@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/drizzle/d1-phone.d.mts

@@ -2,6 +2,7 @@ import { D1PhoneMapping, PhoneMapping, PhoneMappingSource, PhonePersistenceServi
 import { Database as Database$1 } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { PhoneCoordinatorError } from "./phone-target.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { AnyRelations } from "drizzle-orm";
 import { Effect } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
@@ -14,7 +15,7 @@ type Database = EffectSQLiteD1Database<AnyRelations> & {
   readonly $client: D1Client;
 };
 type Table$1 = AnySQLiteTable;
-export declare const makePhonePersistenceServices: <S extends Table$1, I extends Table$1, F extends Table$1, C extends Table$1, N, RSetup = never>(mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & D1PhoneMapping, RSetup>) => Effect.Effect<PhonePersistenceServices, import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/PhoneOtp").PhoneConfigurationError, Database$1 | LifecycleHooks | Exclude<RSetup, import("@yielded/auth-persistence/Adapter").NativeDatabase>>;
+export declare const makePhonePersistenceServices: <S extends Table$1, I extends Table$1, F extends Table$1, C extends Table$1, N, RSetup = never>(mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & D1PhoneMapping, RSetup>) => Effect.Effect<PhonePersistenceServices, import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("@yielded/auth/PhoneOtp").PhoneConfigurationError, Database$1 | LifecycleHooks | Exclude<RSetup, NativeDatabase>>;
 export declare const coordinatePhonePersistence: <D extends Database, S extends Table$1, I extends Table$1, F extends Table$1, C extends Table$1, N, A, E, R, RSetup = never, DatabaseError = never, DatabaseRequirements = never>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & D1PhoneMapping, RSetup>;
 }, body: Effect.Effect<A, E, R>) => Effect.Effect<A, PhoneCoordinatorError<E> | DatabaseError, Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | D1BatchStatements> | LifecycleHooks | RSetup | DatabaseRequirements>;

package/dist/drizzle/d1-phone.mjs

@@ -1,7 +1,9 @@
 import { Database } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { makeD1Owner } from "./d1-planning.mjs";
+import { nativeDatabase } from "./native-database.mjs";
 import { coordinateTargetPhone, makePhoneTarget } from "./phone-target.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, Effect } from "effect";
 import { PhoneAdmission, PhoneOtpUnavailable, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
 //#region src/drizzle/d1-phone.ts
@@ -12,7 +14,7 @@ const configuration = {
 	standaloneGuard: () => Effect.void
 };
 const { makePhonePersistenceServices } = makePhoneTarget(Database, configuration);
-const coordinatePhonePersistence = (acquire, options, body) => Effect.flatMap(acquire, (database) => coordinateTargetPhone(database, options.mapping, configuration, (_transaction, services, append) => Effect.gen(function* () {
+const coordinatePhonePersistence = (acquire, options, body) => Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetPhone(database, options.mapping, configuration, (_transaction, services, append) => Effect.gen(function* () {
 	const original = services.phonePersistence;
 	const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => append(statement)) });
 	const owner = yield* makeD1Owner(PhoneOtpUnavailable.make({})).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
@@ -24,7 +26,7 @@ const coordinatePhonePersistence = (acquire, options, body) => Effect.flatMap(ac
 		cleanup: (input) => owner.run(services.phoneAdmission.cleanup(input))
 	}), Context.add(PhoneSignInTargets, { lookup: (input) => owner.run(services.phoneSignInTargets.lookup(input)) }));
 	return yield* owner.close(Effect.provideContext(body, provided));
-})));
+})).pipe(Effect.provideService(NativeDatabase, database)));
 //#endregion
 export { coordinatePhonePersistence, makePhonePersistenceServices };
 

package/dist/drizzle/d1-phone.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"d1-phone.mjs","names":["DatabaseService","PhoneUnavailable"],"sources":["../../src/drizzle/d1-phone.ts"],"sourcesContent":["import type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PhoneOtpUnavailable as PhoneUnavailable,\n  PhoneAdmission,\n  PhonePersistence,\n  PhoneSignInTargets,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Context, Effect } from \"effect\";\n\nimport { Database as DatabaseService } from \"./d1-database\";\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport type { D1PhoneMapping, PhoneMapping, PhoneMappingSource } from \"./phone-model\";\nimport { coordinateTargetPhone, makePhoneTarget, type PhoneCoordinatorError } from \"./phone-target\";\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\ntype Table = AnySQLiteTable;\n\nconst configuration = {\n  mode: \"batch\" as const,\n  dialect: \"sqlite\" as const,\n  locking: false,\n  standaloneGuard: () => Effect.void,\n};\n\n/** Reads use a primary D1 session; observations and expiry are asserted in the same batch. */\nconst target = makePhoneTarget<DatabaseService, Database, Table, D1PhoneMapping>(\n  DatabaseService,\n  configuration,\n);\n\nexport const { makePhonePersistenceServices } = target;\n\nexport const coordinatePhonePersistence = <\n  D extends Database,\n  S extends Table,\n  I extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & D1PhoneMapping, RSetup>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PhoneCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | D1BatchStatements>\n  | LifecycleHooks\n  | RSetup\n  | DatabaseRequirements\n> =>\n  Effect.flatMap(acquire, (database) =>\n    coordinateTargetPhone(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services, append) =>\n        Effect.gen(function* () {\n          const original = services.phonePersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(PhoneUnavailable.make({})).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: PhonePersistence[\"Service\"] = {\n            target: (input) => owner.run(original.target(input)),\n            mutate: (input, prepare) => owner.run(original.mutate(input, prepare)),\n          };\n\n          const provided = Context.make(PhonePersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n            Context.add(PhoneAdmission, {\n              admit: (input) => owner.run(services.phoneAdmission.admit(input)),\n              cleanup: (input) => owner.run(services.phoneAdmission.cleanup(input)),\n            }),\n            Context.add(PhoneSignInTargets, {\n              lookup: (input) => owner.run(services.phoneSignInTargets.lookup(input)),\n            }),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n    ),\n  );\n"],"mappings":";;;;;;;AAqBA,MAAM,gBAAgB;CACpB,MAAM;CACN,SAAS;CACT,SAAS;CACT,uBAAuB,OAAO;AAChC;AAQA,MAAa,EAAE,iCALA,gBACbA,UACA,aAG8C;AAEhD,MAAa,8BAcX,SACA,SAGA,SASA,OAAO,QAAQ,UAAU,aACvB,sBACE,UACA,QAAQ,SACR,gBACC,cAAc,UAAU,WACvB,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,SAAS;CAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;CAED,MAAM,QAAQ,OAAO,YAAYC,oBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAC1D,OAAO,eAAe,mBAAmB,eAAe,CAC1D;CAOA,MAAM,WAAW,QAAQ,KAAK,kBAAkB;EAJ9C,SAAS,UAAU,MAAM,IAAI,SAAS,OAAO,KAAK,CAAC;EACnD,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;CAGjB,CAAC,CAAC,CAAC,KACvD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,GAC9C,QAAQ,IAAI,gBAAgB;EAC1B,QAAQ,UAAU,MAAM,IAAI,SAAS,eAAe,MAAM,KAAK,CAAC;EAChE,UAAU,UAAU,MAAM,IAAI,SAAS,eAAe,QAAQ,KAAK,CAAC;CACtE,CAAC,GACD,QAAQ,IAAI,oBAAoB,EAC9B,SAAS,UAAU,MAAM,IAAI,SAAS,mBAAmB,OAAO,KAAK,CAAC,EACxE,CAAC,CACH;CAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;AACjE,CAAC,CACL,CACF"}
+{"version":3,"file":"d1-phone.mjs","names":["DatabaseService","PhoneUnavailable"],"sources":["../../src/drizzle/d1-phone.ts"],"sourcesContent":["import type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PhoneOtpUnavailable as PhoneUnavailable,\n  PhoneAdmission,\n  PhonePersistence,\n  PhoneSignInTargets,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Context, Effect } from \"effect\";\n\nimport { Database as DatabaseService } from \"./d1-database\";\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { nativeDatabase } from \"./native-database\";\nimport type { D1PhoneMapping, PhoneMapping, PhoneMappingSource } from \"./phone-model\";\nimport { coordinateTargetPhone, makePhoneTarget, type PhoneCoordinatorError } from \"./phone-target\";\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\ntype Table = AnySQLiteTable;\n\nconst configuration = {\n  mode: \"batch\" as const,\n  dialect: \"sqlite\" as const,\n  locking: false,\n  standaloneGuard: () => Effect.void,\n};\n\n/** Reads use a primary D1 session; observations and expiry are asserted in the same batch. */\nconst target = makePhoneTarget<DatabaseService, Database, Table, D1PhoneMapping>(\n  DatabaseService,\n  configuration,\n);\n\nexport const { makePhonePersistenceServices } = target;\n\nexport const coordinatePhonePersistence = <\n  D extends Database,\n  S extends Table,\n  I extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & D1PhoneMapping, RSetup>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PhoneCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | D1BatchStatements>\n  | LifecycleHooks\n  | RSetup\n  | DatabaseRequirements\n> =>\n  Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPhone(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services, append) =>\n        Effect.gen(function* () {\n          const original = services.phonePersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(PhoneUnavailable.make({})).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: PhonePersistence[\"Service\"] = {\n            target: (input) => owner.run(original.target(input)),\n            mutate: (input, prepare) => owner.run(original.mutate(input, prepare)),\n          };\n\n          const provided = Context.make(PhonePersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n            Context.add(PhoneAdmission, {\n              admit: (input) => owner.run(services.phoneAdmission.admit(input)),\n              cleanup: (input) => owner.run(services.phoneAdmission.cleanup(input)),\n            }),\n            Context.add(PhoneSignInTargets, {\n              lookup: (input) => owner.run(services.phoneSignInTargets.lookup(input)),\n            }),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n"],"mappings":";;;;;;;;;AAuBA,MAAM,gBAAgB;CACpB,MAAM;CACN,SAAS;CACT,SAAS;CACT,uBAAuB,OAAO;AAChC;AAQA,MAAa,EAAE,iCALA,gBACbA,UACA,aAG8C;AAEhD,MAAa,8BAcX,SACA,SAGA,SASA,OAAO,QAAQ,eAAe,OAAO,IAAI,aACvC,sBACE,UACA,QAAQ,SACR,gBACC,cAAc,UAAU,WACvB,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,SAAS;CAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;CAED,MAAM,QAAQ,OAAO,YAAYC,oBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAC1D,OAAO,eAAe,mBAAmB,eAAe,CAC1D;CAOA,MAAM,WAAW,QAAQ,KAAK,kBAAkB;EAJ9C,SAAS,UAAU,MAAM,IAAI,SAAS,OAAO,KAAK,CAAC;EACnD,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;CAGjB,CAAC,CAAC,CAAC,KACvD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,GAC9C,QAAQ,IAAI,gBAAgB;EAC1B,QAAQ,UAAU,MAAM,IAAI,SAAS,eAAe,MAAM,KAAK,CAAC;EAChE,UAAU,UAAU,MAAM,IAAI,SAAS,eAAe,QAAQ,KAAK,CAAC;CACtE,CAAC,GACD,QAAQ,IAAI,oBAAoB,EAC9B,SAAS,UAAU,MAAM,IAAI,SAAS,mBAAmB,OAAO,KAAK,CAAC,EACxE,CAAC,CACH;CAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;AACjE,CAAC,CACL,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD"}

package/dist/drizzle/d1-proofs.d.mts

@@ -66,7 +66,7 @@ export declare const makeD1ProofPersistenceServices: <Rq extends AnySQLiteTable,
       readonly limit: number;
     }, prepare: PrepareProofCommit<ProofCleanupResult, A_1>) => Effect.Effect<PreparedCommit<A_1>, ProofUnavailable>;
   };
-}, never, Database$1 | LifecycleHooks>;
+}, ProofUnavailable, Database$1 | LifecycleHooks>;
 type CoordinatorError<E> = E | ProofUnavailable | HookConfigurationError;
 /**
  * Owns one proof transition plus application statements in one D1 batch. It

package/dist/drizzle/d1-proofs.mjs

@@ -1,9 +1,12 @@
 import { requiredProofConstraints } from "./proof-model.mjs";
-import { PersistenceMappingError, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
+import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
 import { balancedD1And } from "./d1-generated-statement.mjs";
+import { validateDrizzleStorage } from "./storage-validation.mjs";
 import { Database } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { nativeDatabase } from "./native-database.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { and, count, eq, gte, inArray, isNull, lte, notExists, or, sql } from "drizzle-orm";
 import { Cause, Context, Effect, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
@@ -62,7 +65,7 @@ const assertion = Effect.fn(function* (condition, marker) {
 });
 const allocateVersion = (mapping) => mapping.allocateVersion !== void 0 ? mapping.allocateVersion : mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
 	try: mapping.allocateVersionSync,
-	catch: (cause) => new PersistenceMappingError({
+	catch: (cause) => new PersistenceMappingError$1({
 		operation: "mapping",
 		cause
 	})
@@ -309,8 +312,12 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* (mapping, input, prep
 	const existingSeries = actionOpen ? (yield* readSeries(mapping, input.record.moduleId, input.record.purpose, keys.series))[0] : void 0;
 	const seriesVersion = yield* allocateVersion(mapping);
 	const active = existingSeries?.[mapping.series.activeProofId];
+	const activeGeneration = active === null || active === void 0 ? void 0 : (yield* readGeneration(mapping, input.record.moduleId, active))[0];
+	if (active !== null && active !== void 0 && (activeGeneration === void 0 || activeGeneration[mapping.generation.purpose] !== input.record.purpose)) return yield* unavailable();
+	const matchesActiveBinding = activeGeneration !== void 0 && sameBinding(yield* mapping.generation.decodeBinding(activeGeneration), input.record.binding);
+	const replacesLiveProof = activeGeneration !== void 0 && activeGeneration[mapping.generation.state] === "active" && (yield* mapping.decodeInstant(activeGeneration[mapping.generation.expiresAt])) > now;
 	const lastIssue = existingSeries?.[mapping.series.lastIssueAt] === null || existingSeries?.[mapping.series.lastIssueAt] === void 0 ? void 0 : yield* mapping.decodeInstant(existingSeries[mapping.series.lastIssueAt]);
-	const allowed = current.current && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && (input.supersedes === void 0 || input.supersedes === active) && (lastIssue === void 0 || now - lastIssue >= input.policy.abuse.resendCooldownMillis);
+	const allowed = current.current && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && (!replacesLiveProof || matchesActiveBinding) && (input.supersedes === void 0 || input.supersedes === active) && (lastIssue === void 0 || now - lastIssue >= input.policy.abuse.resendCooldownMillis);
 	const receipt = {
 		requestId: input.record.requestId,
 		reference: {
@@ -333,11 +340,13 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* (mapping, input, prep
 		record: input.record,
 		createdAtMillis: now,
 		retentionUntilMillis: retentionUntil
-	}), [[mapping.request.createdAt, mapping.d1.engineNow], [mapping.request.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))), ...yield* anchorStatements(mapping, input.record.moduleId, input.record.purpose, "issue", actionOpen ? scopes : scopes.slice(0, 1), keys.series, seriesVersion, actionOpen), ...yield* insertScopeStatements(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, admitted, now, retentionUntil, marker));
+	}), [[mapping.request.createdAt, mapping.d1.engineNow], [mapping.request.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))), ...yield* anchorStatements(mapping, input.record.moduleId, input.record.purpose, "issue", actionOpen ? scopes : scopes.slice(0, 1), keys.series, seriesVersion, actionOpen), ...yield* insertScopeStatements(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, allowed ? scopes : [], now, retentionUntil, marker));
 	if (allowed) {
 		const sc = seriesColumns(mapping);
+		const gc = generationColumns(mapping);
+		const replacementCondition = activeGeneration === void 0 ? sql`1 = 1` : sql`exists(select 1 from ${mapping.generation.table} where ${and(eq(gc.moduleId, input.record.moduleId), eq(gc.proofId, activeGeneration[mapping.generation.proofId]), eq(gc.version, activeGeneration[mapping.generation.version]), eq(column(mapping.generation.table, mapping.generation.binding), activeGeneration[mapping.generation.binding]), matchesActiveBinding ? sql`1 = 1` : sql`(${gc.state} <> 'active' or ${gc.expiresAt} <= ${mapping.d1.engineNow})`)})`;
 		const seriesCondition = and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series), active === null || active === void 0 ? or(eq(sc.activeProofId, null), sql`${sc.activeProofId} is null`) : eq(sc.activeProofId, active), lastIssue === void 0 ? sql`1 = 1` : lte(sc.lastIssueAt, mapping.d1.engineInstantMinus(input.policy.abuse.resendCooldownMillis)));
-		statements.push(yield* assertion(and(current.condition, sql`${mapping.d1.engineNowMillis} >= ${input.record.issuedAtMillis}`, sql`${mapping.d1.engineNow} < ${sql.param(mapping.encodeInstant(input.record.expiresAtMillis), generationColumns(mapping).expiresAt)}`, sql`exists(select 1 from ${mapping.series.table} where ${seriesCondition})`), marker));
+		statements.push(yield* assertion(and(current.condition, replacementCondition, sql`${mapping.d1.engineNowMillis} >= ${input.record.issuedAtMillis}`, sql`${mapping.d1.engineNow} < ${sql.param(mapping.encodeInstant(input.record.expiresAtMillis), generationColumns(mapping).expiresAt)}`, sql`exists(select 1 from ${mapping.series.table} where ${seriesCondition})`), marker));
 		if (active !== null && active !== void 0) statements.push(yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "superseded"]])).where(and(eq(generationColumns(mapping).moduleId, input.record.moduleId), eq(generationColumns(mapping).proofId, active), eq(generationColumns(mapping).state, "active")))));
 		statements.push(yield* statement(database.insert(mapping.generation.table).values(driverValues(mapping.generation.encodeInsert({
 			record: input.record,
@@ -733,6 +742,7 @@ const makeProofPlans = (mapping) => {
 };
 const makeD1ProofPersistenceServices = Effect.fnUntraced(function* (mapping) {
 	const database = yield* Database;
+	yield* validateDrizzleStorage(mapping).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
 	const hooks = yield* LifecycleHooks;
 	const plans = makeProofPlans(mapping);
 	const run = (plan) => Effect.gen(function* () {
@@ -755,7 +765,8 @@ const makeD1ProofPersistenceServices = Effect.fnUntraced(function* (mapping) {
 * ProofUnavailable so the caller can retry the entire command with fresh secrets.
 */
 function coordinateD1ProofPersistence(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
+		yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		if (yield* hasCommitScope) return yield* unavailable();
 		return (yield* coordinateCommit(() => Effect.gen(function* () {
@@ -794,7 +805,7 @@ function coordinateD1ProofPersistence(acquire, options, body) {
 			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
 			return value;
 		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 /** Private compiler seam for a future same-owner D1 password-reset batch. */
 const compileD1ProofCompletionPlan = Effect.fn("Drizzle.compileD1ProofCompletionPlan")(function* (mapping, plan, protectedMutation, project) {