
-      }),
-    );
-
-  const makeOAuthSignIn = (
-    mapping: any,
-    execute: OAuthExecution,
-  ): OAuthSignInPersistence["Service"] =>
-    capturedOAuthService<OAuthSignInPersistence["Service"]>(
-      {
-        issue: (original, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const input = snapshotOAuthSync(OAuthPendingFlow, original);
-              const value = yield* issueFlow(mapping, input, "sign-in");
-
-              return yield* prepareValue(
-                snapshotOAuthSync(OAuthIssueDecision, value as never),
-                prepare,
-              );
-            }),
-          ),
-        claim: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const read = yield* readFlow(mapping, input, "sign-in");
-
-              const claim =
-                read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)
-                  ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)
-                  : undefined;
-
-              return yield* prepareValue(
-                snapshotOAuthSync(
-                  OAuthClaimDecision,
-                  claim === undefined
-                    ? { _tag: "Rejected" }
-                    : { _tag: "Claimed", claim: claim as typeof OAuthClaim.Type },
-                ),
-                prepare,
-              );
-            }),
-          ),
-        settle: (original, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const claim = snapshotOAuthSync(OAuthClaim, original.claim);
-              const outcome = original.outcome;
-
-              const identity =
-                outcome._tag === "Verified"
-                  ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity
-                  : undefined;
-
-              if (identity !== undefined)
-                invariant(
-                  identity.provider === claim.flow.context.provider &&
-                    identity.issuer === claim.flow.context.issuer,
-                );
-
-              // Discover/lock the existing subject before locking its claimed flow.
-              const found =
-                identity === undefined ? undefined : yield* discoverOwned(mapping, identity);
-
-              const exact = yield* exactClaim(mapping, claim, "sign-in");
-              let value: typeof OAuthSettlementDecision.Type = { _tag: "Rejected" };
-
-              if (exact !== undefined) {
-                const credential =
-                  identity === undefined
-                    ? undefined
-                    : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);
-
-                value =
-                  outcome._tag !== "Verified"
-                    ? { _tag: outcome._tag }
-                    : credential === undefined
-                      ? { _tag: "Rejected" }
-                      : { _tag: "Verified", credential };
-                yield* terminalFlow(mapping, claim.flow, value._tag);
-              }
-
-              return yield* prepareValue(
-                snapshotOAuthSync(OAuthSettlementDecision, value),
-                prepare,
-              );
-            }),
-          ),
-        cleanup: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const value = yield* cleanupFlows(mapping, input, "sign-in");
-
-              return yield* prepareValue(value, prepare);
-            }),
-          ),
-      },
-      signInInputs,
-      execute.active,
-      execute.poison,
-    );
-
-  const makeOAuthRegistrationIntents = (
-    mapping: any,
-    execute: OAuthExecution,
-  ): OAuthRegistrationIntents["Service"] =>
-    capturedOAuthService<OAuthRegistrationIntents["Service"]>(
-      {
-        settle: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const value = yield* settleRegistrationIntent(mapping, {
-                claim: snapshotOAuthSync(OAuthClaim, input.claim),
-                identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),
-                ...(input.intent === undefined
-                  ? {}
-                  : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),
-              });
-
-              return yield* prepareValue(value, prepare);
-            }),
-          ),
-      },
-      registrationIntentInputs,
-      execute.active,
-      execute.poison,
-    );
-
-  const makeOAuthRegistration = <Registration>(
-    mapping: any,
-    execute: OAuthExecution,
-    allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<
-      infer A,
-      any,
-      any
-    >
-      ? A
-      : never,
-  ): OAuthRegistrationAuthority<Registration> =>
-    capturedOAuthService<OAuthRegistrationAuthority<Registration>>(
-      {
-        read: (input) =>
-          execute.run(
-            Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),
-            false,
-          ),
-        inspect: (input) =>
-          Effect.gen(function* () {
-            yield* execute.admit;
-            const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
-            const stored = mapping.application.encode(input.registration);
-
-            invariant(
-              typeof stored === "string" && new TextEncoder().encode(stored).length <= 1048576,
-            );
-            const detached = { intent, registration: mapping.application.decode(stored) };
-
-            const checked = execute.bound
-              ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))
-              : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);
-
-            invariant(typeof checked.eligible === "boolean");
-
-            return {
-              fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),
-              eligible: checked.eligible,
-            };
-          }).pipe(
-            (effect) => (execute.bound ? execute.run(effect, false) : effect),
-            Effect.onExit((exit) =>
-              Effect.sync(() => {
-                if (exit._tag === "Failure") execute.poison();
-              }),
-            ),
-            Effect.mapError(unavailable),
-            Effect.catchDefect(() => Effect.fail(unavailable())),
-          ) as never,
-        register: (input, prepare) =>
-          Effect.gen(function* () {
-            yield* execute.admit;
-            const data = yield* registrationData(mapping, input, execute.bound);
-            const resources = allocated ?? (yield* registrationResources(mapping));
-
-            return yield* execute.run(
-              Effect.gen(function* () {
-                const value = yield* register(mapping, input, data, resources);
-
-                return yield* prepareValue(value, prepare);
-              }),
-            );
-          }).pipe(
-            Effect.onExit((exit) =>
-              Effect.sync(() => {
-                if (exit._tag === "Failure") execute.poison();
-              }),
-            ),
-            Effect.mapError(unavailable),
-            Effect.catchDefect(() => Effect.fail(unavailable())),
-          ) as never,
-        cleanup: (original, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const owner = yield* CurrentOAuthTransaction;
-
-              const input = snapshotOAuthSync(OAuthCleanupInput, original),
-                i = mapping.intent,
-                r = mapping.command;
-
-              const now = yield* owner.now(mapping.clock);
-
-              const candidates = yield* owner.read(
-                i.table,
-                both(
-                  eq(col(i.table, i.moduleId), input.moduleId),
-                  sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,
-                ),
-                { limit: input.limit, observe: false, takeOnly: true },
-              );
-
-              let removed = 0;
-
-              for (const candidate of candidates.rows) {
-                const selected = yield* owner.read(
-                  i.table,
-                  equal(i.table, {
-                    [i.moduleId]: input.moduleId,
-                    [i.reference]: candidate[i.reference],
-                  }),
-                  { limit: 1 },
-                );
-
-                const row = selected.rows[0];
-
-                if (row === undefined || row[i.state] === "ProvisioningPending") continue;
-                let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);
-
-                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))
-                  continue;
-                if (row[i.commandId] !== null) {
-                  const commands = yield* owner.read(
-                    r.table,
-                    equal(r.table, {
-                      [r.moduleId]: input.moduleId,
-                      [r.commandId]: row[i.commandId],
-                    }),
-                    { limit: 1 },
-                  );
-
-                  const command = commands.rows[0];
-
-                  if (command === undefined) continue;
-                  horizon = Math.max(
-                    horizon,
-                    mapping.clock.decodeInstant(command[r.retentionUntil]),
-                  );
-                  if (
-                    !Number.isSafeInteger(horizon) ||
-                    horizon >= (yield* owner.now(mapping.clock))
-                  )
-                    continue;
-                  yield* owner.remove(r.table, {
-                    [r.moduleId]: input.moduleId,
-                    [r.commandId]: row[i.commandId],
-                  });
-                }
-                yield* owner.remove(i.table, {
-                  [i.moduleId]: input.moduleId,
-                  [i.reference]: row[i.reference],
-                });
-                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
-                removed++;
-              }
-
-              return yield* prepareValue(
-                { removed, hasMore: candidates.rows.length === input.limit },
-                prepare,
-              );
-            }),
-          ),
-      },
-      registrationInputs(mapping.application),
-      execute.active,
-      execute.poison,
-    );
-
-  const makeTargetOAuthSignInServices = (mapping: any, configuration: OAuthTargetConfiguration) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
-      oauthSignInPersistence: makeOAuthSignIn(captured, execution),
-    }));
-  };
-
-  const makeTargetOAuthRegistrationIntentServices = (
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-  ) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
-      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),
-    }));
-  };
-
-  const makeTargetOAuthRegistrationServices = <Registration>(
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-  ) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
-      registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),
-    }));
-  };
-
-  const coordinateOAuthOwner = <Services, Transaction, A, E, R>(
-    database: OAuthNativeDatabase,
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-    allocate: (mapping: any) => Effect.Effect<any, PersistenceMappingError>,
-    services: (mapping: any, execution: OAuthExecution, resources: any) => Services,
-    owner: (
-      transaction: Transaction,
-      services: Services,
-      append: (statement: Statement<any>) => void,
-    ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<
-    A,
-    OAuthCoordinatorError<E>,
-    R | Crypto.Crypto | LifecycleHooks | NativeDatabase
-  > => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.flatMap(LifecycleHooks, (hooks) =>
-      coordinateTransactionOwner(
-        database,
-        CurrentOAuthTransaction,
-        configuration,
-        (operations.validateStorage?.(captured) ?? Effect.void).pipe(
-          Effect.andThen(Effect.suspend(() => allocate(captured))),
-        ),
-        unavailable,
-        nonce,
-        (execution, resources) =>
-          services(
-            captured,
-            {
-              ...execution,
-              run: (operation, mutation) =>
-                execution
-                  .run(operation, mutation)
-                  .pipe(Effect.provideService(LifecycleHooks, hooks)),
-            },
-            resources,
-          ),
-        owner,
-      ).pipe(Effect.provideService(LifecycleHooks, hooks)),
-    );
-  };
-
-  const accountResources = (mapping: any) =>
-    Effect.gen(function* () {
-      return {
-        credentialId: snapshotOAuthSync(
-          OAuthCredentialSnapshot.fields.credentialId,
-          yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,
-        ),
-        revision: snapshotOAuthSync(
-          OAuthCredentialSnapshot.fields.credentialRevision,
-          yield* mapping.allocateRevision as Effect.Effect<
-            SecurityRevision,
-            PersistenceMappingError
-          >,
-        ),
-      };
-    });
-
-  const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(
-    database: any,
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-    owner: (
-      transaction: Transaction,
-      services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },
-      append: (statement: Statement<any>) => void,
-    ) => Effect.Effect<A, E, R>,
-  ) =>
-    coordinateOAuthOwner(
-      database,
-      mapping,
-      configuration,
-      registrationResources,
-      (captured, execute, resources) => ({
-        registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),
-      }),
-      owner,
-    );
-
-  const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(
-    database: any,
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-    owner: (
-      transaction: Transaction,
-      services: { readonly oauthSignInPersistence: OAuthSignInPersistence["Service"] },
-      append: (statement: Statement<any>) => void,
-    ) => Effect.Effect<A, E, R>,
-  ) =>
-    coordinateOAuthOwner(
-      database,
-      mapping,
-      configuration,
-      () => Effect.void,
-      (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),
-      owner,
-    );
-
-  const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(
-    database: any,
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-    owner: (
-      transaction: Transaction,
-      services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents["Service"] },
-      append: (statement: Statement<any>) => void,
-    ) => Effect.Effect<A, E, R>,
-  ) =>
-    coordinateOAuthOwner(
-      database,
-      mapping,
-      configuration,
-      () => Effect.void,
-      (captured, execute) => ({
-        oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),
-      }),
-      owner,
-    );
-
-  const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(
-    database: any,
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-    owner: (
-      transaction: Transaction,
-      services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence["Service"] },
-      append: (statement: Statement<any>) => void,
-    ) => Effect.Effect<A, E, R>,
-  ) =>
-    coordinateOAuthOwner(
-      database,
-      mapping,
-      configuration,
-      accountResources,
-      (captured, execute, resources) => ({
-        oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),
-      }),
-      owner,
-    );
-
-  const makeOAuthAccounts = (
-    mapping: any,
-    execute: OAuthExecution,
-    resources?: any,
-  ): OAuthAccountsPersistence["Service"] =>
-    capturedOAuthService<OAuthAccountsPersistence["Service"]>(
-      {
-        capture: (input) =>
-          execute.run(
-            Effect.map(accountCurrent(mapping, input.subjectId), (current) =>
-              current === undefined
-                ? undefined
-                : snapshotOAuthSync(OAuthAccountRevision, current.revision),
-            ),
-            false,
-          ),
-        issue: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const value = yield* issueLink(mapping, input);
-
-              return yield* prepareValue(
-                snapshotOAuthSync(OAuthLinkIssueDecision, value as never),
-                prepare,
-              );
-            }),
-          ),
-        preflight: (input) =>
-          execute.run(
-            Effect.map(preflightLink(mapping, input), (current) =>
-              current === undefined
-                ? undefined
-                : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),
-            ),
-            false,
-          ),
-        claim: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const value = yield* claimLink(mapping, input);
-
-              return yield* prepareValue(
-                snapshotOAuthSync(OAuthLinkClaimDecision, value as never),
-                prepare,
-              );
-            }),
-          ),
-        settle: (input, prepare) =>
-          Effect.gen(function* () {
-            yield* execute.admit;
-            const allocated = resources ?? (yield* accountResources(mapping));
-
-            return yield* execute.run(
-              Effect.gen(function* () {
-                const value = yield* settleLink(mapping, input, allocated as never);
-
-                return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);
-              }),
-            );
-          }).pipe(
-            Effect.mapError(unavailable),
-            Effect.catchDefect(() => Effect.fail(unavailable())),
-          ) as never,
-        inspectUnlink: (input) =>
-          execute.run(
-            Effect.map(inspectUnlink(mapping, input), (value) =>
-              snapshotOAuthSync(OAuthUnlinkInspection, value),
-            ),
-            false,
-          ),
-        unlink: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const value = yield* unlink(mapping, input);
-
-              return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);
-            }),
-          ),
-        cleanup: (input, prepare) =>
-          execute.run(
-            Effect.gen(function* () {
-              const owner = yield* CurrentOAuthTransaction;
-              const value = yield* cleanupFlows(mapping, input, "link");
-              const remaining = input.limit - value.terminalized - value.removed;
-
-              const now = yield* owner.now(mapping.clock),
-                r = mapping.command;
-
-              let removed = 0;
-
-              if (remaining > 0) {
-                const rows = yield* owner.read(
-                  r.table,
-                  both(
-                    eq(col(r.table, r.moduleId), input.moduleId),
-                    sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,
-                  ),
-                  { limit: remaining, observe: false, takeOnly: true },
-                );
-
-                for (const row of rows.rows) {
-                  const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };
-                  const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });
-                  const current = selected.rows[0];
-
-                  if (current === undefined) continue;
-                  const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);
-
-                  if (
-                    !Number.isSafeInteger(horizon) ||
-                    horizon >= (yield* owner.now(mapping.clock))
-                  )
-                    continue;
-                  yield* owner.remove(r.table, key);
-                  owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
-                  removed++;
-                }
-              }
-
-              return yield* prepareValue(
-                {
-                  ...value,
-                  removed: value.removed + removed,
-                  hasMore: value.hasMore || remaining === removed,
-                },
-                prepare,
-              );
-            }),
-          ),
-      },
-      accountsInputs,
-      execute.active,
-      execute.poison,
-    );
-
-  const makeTargetOAuthAccountsServices = (
-    mapping: any,
-    configuration: OAuthTargetConfiguration,
-  ) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
-      oauthAccountsPersistence: makeOAuthAccounts(captured, execution),
-    }));
-  };
-
-  return {
-    makeOAuthExecution,
-    makeTargetOAuthSignInServices,
-    makeTargetOAuthRegistrationIntentServices,
-    makeTargetOAuthRegistrationServices,
-    coordinateOAuthOwner,
-    coordinateTargetOAuthRegistration,
-    coordinateTargetOAuthSignIn,
-    coordinateTargetOAuthRegistrationIntents,
-    coordinateTargetOAuthAccounts,
-    makeTargetOAuthAccountsServices,
-  };
-});
-
-export class OAuthTarget extends Context.Service<OAuthTarget, Effect.Success<typeof make>>()(
-  "effect-auth/persistence/OAuthTarget",
-) {
-  static readonly layer = Layer.effect(OAuthTarget, make);
-}
-
-export const oauthAccountsPersistenceLayer = <E, R>(
-  services: Effect.Effect<
-    { readonly oauthAccountsPersistence: OAuthAccountsPersistence["Service"] },
-    E,
-    R
-  >,
-) =>
-  Layer.effect(
-    OAuthAccountsPersistence,
-    Effect.map(services, (value) => value.oauthAccountsPersistence),
-  );
-
-export const oauthSignInPersistenceLayer = <E, R>(
-  services: Effect.Effect<
-    { readonly oauthSignInPersistence: OAuthSignInPersistence["Service"] },
-    E,
-    R
-  >,
-) =>
-  Layer.effect(
-    OAuthSignInPersistence,
-    Effect.map(services, (value) => value.oauthSignInPersistence),
-  );
-
-export const oauthRegistrationIntentsLayer = <E, R>(
-  services: Effect.Effect<
-    { readonly oauthRegistrationIntents: OAuthRegistrationIntents["Service"] },
-    E,
-    R
-  >,
-) =>
-  Layer.effect(
-    OAuthRegistrationIntents,
-    Effect.map(services, (value) => value.oauthRegistrationIntents),
-  );
-
-export const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(
-  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,
-  services: Effect.Effect<
-    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },
-    E,
-    R
-  >,
-) =>
-  Layer.effect(
-    tag,
-    Effect.map(services, (value) => value.registrationAuthority),
-  );