@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.1

package/src/SqliteNode.ts

@@ -3,30 +3,12 @@ import { type EffectSQLiteNodeDatabase, makeWithDefaults } from "drizzle-orm/eff
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Effect } from "effect";
 
+import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target";
 import type {
-  AuthStoreTables,
-  AuthTables,
   ExternalIdentityTables,
   IdentityTables,
-  OAuthStateTables,
   SubjectProvisioningTables,
 } from "./drizzle/model";
-import {
-  coordinateSqliteAuthStoreTransaction,
-  coordinateSqliteAuthTransaction,
-  coordinateSqliteOAuthStateTransaction,
-  makeSqliteAuthServices,
-  makeSqliteAuthStoreServices,
-  makeSqliteOAuthStateServices,
-} from "./drizzle/sqlite";
-
-export {
-  coordinateSqliteAuthStoreTransaction as coordinateAuthStoreTransaction,
-  coordinateSqliteAuthTransaction as coordinateAuthTransaction,
-  coordinateSqliteOAuthStateTransaction as coordinateOAuthStateTransaction,
-};
-
-import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target";
 import { sqlClientPasswordStandaloneGuard } from "./drizzle/password-target";
 import { sqlClientProofStandaloneGuard } from "./drizzle/proof-target";
 import { sqlClientSessionStandaloneGuard } from "./drizzle/session-target";
@@ -97,25 +79,6 @@ export const {
 
 export const commitMode = "interactive" as const;
 
-export const makeAuthStoreServices = <C extends AnySQLiteTable, R extends AnySQLiteTable>(
-  database: EffectSQLiteNodeDatabase<AnyRelations>,
-  mapping: AuthStoreTables<C, R>,
-) => makeSqliteAuthStoreServices(database, mapping);
-
-export const makeOAuthStateServices = <S extends AnySQLiteTable>(
-  database: EffectSQLiteNodeDatabase<AnyRelations>,
-  mapping: OAuthStateTables<S>,
-) => makeSqliteOAuthStateServices(database, mapping);
-
-export const makeAuthServices = <
-  C extends AnySQLiteTable,
-  R extends AnySQLiteTable,
-  S extends AnySQLiteTable,
->(
-  database: EffectSQLiteNodeDatabase<AnyRelations>,
-  mapping: AuthTables<C, R, S>,
-) => makeSqliteAuthServices(database, mapping);
-
 export const makeIdentityServices = <
   Subject extends AnySQLiteTable,
   Identifier extends AnySQLiteTable,

package/src/SqliteWasm.ts

@@ -3,30 +3,12 @@ import { type EffectSQLiteWasmDatabase, makeWithDefaults } from "drizzle-orm/eff
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Effect } from "effect";
 
+import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target";
 import type {
-  AuthStoreTables,
-  AuthTables,
   ExternalIdentityTables,
   IdentityTables,
-  OAuthStateTables,
   SubjectProvisioningTables,
 } from "./drizzle/model";
-import {
-  coordinateSqliteAuthStoreTransaction,
-  coordinateSqliteAuthTransaction,
-  coordinateSqliteOAuthStateTransaction,
-  makeSqliteAuthServices,
-  makeSqliteAuthStoreServices,
-  makeSqliteOAuthStateServices,
-} from "./drizzle/sqlite";
-
-export {
-  coordinateSqliteAuthStoreTransaction as coordinateAuthStoreTransaction,
-  coordinateSqliteAuthTransaction as coordinateAuthTransaction,
-  coordinateSqliteOAuthStateTransaction as coordinateOAuthStateTransaction,
-};
-
-import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target";
 import { sqlClientPasswordStandaloneGuard } from "./drizzle/password-target";
 import { sqlClientProofStandaloneGuard } from "./drizzle/proof-target";
 import { sqlClientSessionStandaloneGuard } from "./drizzle/session-target";
@@ -97,25 +79,6 @@ export const {
 
 export const commitMode = "interactive" as const;
 
-export const makeAuthStoreServices = <C extends AnySQLiteTable, R extends AnySQLiteTable>(
-  database: EffectSQLiteWasmDatabase<AnyRelations>,
-  mapping: AuthStoreTables<C, R>,
-) => makeSqliteAuthStoreServices(database, mapping);
-
-export const makeOAuthStateServices = <S extends AnySQLiteTable>(
-  database: EffectSQLiteWasmDatabase<AnyRelations>,
-  mapping: OAuthStateTables<S>,
-) => makeSqliteOAuthStateServices(database, mapping);
-
-export const makeAuthServices = <
-  C extends AnySQLiteTable,
-  R extends AnySQLiteTable,
-  S extends AnySQLiteTable,
->(
-  database: EffectSQLiteWasmDatabase<AnyRelations>,
-  mapping: AuthTables<C, R, S>,
-) => makeSqliteAuthServices(database, mapping);
-
 export const makeIdentityServices = <
   Subject extends AnySQLiteTable,
   Identifier extends AnySQLiteTable,

package/src/drizzle/D1BatchStatements.ts

@@ -1,5 +1,5 @@
 import { Context, type Effect } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 /** Appends application statements to the current coordinator's single atomic batch. */
 export class D1BatchStatements extends Context.Service<

package/src/drizzle/d1-emails.ts

@@ -35,7 +35,7 @@ import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Schema, Cause, DateTime, Effect, Option, Context } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
 import { compileD1ProofCompletionPlan } from "./d1-proofs";
@@ -1797,9 +1797,7 @@ const executeStandalone = <A, E, R>(
   retries = 2,
 ): Effect.Effect<
   A,
-  | E
-  | import("@yielded/auth/Hooks").HookConfigurationError
-  | import("effect/unstable/sql/SqlError").SqlError,
+  E | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError,
   Exclude<R, CurrentCommitJournal> | CurrentD1PlanningDatabase | LifecycleHooks
 > =>
   Effect.suspend(() => {

package/src/drizzle/d1-generated-statement.ts

@@ -1,6 +1,6 @@
 import { sql, type SQL } from "drizzle-orm";
 import { Schema } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 // oxlint-disable-next-line no-restricted-properties -- Statement.compile exposes untyped native SQL parameters.
 const valuesJson = Schema.encodeUnknownSync(

package/src/drizzle/d1-password-prepared.ts

@@ -30,7 +30,7 @@ import { eq, is, isNotNull, lte, or, SQL, sql, type AnyRelations, type Table } f
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, DateTime, Effect, Predicate, Redacted, Schema, Context } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 import { balancedD1And as and, compactD1GeneratedStatement } from "./d1-generated-statement";
 import { passwordD1Kernel as kernel } from "./d1-passwords";
@@ -791,10 +791,7 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
             Effect.catchCause(
               (
                 cause,
-              ): Effect.Effect<
-                never,
-                PasswordRejected | import("effect/unstable/sql/SqlError").SqlError
-              > =>
+              ): Effect.Effect<never, PasswordRejected | import("effect/sql/SqlError").SqlError> =>
                 everyFailureMatches(cause, (failure) =>
                   kernel.isGuardFailure(
                     failure,

package/src/drizzle/d1-passwords.ts

@@ -54,7 +54,7 @@ import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema, Context } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 import { balancedD1And } from "./d1-generated-statement";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
@@ -2624,9 +2624,7 @@ const executeStandalone = <A, E, R>(
   retries = 2,
 ): Effect.Effect<
   A,
-  | E
-  | import("@yielded/auth/Hooks").HookConfigurationError
-  | import("effect/unstable/sql/SqlError").SqlError,
+  E | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError,
   Exclude<R, CurrentCommitJournal> | CurrentD1PlanningDatabase | LifecycleHooks
 > =>
   Effect.suspend(() => {

package/src/drizzle/d1-proofs.ts

@@ -45,7 +45,7 @@ import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, Effect, Schema, Context } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 import { balancedD1And } from "./d1-generated-statement";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
@@ -2273,9 +2273,7 @@ const executeStandalone = <A, E, R>(
   retries = 2,
 ): Effect.Effect<
   A,
-  | E
-  | import("@yielded/auth/Hooks").HookConfigurationError
-  | import("effect/unstable/sql/SqlError").SqlError,
+  E | import("@yielded/auth/Hooks").HookConfigurationError | import("effect/sql/SqlError").SqlError,
   Exclude<R, CurrentCommitJournal> | CurrentD1PlanningDatabase | LifecycleHooks
 > =>
   Effect.suspend(() => {

package/src/drizzle/d1-sessions.ts

@@ -49,8 +49,8 @@ import { and, eq, getTableColumns, gt, inArray, not, or, sql, type SQL } from "d
 import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, Context, Data, DateTime, Effect, Schema } from "effect";
-import type * as SqlError from "effect/unstable/sql/SqlError";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type * as SqlError from "effect/sql/SqlError";
+import type { Statement } from "effect/sql/Statement";
 
 import { compactD1GeneratedStatement } from "./d1-generated-statement";
 import {

package/src/drizzle/email-target.ts

@@ -7,7 +7,7 @@ import {
 } from "@yielded/auth/Hooks";
 /* oxlint-disable no-explicit-any -- public driver wrappers restore concrete Drizzle generics. */
 import { type Context, Effect, Layer } from "effect";
-import type * as SqlError from "effect/unstable/sql/SqlError";
+import type * as SqlError from "effect/sql/SqlError";
 
 import {
   makeSqlEmailRegistrationAuthority,

package/src/drizzle/model.ts

@@ -1,6 +1,3 @@
-import { requireStandalone } from "@yielded/auth-persistence/Adapter";
-import { AuthStore } from "@yielded/auth/AuthStore";
-import { AuthStoreError } from "@yielded/auth/Errors";
 import {
   ExternalIdentityMutation,
   SubjectProvisioner,
@@ -8,48 +5,11 @@ import {
   type ExternalIdentity,
   type LoginIdentifier,
 } from "@yielded/auth/Identity";
-import { OAuthStateStore, type OAuthState } from "@yielded/auth/OAuth";
-import {
-  type ConsumeChallenge,
-  type NewChallenge,
-  type NewRegistration,
-  type PendingRegistration,
-} from "@yielded/auth/Schema";
-import {
-  getTableColumns,
-  type AnyColumn,
-  type InferInsertModel,
-  type InferSelectModel,
-  type Table,
-} from "drizzle-orm";
+import { getTableColumns, type AnyColumn, type InferInsertModel, type Table } from "drizzle-orm";
 import { Context, DateTime, Effect, Layer } from "effect";
-import type * as SqlClient from "effect/unstable/sql/SqlClient";
 
 export type CommitMode = "interactive" | "synchronous" | "batch";
 
-/**
- * Ordinary error-channel consumes must own their commit. Coordinated callers
- * use the decision methods inside their outer transaction and translate only
- * after that owner commits.
- */
-export interface SqlClientTransactionDatabase {
-  readonly $client: Pick<SqlClient.SqlClient, "transactionService">;
-}
-
-export const requireStandaloneConsume = (
-  database: SqlClientTransactionDatabase,
-): Effect.Effect<void, AuthStoreError> =>
-  requireStandalone(
-    () =>
-      AuthStoreError.make({
-        message: "Use the decision consume API inside an outer database transaction",
-      }),
-    database.$client,
-  );
-
-export type { ChallengeConsumeDecision } from "@yielded/auth/Persistence";
-export type { ConsumeDecision } from "@yielded/auth/AuthStore";
-
 export {
   PersistenceMappingError,
   isMappedConstraintConflict,
@@ -62,156 +22,8 @@ export interface InstantCodec<NativeInstant> {
   readonly decode: (native: NativeInstant) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
 }
 
-export interface RequiredAuthStoreConstraints {
-  readonly series: "unique(namespace,value,purpose)";
-  readonly challengeDigest: "unique(tokenDigest)";
-  readonly registrationDigest: "unique(tokenDigest)";
-}
-
-export interface RequiredOAuthStateConstraints {
-  readonly oauthStateDigest: "unique(stateDigest)";
-}
-
-export interface RequiredAuthConstraints
-  extends RequiredAuthStoreConstraints, RequiredOAuthStateConstraints {}
-
-export const requiredAuthConstraints: RequiredAuthConstraints = {
-  series: "unique(namespace,value,purpose)",
-  challengeDigest: "unique(tokenDigest)",
-  registrationDigest: "unique(tokenDigest)",
-  oauthStateDigest: "unique(stateDigest)",
-};
-
-export const requiredAuthStoreConstraints: RequiredAuthStoreConstraints = {
-  series: "unique(namespace,value,purpose)",
-  challengeDigest: "unique(tokenDigest)",
-  registrationDigest: "unique(tokenDigest)",
-};
-
-export const requiredOAuthStateConstraints: RequiredOAuthStateConstraints = {
-  oauthStateDigest: "unique(stateDigest)",
-};
-
 type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
 
-export interface ChallengeRecord {
-  readonly challenge: NewChallenge;
-  readonly namespace: string;
-  readonly failedAttempts: number;
-  readonly consumed: boolean;
-}
-
-export interface ChallengeColumns<T extends Table> {
-  readonly challengeId: ColumnKey<T>;
-  readonly tokenDigest: ColumnKey<T>;
-  readonly namespace: ColumnKey<T>;
-  readonly value: ColumnKey<T>;
-  readonly purpose: ColumnKey<T>;
-  readonly otpKeyId: ColumnKey<T>;
-  readonly otpDigest: ColumnKey<T>;
-  readonly issuedAt: ColumnKey<T>;
-  readonly expiresAt: ColumnKey<T>;
-  readonly attemptLimit: ColumnKey<T>;
-  readonly failedAttempts: ColumnKey<T>;
-  readonly consumed: ColumnKey<T>;
-}
-
-/**
- * Inputs are immutable server-created issuances. Replacements must advance
- * issuedAt; equal or older issuances fail even after consumption or expiry.
- * Instant encoding must preserve this ordering. Retain the series row as an
- * issuance watermark until every previously accepted issuance has expired;
- * current-row expiry alone is insufficient if historical lifetimes were longer.
- */
-export interface ChallengeTableMapping<T extends Table> {
-  readonly table: T;
-  readonly columns: ChallengeColumns<T>;
-  readonly identifierNamespace: string;
-  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
-  readonly encodeInsert: (
-    input: NewChallenge,
-    state: {
-      readonly namespace: string;
-      readonly failedAttempts: number;
-      readonly consumed: false;
-    },
-  ) => InferInsertModel<T>;
-  readonly encodeUpdate: (
-    input: NewChallenge,
-    state: {
-      readonly namespace: string;
-      readonly failedAttempts: unknown;
-      readonly consumed: false;
-    },
-  ) => Readonly<Record<string, unknown>>;
-  readonly decode: (
-    row: InferSelectModel<T>,
-  ) => Effect.Effect<ChallengeRecord, PersistenceMappingError>;
-}
-
-export interface RegistrationRecord {
-  readonly registration: PendingRegistration;
-  readonly consumed: boolean;
-}
-
-export interface RegistrationColumns<T extends Table> {
-  readonly registrationId: ColumnKey<T>;
-  readonly tokenDigest: ColumnKey<T>;
-  readonly expiresAt: ColumnKey<T>;
-  readonly consumed: ColumnKey<T>;
-}
-
-export interface RegistrationTableMapping<T extends Table> {
-  readonly table: T;
-  readonly columns: RegistrationColumns<T>;
-  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
-  readonly encodeInsert: (input: NewRegistration, consumed: false) => InferInsertModel<T>;
-  readonly decode: (
-    row: InferSelectModel<T>,
-  ) => Effect.Effect<RegistrationRecord, PersistenceMappingError>;
-}
-
-export interface OAuthStateColumns<T extends Table> {
-  readonly stateDigest: ColumnKey<T>;
-  readonly expiresAt: ColumnKey<T>;
-  readonly consumed: ColumnKey<T>;
-}
-
-export interface OAuthStateTableMapping<T extends Table> {
-  readonly table: T;
-  readonly columns: OAuthStateColumns<T>;
-  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
-  readonly encodeInsert: (state: OAuthState, consumed: false) => InferInsertModel<T>;
-  readonly decode: (
-    row: InferSelectModel<T>,
-  ) => Effect.Effect<
-    { readonly state: OAuthState; readonly consumed: boolean },
-    PersistenceMappingError
-  >;
-}
-
-export interface AuthStoreTables<Challenge extends Table, Registration extends Table> {
-  readonly constraints: RequiredAuthStoreConstraints;
-  readonly challenge: ChallengeTableMapping<Challenge>;
-  readonly registration: RegistrationTableMapping<Registration>;
-}
-
-export interface OAuthStateTables<State extends Table> {
-  readonly constraints: RequiredOAuthStateConstraints;
-  readonly oauthState: OAuthStateTableMapping<State>;
-}
-
-export interface AuthTables<
-  Challenge extends Table,
-  Registration extends Table,
-  State extends Table,
-> {
-  readonly constraints: RequiredAuthConstraints;
-  readonly challenge: ChallengeTableMapping<Challenge>;
-  readonly registration: RegistrationTableMapping<Registration>;
-  readonly oauthState: OAuthStateTableMapping<State>;
-}
-
 export interface RequiredIdentityConstraints {
   readonly identifier: "unique(namespace,value)";
   readonly externalIdentity: "unique(provider,issuer,subject)";
@@ -420,25 +232,6 @@ export const updateValues = <T extends Table>(
   entries: ReadonlyArray<readonly [ColumnKey<T>, unknown]>,
 ): Partial<InferInsertModel<T>> => Object.fromEntries(entries) as Partial<InferInsertModel<T>>;
 
-export type ChallengeInput = ConsumeChallenge;
-
-/** Acquire an application database in Effect and expose the auth stores as one layer. */
-export const authServicesLayer = <E, R>(
-  acquire: Effect.Effect<
-    {
-      readonly authStore: AuthStore["Service"];
-      readonly oauthStateStore: OAuthStateStore["Service"];
-    },
-    E,
-    R
-  >,
-) =>
-  Layer.effectContext(
-    Effect.map(acquire, ({ authStore, oauthStateStore }) =>
-      Context.make(AuthStore, authStore).pipe(Context.add(OAuthStateStore, oauthStateStore)),
-    ),
-  );
-
 /** Acquire an application database in Effect and expose the identity services as one layer. */
 export const identityServicesLayer = <E, R>(
   acquire: Effect.Effect<

package/src/drizzle/mysql-emails.ts

@@ -5,7 +5,7 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import type {
   EmailAddressMapping,

package/src/drizzle/mysql-password-prepared.ts

@@ -4,7 +4,7 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import { mysqlPasswordConfiguration as configuration } from "./mysql-passwords";
 import type {

package/src/drizzle/mysql-passwords.ts

@@ -5,7 +5,7 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import type { PasswordPersistenceMapping, PasswordRegistrationMapping } from "./password-model";
 import type { PasswordRegistrationAuthority } from "./password-registration";

package/src/drizzle/mysql-proofs.ts

@@ -4,7 +4,7 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import { updateValues } from "./model";
 import type { ProofPersistenceMapping } from "./proof-model";

package/src/drizzle/mysql-sessions.ts

@@ -12,7 +12,7 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import type {
   AuthenticationAuthorityMapping,

package/src/drizzle/oauth-connected-access.ts

@@ -132,6 +132,7 @@ export const claimRefresh = Effect.fn("oauthConnected.claimRefresh")(function* (
 
   const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
     grant: input.grant,
+    order: String(yield* S.nextOrder(mapping, read.client)),
     claimId: input.claimId,
     claimedAtMillis: read.now,
     claimExpiresAtMillis: expires,
@@ -204,10 +205,16 @@ export const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function*
   if (incoming !== undefined)
     invariant(
       C.sameContext(
-        { ...incoming.context, tokenVersion: old.tokenVersion, metadata: old.metadata },
+        {
+          ...incoming.context,
+          tokenVersion: old.tokenVersion,
+          metadata: old.metadata,
+          exchangeOrder: old.exchangeOrder,
+        },
         old,
       ) &&
         incoming.context.tokenVersion === input.claim.nextTokenVersion &&
+        incoming.context.exchangeOrder === input.claim.order &&
         validMetadata(incoming.context, now) &&
         incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&
         (incoming.context.metadata.refreshUseUntilMillis === undefined ||

package/src/drizzle/oauth-connected-drivers.ts

@@ -374,6 +374,9 @@ export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra
           );
 
           const service: OAuthConnectedPersistence["Service"] = {
+            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),
+            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),
+            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),
             capture: (input) => owner.run(original.capture(input)),
             issue: (input, prepare) => owner.run(original.issue(input, prepare)),
             preflight: (input) => owner.run(original.preflight(input)),

package/src/drizzle/oauth-connected-input.ts

@@ -105,6 +105,19 @@ const snapshot =
     snapshotOAuthSync(schema, input);
 
 export const connectedInputs = {
+  claimSignIn: snapshot(
+    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),
+  ),
+  inspectSignIn: snapshot(
+    Schema.Struct({
+      reservation: M.OAuthSignInAccessClaim,
+      credential: M.OAuthCredentialSnapshot,
+      grantId: M.OAuthGrantId,
+    }),
+  ),
+  settleSignIn: snapshot(
+    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),
+  ),
   capture: snapshot(capture),
   issue: snapshot(issue),
   preflight: snapshot(M.OAuthConnectedAccess),

package/src/drizzle/oauth-connected-model.ts

@@ -7,6 +7,8 @@ import type { SubjectIdCodec } from "./model";
 import type {
   OAuthAuthorityReadTable,
   OAuthClock,
+  OAuthCredentialReadTable,
+  OAuthFlowTable,
   OAuthOwnershipMutation,
   OAuthSubjectReadTable,
   requiredOAuthTupleConstraints,
@@ -53,6 +55,9 @@ export interface OAuthConnectedFlowTable<F extends Table, N> {
   readonly work: Column<F>;
   /** Exact sealed quarantine when no correctly sealed revocation job is available. */
   readonly custody: Column<F>;
+  /** Required when retaining grants during sign-in. subjectId is NULL until
+   * identity resolution; custom required columns are supplied by this encoder. */
+  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;
   readonly encodeInsert: (input: {
     readonly flow: M.OAuthConnectedPendingFlow;
     readonly subjectId: N;
@@ -192,6 +197,12 @@ export type OAuthConnectedPolicyInput<N> = {
       readonly configuration: M.OAuthConnectedConfiguration;
       readonly grant?: M.OAuthConnectedTokenContext;
     }
+  | {
+      readonly kind: "sign-in";
+      readonly credential: M.OAuthCredentialSnapshot;
+      readonly configuration: M.OAuthConnectedConfiguration;
+      readonly grant?: M.OAuthConnectedTokenContext;
+    }
   | {
       readonly kind: "metadata" | "use";
       readonly authorization: M.OAuthConnectedUseAuthorization;
@@ -307,6 +318,12 @@ export interface OAuthConnectedMapping<
   readonly subject: OAuthConnectedSubjectTable<S>;
   readonly authority: OAuthAuthorityReadTable<AC>;
   readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
+   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
+  readonly signIn?: {
+    readonly credential: OAuthCredentialReadTable<Table>;
+    readonly flow: OAuthFlowTable<Table>;
+  };
   readonly command: OAuthConnectedCommandTable<D, N>;
   readonly policy: OAuthConnectedSqlPolicy<N>;
   readonly constraints: typeof requiredOAuthConnectedConstraints;