@yielded/auth-persistence-drizzle 0.1.0-beta.1 → 0.1.0-beta.13

package/src/drizzle/d1-passwords.ts

@@ -56,6 +56,7 @@ import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema, Context } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
+import { Database as DatabaseService } from "./d1-database";
 import { balancedD1And } from "./d1-generated-statement";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
 import { compileD1ProofCompletionPlan, type D1ProtectedProofMutation } from "./d1-proofs";
@@ -411,35 +412,53 @@ const scopeEntries = (keys: PasswordScopeKeys, policy: PasswordAttemptPolicy) =>
   return entries;
 };
 
-const scopeAdmissionCondition = (
+const livePendingAttempts = (
   mapping: Mapping,
   moduleId: string,
   action: "sign-in" | "change",
   entry: ScopeEntry,
-  policy: PasswordAttemptPolicy,
   identifier: LoginIdentifier,
   nativeSubjectId: unknown | undefined,
+  activeAt: unknown,
 ) => {
-  const c = chargeColumns(mapping);
   const a = attemptColumns(mapping);
 
-  const pending =
+  return and(
     entry.kind === "action"
-      ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending"))
+      ? and(eq(a.moduleId, moduleId), eq(a.action, action))
       : entry.kind === "identifier"
         ? and(
             eq(a.moduleId, moduleId),
             eq(a.action, action),
             eq(a.identifierNamespace, identifier.namespace),
             eq(a.identifierValue, identifier.value),
-            eq(a.state, "pending"),
           )
-        : and(
-            eq(a.moduleId, moduleId),
-            eq(a.action, action),
-            eq(a.subjectId, nativeSubjectId),
-            eq(a.state, "pending"),
-          );
+        : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)),
+    eq(a.state, "pending"),
+    sql`${a.retentionUntil} > ${activeAt}`,
+  );
+};
+
+const scopeAdmissionCondition = (
+  mapping: Mapping,
+  moduleId: string,
+  action: "sign-in" | "change",
+  entry: ScopeEntry,
+  policy: PasswordAttemptPolicy,
+  identifier: LoginIdentifier,
+  nativeSubjectId: unknown | undefined,
+) => {
+  const c = chargeColumns(mapping);
+
+  const pending = livePendingAttempts(
+    mapping,
+    moduleId,
+    action,
+    entry,
+    identifier,
+    nativeSubjectId,
+    mapping.d1.engineNow,
+  );
 
   return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
 };
@@ -457,7 +476,6 @@ const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(fun
   const database = yield* CurrentD1PlanningDatabase;
 
   const c = chargeColumns(mapping);
-  const a = attemptColumns(mapping);
   const admitted: ScopeEntry[] = [];
 
   for (let index = 0; index < entries.length; index++) {
@@ -478,26 +496,21 @@ const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(fun
         ),
     );
 
-    const pendingWhere =
-      entry.kind === "action"
-        ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending"))
-        : entry.kind === "identifier"
-          ? and(
-              eq(a.moduleId, moduleId),
-              eq(a.action, action),
-              eq(a.identifierNamespace, identifier.namespace),
-              eq(a.identifierValue, identifier.value),
-              eq(a.state, "pending"),
-            )
-          : and(
-              eq(a.moduleId, moduleId),
-              eq(a.action, action),
-              eq(a.subjectId, nativeSubjectId),
-              eq(a.state, "pending"),
-            );
-
     const pendingRows = yield* mapAdapter(
-      database.select({ total: count() }).from(mapping.attempt.table).where(pendingWhere),
+      database
+        .select({ total: count() })
+        .from(mapping.attempt.table)
+        .where(
+          livePendingAttempts(
+            mapping,
+            moduleId,
+            action,
+            entry,
+            identifier,
+            nativeSubjectId,
+            mapping.encodeInstant(now),
+          ),
+        ),
     );
 
     const admittedHere =
@@ -1980,7 +1993,7 @@ const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* <A>(
   };
 });
 
-export const makeD1PasswordPersistenceServices = <
+export const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <
   S extends AnySQLiteTable,
   I extends AnySQLiteTable,
   C extends AnySQLiteTable,
@@ -1991,7 +2004,6 @@ export const makeD1PasswordPersistenceServices = <
   M extends AnySQLiteTable,
   NativeId,
 >(
-  database: Database,
   mapping: D1PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>,
   proofMapping?: D1ProofPersistenceMapping<
     any,
@@ -2007,62 +2019,62 @@ export const makeD1PasswordPersistenceServices = <
     any,
     any
   >,
-) =>
-  Effect.gen(function* () {
-    const hooks = yield* LifecycleHooks;
-    const plans = makePasswordPlans(mapping as unknown as Mapping, proofMapping);
+) {
+  const database = yield* DatabaseService;
 
-    const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
-      Effect.gen(function* () {
-        if (yield* hasCommitScope) return yield* unavailable();
+  const hooks = yield* LifecycleHooks;
+  const plans = makePasswordPlans(mapping as unknown as Mapping, proofMapping);
 
-        return yield* executeStandalone(plan, 2);
-      }).pipe(
-        Effect.provideService(CurrentD1PlanningDatabase, database),
-        Effect.provideService(LifecycleHooks, hooks),
-      );
-
-    const service: PasswordPersistence["Service"] = {
-      admitAttempt: (input, prepare) =>
-        run(plans.admitAttempt(input, prepare)).pipe(translateFailure),
-      settleAttempt: (input, prepare) =>
-        run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
-      readForSubject: (input) =>
-        plans
-          .readForSubject(input)
-          .pipe(
-            Effect.provideService(CurrentD1PlanningDatabase, database),
-            Effect.provideService(LifecycleHooks, hooks),
-            translateFailure,
-          ),
-      recoveryTarget: (input) =>
-        plans
-          .recoveryTarget(input)
-          .pipe(
-            Effect.provideService(CurrentD1PlanningDatabase, database),
-            Effect.provideService(LifecycleHooks, hooks),
-            translateFailure,
-          ),
-      addIfAbsent: (input, prepare) =>
-        run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),
-      replaceIfCurrent: (input, prepare) =>
-        run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),
-      checkReset: (input) =>
-        plans
-          .checkReset(input)
-          .pipe(
-            Effect.provideService(CurrentD1PlanningDatabase, database),
-            Effect.provideService(LifecycleHooks, hooks),
-            translateFailure,
-          ),
-      resetWithProof: (input, prepare) =>
-        run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
-      cleanupAttempts: (input, prepare) =>
-        run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure),
-    };
+  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
+    Effect.gen(function* () {
+      if (yield* hasCommitScope) return yield* unavailable();
 
-    return { passwordPersistence: service };
-  });
+      return yield* executeStandalone(plan, 2);
+    }).pipe(
+      Effect.provideService(CurrentD1PlanningDatabase, database),
+      Effect.provideService(LifecycleHooks, hooks),
+    );
+
+  const service: PasswordPersistence["Service"] = {
+    admitAttempt: (input, prepare) =>
+      run(plans.admitAttempt(input, prepare)).pipe(translateFailure),
+    settleAttempt: (input, prepare) =>
+      run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
+    readForSubject: (input) =>
+      plans
+        .readForSubject(input)
+        .pipe(
+          Effect.provideService(CurrentD1PlanningDatabase, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+    recoveryTarget: (input) =>
+      plans
+        .recoveryTarget(input)
+        .pipe(
+          Effect.provideService(CurrentD1PlanningDatabase, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+    addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),
+    replaceIfCurrent: (input, prepare) =>
+      run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),
+    checkReset: (input) =>
+      plans
+        .checkReset(input)
+        .pipe(
+          Effect.provideService(CurrentD1PlanningDatabase, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+    resetWithProof: (input, prepare) =>
+      run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
+    cleanupAttempts: (input, prepare) =>
+      run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure),
+  };
+
+  return { passwordPersistence: service };
+});
 
 type CoordinatorError<E> = E | PasswordUnavailable | HookConfigurationError;
 
@@ -2443,7 +2455,7 @@ const makeRegistrationPlans = <Registration>(mapping: RegistrationMapping<Regist
     }),
 });
 
-export const makeD1PasswordRegistrationServices = <
+export const makeD1PasswordRegistrationServices = Effect.fnUntraced(function* <
   Registration,
   S extends AnySQLiteTable,
   I extends AnySQLiteTable,
@@ -2451,30 +2463,28 @@ export const makeD1PasswordRegistrationServices = <
   AC extends AnySQLiteTable,
   Rq extends AnySQLiteTable,
   NativeId,
->(
-  database: Database,
-  mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
-) =>
-  Effect.gen(function* () {
-    const hooks = yield* LifecycleHooks;
-    const plans = makeRegistrationPlans(mapping as unknown as RegistrationMapping<Registration>);
+>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) {
+  const database = yield* DatabaseService;
 
-    const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
-      Effect.gen(function* () {
-        if (yield* hasCommitScope) return yield* unavailable();
+  const hooks = yield* LifecycleHooks;
+  const plans = makeRegistrationPlans(mapping as unknown as RegistrationMapping<Registration>);
 
-        return yield* executeStandalone(plan, 2);
-      }).pipe(
-        Effect.provideService(CurrentD1PlanningDatabase, database),
-        Effect.provideService(LifecycleHooks, hooks),
-      );
+  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
+    Effect.gen(function* () {
+      if (yield* hasCommitScope) return yield* unavailable();
 
-    const service: PasswordRegistrationAuthority<Registration> = {
-      register: (input, prepare) => run(plans.register(input, prepare)).pipe(translateFailure),
-    };
+      return yield* executeStandalone(plan, 2);
+    }).pipe(
+      Effect.provideService(CurrentD1PlanningDatabase, database),
+      Effect.provideService(LifecycleHooks, hooks),
+    );
 
-    return { registrationAuthority: service };
-  });
+  const service: PasswordRegistrationAuthority<Registration> = {
+    register: (input, prepare) => run(plans.register(input, prepare)).pipe(translateFailure),
+  };
+
+  return { registrationAuthority: service };
+});
 
 export function coordinateD1PasswordRegistration<
   TargetId,

package/src/drizzle/d1-phone.ts

@@ -11,6 +11,7 @@ import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Context, Effect } from "effect";
 
+import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
 import type { D1PhoneMapping, PhoneMapping, PhoneMappingSource } from "./phone-model";
@@ -26,7 +27,10 @@ const configuration = {
 };
 
 /** Reads use a primary D1 session; observations and expiry are asserted in the same batch. */
-const target = makePhoneTarget<Database, Table, D1PhoneMapping>(configuration);
+const target = makePhoneTarget<DatabaseService, Database, Table, D1PhoneMapping>(
+  DatabaseService,
+  configuration,
+);
 
 export const { makePhonePersistenceServices } = target;
 

package/src/drizzle/d1-proofs.ts

@@ -47,6 +47,7 @@ import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, Effect, Schema, Context } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
+import { Database as DatabaseService } from "./d1-database";
 import { balancedD1And } from "./d1-generated-statement";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
@@ -1985,7 +1986,7 @@ const makeProofPlans = (mapping: Mapping) => {
   };
 };
 
-export const makeD1ProofPersistenceServices = <
+export const makeD1ProofPersistenceServices = Effect.fnUntraced(function* <
   Rq extends AnySQLiteTable,
   S extends AnySQLiteTable,
   G extends AnySQLiteTable,
@@ -1998,38 +1999,36 @@ export const makeD1ProofPersistenceServices = <
   I extends AnySQLiteTable,
   Cr extends AnySQLiteTable,
   NativeId,
->(
-  database: Database,
-  mapping: D1ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>,
-) =>
-  Effect.gen(function* () {
-    const hooks = yield* LifecycleHooks;
-    const plans = makeProofPlans(mapping as unknown as Mapping);
-
-    const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
-      Effect.gen(function* () {
-        if (yield* hasCommitScope) return yield* unavailable();
+>(mapping: D1ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>) {
+  const database = yield* DatabaseService;
 
-        return yield* executeStandalone(plan, 2);
-      }).pipe(
-        Effect.provideService(CurrentD1PlanningDatabase, database),
-        Effect.provideService(LifecycleHooks, hooks),
-      );
+  const hooks = yield* LifecycleHooks;
+  const plans = makeProofPlans(mapping as unknown as Mapping);
 
-    const service: ProofPersistence["Service"] = {
-      issue: (input, prepare) => run(plans.issue(input, prepare)).pipe(translateIssueFailure),
-      attempt: (input, prepare) => run(plans.attempt(input, prepare)).pipe(translateFailure),
-      complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
-      claimDelivery: (input, prepare) =>
-        run(plans.claimDelivery(input, prepare)).pipe(translateFailure),
-      settleDelivery: (input, prepare) =>
-        run(plans.settleDelivery(input, prepare)).pipe(translateFailure),
-      cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
-      cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure),
-    };
+  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
+    Effect.gen(function* () {
+      if (yield* hasCommitScope) return yield* unavailable();
 
-    return { proofPersistence: service };
-  });
+      return yield* executeStandalone(plan, 2);
+    }).pipe(
+      Effect.provideService(CurrentD1PlanningDatabase, database),
+      Effect.provideService(LifecycleHooks, hooks),
+    );
+
+  const service: ProofPersistence["Service"] = {
+    issue: (input, prepare) => run(plans.issue(input, prepare)).pipe(translateIssueFailure),
+    attempt: (input, prepare) => run(plans.attempt(input, prepare)).pipe(translateFailure),
+    complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
+    claimDelivery: (input, prepare) =>
+      run(plans.claimDelivery(input, prepare)).pipe(translateFailure),
+    settleDelivery: (input, prepare) =>
+      run(plans.settleDelivery(input, prepare)).pipe(translateFailure),
+    cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
+    cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure),
+  };
+
+  return { proofPersistence: service };
+});
 
 type CoordinatorError<E> = E | ProofUnavailable | HookConfigurationError;
 

package/src/drizzle/d1-sessions.ts

@@ -52,6 +52,7 @@ import { Cause, Context, Data, DateTime, Effect, Schema } from "effect";
 import type * as SqlError from "effect/sql/SqlError";
 import type { Statement } from "effect/sql/Statement";
 
+import { Database as DatabaseService } from "./d1-database";
 import { compactD1GeneratedStatement } from "./d1-generated-statement";
 import {
   CurrentD1PlanningDatabase,
@@ -1622,8 +1623,9 @@ export const makeD1SignedValidity = (
 };
 
 export const makeD1SessionServiceEffects = {
-  authority: <Claims>(database: Database, mapping: any) =>
+  authority: <Claims>(mapping: any) =>
     Effect.gen(function* () {
+      const database = yield* CurrentD1PlanningDatabase;
       const hooks = yield* LifecycleHooks;
       const raw = makeD1AuthenticationAuthority<Claims>(mapping);
 
@@ -1649,8 +1651,9 @@ export const makeD1SessionServiceEffects = {
 
       return { authenticationAuthority };
     }),
-  pending: <Claims>(database: Database, mapping: any) =>
+  pending: <Claims>(mapping: any) =>
     Effect.gen(function* () {
+      const database = yield* CurrentD1PlanningDatabase;
       const hooks = yield* LifecycleHooks;
       const raw = makeD1PendingAuthentication<Claims>(mapping);
 
@@ -1677,8 +1680,9 @@ export const makeD1SessionServiceEffects = {
 
       return { pendingAuthentication };
     }),
-  stateful: <Claims>(database: Database, mapping: any) =>
+  stateful: <Claims>(mapping: any) =>
     Effect.gen(function* () {
+      const database = yield* CurrentD1PlanningDatabase;
       const hooks = yield* LifecycleHooks;
       const raw = makeD1StatefulSessions<Claims>(mapping);
 
@@ -1711,8 +1715,9 @@ export const makeD1SessionServiceEffects = {
 
       return { statefulSessionPersistence, sessionRepository };
     }),
-  validity: (database: Database, mapping: any) =>
+  validity: (mapping: any) =>
     Effect.gen(function* () {
+      const database = yield* CurrentD1PlanningDatabase;
       const hooks = yield* LifecycleHooks;
       const raw = makeD1SignedValidity(mapping);
 
@@ -1832,7 +1837,6 @@ export const makeD1AuthenticationAuthorityServices = <
   Pending extends AnySQLiteTable,
   NativeSubjectId,
 >(
-  database: Database,
   mapping: D1AuthenticationAuthorityMapping<
     Claims,
     Subject,
@@ -1841,7 +1845,10 @@ export const makeD1AuthenticationAuthorityServices = <
     Pending,
     NativeSubjectId
   >,
-) => makeD1SessionServiceEffects.authority<Claims>(database, mapping as any);
+) =>
+  makeD1SessionServiceEffects
+    .authority<Claims>(mapping as any)
+    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
 
 export const makeD1PendingAuthenticationServices = <
   Claims,
@@ -1851,7 +1858,6 @@ export const makeD1PendingAuthenticationServices = <
   Flow extends AnySQLiteTable,
   NativeSubjectId,
 >(
-  database: Database,
   mapping: D1PendingAuthenticationMapping<
     Claims,
     Subject,
@@ -1860,7 +1866,10 @@ export const makeD1PendingAuthenticationServices = <
     Flow,
     NativeSubjectId
   >,
-) => makeD1SessionServiceEffects.pending<Claims>(database, mapping as any);
+) =>
+  makeD1SessionServiceEffects
+    .pending<Claims>(mapping as any)
+    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
 
 export const makeD1StatefulSessionServices = <
   Claims,
@@ -1872,7 +1881,6 @@ export const makeD1StatefulSessionServices = <
   NativeSubjectId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: D1StatefulSessionMapping<
     Claims,
     Subject,
@@ -1883,7 +1891,10 @@ export const makeD1StatefulSessionServices = <
     NativeSubjectId,
     NativeSessionId
   >,
-) => makeD1SessionServiceEffects.stateful<Claims>(database, mapping as any);
+) =>
+  makeD1SessionServiceEffects
+    .stateful<Claims>(mapping as any)
+    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
 
 export const makeD1SignedSessionValidityServices = <
   Subject extends AnySQLiteTable,
@@ -1891,9 +1902,11 @@ export const makeD1SignedSessionValidityServices = <
   NativeSubjectId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: D1SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId>,
-) => makeD1SessionServiceEffects.validity(database, mapping as any);
+) =>
+  makeD1SessionServiceEffects
+    .validity(mapping as any)
+    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
 
 export function coordinateD1AuthenticationAuthority<
   Claims,
@@ -2733,7 +2746,7 @@ export const makeD1SessionStepUp = <Claims>(
   };
 };
 
-export const makeD1SessionStepUpServices = <
+export const makeD1SessionStepUpServices = Effect.fnUntraced(function* <
   Claims,
   Id,
   S extends AnySQLiteTable,
@@ -2744,39 +2757,39 @@ export const makeD1SessionStepUpServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: D1SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,
   target: Context.Service<Id, SessionStepUpPersistence<Claims>>,
-) =>
-  Effect.gen(function* () {
-    const hooks = yield* LifecycleHooks;
-    const raw = makeD1SessionStepUp<Claims>(mapping as any);
+) {
+  const database = yield* DatabaseService;
 
-    const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-      Effect.gen(function* () {
-        if (
-          (yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" ||
-          (yield* hasCommitScope)
-        )
-          return yield* unavailable();
+  const hooks = yield* LifecycleHooks;
+  const raw = makeD1SessionStepUp<Claims>(mapping as any);
 
-        return yield* effect.pipe(
-          Effect.provideService(CurrentD1PlanningDatabase, database),
-          Effect.provideService(LifecycleHooks, hooks),
-        );
-      });
-
-    const sessionStepUpPersistence = target.of({
-      create: (input, now, prepare) => run(raw.create(input, now, prepare)),
-      context: (input) => run(raw.context(input)),
-      read: (input) => run(raw.read(input)),
-      reject: (input, prepare) => run(raw.reject(input, prepare)),
-      complete: (plan, prepare) => run(raw.complete(plan, prepare)),
+  const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    Effect.gen(function* () {
+      if (
+        (yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" ||
+        (yield* hasCommitScope)
+      )
+        return yield* unavailable();
+
+      return yield* effect.pipe(
+        Effect.provideService(CurrentD1PlanningDatabase, database),
+        Effect.provideService(LifecycleHooks, hooks),
+      );
     });
 
-    return { sessionStepUpPersistence };
+  const sessionStepUpPersistence = target.of({
+    create: (input, now, prepare) => run(raw.create(input, now, prepare)),
+    context: (input) => run(raw.context(input)),
+    read: (input) => run(raw.read(input)),
+    reject: (input, prepare) => run(raw.reject(input, prepare)),
+    complete: (plan, prepare) => run(raw.complete(plan, prepare)),
   });
 
+  return { sessionStepUpPersistence };
+});
+
 export function coordinateD1SessionStepUp<
   Claims,
   Id,

package/src/drizzle/d1-totp.ts

@@ -6,6 +6,7 @@ import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Context, Effect } from "effect";
 
+import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
 import type { D1TotpMapping, TotpMapping, TotpMappingSource } from "./totp-model";
@@ -21,7 +22,10 @@ const configuration = {
 };
 
 /** Reads use a primary D1 session; observations and expiry are asserted in the same batch. */
-const target = makeTotpTarget<Database, Table, D1TotpMapping>(configuration);
+const target = makeTotpTarget<DatabaseService, Database, Table, D1TotpMapping>(
+  DatabaseService,
+  configuration,
+);
 
 export const { makeTotpPersistenceServices } = target;
 

package/src/drizzle/email-registration.ts

@@ -540,10 +540,14 @@ const prepareConflict = Effect.fn("Drizzle.prepareConflict")(function* <Registra
 
 export const makeSqlEmailRegistrationAuthority = Effect.fn("makeSqlEmailRegistrationAuthority")(
   function* <Registration>(
-    database: EmailSqlDatabase,
     mapping: Mapping<Registration>,
     configuration: EmailRegistrationConfiguration,
-  ): Effect.fn.Return<EmailRegistrationAuthority<Registration>, never, LifecycleHooks> {
+  ): Effect.fn.Return<
+    EmailRegistrationAuthority<Registration>,
+    never,
+    LifecycleHooks | CurrentEmailSql
+  > {
+    const database = yield* CurrentEmailSql;
     const hooks = yield* LifecycleHooks;
 
     return {