@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.15

package/src/drizzle/mysql-sessions.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks";
 import {
   AuthenticationAuthority,
@@ -65,7 +66,10 @@ export const makeMysqlAuthenticationAuthorityServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetAuthenticationAuthorityServices<Claims>(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export const makeMysqlPendingAuthenticationServices = <
   Claims,
@@ -80,7 +84,10 @@ export const makeMysqlPendingAuthenticationServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetPendingAuthenticationServices<Claims>(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export const makeMysqlStatefulSessionServices = <
   Claims,
@@ -97,7 +104,10 @@ export const makeMysqlStatefulSessionServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetStatefulSessionServices<Claims>(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export const makeMysqlSignedSessionValidityServices = <
   S extends AnyMySqlTable,
@@ -110,7 +120,10 @@ export const makeMysqlSignedSessionValidityServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetSignedSessionValidityServices(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlAuthenticationAuthority<
   D extends Database,
@@ -193,7 +206,7 @@ export function coordinateMysqlAuthenticationAuthority<
   E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetAuthenticationAuthority<
       Claims,
       Transaction,
@@ -215,7 +228,7 @@ export function coordinateMysqlAuthenticationAuthority<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -306,7 +319,7 @@ export function coordinateMysqlPendingAuthentication<
   E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
@@ -322,7 +335,7 @@ export function coordinateMysqlPendingAuthentication<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -452,7 +465,7 @@ export function coordinateMysqlStatefulSessions<
   E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetStatefulSessions<
       Claims,
       Transaction,
@@ -481,7 +494,7 @@ export function coordinateMysqlStatefulSessions<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -566,7 +579,7 @@ export function coordinateMysqlSignedSessionValidity<
   E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
@@ -582,7 +595,7 @@ export function coordinateMysqlSignedSessionValidity<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -605,7 +618,10 @@ export const makeMysqlSessionStepUpServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetSessionStepUpServices(mapping, target, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlSessionStepUp<
   Claims,
@@ -735,7 +751,7 @@ export function coordinateMysqlSessionStepUp<
   E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, Id> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetSessionStepUp<
       Claims,
       Id,
@@ -759,6 +775,6 @@ export function coordinateMysqlSessionStepUp<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }

package/src/drizzle/native-database.ts

@@ -5,16 +5,17 @@ import type {
   EmailSqlDatabase,
   ProofSqlDatabase,
 } from "@yielded/auth-persistence/Adapter";
-import { type Context, Effect } from "effect";
+import { Effect } from "effect";
 
 /** Drizzle omits its captured $client from database class types, and only D1
  * exposes batch. Its generic query builders implement the SQL kernel contracts
  * through drizzleQueryOperations. The selected driver mode controls native calls. */
-export const nativeDatabase = <Id, Database>(databaseService: Context.Key<Id, Database>) =>
+export const nativeDatabase = <Database, E, R>(acquire: Effect.Effect<Database, E, R>) =>
   Effect.map(
-    Effect.service(databaseService),
+    acquire,
     (database) =>
-      database as unknown as TransactionNativeDatabase &
+      database as unknown as Database &
+        TransactionNativeDatabase &
         SessionSqlDatabase &
         PasswordSqlDatabase &
         EmailSqlDatabase &

package/src/drizzle/oauth-connected-drivers.ts

@@ -144,7 +144,7 @@ export const makeOAuthConnectedTarget = <
     OAuthCoordinatorError<E> | DatabaseError,
     Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(
         database,
         options.mapping,
@@ -164,7 +164,7 @@ export const makeOAuthConnectedTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
   function coordinateOAuthConnectedRevocations<
@@ -260,7 +260,7 @@ export const makeOAuthConnectedTarget = <
     OAuthCoordinatorError<E> | DatabaseError,
     Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnectedRevocations<
         TransactionOf<D>,
         A,
@@ -285,7 +285,7 @@ export const makeOAuthConnectedTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
 
@@ -364,7 +364,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
     | LifecycleHooks
     | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnected<
         Database,
         A,
@@ -388,6 +388,8 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
             settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),
             capture: (input) => owner.run(original.capture(input)),
             issue: (input, prepare) => owner.run(original.issue(input, prepare)),
+            prepare: (input, prepare) => owner.run(original.prepare(input, prepare)),
+            inspectPrepared: (input) => owner.run(original.inspectPrepared(input)),
             preflight: (input) => owner.run(original.preflight(input)),
             claim: (input, prepare) => owner.run(original.claim(input, prepare)),
             inspectGrant: (input) => owner.run(original.inspectGrant(input)),
@@ -408,7 +410,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
 
           return yield* owner.close(Effect.provideContext(body, provided));
         }),
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
   function coordinateOAuthConnectedRevocations<
@@ -436,7 +438,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
     | LifecycleHooks
     | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnectedRevocations<
         Database,
         A,
@@ -465,7 +467,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
 
           return yield* owner.close(Effect.provideContext(body, provided));
         }),
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
 

package/src/drizzle/oauth-connected-flow.ts

@@ -84,9 +84,11 @@ export const expected = (flow: M.OAuthConnectedPendingFlow) => ({
   configuration: S.configuration(flow),
 });
 
-export const issue = Effect.fn("oauthConnected.issue")(function* (
+const retain = Effect.fn("oauthConnected.retain")(function* (
   mapping: S.Mapping,
-  input: Input<"issue">,
+  input:
+    | ({ readonly _tag: "Prepare" } & Input<"prepare">)
+    | ({ readonly _tag: "Issue" } & Input<"issue">),
 ) {
   const owner = yield* CurrentOAuthTransaction;
 
@@ -95,10 +97,16 @@ export const issue = Effect.fn("oauthConnected.issue")(function* (
 
   const found = yield* S.current(mapping, c.revision.subjectId);
 
-  if (
-    found === undefined ||
-    !(yield* S.action(mapping, found, input.authorization, "issue", expected(flow)))
-  )
+  if (found === undefined) return { _tag: "Rejected" } as const;
+  if (input._tag === "Prepare") {
+    if (
+      input.authorization.moduleId !== c.moduleId ||
+      !sameRevision(input.authorization.revision, c.revision) ||
+      !sameRevision(found.revision, c.revision) ||
+      (yield* S.useAuthority(mapping, input.authorization, "metadata")) === undefined
+    )
+      return { _tag: "Rejected" } as const;
+  } else if (!(yield* S.action(mapping, found, input.authorization, "issue", expected(flow))))
     return { _tag: "Rejected" } as const;
   if (c.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
   const client = yield* S.client(mapping, S.configuration(flow), true);
@@ -131,6 +139,31 @@ export const issue = Effect.fn("oauthConnected.issue")(function* (
     { limit: 1 },
   );
 
+  owner.postconditions.push(
+    sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,
+  );
+  if (input._tag === "Issue") {
+    const row = prior.rows[0];
+
+    if (
+      row === undefined ||
+      command.rows[0] === undefined ||
+      row[f.state] !== "Prepared" ||
+      row[f.snapshot] !== S.flowStorage.encode(flow) ||
+      command.rows[0][f.flowId] !== c.flowId
+    )
+      return { _tag: "Rejected" } as const;
+    yield* owner.update(
+      f.table,
+      { ...key, [f.state]: "Prepared", [f.version]: row[f.version] },
+      { [f.state]: "Pending", [f.version]: owner.marker },
+    );
+    owner.postconditions.push(
+      sql`exists(select 1 from ${f.table} where ${equal(f.table, { ...key, [f.state]: "Pending", [f.version]: owner.marker })})`,
+    );
+
+    return { _tag: "Issued", flow } as const;
+  }
   if (prior.rows.length || command.rows.length) return { _tag: "Rejected" } as const;
 
   const values = {
@@ -143,7 +176,7 @@ export const issue = Effect.fn("oauthConnected.issue")(function* (
     [f.subjectId]: found.nativeId,
     [f.clientKey]: client.id,
     [f.cohortKey]: null,
-    [f.state]: "Pending",
+    [f.state]: "Prepared",
     [f.version]: owner.marker,
     [f.stateDigest]: c.stateDigest,
     [f.snapshot]: S.flowStorage.encode(flow),
@@ -163,13 +196,68 @@ export const issue = Effect.fn("oauthConnected.issue")(function* (
   prior.rows = inserted.rows;
   command.rows = inserted.rows;
   if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" } as const;
-  owner.postconditions.push(
-    sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,
-  );
 
   return { _tag: "Issued", flow } as const;
 });
 
+export const prepare = (mapping: S.Mapping, input: Input<"prepare">) =>
+  retain(mapping, { _tag: "Prepare", ...input });
+
+export const issue = (mapping: S.Mapping, input: Input<"issue">) =>
+  retain(mapping, { _tag: "Issue", ...input });
+
+export const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(function* (
+  mapping: S.Mapping,
+  access: M.OAuthConnectedPreparedAccess,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const found = yield* S.current(mapping, access.subjectId);
+
+  if (found === undefined) return undefined;
+  const f = mapping.flow;
+
+  const read = yield* owner.read(
+    f.table,
+    equal(f.table, {
+      [f.moduleId]: access.moduleId,
+      [f.flowId]: access.flowId,
+      [f.subjectId]: found.nativeId,
+    }),
+    { limit: 1 },
+  );
+
+  const row = read.rows[0];
+
+  if (row === undefined || row[f.state] !== "Prepared" || row[f.snapshot] === null)
+    return undefined;
+  const flow = S.flowStorage.decode(row[f.snapshot]);
+  const c = flow.context;
+
+  invariant(
+    row[f.moduleId] === c.moduleId &&
+      row[f.flowId] === c.flowId &&
+      row[f.commandId] === c.commandId &&
+      mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&
+      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&
+      row[f.stateDigest] === c.stateDigest &&
+      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
+      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
+  );
+  const now = yield* owner.now(mapping.clock);
+
+  return c.moduleId === access.moduleId &&
+    c.generation === access.generation &&
+    c.flowId === access.flowId &&
+    c.commandId === access.commandId &&
+    c.revision.subjectId === access.subjectId &&
+    sameRevision(found.revision, c.revision) &&
+    c.requestBindingVerifier === access.requestBindingVerifier &&
+    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&
+    live(flow, now)
+    ? flow
+    : undefined;
+});
+
 export const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>
   target.grantId === context.grantId &&
   target.grantVersion === context.grantVersion &&

package/src/drizzle/oauth-connected-input.ts

@@ -22,6 +22,11 @@ const issue = Schema.Struct({
   authorization: M.OAuthConnectedActionAuthorization,
 });
 
+const preparation = Schema.Struct({
+  flow: M.OAuthConnectedPendingFlow,
+  authorization: M.OAuthConnectedUseAuthorization,
+});
+
 const claim = Schema.Struct({
   ...issue.fields,
   access: M.OAuthConnectedAccess,
@@ -120,6 +125,8 @@ export const connectedInputs = {
   ),
   capture: snapshot(capture),
   issue: snapshot(issue),
+  prepare: snapshot(preparation),
+  inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),
   preflight: snapshot(M.OAuthConnectedAccess),
   claim: snapshot(claim),
   inspectGrant: snapshot(inspectGrant),

package/src/drizzle/oauth-connected-maintenance.ts

@@ -197,7 +197,7 @@ export const cleanup = Effect.fn("oauthConnected.cleanup")(function* (
     f.table,
     both(
       eq(col(f.table, f.moduleId), input.moduleId),
-      sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,
+      sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,
     ),
     {
       limit: input.limit + 1,
@@ -250,7 +250,7 @@ export const cleanup = Effect.fn("oauthConnected.cleanup")(function* (
       state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt],
     );
 
-    if ((state === "Pending" || state === "Claimed") && now >= expires) {
+    if ((state === "Prepared" || state === "Pending" || state === "Claimed") && now >= expires) {
       yield* owner.update(
         f.table,
         { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },
@@ -263,6 +263,7 @@ export const cleanup = Effect.fn("oauthConnected.cleanup")(function* (
       owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
       terminalized++;
     } else if (
+      state !== "Prepared" &&
       state !== "Pending" &&
       state !== "Claimed" &&
       row[f.work] !== "Unresolved" &&

package/src/drizzle/oauth-connected-target.ts

@@ -134,6 +134,8 @@ export const makeConnected = (
       ),
       capture: read(mapping, execute, F.capture),
       issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),
+      prepare: mutation(mapping, execute, F.prepare, M.OAuthConnectedIssueDecision),
+      inspectPrepared: read(mapping, execute, F.inspectPrepared),
       preflight: read(mapping, execute, F.preflight),
       claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),
       inspectGrant: read(mapping, execute, F.inspectGrant),
@@ -189,7 +191,7 @@ export const makeTargetOAuthConnectedServices = (
 ) => {
   const retained = captured(mapping);
 
-  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+  return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({
     oauthConnectedPersistence: makeConnected(retained, execution),
   }));
 };
@@ -200,7 +202,7 @@ export const makeTargetOAuthConnectedRevocationServices = (
 ) => {
   const retained = captured(mapping);
 
-  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+  return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({
     oauthConnectedRevocations: makeRevocations(retained, execution),
   }));
 };

package/src/drizzle/oauth-drivers.ts

@@ -133,7 +133,7 @@ export const makeOAuthTarget = <
     OAuthCoordinatorError<E> | DatabaseError,
     Exclude<R, OAuthSignInPersistence> | LifecycleHooks | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthSignIn<
         TransactionOf<Database>,
         A,
@@ -154,7 +154,7 @@ export const makeOAuthTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
   function coordinateOAuthRegistrationIntents<
@@ -250,7 +250,7 @@ export const makeOAuthTarget = <
     OAuthCoordinatorError<E> | DatabaseError,
     Exclude<R, OAuthRegistrationIntents> | LifecycleHooks | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthRegistrationIntents<
         TransactionOf<Database>,
         A,
@@ -275,7 +275,7 @@ export const makeOAuthTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
   function coordinateOAuthAccounts<
@@ -371,7 +371,7 @@ export const makeOAuthTarget = <
     OAuthCoordinatorError<E> | DatabaseError,
     Exclude<R, OAuthAccountsPersistence> | LifecycleHooks | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthAccounts<
         TransactionOf<Database>,
         A,
@@ -396,7 +396,7 @@ export const makeOAuthTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
   function coordinateOAuthRegistration<
@@ -497,7 +497,7 @@ export const makeOAuthTarget = <
     OAuthCoordinatorError<E> | DatabaseError,
     Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthRegistration<
         Registration,
         TransactionOf<Database>,
@@ -519,7 +519,7 @@ export const makeOAuthTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
 

package/src/drizzle/oauth-target.ts

@@ -70,6 +70,7 @@ import {
   settleRegistrationIntent,
 } from "./oauth-registration";
 import { captureOAuthMapping, invariant, nonce, unavailable } from "./oauth-state";
+import { validateDrizzleStorage } from "./storage-validation";
 import {
   coordinateTransactionOwner,
   makeTransactionExecution,
@@ -89,9 +90,12 @@ export const sqlClientOAuthStandaloneGuard = (
 
 export const makeOAuthExecution = Effect.fnUntraced(function* (
   configuration: OAuthTargetConfiguration,
-): Effect.fn.Return<OAuthExecution, never, LifecycleHooks | NativeDatabase> {
+  mapping: unknown,
+): Effect.fn.Return<OAuthExecution, OAuthUnavailable, LifecycleHooks | NativeDatabase> {
   const hooks = yield* LifecycleHooks;
 
+  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
+
   const execution = yield* makeTransactionExecution(
     CurrentOAuthTransaction,
     configuration,
@@ -393,7 +397,7 @@ export const makeTargetOAuthSignInServices = (
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
     oauthSignInPersistence: makeOAuthSignIn(captured, execution),
   }));
 };
@@ -404,7 +408,7 @@ export const makeTargetOAuthRegistrationIntentServices = (
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
     oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),
   }));
 };
@@ -415,7 +419,7 @@ export const makeTargetOAuthRegistrationServices = <Registration>(
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
     registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),
   }));
 };
@@ -431,7 +435,7 @@ export const coordinateOAuthOwner = <Services, Transaction, A, E, R>(
     services: Services,
     append: (statement: Statement<any>) => void,
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, OAuthCoordinatorError<E>, R | LifecycleHooks> => {
+): Effect.Effect<A, OAuthCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> => {
   const captured = captureOAuthMapping(mapping);
 
   return Effect.flatMap(LifecycleHooks, (hooks) =>
@@ -439,7 +443,9 @@ export const coordinateOAuthOwner = <Services, Transaction, A, E, R>(
       database,
       CurrentOAuthTransaction,
       configuration,
-      Effect.suspend(() => allocate(captured)),
+      validateDrizzleStorage(captured).pipe(
+        Effect.andThen(Effect.suspend(() => allocate(captured))),
+      ),
       unavailable,
       nonce,
       (execution, resources) =>
@@ -691,7 +697,7 @@ export const makeTargetOAuthAccountsServices = (
 ) => {
   const captured = captureOAuthMapping(mapping);
 
-  return Effect.map(makeOAuthExecution(configuration), (execution) => ({
+  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({
     oauthAccountsPersistence: makeOAuthAccounts(captured, execution),
   }));
 };

package/src/drizzle/passkey-drivers.ts

@@ -177,7 +177,7 @@ export const makePasskeyTarget = <
     PasskeyCoordinatorError<E> | DatabaseError,
     Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskey(
         database,
         options.mapping,
@@ -190,7 +190,7 @@ export const makePasskeyTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }
   function coordinatePasskeyRegistrationCeremony<
@@ -290,7 +290,7 @@ export const makePasskeyTarget = <
     PasskeyCoordinatorError<E> | DatabaseError,
     Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
   > {
-    return Effect.flatMap(acquire, (database) =>
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskeyRegistration(
         database,
         options.mapping,
@@ -303,7 +303,7 @@ export const makePasskeyTarget = <
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ),
+      ).pipe(Effect.provideService(NativeDatabase, database)),
     );
   }