@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/src/internal/persistence.ts

@@ -1,6 +1,12 @@
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { hasCommitScope } from "@yielded/auth/Hooks";
+import {
+  OAuthConnectedPersistence,
+  OAuthConnectedRevocations,
+  OAuthSignInPersistence,
+  OAuthUnavailable,
+} from "@yielded/auth/OAuth";
 import {
   PasskeyCredentials,
   PasskeyManagementPersistence,
@@ -8,7 +14,7 @@ import {
   PasskeyUnavailable,
 } from "@yielded/auth/Passkey";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
-import { hooksLayer } from "@yielded/auth/Persistence";
+import { hooksLayer, reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { PhoneSignInTargets, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
@@ -30,10 +36,12 @@ import {
   type SubjectOptions,
   type PasskeyFeature,
   type PasskeyRequirement,
+  type OAuthFeature,
 } from "./configuration";
 import { makeNativeEmailAddressServices } from "./email-native";
 import { PersistenceMappingError } from "./mapping-error";
 import type { NativeSqlTables } from "./native-sql-table";
+import { makeManagedOAuth } from "./oauth-managed";
 import { makeManagedPasskeys } from "./passkey-managed";
 import { makeNativePasswordServices } from "./password-native";
 import { makeComposedPhoneTargets } from "./phone-composed";
@@ -65,6 +73,8 @@ export interface Backend<T extends object, R, Database extends object = object>
   readonly describe: (table: T) => StorageTable;
   readonly acquire: Effect.Effect<Database, PersistenceConfigurationError, R | SqlClient.SqlClient>;
   readonly nativeTables: (database: Database) => NativeSqlTables;
+  /** Fixed atomic batches replace interactive transactions on backends such as D1. */
+  readonly batch?: (database: Database) => NonNullable<SqlBatchCommit["Service"]>;
 }
 
 const configError = (reason: string) => PersistenceConfigurationError.make({ reason });
@@ -86,6 +96,11 @@ const timestampKeys = new Set([
   "deadline",
   "occurredAt",
   "dedupUntil",
+  "binderExpiresAt",
+  "refreshClaimedAt",
+  "refreshClaimExpiresAt",
+  "claimedAt",
+  "claimExpiresAt",
 ]);
 
 export const createPersistence = <T extends object, R, Database extends object = object>(
@@ -94,27 +109,46 @@ export const createPersistence = <T extends object, R, Database extends object =
   const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(
     auth: A & Definition<C, Id>,
   ) => {
-    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);
-    const phone = features.some((feature) => feature?.kind === "phone");
-    const password = features.some((feature) => feature?.kind === "password");
+    const features = Object.values(auth.strategies).flatMap((strategy) =>
+      strategy.persistence === undefined ? [] : [strategy.persistence],
+    );
+
+    const phone = features.some((feature) => feature.kind === "phone");
+    const password = features.some((feature) => feature.kind === "password");
 
     const passkeys = features.filter(
-      (feature): feature is PasskeyFeature => feature?.kind === "passkey",
+      (feature): feature is PasskeyFeature => feature.kind === "passkey",
     );
 
+    const oauth = features.filter((feature): feature is OAuthFeature => feature?.kind === "oauth");
+    const oauthSignIn = oauth.some((feature) => feature.signIn);
+    const oauthConnected = oauth.some((feature) => feature.connected !== undefined);
+    const stateful = auth.sessionMode === "stateful";
+
+    const stateless =
+      auth.sessionMode === "stateless" &&
+      features.length > 0 &&
+      features.every((feature) => feature?.kind === "oauth");
+
     const management = features.some(
-      (feature) => feature?.kind === "password" && feature.management,
+      (feature) => feature.kind === "password" && feature.management,
     );
 
-    const email = features.some((feature) => feature?.kind === "email" && feature.addresses);
+    const email = features.some((feature) => feature.kind === "email" && feature.addresses);
     const proofs = phone || management || email;
 
-    const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "pending"];
+    const roles: StorageRole[] = ["identifiers", "credentials"];
 
+    if (stateful) roles.push("sessions");
+    roles.push("pending");
     if (password) roles.push("passwords");
     if (email) roles.push("emailCredentials");
     if (passkeys.length > 0) roles.push("passkeyCredentials", "passkeyFlows");
     if (proofs) roles.push("proofs");
+    if (oauth.length > 0) roles.push("oauthIdentities", "oauthCredentials");
+    if (oauthSignIn) roles.push("oauthSignInFlows");
+    if (oauthConnected)
+      roles.push("oauthConnectedFlows", "oauthConnectedGrants", "oauthConnectedRevocations");
 
     const ConfigKey = Context.Service<
       ConfigId<A["namespace"]>,
@@ -233,205 +267,229 @@ export const createPersistence = <T extends object, R, Database extends object =
     };
 
     const services = Layer.effectContext(
-      Effect.gen(function* () {
-        const storage = yield* ConfigKey;
-        const client = yield* SqlClient.SqlClient;
-        const database = yield* backend.acquire;
-
-        const dialect = client.onDialectOrElse({
-          pg: () => "pg" as const,
-          sqlite: () => "sqlite" as const,
-          orElse: () => undefined,
-        });
+      Effect.flatMap(backend.acquire, (database) =>
+        Effect.gen(function* () {
+          const storage = yield* ConfigKey;
+          const client = yield* SqlClient.SqlClient;
+
+          const dialect = client.onDialectOrElse({
+            pg: () => "pg" as const,
+            sqlite: () => "sqlite" as const,
+            orElse: () => undefined,
+          });
 
-        if (dialect === undefined)
-          return yield* configError("Use an explicit adapter for this SQL dialect");
-        if (auth.sessionMode !== "stateful")
-          return yield* configError("The composed layer currently requires stateful sessions");
-        if (
-          features.some(
-            (feature) =>
-              feature === undefined ||
-              ("lifecycle" in feature && feature.lifecycle) ||
-              (feature.kind === "email" && !feature.addresses),
+          if (dialect === undefined)
+            return yield* configError("Use an explicit adapter for this SQL dialect");
+          if (
+            features.some(
+              (feature) =>
+                ("lifecycle" in feature && feature.lifecycle) ||
+                (feature.kind === "email" && !feature.addresses),
+            )
           )
-        )
-          return yield* configError(
-            "Use explicit services for strategies without composed persistence support",
-          );
-        if (storage.namespace !== auth.namespace)
-          return yield* configError(
-            "Persistence configuration belongs to a different Auth definition",
-          );
-        const validations: StorageValidation[] = [];
+            return yield* configError(
+              "Use explicit services for strategies without composed persistence support",
+            );
+          if (storage.namespace !== auth.namespace)
+            return yield* configError(
+              "Persistence configuration belongs to a different Auth definition",
+            );
+          const validations: StorageValidation[] = [];
 
-        for (const role of roles) {
-          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];
+          for (const role of roles) {
+            const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];
 
-          if (table === undefined) return yield* configError(`Missing ${role} table`);
-          const description = backend.describe(table);
-          const columns = description.columns;
+            if (table === undefined) return yield* configError(`Missing ${role} table`);
+            const description = backend.describe(table);
+            const columns = description.columns;
 
-          for (const name of Object.keys(storageTables[role].columns)) {
-            if (columns[name] === undefined)
-              return yield* configError(`Missing ${role}.${name} column`);
+            for (const name of Object.keys(storageTables[role].columns)) {
+              if (columns[name] === undefined)
+                return yield* configError(`Missing ${role}.${name} column`);
+            }
+            validations.push({ table: description, required: storageTables[role].unique });
           }
-          validations.push({ table: description, required: storageTables[role].unique });
-        }
-        validations.push({
-          table: backend.describe(storage.subjects.table as T),
-          required: [[storage.subjects.id]],
-        });
-        yield* validateStorageBatch(dialect, validations);
-        const mappings = yield* makeMappings(storage);
-
-        const nativeTables = backend.nativeTables(database);
-        const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);
-        const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
-
-        const sessionServices = yield* makeNativeStatefulSessionServices(
-          nativeTables,
-          sessionMapping,
-        );
+          validations.push({
+            table: backend.describe(storage.subjects.table as T),
+            required: [[storage.subjects.id]],
+          });
+          yield* validateStorageBatch(dialect, validations);
+          const nativeTables = backend.nativeTables(database);
+          const mappings = yield* makeMappings(storage, nativeTables);
 
-        const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(
-          nativeTables,
-          sessionMapping,
-        );
+          const sessionMapping = stateful
+            ? mappings.sessions(auth.claims, auth.sessions.moduleId)
+            : undefined;
 
-        const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(
-          nativeTables,
-          pendingMapping,
-        );
+          const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
 
-        const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(nativeTables, {
-          ...pendingMapping,
-          source: {
-            kind: "Stateful",
-            session: sessionMapping.session,
-            sessionId: sessionMapping.sessionId,
-            constraints: { sessionDigest: "unique(session.digest)" },
-          },
-        });
+          const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(
+            nativeTables,
+            sessionMapping ?? {
+              ...pendingMapping,
+              pending: { pending: pendingMapping.pending, login: pendingMapping.login },
+            },
+          );
 
-        const { sessionCleanup } = yield* makeNativeSessionCleanupServices(
-          nativeTables,
-          pendingMapping,
-        );
+          const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(
+            nativeTables,
+            pendingMapping,
+          );
 
-        let context: Context.Context<never> = Context.make(
-          AuthenticationAuthority,
-          authenticationAuthority,
-        ).pipe(
-          Context.add(
-            auth.sessions.StatefulSessionPersistence,
-            sessionServices.statefulSessionPersistence,
-          ),
-          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
-          Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),
-          Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),
-          Context.add(auth.sessions.SessionCleanup, sessionCleanup),
-        );
+          const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(
+            nativeTables,
+            {
+              ...pendingMapping,
+              source:
+                sessionMapping === undefined
+                  ? { kind: "StatelessSigned" }
+                  : {
+                      kind: "Stateful",
+                      session: sessionMapping.session,
+                      sessionId: sessionMapping.sessionId,
+                      constraints: { sessionDigest: "unique(session.digest)" },
+                    },
+            },
+          );
 
-        const proofMapping = proofs ? mappings.proofs() : undefined;
+          const { sessionCleanup } = yield* makeNativeSessionCleanupServices(
+            nativeTables,
+            pendingMapping,
+          );
 
-        if (proofMapping !== undefined) {
-          const services = yield* makeNativeProofServices(
-            backend.nativeTables(database),
-            proofMapping,
+          let context: Context.Context<never> = Context.make(
+            AuthenticationAuthority,
+            authenticationAuthority,
+          ).pipe(
+            Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),
+            Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),
+            Context.add(auth.sessions.SessionCleanup, sessionCleanup),
           );
 
-          context = Context.add(context, ProofPersistence, services.proofPersistence);
-        }
+          if (sessionMapping !== undefined) {
+            const sessionServices = yield* makeNativeStatefulSessionServices(
+              nativeTables,
+              sessionMapping,
+            );
 
-        if (password) {
-          const mapping = mappings.passwords();
+            context = context.pipe(
+              Context.add(
+                auth.sessions.StatefulSessionPersistence,
+                sessionServices.statefulSessionPersistence,
+              ),
+              Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
+            );
+          }
 
-          const services = yield* makeNativePasswordServices(
-            backend.nativeTables(database),
-            mapping,
-            proofMapping,
-          );
+          const proofMapping = proofs ? mappings.proofs() : undefined;
 
-          context = Context.add(context, PasswordPersistence, services.passwordPersistence);
-        }
-        for (const [name, strategy] of Object.entries(auth.strategies)) {
-          if (strategy.persistence?.kind !== "password" || !strategy.persistence.management)
-            continue;
-          const key = strategy.RegistrationAuthority;
+          if (proofMapping !== undefined) {
+            const services = yield* makeNativeProofServices(
+              backend.nativeTables(database),
+              proofMapping,
+            );
 
-          if (key === undefined)
-            return yield* configError(`Missing subject provisioning for ${name}`);
+            context = Context.add(context, ProofPersistence, services.proofPersistence);
+          }
 
-          const registration = yield* makeRegistrationAuthority(
-            backend.nativeTables(database),
-            mappings.passwords(),
-            ProvisioningKey,
-            name,
-          );
+          if (password) {
+            const mapping = mappings.passwords();
 
-          context = Context.add(context, key, registration);
-        }
-        if (email)
-          context = Context.add(
-            context,
-            EmailAddressPersistence,
-            (yield* makeNativeEmailAddressServices(
+            const services = yield* makeNativePasswordServices(
               backend.nativeTables(database),
-              mappings.emails(),
+              mapping,
               proofMapping,
-            )).emailAddressPersistence,
-          );
+            );
 
-        if (phone)
-          context = Context.add(
-            context,
-            PhoneSignInTargets,
-            yield* makeComposedPhoneTargets(
+            context = Context.add(context, PasswordPersistence, services.passwordPersistence);
+          }
+          for (const [name, strategy] of Object.entries(auth.strategies)) {
+            if (strategy.persistence?.kind !== "password" || !strategy.persistence.management)
+              continue;
+            const key = strategy.RegistrationAuthority;
+
+            if (key === undefined)
+              return yield* configError(`Missing subject provisioning for ${name}`);
+
+            const registration = yield* makeRegistrationAuthority(
               backend.nativeTables(database),
-              storage,
-              mappings.proofs(),
-              features.flatMap((feature) => (feature?.kind === "phone" ? [feature.moduleId] : [])),
-            ),
-          );
+              mappings.passwords(),
+              ProvisioningKey,
+              name,
+            );
 
-        if (passkeys.length > 0) {
-          // Auth capability metadata determines whether PasskeyConfig is required.
-          const services = makeManagedPasskeys(
-            {
-              storage,
-              namespace: auth.namespace,
-              dialect,
-              features: passkeys,
-              passwordModules: features.flatMap((feature) =>
-                feature?.kind === "password" ? [feature.moduleId] : [],
+            context = Context.add(context, key, registration);
+          }
+          if (email)
+            context = Context.add(
+              context,
+              EmailAddressPersistence,
+              (yield* makeNativeEmailAddressServices(
+                backend.nativeTables(database),
+                mappings.emails(),
+                proofMapping,
+              )).emailAddressPersistence,
+            );
+
+          if (phone)
+            context = Context.add(
+              context,
+              PhoneSignInTargets,
+              yield* makeComposedPhoneTargets(
+                backend.nativeTables(database),
+                storage,
+                mappings.proofs(),
+                features.flatMap((feature) => (feature.kind === "phone" ? [feature.moduleId] : [])),
               ),
-            },
-            backend.nativeTables(database),
-          ) as Effect.Effect<
-            Context.Context<never>,
-            PersistenceConfigurationError,
-            PasskeyRequirement<A> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient
-          >;
-
-          context = Context.merge(context, yield* services);
-        }
+            );
 
-        // The checked capability metadata above determines exactly these service keys.
-        return context as Context.Context<Ports<C, Id, A>>;
-      }).pipe(
-        Effect.provideService(SqlBatchCommit, undefined),
-        withStorageValidation,
-        Effect.mapError((error) =>
-          Schema.is(PersistenceConfigurationError)(error)
-            ? error
-            : configError("Cannot acquire SQL persistence"),
-        ),
-      ),
+          if (passkeys.length > 0) {
+            // Auth capability metadata determines whether PasskeyConfig is required.
+            const services = makeManagedPasskeys(
+              {
+                storage,
+                namespace: auth.namespace,
+                dialect,
+                features: passkeys,
+                passwordModules: features.flatMap((feature) =>
+                  feature.kind === "password" ? [feature.moduleId] : [],
+                ),
+              },
+              backend.nativeTables(database),
+            ) as Effect.Effect<
+              Context.Context<never>,
+              PersistenceConfigurationError,
+              | PasskeyRequirement<A>
+              | Crypto.Crypto
+              | LifecycleHooks
+              | SqlClient.SqlClient
+              | SqlBatchCommit
+            >;
+
+            context = Context.merge(context, yield* services);
+          }
+
+          if (oauth.length > 0)
+            context = Context.merge(context, yield* makeManagedOAuth(storage, nativeTables, oauth));
+
+          // The checked capability metadata above determines exactly these service keys.
+          return context as Context.Context<Ports<C, Id, A>>;
+        }).pipe(Effect.provideService(SqlBatchCommit, backend.batch?.(database))),
+      ).pipe(withStorageValidation),
     ).pipe(Layer.provide(hooksLayer));
 
     const layer = Layer.effectContext(
       Effect.gen(function* () {
+        if (!stateful && !stateless) {
+          if (auth.sessionMode === "stateless")
+            return yield* configError(
+              "Composed stateless sessions support only OAuth strategies; use explicit persistence for other strategies",
+            );
+
+          return yield* configError(
+            "Composed persistence supports stateful or OAuth-only stateless sessions; state-assisted validity and other session modes require explicit persistence",
+          );
+        }
         const scope = yield* Effect.scope;
         const captured = yield* Effect.context<Layer.Services<typeof services>>();
         const client = Context.get(captured, SqlClient.SqlClient);
@@ -455,7 +513,22 @@ export const createPersistence = <T extends object, R, Database extends object =
             if (yield* hasCommitScope) return yield* Effect.fail(unavailable());
             yield* requireStandalone(unavailable, client.transactionService);
           }
-          const acquired = yield* initialize.pipe(Effect.mapError(unavailable));
+
+          // Observe the cached failure in this invocation, not the captured setup context.
+          const acquired = yield* initialize.pipe(
+            Effect.tapError((error) =>
+              reportAuthDiagnostic(
+                "persistence-initialization",
+                Schema.is(PersistenceConfigurationError)(error)
+                  ? "configuration"
+                  : Schema.is(PersistenceMappingError)(error)
+                    ? "mapping"
+                    : "unavailable",
+              ),
+            ),
+            Effect.mapError(unavailable),
+          );
+
           const value = Context.getOrUndefined(acquired, key);
 
           return value === undefined ? yield* Effect.fail(unavailable()) : value;
@@ -465,18 +538,6 @@ export const createPersistence = <T extends object, R, Database extends object =
         const authority = service(AuthenticationAuthority, sessionUnavailable, false);
         const authorityMutation = service(AuthenticationAuthority, sessionUnavailable);
 
-        const sessions = service(
-          auth.sessions.StatefulSessionPersistence,
-          sessionUnavailable,
-          false,
-        );
-
-        const sessionMutations = service(
-          auth.sessions.StatefulSessionPersistence,
-          sessionUnavailable,
-        );
-
-        const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);
         const pendingRead = service(auth.sessions.PendingAuthentication, sessionUnavailable, false);
         const pendingMutation = service(auth.sessions.PendingAuthentication, sessionUnavailable);
 
@@ -496,22 +557,6 @@ export const createPersistence = <T extends object, R, Database extends object =
           approve: (input, prepare) =>
             Effect.flatMap(authorityMutation, (s) => s.approve(input, prepare)),
         }).pipe(
-          Context.add(auth.sessions.StatefulSessionPersistence, {
-            establish: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),
-            verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),
-            rotate: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),
-            revokeDigest: (digest, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),
-            revoke: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),
-            revokeAll: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare)),
-          }),
-          Context.add(auth.sessions.SessionRepository, {
-            list: (input) => Effect.flatMap(repository, (s) => s.list(input)),
-          }),
           Context.add(auth.sessions.PendingAuthentication, {
             create: (input, now, prepare) =>
               Effect.flatMap(pendingMutation, (s) => s.create(input, now, prepare)),
@@ -533,6 +578,40 @@ export const createPersistence = <T extends object, R, Database extends object =
           }),
         );
 
+        if (stateful) {
+          const sessions = service(
+            auth.sessions.StatefulSessionPersistence,
+            sessionUnavailable,
+            false,
+          );
+
+          const sessionMutations = service(
+            auth.sessions.StatefulSessionPersistence,
+            sessionUnavailable,
+          );
+
+          const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);
+
+          context = context.pipe(
+            Context.add(auth.sessions.StatefulSessionPersistence, {
+              establish: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),
+              verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),
+              rotate: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),
+              revokeDigest: (digest, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),
+              revoke: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),
+              revokeAll: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare)),
+            }),
+            Context.add(auth.sessions.SessionRepository, {
+              list: (input) => Effect.flatMap(repository, (s) => s.list(input)),
+            }),
+          );
+        }
+
         if (proofs) {
           const persistence = service(ProofPersistence, () => ProofUnavailable.make({}));
 
@@ -643,6 +722,83 @@ export const createPersistence = <T extends object, R, Database extends object =
           }
         }
 
+        const oauthUnavailable = () => OAuthUnavailable.make({});
+
+        function oauthService<I, S>(
+          key: Context.Key<I, S>,
+          moduleId: string,
+          capability: "signIn" | "connected",
+        ): Effect.Effect<S, OAuthUnavailable> {
+          const enabled = oauth.some(
+            (feature) =>
+              feature.moduleId === moduleId &&
+              (capability === "signIn" ? feature.signIn : feature.connected !== undefined),
+          );
+
+          return enabled ? service(key, oauthUnavailable) : Effect.fail(oauthUnavailable());
+        }
+
+        if (oauthSignIn) {
+          const persistence = (moduleId: string) =>
+            oauthService(OAuthSignInPersistence, moduleId, "signIn");
+
+          context = Context.add(context, OAuthSignInPersistence, {
+            issue: (input, prepare) =>
+              Effect.flatMap(persistence(input.context.moduleId), (s) => s.issue(input, prepare)),
+            consume: (input, prepare) =>
+              Effect.flatMap(persistence(input.moduleId), (s) => s.consume(input, prepare)),
+            resolve: (input) =>
+              Effect.flatMap(persistence(input.moduleId), (s) => s.resolve(input)),
+            cleanup: (input, prepare) =>
+              Effect.flatMap(persistence(input.moduleId), (s) => s.cleanup(input, prepare)),
+          });
+        }
+        if (oauthConnected) {
+          const persistence = (moduleId: string) =>
+            oauthService(OAuthConnectedPersistence, moduleId, "connected");
+
+          const revocations = (moduleId: string) =>
+            oauthService(OAuthConnectedRevocations, moduleId, "connected");
+
+          context = context.pipe(
+            Context.add(OAuthConnectedPersistence, {
+              read: (input) => Effect.flatMap(persistence(input.moduleId), (s) => s.read(input)),
+              issue: (input, prepare) =>
+                Effect.flatMap(persistence(input.context.moduleId), (s) => s.issue(input, prepare)),
+              consume: (input, prepare) =>
+                Effect.flatMap(persistence(input.moduleId), (s) => s.consume(input, prepare)),
+              settle: (input, prepare) =>
+                Effect.flatMap(persistence(input.grant.context.moduleId), (s) =>
+                  s.settle(input, prepare),
+                ),
+              list: (input) =>
+                Effect.flatMap(persistence(input.authorization.moduleId), (s) => s.list(input)),
+              disconnect: (input, prepare) =>
+                Effect.flatMap(persistence(input.key.moduleId), (s) =>
+                  s.disconnect(input, prepare),
+                ),
+              claimRefresh: (input, prepare) =>
+                Effect.flatMap(persistence(input.grant.context.moduleId), (s) =>
+                  s.claimRefresh(input, prepare),
+                ),
+              settleRefresh: (input, prepare) =>
+                Effect.flatMap(persistence(input.claim.grant.context.moduleId), (s) =>
+                  s.settleRefresh(input, prepare),
+                ),
+              cleanup: (input, prepare) =>
+                Effect.flatMap(persistence(input.moduleId), (s) => s.cleanup(input, prepare)),
+            }),
+            Context.add(OAuthConnectedRevocations, {
+              claim: (input, prepare) =>
+                Effect.flatMap(revocations(input.moduleId), (s) => s.claim(input, prepare)),
+              settle: (input, prepare) =>
+                Effect.flatMap(revocations(input.claim.job.grant.context.moduleId), (s) =>
+                  s.settle(input, prepare),
+                ),
+            }),
+          );
+        }
+
         // Match the same capability-selected service keys as the acquired graph.
         return context as Context.Context<Ports<C, Id, A>>;
       }),