@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/persistence.ts

@@ -1,9 +1,15 @@
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import type { PasskeyConfig } from "@yielded/auth/Passkey";
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { hasCommitScope } from "@yielded/auth/Hooks";
+import {
+  PasskeyCredentials,
+  PasskeyManagementPersistence,
+  PasskeyPersistence,
+  PasskeyUnavailable,
+} from "@yielded/auth/Passkey";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
 import { hooksLayer } from "@yielded/auth/Persistence";
-import { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
+import { PhoneSignInTargets, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
 import { Context, type Crypto, Effect, Layer, Schema } from "effect";
@@ -24,27 +30,22 @@ import {
   type SubjectOptions,
   type PasskeyFeature,
   type PasskeyRequirement,
-  type MappingInput,
 } from "./configuration";
-import { randomId } from "./crypto";
-import { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from "./email-kernel";
+import { makeNativeEmailAddressServices } from "./email-native";
 import { PersistenceMappingError } from "./mapping-error";
 import type { NativeSqlTables } from "./native-sql-table";
-import {
-  makePasswordKernel,
-  CurrentPasswordSql,
-  type PasswordSqlDatabase,
-} from "./password-kernel";
-import { makePhoneKernel, CurrentPhoneTransaction } from "./phone-kernel";
-import {
-  makeProofKernel,
-  CurrentProofSql,
-  type ProofSqlDatabase,
-  type ProofSqlQuery,
-} from "./proof-kernel";
-import type { QueryOperations } from "./query-operations";
+import { makeManagedPasskeys } from "./passkey-managed";
+import { makeNativePasswordServices } from "./password-native";
+import { makeComposedPhoneTargets } from "./phone-composed";
+import { makeNativeProofServices } from "./proof-native";
 import { makeRegistrationAuthority } from "./registration";
-import { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from "./session-kernel";
+import type { PasswordRegistrationAuthority } from "./registration-contract";
+import { makeNativeAuthenticationAuthorityServices } from "./session-native-authority";
+import { makeNativeSessionCleanupServices } from "./session-native-cleanup";
+import { makeNativePendingAuthenticationServices } from "./session-native-login";
+import { makeNativeStatefulSessionServices } from "./session-native-stateful";
+import { makeNativeSessionStepUpServices } from "./session-native-step-up";
+import { SqlBatchCommit } from "./sql-commit";
 import { requireStandalone } from "./standalone";
 import { makeMappings } from "./storage-mapping";
 import {
@@ -58,35 +59,12 @@ import {
   withStorageValidation,
   type StorageValidation,
 } from "./storage-validation";
-import { makeTransactionExecutionKernel } from "./transaction-execution-kernel";
-import {
-  makeTransactionKernel,
-  NativeDatabase,
-  type TransactionNativeDatabase,
-} from "./transaction-kernel";
 
-export interface Backend<T extends object, R> {
+export interface Backend<T extends object, R, Database extends object = object> {
   readonly makeTable: (definition: StorageTable) => T;
   readonly describe: (table: T) => StorageTable;
-  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;
-  readonly operations: QueryOperations;
-  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;
-  readonly passkeys: (input: {
-    readonly storage: MappingInput;
-    readonly namespace: string;
-    readonly dialect: "pg" | "sqlite";
-    readonly features: ReadonlyArray<PasskeyFeature>;
-    readonly passwordModules: ReadonlyArray<string>;
-  }) => Effect.Effect<
-    Context.Context<never>,
-    PersistenceConfigurationError,
-    | PasskeyConfig
-    | LifecycleHooks
-    | SqlClient.SqlClient
-    | NativeDatabase
-    | CurrentProofSql
-    | Crypto.Crypto
-  >;
+  readonly acquire: Effect.Effect<Database, PersistenceConfigurationError, R | SqlClient.SqlClient>;
+  readonly nativeTables: (database: Database) => NativeSqlTables;
 }
 
 const configError = (reason: string) => PersistenceConfigurationError.make({ reason });
@@ -110,17 +88,9 @@ const timestampKeys = new Set([
   "dedupUntil",
 ]);
 
-export const createPersistence = <T extends object, R>(
-  backend: Backend<T, R>,
+export const createPersistence = <T extends object, R, Database extends object = object>(
+  backend: Backend<T, R, Database>,
 ): PersistenceApi<T, R> => {
-  const proofKernel = makeProofKernel(backend.operations);
-  const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);
-  const emailKernel = makeEmailKernel(backend.operations, proofKernel);
-  const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);
-  const transactionKernel = makeTransactionKernel(backend.operations);
-  const executionKernel = makeTransactionExecutionKernel(transactionKernel);
-  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);
-
   const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(
     auth: A & Definition<C, Id>,
   ) => {
@@ -139,34 +109,12 @@ export const createPersistence = <T extends object, R>(
     const email = features.some((feature) => feature?.kind === "email" && feature.addresses);
     const proofs = phone || management || email;
 
-    const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "sessionFlows"];
-
-    if (password) roles.push("passwords", "passwordCommands");
-    if (management) roles.push("passwordRegistrations");
-    if (email) roles.push("emailCredentials", "emailCommands");
-    if (phone) roles.push("phoneState");
-    if (passkeys.length > 0)
-      roles.push(
-        "passkeyCredentials",
-        "passkeyOwnership",
-        "passkeyHandles",
-        "passkeyModules",
-        "passkeyFlows",
-        "passkeyAdmissions",
-        "passkeyCharges",
-      );
-    if (passkeys.some((feature) => feature.management)) roles.push("passkeyCommands");
-    if (proofs)
-      roles.push(
-        "proofRequests",
-        "proofSeries",
-        "proofGenerations",
-        "proofContinuations",
-        "proofScopes",
-        "proofAbuse",
-        "proofFailures",
-        "proofCommands",
-      );
+    const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "pending"];
+
+    if (password) roles.push("passwords");
+    if (email) roles.push("emailCredentials");
+    if (passkeys.length > 0) roles.push("passkeyCredentials", "passkeyFlows");
+    if (proofs) roles.push("proofs");
 
     const ConfigKey = Context.Service<
       ConfigId<A["namespace"]>,
@@ -287,7 +235,6 @@ export const createPersistence = <T extends object, R>(
     const services = Layer.effectContext(
       Effect.gen(function* () {
         const storage = yield* ConfigKey;
-        const hooks = yield* LifecycleHooks;
         const client = yield* SqlClient.SqlClient;
         const database = yield* backend.acquire;
 
@@ -338,89 +285,75 @@ export const createPersistence = <T extends object, R>(
         yield* validateStorageBatch(dialect, validations);
         const mappings = yield* makeMappings(storage);
 
-        const standalone = <E>(error: () => E) =>
-          requireStandalone(error, client.transactionService);
+        const nativeTables = backend.nativeTables(database);
+        const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);
+        const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
 
-        // Backend validation owns the foreign query-builder shape, never the decoded rows.
-        const native = database as ProofSqlDatabase &
-          PasswordSqlDatabase &
-          EmailSqlDatabase &
-          SessionSqlDatabase &
-          TransactionNativeDatabase;
+        const sessionServices = yield* makeNativeStatefulSessionServices(
+          nativeTables,
+          sessionMapping,
+        );
 
-        const options = {
-          mode: "interactive" as const,
-          locking: dialect === "pg",
-          standaloneGuard: standalone(() => SessionUnavailable.make({})),
-        };
+        const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(
+          nativeTables,
+          sessionMapping,
+        );
 
-        const sessionMapping = mappings.sessions(auth.claims);
+        const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(
+          nativeTables,
+          pendingMapping,
+        );
 
-        const sessionServices = yield* sessionKernel
-          .makeSqlStatefulSessions(sessionMapping, options)
-          .pipe(
-            Effect.provideService(CurrentSessionSql, native),
-            Effect.provideService(NativeDatabase, native),
-          );
+        const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(nativeTables, {
+          ...pendingMapping,
+          source: {
+            kind: "Stateful",
+            session: sessionMapping.session,
+            sessionId: sessionMapping.sessionId,
+            constraints: { sessionDigest: "unique(session.digest)" },
+          },
+        });
 
-        const authority = yield* sessionKernel
-          .makeSqlAuthenticationAuthority<C["Type"]>(
-            { ...mappings.authority(), isConstraintConflict: () => false },
-            options,
-          )
-          .pipe(
-            Effect.provideService(CurrentSessionSql, native),
-            Effect.provideService(NativeDatabase, native),
-          );
+        const { sessionCleanup } = yield* makeNativeSessionCleanupServices(
+          nativeTables,
+          pendingMapping,
+        );
 
-        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(
+        let context: Context.Context<never> = Context.make(
+          AuthenticationAuthority,
+          authenticationAuthority,
+        ).pipe(
           Context.add(
             auth.sessions.StatefulSessionPersistence,
             sessionServices.statefulSessionPersistence,
           ),
           Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
+          Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),
+          Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),
+          Context.add(auth.sessions.SessionCleanup, sessionCleanup),
         );
 
-        const proofConfiguration = proofs
-          ? {
-              mapping: mappings.proofs(),
-              configuration: {
-                mode: "interactive" as const,
-                locking: dialect === "pg",
-                standaloneGuard: standalone(() => ProofUnavailable.make({})),
-                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),
-              },
-            }
-          : undefined;
-
-        if (proofConfiguration !== undefined) {
-          context = Context.add(
-            context,
-            ProofPersistence,
-            yield* proofKernel
-              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)
-              .pipe(
-                Effect.provideService(CurrentProofSql, native),
-                Effect.provideService(NativeDatabase, native),
-              ),
+        const proofMapping = proofs ? mappings.proofs() : undefined;
+
+        if (proofMapping !== undefined) {
+          const services = yield* makeNativeProofServices(
+            backend.nativeTables(database),
+            proofMapping,
           );
+
+          context = Context.add(context, ProofPersistence, services.proofPersistence);
         }
 
         if (password) {
-          const persistence = yield* passwordKernel
-            .makeSqlPasswordPersistence(mappings.passwords(), {
-              mode: "interactive",
-              locking: dialect === "pg",
-              standaloneGuard: standalone(() => PasswordUnavailable.make({})),
-              insertIfAbsent: (query) => query.onConflictDoNothing(),
-              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),
-            })
-            .pipe(
-              Effect.provideService(CurrentPasswordSql, native),
-              Effect.provideService(NativeDatabase, native),
-            );
+          const mapping = mappings.passwords();
 
-          context = Context.add(context, PasswordPersistence, persistence);
+          const services = yield* makeNativePasswordServices(
+            backend.nativeTables(database),
+            mapping,
+            proofMapping,
+          );
+
+          context = Context.add(context, PasswordPersistence, services.passwordPersistence);
         }
         for (const [name, strategy] of Object.entries(auth.strategies)) {
           if (strategy.persistence?.kind !== "password" || !strategy.persistence.management)
@@ -431,168 +364,63 @@ export const createPersistence = <T extends object, R>(
             return yield* configError(`Missing subject provisioning for ${name}`);
 
           const registration = yield* makeRegistrationAuthority(
-            mappings,
-            backend.operations,
-            standalone(() => PasswordUnavailable.make({})),
+            backend.nativeTables(database),
+            mappings.passwords(),
             ProvisioningKey,
             name,
-          ).pipe(Effect.provideService(CurrentPasswordSql, native));
+          );
 
           context = Context.add(context, key, registration);
         }
-        if (email) {
+        if (email)
           context = Context.add(
             context,
             EmailAddressPersistence,
-            yield* emailKernel
-              .makeSqlEmailAddressPersistence(mappings.emails(), {
-                mode: "interactive",
-                locking: dialect === "pg",
-                standaloneGuard: standalone(() => EmailUnavailable.make({})),
-                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),
-              })
-              .pipe(
-                Effect.provideService(CurrentEmailSql, native),
-                Effect.provideService(NativeDatabase, native),
-              ),
+            (yield* makeNativeEmailAddressServices(
+              backend.nativeTables(database),
+              mappings.emails(),
+              proofMapping,
+            )).emailAddressPersistence,
           );
-        }
-        if (phone) {
-          const { column, eq } = backend.operations;
-
-          const mapping = (moduleId: string) => ({
-            moduleId,
-            subject: {
-              table: storage.subjects.table,
-              id: storage.subjects.id,
-              securityRevision: storage.subjects.securityRevision,
-              activeCondition: eq(
-                column(storage.subjects.table, storage.subjects.status),
-                storage.subjects.activeValue,
-              ),
-            },
-            subjectIds: {
-              toNative: storage.subjects.toNativeSync,
-              toSubject: storage.subjects.toSubjectSync,
-            },
-            identifier: {
-              table: mappings.table("identifiers"),
-              namespace: "namespace",
-              value: "value",
-              subjectId: "subjectId",
-              revision: "revision",
-              verifiedAt: "verifiedAt",
-              activeCondition: eq(column(mappings.table("identifiers"), "active"), true),
-            },
-            credential: {
-              table: mappings.table("credentials"),
-              id: "credentialId",
-              subjectId: "subjectId",
-              revision: "revision",
-              activeCondition: eq(column(mappings.table("credentials"), "active"), true),
-            },
-            state: {
-              table: mappings.table("phoneState"),
-              scope: "scope",
-              state: "state",
-              version: "version",
-              encodeInsert: (row: object) => row,
-            },
-            admission: {
-              windowMillis: 60_000,
-              networkRequests: 10,
-              networkAttempts: 100,
-              maximumMessages: 10,
-              requestRetentionMillis: 86_400_000,
-            },
-            engineNowMillis: backend.operations
-              .sql`${dialect === "pg" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,
-            encodeInstant: storage.encodeInstant,
-          });
-
-          const execution = yield* executionKernel
-            .makeTransactionExecution(
-              CurrentPhoneTransaction,
-              {
-                mode: "interactive",
-                dialect,
-                locking: dialect === "pg",
-                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),
-              },
-              () => PhoneOtpUnavailable.make({}),
-              randomId,
-            )
-            .pipe(Effect.provideService(NativeDatabase, native));
-
-          const run = <Value, E, Requirements>(
-            work: Effect.Effect<Value, E, Requirements>,
-            mutation = true,
-          ) =>
-            execution.admit.pipe(
-              Effect.andThen(execution.run(work, mutation)),
-              Effect.provideService(LifecycleHooks, hooks),
-            );
-
-          const allowed = (moduleId: string) =>
-            features.some((feature) => feature?.kind === "phone" && feature.moduleId === moduleId);
-
-          const admission = PhoneAdmission.of({
-            admit: (request) =>
-              allowed(request.moduleId)
-                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))
-                : Effect.fail(PhoneOtpUnavailable.make({})),
-            cleanup: (request) =>
-              allowed(request.moduleId)
-                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))
-                : Effect.fail(PhoneOtpUnavailable.make({})),
-          });
 
-          const targets = PhoneSignInTargets.of({
-            lookup: (request) =>
-              allowed(request.moduleId)
-                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)
-                : Effect.fail(PhoneOtpUnavailable.make({})),
-          });
-
-          context = context.pipe(
-            Context.add(PhoneAdmission, admission),
-            Context.add(PhoneSignInTargets, targets),
+        if (phone)
+          context = Context.add(
+            context,
+            PhoneSignInTargets,
+            yield* makeComposedPhoneTargets(
+              backend.nativeTables(database),
+              storage,
+              mappings.proofs(),
+              features.flatMap((feature) => (feature?.kind === "phone" ? [feature.moduleId] : [])),
+            ),
           );
-        }
 
         if (passkeys.length > 0) {
           // Auth capability metadata determines whether PasskeyConfig is required.
-          const services = backend.passkeys({
-            storage,
-            namespace: auth.namespace,
-            dialect,
-            features: passkeys,
-            passwordModules: features.flatMap((feature) =>
-              feature?.kind === "password" ? [feature.moduleId] : [],
-            ),
-          }) as Effect.Effect<
+          const services = makeManagedPasskeys(
+            {
+              storage,
+              namespace: auth.namespace,
+              dialect,
+              features: passkeys,
+              passwordModules: features.flatMap((feature) =>
+                feature?.kind === "password" ? [feature.moduleId] : [],
+              ),
+            },
+            backend.nativeTables(database),
+          ) as Effect.Effect<
             Context.Context<never>,
             PersistenceConfigurationError,
-            | PasskeyRequirement<A>
-            | Crypto.Crypto
-            | LifecycleHooks
-            | SqlClient.SqlClient
-            | NativeDatabase
-            | CurrentProofSql
+            PasskeyRequirement<A> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient
           >;
 
-          context = Context.merge(
-            context,
-            yield* services.pipe(
-              Effect.provideService(NativeDatabase, native),
-              Effect.provideService(CurrentProofSql, native),
-            ),
-          );
+          context = Context.merge(context, yield* services);
         }
 
         // The checked capability metadata above determines exactly these service keys.
         return context as Context.Context<Ports<C, Id, A>>;
       }).pipe(
+        Effect.provideService(SqlBatchCommit, undefined),
         withStorageValidation,
         Effect.mapError((error) =>
           Schema.is(PersistenceConfigurationError)(error)
@@ -602,10 +430,228 @@ export const createPersistence = <T extends object, R>(
       ),
     ).pipe(Layer.provide(hooksLayer));
 
+    const layer = Layer.effectContext(
+      Effect.gen(function* () {
+        const scope = yield* Effect.scope;
+        const captured = yield* Effect.context<Layer.Services<typeof services>>();
+        const client = Context.get(captured, SqlClient.SqlClient);
+
+        // Construction uses the layer's exact environment and lifetime, never the
+        // first operation's SQL transaction, service overrides, or request scope.
+        // Cache the full exit: concurrent callers share failures/interruption too,
+        // and cannot retry partially completed setup within this acquired layer.
+        const initialize = yield* Effect.cached(
+          Layer.buildWithScope(services, scope).pipe(Effect.setContext(captured)),
+        );
+
+        const service = Effect.fnUntraced(function* <I, S, Failure>(
+          key: Context.Key<I, S>,
+          unavailable: () => Failure,
+          standalone = true,
+        ): Effect.fn.Return<S, Failure> {
+          // Reject unsupported ownership before setup can perform any writes.
+          // Session/authority reads retain their existing ambient-read semantics.
+          if (standalone) {
+            if (yield* hasCommitScope) return yield* Effect.fail(unavailable());
+            yield* requireStandalone(unavailable, client.transactionService);
+          }
+          const acquired = yield* initialize.pipe(Effect.mapError(unavailable));
+          const value = Context.getOrUndefined(acquired, key);
+
+          return value === undefined ? yield* Effect.fail(unavailable()) : value;
+        });
+
+        const sessionUnavailable = () => SessionUnavailable.make({});
+        const authority = service(AuthenticationAuthority, sessionUnavailable, false);
+        const authorityMutation = service(AuthenticationAuthority, sessionUnavailable);
+
+        const sessions = service(
+          auth.sessions.StatefulSessionPersistence,
+          sessionUnavailable,
+          false,
+        );
+
+        const sessionMutations = service(
+          auth.sessions.StatefulSessionPersistence,
+          sessionUnavailable,
+        );
+
+        const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);
+        const pendingRead = service(auth.sessions.PendingAuthentication, sessionUnavailable, false);
+        const pendingMutation = service(auth.sessions.PendingAuthentication, sessionUnavailable);
+
+        const stepUpRead = service(
+          auth.sessions.SessionStepUpPersistence,
+          sessionUnavailable,
+          false,
+        );
+
+        const stepUpMutation = service(auth.sessions.SessionStepUpPersistence, sessionUnavailable);
+        const cleanup = service(auth.sessions.SessionCleanup, sessionUnavailable);
+
+        let context: Context.Context<never> = Context.make(AuthenticationAuthority, {
+          capture: (subjectId, credentialIds) =>
+            Effect.flatMap(authority, (s) => s.capture(subjectId, credentialIds)),
+          requirements: (evidence) => Effect.flatMap(authority, (s) => s.requirements(evidence)),
+          approve: (input, prepare) =>
+            Effect.flatMap(authorityMutation, (s) => s.approve(input, prepare)),
+        }).pipe(
+          Context.add(auth.sessions.StatefulSessionPersistence, {
+            establish: (input, prepare) =>
+              Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),
+            verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),
+            rotate: (input, prepare) =>
+              Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),
+            revokeDigest: (digest, prepare) =>
+              Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),
+            revoke: (input, prepare) =>
+              Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),
+            revokeAll: (input, prepare) =>
+              Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare)),
+          }),
+          Context.add(auth.sessions.SessionRepository, {
+            list: (input) => Effect.flatMap(repository, (s) => s.list(input)),
+          }),
+          Context.add(auth.sessions.PendingAuthentication, {
+            create: (input, now, prepare) =>
+              Effect.flatMap(pendingMutation, (s) => s.create(input, now, prepare)),
+            read: (input) => Effect.flatMap(pendingRead, (s) => s.read(input)),
+            reject: (input, prepare) =>
+              Effect.flatMap(pendingMutation, (s) => s.reject(input, prepare)),
+          }),
+          Context.add(auth.sessions.SessionStepUpPersistence, {
+            create: (input, now, prepare) =>
+              Effect.flatMap(stepUpMutation, (s) => s.create(input, now, prepare)),
+            read: (input) => Effect.flatMap(stepUpRead, (s) => s.read(input)),
+            reject: (input, prepare) =>
+              Effect.flatMap(stepUpMutation, (s) => s.reject(input, prepare)),
+            complete: (plan, prepare) =>
+              Effect.flatMap(stepUpMutation, (s) => s.complete(plan, prepare)),
+          }),
+          Context.add(auth.sessions.SessionCleanup, {
+            cleanup: (input) => Effect.flatMap(cleanup, (s) => s.cleanup(input)),
+          }),
+        );
+
+        if (proofs) {
+          const persistence = service(ProofPersistence, () => ProofUnavailable.make({}));
+
+          context = Context.add(context, ProofPersistence, {
+            issue: (input, prepare) => Effect.flatMap(persistence, (s) => s.issue(input, prepare)),
+            redeem: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.redeem(input, prepare)),
+            cancel: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.cancel(input, prepare)),
+            cleanup: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.cleanup(input, prepare)),
+          });
+        }
+        if (password) {
+          const persistence = service(PasswordPersistence, () => PasswordUnavailable.make({}));
+
+          context = Context.add(context, PasswordPersistence, {
+            findCredential: (input) => Effect.flatMap(persistence, (s) => s.findCredential(input)),
+            rehashIfCurrent: (input) =>
+              Effect.flatMap(persistence, (s) => s.rehashIfCurrent(input)),
+            readForSubject: (input) => Effect.flatMap(persistence, (s) => s.readForSubject(input)),
+            recoveryTarget: (input) => Effect.flatMap(persistence, (s) => s.recoveryTarget(input)),
+            addIfAbsent: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.addIfAbsent(input, prepare)),
+            replaceIfCurrent: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.replaceIfCurrent(input, prepare)),
+            resetWithProof: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.resetWithProof(input, prepare)),
+          });
+        }
+        for (const [name, strategy] of Object.entries(auth.strategies)) {
+          if (strategy.persistence?.kind !== "password" || !strategy.persistence.management)
+            continue;
+          const key = strategy.RegistrationAuthority;
+
+          if (key === undefined)
+            return yield* configError(`Missing subject provisioning for ${name}`);
+
+          // The heterogeneous strategy table erases the registration input type;
+          // its decoded value is forwarded unchanged to the same authority key.
+          const registration = service(
+            key as Context.Key<unknown, PasswordRegistrationAuthority<unknown>>,
+            () => PasswordUnavailable.make({}),
+          );
+
+          context = Context.add(context, key, {
+            register: (input, prepare) =>
+              Effect.flatMap(registration, (s) => s.register(input, prepare)),
+          } satisfies PasswordRegistrationAuthority<unknown>);
+        }
+        if (email) {
+          const persistence = service(EmailAddressPersistence, () => EmailUnavailable.make({}));
+
+          context = Context.add(context, EmailAddressPersistence, {
+            target: (input) => Effect.flatMap(persistence, (s) => s.target(input)),
+            verifyWithProof: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.verifyWithProof(input, prepare)),
+            changeWithProof: (input, prepare) =>
+              Effect.flatMap(persistence, (s) => s.changeWithProof(input, prepare)),
+          });
+        }
+        if (phone) {
+          const unavailable = () => PhoneOtpUnavailable.make({});
+          const targets = service(PhoneSignInTargets, unavailable);
+
+          context = context.pipe(
+            Context.add(PhoneSignInTargets, {
+              lookup: (input) => Effect.flatMap(targets, (s) => s.lookup(input)),
+            }),
+          );
+        }
+        if (passkeys.length > 0) {
+          const unavailable = () => PasskeyUnavailable.make({});
+          const credentials = service(PasskeyCredentials, unavailable);
+          const persistence = service(PasskeyPersistence, unavailable);
+
+          context = context.pipe(
+            Context.add(PasskeyCredentials, {
+              lookup: (input) => Effect.flatMap(credentials, (s) => s.lookup(input)),
+              listForSubject: (input) =>
+                Effect.flatMap(credentials, (s) => s.listForSubject(input)),
+            }),
+            Context.add(PasskeyPersistence, {
+              issue: (input, prepare) =>
+                Effect.flatMap(persistence, (s) => s.issue(input, prepare)),
+              context: (input) => Effect.flatMap(persistence, (s) => s.context(input)),
+              consume: (input, prepare) =>
+                Effect.flatMap(persistence, (s) => s.consume(input, prepare)),
+              cleanup: (input, prepare) =>
+                Effect.flatMap(persistence, (s) => s.cleanup(input, prepare)),
+            }),
+          );
+          if (passkeys.some((feature) => feature.management)) {
+            const manager = service(PasskeyManagementPersistence, unavailable);
+
+            context = context.pipe(
+              Context.add(PasskeyManagementPersistence, {
+                list: (input) => Effect.flatMap(manager, (s) => s.list(input)),
+                completeEnrollment: (input, prepare) =>
+                  Effect.flatMap(manager, (s) => s.completeEnrollment(input, prepare)),
+                inspectRemove: (input) => Effect.flatMap(manager, (s) => s.inspectRemove(input)),
+                remove: (input, prepare) =>
+                  Effect.flatMap(manager, (s) => s.remove(input, prepare)),
+                rename: (input, prepare) =>
+                  Effect.flatMap(manager, (s) => s.rename(input, prepare)),
+              }),
+            );
+          }
+        }
+
+        // Match the same capability-selected service keys as the acquired graph.
+        return context as Context.Context<Ports<C, Id, A>>;
+      }),
+    );
+
     return {
       Config,
       Provisioning: ProvisioningKey,
-      layer: services,
+      layer,
       managed: <N, Instant = number>(options: {
         readonly subjects: SubjectOptions<T, N>;
         readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;