@yielded/auth-persistence-drizzle 0.1.0-beta.1 → 0.1.0-beta.12

package/src/drizzle/mysql-database.ts

@@ -0,0 +1,8 @@
+import type { AnyRelations } from "drizzle-orm";
+import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
+import { Context } from "effect";
+
+/** Application-owned MySQL database used to construct persistence services. */
+export class Database extends Context.Service<Database, EffectMysql2Database<AnyRelations>>()(
+  "effect-auth/persistence-drizzle/Mysql2/Database",
+) {}

package/src/drizzle/mysql-emails.ts

@@ -13,6 +13,7 @@ import type {
   EmailSignInMapping,
 } from "./email-model";
 import type { EmailRegistrationAuthority } from "./email-registration";
+import { CurrentEmailSql } from "./email-sql";
 import type { EmailSqlQuery } from "./email-sql";
 import {
   coordinateTargetEmailAddress,
@@ -22,9 +23,16 @@ import {
   makeTargetEmailSignInServices,
   sqlClientEmailStandaloneGuard,
 } from "./email-target";
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
 import { sqlClientProofStandaloneGuard } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
@@ -44,15 +52,15 @@ type ProofMapping = ProofPersistenceMapping<
   any
 >;
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientEmailStandaloneGuard(database),
+  standaloneGuard: sqlClientEmailStandaloneGuard(service),
   generatedSubjectRows: (query: EmailSqlQuery) => query.$returningId(),
   proof: {
     mode: "interactive" as const,
     locking: true,
-    standaloneGuard: sqlClientProofStandaloneGuard(database),
+    standaloneGuard: sqlClientProofStandaloneGuard(service),
     insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>
       query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),
   },
@@ -64,9 +72,12 @@ export const makeMysqlEmailSignInServices = <
   C extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: EmailSignInMapping<S, I, C, NativeId>,
-) => makeTargetEmailSignInServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetEmailSignInServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlEmailAddressServices = <
   S extends AnyMySqlTable,
@@ -76,10 +87,13 @@ export const makeMysqlEmailAddressServices = <
   M extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>,
   proofMapping: ProofMapping,
-) => makeTargetEmailAddressServices(database, mapping, proofMapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetEmailAddressServices(mapping, proofMapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlEmailAddress<
   D extends Database,
@@ -170,7 +184,7 @@ export function coordinateMysqlEmailAddress<
       database,
       options.mapping,
       options.proofMapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly emailAddressPersistence: EmailAddressPersistence["Service"] },
@@ -195,16 +209,14 @@ export const makeMysqlEmailRegistrationServices = <
   Rq extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
   proofMapping: ProofMapping,
 ) =>
-  makeTargetEmailRegistrationServices<Registration>(
-    database,
-    mapping,
-    proofMapping,
-    configuration(database),
-  );
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) =>
+      makeTargetEmailRegistrationServices<Registration>(mapping, proofMapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlEmailRegistration<
   TargetId,
@@ -304,7 +316,7 @@ export function coordinateMysqlEmailRegistration<
       database,
       options.mapping,
       options.proofMapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },

package/src/drizzle/mysql-identity.ts

@@ -10,7 +10,7 @@ import {
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import type { SubjectId } from "@yielded/auth/Schema";
 /* oxlint-disable no-explicit-any -- Drizzle generic query types are narrowed at this technology boundary. */
-import { and, eq, type AnyRelations } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable, MySqlColumn } from "drizzle-orm/mysql-core";
 import { Cause, Effect, Schema } from "effect";
@@ -24,8 +24,8 @@ import {
   type IdentityTables,
   type SubjectProvisioningTables,
 } from "./model";
+import { Database as DatabaseService } from "./mysql-database";
 
-type Database = EffectMysql2Database<AnyRelations>;
 type RuntimeDatabase = EffectMysql2Database<any>;
 const unavailable = () => IdentityUnavailable.make();
 const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
@@ -39,15 +39,14 @@ const mapUnavailable = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
     ),
   );
 
-export const makeMysqlSubjectProvisioningServices = <
+export const makeMysqlSubjectProvisioningServices = Effect.fnUntraced(function* <
   Subject extends AnyMySqlTable,
   Identifier extends AnyMySqlTable,
   Request extends AnyMySqlTable,
   NativeId,
->(
-  database: Database,
-  mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,
-) => {
+>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) {
+  const database = yield* DatabaseService;
+
   const db = database as RuntimeDatabase;
   const requestTable = mapping.provisioningRequest.table;
 
@@ -190,16 +189,15 @@ export const makeMysqlSubjectProvisioningServices = <
   }, mapUnavailable);
 
   return { subjectProvisioner: SubjectProvisioner.of({ provision }) } as const;
-};
+});
 
-export const makeMysqlExternalIdentityServices = <
+export const makeMysqlExternalIdentityServices = Effect.fnUntraced(function* <
   Subject extends AnyMySqlTable,
   External extends AnyMySqlTable,
   NativeId,
->(
-  database: Database,
-  mapping: ExternalIdentityTables<Subject, External, NativeId>,
-) => {
+>(mapping: ExternalIdentityTables<Subject, External, NativeId>) {
+  const database = yield* DatabaseService;
+
   const db = database as RuntimeDatabase;
   const externalTable = mapping.externalIdentity.table;
 
@@ -307,18 +305,17 @@ export const makeMysqlExternalIdentityServices = <
   }, mapUnavailable);
 
   return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;
-};
+});
 
-export const makeMysqlIdentityServices = <
+export const makeMysqlIdentityServices = Effect.fnUntraced(function* <
   Subject extends AnyMySqlTable,
   Identifier extends AnyMySqlTable,
   External extends AnyMySqlTable,
   Request extends AnyMySqlTable,
   NativeId,
->(
-  database: Database,
-  mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,
-) => ({
-  ...makeMysqlSubjectProvisioningServices(database, mapping),
-  ...makeMysqlExternalIdentityServices(database, mapping),
+>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) {
+  return {
+    ...(yield* makeMysqlSubjectProvisioningServices(mapping)),
+    ...(yield* makeMysqlExternalIdentityServices(mapping)),
+  };
 });

package/src/drizzle/mysql-password-prepared.ts

@@ -6,7 +6,9 @@ import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
 import type { SqlError } from "effect/sql/SqlError";
 
+import { Database as DatabaseService } from "./mysql-database";
 import { mysqlPasswordConfiguration as configuration } from "./mysql-passwords";
+import { nativeDatabase } from "./native-database";
 import type {
   PasswordPreparedPersistenceMapping,
   PasswordPreparedProofMapping,
@@ -15,6 +17,8 @@ import {
   makeTargetPasswordPreparedPersistenceServices,
   coordinateTargetPasswordPreparedPersistence,
 } from "./password-prepared-target";
+import { CurrentPasswordSql } from "./password-sql";
+import { acquireTransactionService, transactionService } from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 type Database = EffectMysql2Database<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
@@ -39,16 +43,14 @@ export const makeMySqlPasswordPreparedPersistenceServices = <
   PCr extends AnyMySqlTable = AnyMySqlTable,
   PNativeId = unknown,
 >(
-  database: Database,
   mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>,
   proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,
 ) =>
-  makeTargetPasswordPreparedPersistenceServices(
-    database,
-    mapping,
-    configuration(database),
-    proofMapping,
-  );
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) =>
+      makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMySqlPasswordPreparedPersistence<
   TargetId,
@@ -186,7 +188,7 @@ export function coordinateMySqlPasswordPreparedPersistence<
     coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       options.proofMapping,
       (
         transaction: TransactionOf<D>,

package/src/drizzle/mysql-passwords.ts

@@ -7,8 +7,11 @@ import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
 import type { SqlError } from "effect/sql/SqlError";
 
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type { PasswordPersistenceMapping, PasswordRegistrationMapping } from "./password-model";
 import type { PasswordRegistrationAuthority } from "./password-registration";
+import { CurrentPasswordSql } from "./password-sql";
 import type { PasswordSqlQuery } from "./password-sql";
 import {
   coordinateTargetPasswordPersistence,
@@ -20,22 +23,27 @@ import {
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
 import { sqlClientProofStandaloneGuard } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientPasswordStandaloneGuard(database),
+  standaloneGuard: sqlClientPasswordStandaloneGuard(service),
   insertIfAbsent: (query: PasswordSqlQuery, selfKey: string, selfValue: unknown) =>
     query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),
   generatedSubjectRows: (query: PasswordSqlQuery) => query.$returningId(),
   proof: {
     mode: "interactive" as const,
     locking: true,
-    standaloneGuard: sqlClientProofStandaloneGuard(database),
+    standaloneGuard: sqlClientProofStandaloneGuard(service),
     insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>
       query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),
   },
@@ -64,7 +72,6 @@ export const makeMysqlPasswordPersistenceServices = <
   M extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>,
   proofMapping?: ProofPersistenceMapping<
     any,
@@ -81,7 +88,10 @@ export const makeMysqlPasswordPersistenceServices = <
     any
   >,
 ) =>
-  makeTargetPasswordPersistenceServices(database, mapping, configuration(database), proofMapping);
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPasswordPersistenceServices(mapping, configuration, proofMapping),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlPasswordPersistence<
   D extends Database,
@@ -189,7 +199,7 @@ export function coordinateMysqlPasswordPersistence<
     coordinateTargetPasswordPersistence<TransactionOf<D>, Out, E, Exclude<R, PasswordPersistence>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       options.proofMapping,
       (
         transaction: TransactionOf<D>,
@@ -215,10 +225,12 @@ export const makeMysqlPasswordRegistrationServices = <
   Rq extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
 ) =>
-  makeTargetPasswordRegistrationServices<Registration>(database, mapping, configuration(database));
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPasswordRegistrationServices<Registration>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlPasswordRegistration<
   TargetId,
@@ -320,7 +332,7 @@ export function coordinateMysqlPasswordRegistration<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },

package/src/drizzle/mysql-proofs.ts

@@ -7,13 +7,21 @@ import { Effect, Context } from "effect";
 import type { SqlError } from "effect/sql/SqlError";
 
 import { updateValues } from "./model";
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type { ProofPersistenceMapping } from "./proof-model";
+import { CurrentProofSql } from "./proof-sql";
 import type { ProofSqlQuery } from "./proof-sql";
 import {
   coordinateTargetProofPersistence,
   makeTargetProofPersistenceServices,
   sqlClientProofStandaloneGuard,
 } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
@@ -33,10 +41,10 @@ type Mapping<
   NativeId,
 > = ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>;
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientProofStandaloneGuard(database),
+  standaloneGuard: sqlClientProofStandaloneGuard(service),
   insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>
     query.onDuplicateKeyUpdate({
       set: updateValues([[selfKey, selfValue]]),
@@ -57,9 +65,12 @@ export const makeMysqlProofPersistenceServices = <
   Cr extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: Mapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>,
-) => makeTargetProofPersistenceServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetProofPersistenceServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentProofSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlProofPersistence<
   D extends Database,
@@ -164,7 +175,7 @@ export function coordinateMysqlProofPersistence<
     coordinateTargetProofPersistence<Transaction, A, E, Exclude<R, ProofPersistence>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly proofPersistence: ProofPersistence["Service"] },

package/src/drizzle/mysql-sessions.ts

@@ -14,12 +14,15 @@ import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
 import type { SqlError } from "effect/sql/SqlError";
 
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type {
   AuthenticationAuthorityMapping,
   PendingAuthenticationMapping,
   SignedSessionValidityMapping,
   StatefulSessionMapping,
 } from "./session-model";
+import { CurrentSessionSql } from "./session-sql";
 import {
   coordinateTargetAuthenticationAuthority,
   coordinateTargetPendingAuthentication,
@@ -33,15 +36,20 @@ import {
   makeTargetSessionStepUpServices,
   coordinateTargetSessionStepUp,
 } from "./session-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
 type Transaction = Parameters<Parameters<Database["transaction"]>[0]>[0];
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientSessionStandaloneGuard(database),
+  standaloneGuard: sqlClientSessionStandaloneGuard(service),
 });
 
 export const makeMysqlAuthenticationAuthorityServices = <
@@ -52,9 +60,12 @@ export const makeMysqlAuthenticationAuthorityServices = <
   P extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,
-) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetAuthenticationAuthorityServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlPendingAuthenticationServices = <
   Claims,
@@ -64,9 +75,12 @@ export const makeMysqlPendingAuthenticationServices = <
   F extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,
-) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPendingAuthenticationServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlStatefulSessionServices = <
   Claims,
@@ -78,9 +92,12 @@ export const makeMysqlStatefulSessionServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,
-) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetStatefulSessionServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlSignedSessionValidityServices = <
   S extends AnyMySqlTable,
@@ -88,9 +105,12 @@ export const makeMysqlSignedSessionValidityServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,
-) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetSignedSessionValidityServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlAuthenticationAuthority<
   D extends Database,
@@ -183,7 +203,7 @@ export function coordinateMysqlAuthenticationAuthority<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly authenticationAuthority: AuthenticationAuthority["Service"] },
@@ -290,7 +310,7 @@ export function coordinateMysqlPendingAuthentication<
     coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly pendingAuthentication: PendingAuthentication<Claims> },
@@ -442,7 +462,7 @@ export function coordinateMysqlStatefulSessions<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: {
@@ -550,7 +570,7 @@ export function coordinateMysqlSignedSessionValidity<
     coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly signedSessionValidity: SignedSessionValidity },
@@ -579,10 +599,13 @@ export const makeMysqlSessionStepUpServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,
   target: Context.Service<Id, SessionStepUpPersistence<Claims>>,
-) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetSessionStepUpServices(mapping, target, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlSessionStepUp<
   Claims,
@@ -724,7 +747,7 @@ export function coordinateMysqlSessionStepUp<
       database,
       options.mapping,
       options.target,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Parameters<Parameters<D["transaction"]>[0]>[0],
         services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },

package/src/drizzle/native-database.ts

@@ -0,0 +1,22 @@
+import type {
+  TransactionNativeDatabase,
+  SessionSqlDatabase,
+  PasswordSqlDatabase,
+  EmailSqlDatabase,
+  ProofSqlDatabase,
+} from "@yielded/auth-persistence/Adapter";
+import { type Context, Effect } from "effect";
+
+/** Drizzle omits its captured $client from database class types, and only D1
+ * exposes batch. Its generic query builders implement the SQL kernel contracts
+ * through drizzleQueryOperations. The selected driver mode controls native calls. */
+export const nativeDatabase = <Id, Database>(databaseService: Context.Key<Id, Database>) =>
+  Effect.map(
+    Effect.service(databaseService),
+    (database) =>
+      database as unknown as TransactionNativeDatabase &
+        SessionSqlDatabase &
+        PasswordSqlDatabase &
+        EmailSqlDatabase &
+        ProofSqlDatabase,
+  );

package/src/drizzle/oauth-connected-drivers.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   OAuthConnectedPersistence,
@@ -9,6 +10,7 @@ import { Effect, Context } from "effect";
 
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
+import { nativeDatabase } from "./native-database";
 import type {
   OAuthConnectedMapping,
   OAuthConnectedRevocationMapping,
@@ -28,11 +30,13 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
 const unavailable = () => OAuthUnavailable.make({});
 
 export const makeOAuthConnectedTarget = <
+  DatabaseId,
   Database,
   Family extends Table,
   Extra = {},
   Synchronous extends boolean = false,
 >(
+  databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthConnected<
@@ -300,9 +304,11 @@ export const makeOAuthConnectedTarget = <
       N,
       J extends Family = never,
     >(
-      database: Database,
       mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,
-    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthConnectedServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     makeOAuthConnectedRevocationServices: <
       T extends Family,
       O extends Family,
@@ -313,15 +319,18 @@ export const makeOAuthConnectedTarget = <
       J extends Family,
       N,
     >(
-      database: Database,
       mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,
-    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     coordinateOAuthConnected,
     coordinateOAuthConnectedRevocations,
   };
 };
 
-export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(
+export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(
+  databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthConnected<
@@ -461,7 +470,10 @@ export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra
   }
 
   return {
-    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),
+    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(
+      databaseService,
+      configuration,
+    ),
     coordinateOAuthConnected,
     coordinateOAuthConnectedRevocations,
   };