@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.12

package/src/drizzle/pg-emails.ts

@@ -6,7 +6,7 @@ import type { EffectPgDatabase as PgliteDatabase } from "drizzle-orm/effect-pgli
 import type { EffectPgDatabase as PostgresDatabase } from "drizzle-orm/effect-postgres";
 import type { AnyPgTable } from "drizzle-orm/pg-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import type {
   EmailAddressMapping,
@@ -14,6 +14,7 @@ import type {
   EmailSignInMapping,
 } from "./email-model";
 import type { EmailRegistrationAuthority } from "./email-registration";
+import { CurrentEmailSql } from "./email-sql";
 import type { EmailSqlQuery } from "./email-sql";
 import {
   coordinateTargetEmailAddress,
@@ -23,9 +24,16 @@ import {
   makeTargetEmailSignInServices,
   sqlClientEmailStandaloneGuard,
 } from "./email-target";
+import { nativeDatabase } from "./native-database";
+import { Database as DatabaseService } from "./pg-database";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
 import { sqlClientProofStandaloneGuard } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = PostgresDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;
@@ -45,15 +53,15 @@ type ProofMapping = ProofPersistenceMapping<
   any
 >;
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientEmailStandaloneGuard(database),
+  standaloneGuard: sqlClientEmailStandaloneGuard(service),
   generatedSubjectRows: (query: EmailSqlQuery) => query.returning(),
   proof: {
     mode: "interactive" as const,
     locking: true,
-    standaloneGuard: sqlClientProofStandaloneGuard(database),
+    standaloneGuard: sqlClientProofStandaloneGuard(service),
     insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),
   },
 });
@@ -64,9 +72,12 @@ export const makePgEmailSignInServices = <
   C extends AnyPgTable,
   NativeId,
 >(
-  database: Database,
   mapping: EmailSignInMapping<S, I, C, NativeId>,
-) => makeTargetEmailSignInServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetEmailSignInServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
 
 export const makePgEmailAddressServices = <
   S extends AnyPgTable,
@@ -76,10 +87,13 @@ export const makePgEmailAddressServices = <
   M extends AnyPgTable,
   NativeId,
 >(
-  database: Database,
   mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>,
   proofMapping: ProofMapping,
-) => makeTargetEmailAddressServices(database, mapping, proofMapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetEmailAddressServices(mapping, proofMapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
 
 export function coordinatePgEmailAddress<
   D extends Database,
@@ -170,7 +184,7 @@ export function coordinatePgEmailAddress<
       database,
       options.mapping,
       options.proofMapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly emailAddressPersistence: EmailAddressPersistence["Service"] },
@@ -195,16 +209,14 @@ export const makePgEmailRegistrationServices = <
   Rq extends AnyPgTable,
   NativeId,
 >(
-  database: Database,
   mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
   proofMapping: ProofMapping,
 ) =>
-  makeTargetEmailRegistrationServices<Registration>(
-    database,
-    mapping,
-    proofMapping,
-    configuration(database),
-  );
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) =>
+      makeTargetEmailRegistrationServices<Registration>(mapping, proofMapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
 
 export function coordinatePgEmailRegistration<
   TargetId,
@@ -304,7 +316,7 @@ export function coordinatePgEmailRegistration<
       database,
       options.mapping,
       options.proofMapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },

package/src/drizzle/pg-identity.ts

@@ -0,0 +1,297 @@
+import {
+  ExternalIdentityMutation,
+  IdentityConflict,
+  IdentityUnavailable,
+  SubjectProvisioned,
+  type ExternalIdentity,
+  SubjectProvisioner,
+  type SubjectProvisioningInput,
+} from "@yielded/auth/Identity";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import type { SubjectId } from "@yielded/auth/Schema";
+/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */
+import { and, eq } from "drizzle-orm";
+import type { EffectPgDatabase as PgDatabase } from "drizzle-orm/effect-postgres";
+import { type AnyPgTable, type PgColumn } from "drizzle-orm/pg-core";
+import { Cause, Effect, Schema } from "effect";
+
+import {
+  column,
+  PersistenceMappingError,
+  isMappedConstraintConflict,
+  provisioningFingerprint,
+  type ExternalIdentityTables,
+  type IdentityTables,
+  type SubjectProvisioningTables,
+} from "./model";
+import { Database as DatabaseService } from "./pg-database";
+
+type RuntimeDatabase = PgDatabase<any>;
+
+const identityUnavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+
+const mapIdentityFailure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  reportPersistenceFailure(effect, isIdentityFailure).pipe(
+    Effect.catchCause((cause) =>
+      Effect.failCause(
+        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : identityUnavailable())),
+      ),
+    ),
+  );
+
+export const makePgSubjectProvisioningServices = Effect.fnUntraced(function* <
+  Subject extends AnyPgTable,
+  Identifier extends AnyPgTable,
+  Request extends AnyPgTable,
+  NativeId,
+>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) {
+  const database = yield* DatabaseService;
+
+  const db = database as RuntimeDatabase;
+  const requestTable = mapping.provisioningRequest.table;
+  const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);
+  const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
+  const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
+  const identifierTable = mapping.identifier.table;
+  const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
+  const identifierValueColumn = column(identifierTable, mapping.identifier.value);
+
+  const findReceipt = Effect.fn("DrizzlePgIdentity.findReceipt")(function* (requestId: string) {
+    const rows = yield* db
+      .select({
+        fingerprint: requestFingerprintColumn as PgColumn,
+        subjectId: requestSubjectColumn as PgColumn,
+      })
+      .from(requestTable as any)
+      .where(eq(requestIdColumn, requestId))
+      .limit(1);
+
+    return rows[0];
+  });
+
+  const provision = Effect.fn("DrizzlePgIdentity.provision")(function* (
+    input: SubjectProvisioningInput,
+  ) {
+    const fingerprint = provisioningFingerprint(input);
+    const existing = yield* findReceipt(input.requestId);
+
+    if (existing !== undefined) {
+      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+      const id = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);
+
+      return SubjectProvisioned.make({ subjectId: id });
+    }
+
+    const attempt = db.transaction((tx) =>
+      Effect.gen(function* () {
+        const allocated =
+          mapping.subject.allocateId === undefined ? undefined : yield* mapping.subject.allocateId;
+
+        const inserted = yield* tx
+          .insert(mapping.subject.table as any)
+          .values(mapping.subject.encodeInsert(input, allocated) as any)
+          .returning({ id: column(mapping.subject.table, mapping.subject.id) as PgColumn });
+
+        const nativeId = (inserted[0]?.id ?? allocated) as NativeId | undefined;
+
+        if (nativeId === undefined) {
+          return yield* PersistenceMappingError.make({
+            operation: "provisionSubject.generatedId",
+            cause: new Error("subject insert did not return its native id"),
+          });
+        }
+        if (input.identifier !== undefined) {
+          yield* tx
+            .insert(identifierTable as any)
+            .values(
+              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,
+            );
+        }
+        yield* tx
+          .insert(requestTable as any)
+          .values(
+            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,
+          );
+
+        return nativeId;
+      }),
+    );
+
+    const nativeId = yield* attempt.pipe(
+      Effect.catchCause(
+        (
+          cause,
+        ): Effect.Effect<
+          NativeId,
+          | Effect.Error<typeof attempt>
+          | Effect.Error<ReturnType<typeof findReceipt>>
+          | IdentityConflict
+        > => {
+          if (
+            cause.reasons.length === 0 ||
+            !cause.reasons.every(
+              (reason) =>
+                Cause.isFailReason(reason) &&
+                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),
+            )
+          )
+            return Effect.failCause(cause);
+
+          return findReceipt(input.requestId).pipe(
+            Effect.flatMap((receipt) => {
+              if (receipt !== undefined && receipt.fingerprint === fingerprint) {
+                return Effect.succeed(receipt.subjectId as NativeId);
+              }
+              if (input.identifier === undefined) return IdentityConflict.make();
+
+              return db
+                .select({
+                  subjectId: column(identifierTable, mapping.identifier.subjectId) as PgColumn,
+                })
+                .from(identifierTable as any)
+                .where(
+                  and(
+                    eq(identifierNamespaceColumn, input.identifier.namespace),
+                    eq(identifierValueColumn, input.identifier.value),
+                  ),
+                )
+                .limit(1)
+                .pipe(Effect.flatMap(() => IdentityConflict.make()));
+            }),
+          );
+        },
+      ),
+    );
+
+    const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+
+    return SubjectProvisioned.make({ subjectId });
+  }, mapIdentityFailure);
+
+  return {
+    subjectProvisioner: SubjectProvisioner.of({ provision }),
+  } as const;
+});
+
+export const makePgExternalIdentityServices = Effect.fnUntraced(function* <
+  Subject extends AnyPgTable,
+  External extends AnyPgTable,
+  NativeId,
+>(mapping: ExternalIdentityTables<Subject, External, NativeId>) {
+  const database = yield* DatabaseService;
+
+  const db = database as RuntimeDatabase;
+  const externalTable = mapping.externalIdentity.table;
+
+  const externalProviderColumn = column(
+    externalTable,
+    mapping.externalIdentity.provider,
+  ) as PgColumn;
+
+  const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer) as PgColumn;
+  const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject) as PgColumn;
+
+  const externalSubjectIdColumn = column(
+    externalTable,
+    mapping.externalIdentity.subjectId,
+  ) as PgColumn;
+
+  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as PgColumn;
+  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as PgColumn;
+
+  const bind = Effect.fn("DrizzlePgIdentity.bindExternalIdentity")(function* (
+    subjectId: SubjectId,
+    identity: ExternalIdentity,
+  ) {
+    const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+    const decision = yield* db
+      .transaction((tx) =>
+        Effect.gen(function* () {
+          const subjects = yield* tx
+            .select({ status: subjectStatusColumn })
+            .from(mapping.subject.table as any)
+            .where(eq(subjectIdColumn, nativeId))
+            .for("update")
+            .limit(1);
+
+          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))
+            return { _tag: "conflict" } as const;
+
+          const links = yield* tx
+            .select({ subjectId: externalSubjectIdColumn })
+            .from(externalTable as any)
+            .where(
+              and(
+                eq(externalProviderColumn, identity.provider),
+                eq(externalIssuerColumn, identity.issuer),
+                eq(externalSubjectColumn, identity.subject),
+              ),
+            )
+            .for("update")
+            .limit(1);
+
+          if (links[0] !== undefined)
+            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)
+              ? ({ _tag: "bound" } as const)
+              : ({ _tag: "conflict" } as const);
+          yield* tx
+            .insert(externalTable as any)
+            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);
+
+          return { _tag: "bound" } as const;
+        }),
+      )
+      .pipe(
+        Effect.catchCause((cause) => {
+          if (
+            cause.reasons.length === 0 ||
+            !cause.reasons.every(
+              (reason) =>
+                Cause.isFailReason(reason) &&
+                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),
+            )
+          )
+            return Effect.failCause(cause);
+
+          return db
+            .select({ subjectId: externalSubjectIdColumn })
+            .from(externalTable as any)
+            .where(
+              and(
+                eq(externalProviderColumn, identity.provider),
+                eq(externalIssuerColumn, identity.issuer),
+                eq(externalSubjectColumn, identity.subject),
+              ),
+            )
+            .limit(1)
+            .pipe(
+              Effect.map((rows) =>
+                rows[0] !== undefined &&
+                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)
+                  ? ({ _tag: "bound" } as const)
+                  : ({ _tag: "conflict" } as const),
+              ),
+            );
+        }),
+      );
+
+    if (decision._tag === "conflict") return yield* IdentityConflict.make();
+  }, mapIdentityFailure);
+
+  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;
+});
+
+export const makePgIdentityServices = Effect.fnUntraced(function* <
+  Subject extends AnyPgTable,
+  Identifier extends AnyPgTable,
+  External extends AnyPgTable,
+  Request extends AnyPgTable,
+  NativeId,
+>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) {
+  return {
+    ...(yield* makePgSubjectProvisioningServices(mapping)),
+    ...(yield* makePgExternalIdentityServices(mapping)),
+  };
+});

package/src/drizzle/pg-password-prepared.ts

@@ -5,8 +5,9 @@ import type { EffectPgDatabase as PgliteDatabase } from "drizzle-orm/effect-pgli
 import type { EffectPgDatabase as PostgresDatabase } from "drizzle-orm/effect-postgres";
 import type { AnyPgTable } from "drizzle-orm/pg-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
+import { nativeDatabase } from "./native-database";
 import type {
   PasswordPreparedPersistenceMapping,
   PasswordPreparedProofMapping,
@@ -15,7 +16,10 @@ import {
   makeTargetPasswordPreparedPersistenceServices,
   coordinateTargetPasswordPreparedPersistence,
 } from "./password-prepared-target";
+import { CurrentPasswordSql } from "./password-sql";
+import { Database as DatabaseService } from "./pg-database";
 import { pgPasswordConfiguration as configuration } from "./pg-passwords";
+import { acquireTransactionService, transactionService } from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 type Database = PostgresDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
@@ -40,16 +44,14 @@ export const makePgPasswordPreparedPersistenceServices = <
   PCr extends AnyPgTable = AnyPgTable,
   PNativeId = unknown,
 >(
-  database: Database,
   mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>,
   proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,
 ) =>
-  makeTargetPasswordPreparedPersistenceServices(
-    database,
-    mapping,
-    configuration(database),
-    proofMapping,
-  );
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) =>
+      makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinatePgPasswordPreparedPersistence<
   TargetId,
@@ -187,7 +189,7 @@ export function coordinatePgPasswordPreparedPersistence<
     coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       options.proofMapping,
       (
         transaction: TransactionOf<D>,

package/src/drizzle/pg-passwords.ts

@@ -6,10 +6,12 @@ import type { EffectPgDatabase as PgliteDatabase } from "drizzle-orm/effect-pgli
 import type { EffectPgDatabase as PostgresDatabase } from "drizzle-orm/effect-postgres";
 import type { AnyPgTable } from "drizzle-orm/pg-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
+import { nativeDatabase } from "./native-database";
 import type { PasswordPersistenceMapping, PasswordRegistrationMapping } from "./password-model";
 import type { PasswordRegistrationAuthority } from "./password-registration";
+import { CurrentPasswordSql } from "./password-sql";
 import type { PasswordSqlQuery } from "./password-sql";
 import {
   coordinateTargetPasswordPersistence,
@@ -18,24 +20,30 @@ import {
   makeTargetPasswordRegistrationServices,
   sqlClientPasswordStandaloneGuard,
 } from "./password-target";
+import { Database as DatabaseService } from "./pg-database";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
 import { sqlClientProofStandaloneGuard } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = PostgresDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientPasswordStandaloneGuard(database),
+  standaloneGuard: sqlClientPasswordStandaloneGuard(service),
   insertIfAbsent: (query: PasswordSqlQuery) => query.onConflictDoNothing(),
   generatedSubjectRows: (query: PasswordSqlQuery) => query.returning(),
   proof: {
     mode: "interactive" as const,
     locking: true,
-    standaloneGuard: sqlClientProofStandaloneGuard(database),
+    standaloneGuard: sqlClientProofStandaloneGuard(service),
     insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),
   },
 });
@@ -63,7 +71,6 @@ export const makePgPasswordPersistenceServices = <
   M extends AnyPgTable,
   NativeId,
 >(
-  database: Database,
   mapping: PasswordMapping<S, I, C, AC, A, RS, CE, M, NativeId>,
   proofMapping?: ProofPersistenceMapping<
     any,
@@ -80,7 +87,10 @@ export const makePgPasswordPersistenceServices = <
     any
   >,
 ) =>
-  makeTargetPasswordPersistenceServices(database, mapping, configuration(database), proofMapping);
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPasswordPersistenceServices(mapping, configuration, proofMapping),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinatePgPasswordPersistence<
   D extends Database,
@@ -188,7 +198,7 @@ export function coordinatePgPasswordPersistence<
     coordinateTargetPasswordPersistence<TransactionOf<D>, Out, E, Exclude<R, PasswordPersistence>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       options.proofMapping,
       (
         transaction: TransactionOf<D>,
@@ -214,10 +224,12 @@ export const makePgPasswordRegistrationServices = <
   Rq extends AnyPgTable,
   NativeId,
 >(
-  database: Database,
   mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
 ) =>
-  makeTargetPasswordRegistrationServices<Registration>(database, mapping, configuration(database));
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPasswordRegistrationServices<Registration>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinatePgPasswordRegistration<
   TargetId,
@@ -319,7 +331,7 @@ export function coordinatePgPasswordRegistration<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },

package/src/drizzle/pg-proofs.ts

@@ -5,15 +5,23 @@ import type { EffectPgDatabase as PgliteDatabase } from "drizzle-orm/effect-pgli
 import type { EffectPgDatabase as PostgresDatabase } from "drizzle-orm/effect-postgres";
 import type { AnyPgTable } from "drizzle-orm/pg-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
+import { nativeDatabase } from "./native-database";
+import { Database as DatabaseService } from "./pg-database";
 import type { ProofPersistenceMapping } from "./proof-model";
+import { CurrentProofSql } from "./proof-sql";
 import type { ProofSqlQuery } from "./proof-sql";
 import {
   coordinateTargetProofPersistence,
   makeTargetProofPersistenceServices,
   sqlClientProofStandaloneGuard,
 } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = PostgresDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;
@@ -46,10 +54,10 @@ type Mapping<
   NativeSubjectId
 >;
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientProofStandaloneGuard(database),
+  standaloneGuard: sqlClientProofStandaloneGuard(service),
   insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),
 });
 
@@ -67,9 +75,12 @@ export const makePgProofPersistenceServices = <
   Cr extends AnyPgTable,
   NativeId,
 >(
-  database: Database,
   mapping: Mapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>,
-) => makeTargetProofPersistenceServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetProofPersistenceServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentProofSql, nativeDatabase(DatabaseService)));
 
 export function coordinatePgProofPersistence<
   D extends Database,
@@ -174,7 +185,7 @@ export function coordinatePgProofPersistence<
     coordinateTargetProofPersistence<TransactionOf<D>, A, E, Exclude<R, ProofPersistence>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly proofPersistence: ProofPersistence["Service"] },