@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/drizzle/totp-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { randomId } from \"@yielded/auth-crypto\";\nimport { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  TotpConfigurationError,\n  type TotpUnavailable,\n  TotpMutation,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  type TotpMapping,\n  type TotpMappingSource,\n  type TotpPersistenceServices,\n  requiredTotpConstraints,\n} from \"./totp-model\";\nimport {\n  captureTotp,\n  CurrentTotpTransaction,\n  invariant,\n  mutateTotp,\n  unavailable,\n} from \"./totp-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;\n\nexport type TotpCoordinatorError<E> =\n  | TransactionCoordinatorError<E, TotpUnavailable>\n  | TotpConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientTotpStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nconst validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(TotpPolicy)(mapping.policy);\n  for (const [key, value] of Object.entries(requiredTotpConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    factor: Object.freeze({ ...mapping.factor }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = Effect.fnUntraced(function* (\n  mapping: any,\n  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,\n): Effect.fn.Return<TotpPersistenceServices, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    totpPersistence: TotpPersistence.of({\n      snapshot: Effect.fn(\"TotpNative.snapshot\")(\n        function* (input) {\n          const captured = { ...input };\n\n          invariant(captured.moduleId === mapping.moduleId);\n          yield* execution.admit;\n\n          return yield* execution\n            .run(\n              Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),\n              false,\n            )\n            .pipe(Effect.provideService(LifecycleHooks, hooks));\n        },\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          // Detach caller-owned payloads before any driver or hook can suspend.\n          const codec = Schema.toCodecIso(TotpMutation);\n          const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));\n\n          return execution.admit.pipe(\n            Effect.andThen(\n              execution.run(\n                Effect.gen(function* () {\n                  const decision = yield* mutateTotp(mapping, input),\n                    owner = yield* CurrentTotpTransaction;\n\n                  owner.guards.push(owner.journal.prepare(undefined));\n                  const receipt = prepare(decision, owner.journal);\n\n                  invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n                  owner.guards.push(receipt as any);\n\n                  return receipt;\n                }),\n              ),\n            ),\n            Effect.provideService(LifecycleHooks, hooks),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n});\n\nexport const makeTargetTotpPersistence = <\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,\n  configuration: TotpTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    const execution = yield* makeTransactionExecution(\n      CurrentTotpTransaction,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return yield* services(mapping, execution);\n  });\n\nexport const coordinateTargetTotp = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<M, RSetup>,\n  configuration: TotpTargetConfiguration,\n  body: (\n    transaction: any,\n    services: TotpPersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, TotpCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentTotpTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution),\n      (transaction, acquireServices, append) =>\n        Effect.flatMap(acquireServices, (boundServices) =>\n          body(transaction, boundServices, append),\n        ),\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */\nexport const makeTotpTarget = <\n  DatabaseId,\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: TotpTargetConfiguration,\n) => {\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    Exclude<R, TotpPersistence> | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetTotp(\n        database as any,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services) => {\n          const provided = Context.make(TotpPersistence, services.totpPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeTotpPersistenceServices: <S extends T, F extends T, C extends T, N, RSetup = never>(\n      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,\n    ) =>\n      makeTargetTotpPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateTotpPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;AA+CA,MAAa,gCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAM,mBAAsB,UAAa,kBAA8C;CACrF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,UAAU,CAAC,CAAC,QAAQ,MAAM;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,uBAAuB,GAC/D,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,WAAW,OAAO,WAAW,WACjC,SACA,WACkE;CAClE,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,iBAAiB,gBAAgB,GAAG;EAClC,UAAU,OAAO,GAAG,qBAAqB,CAAC,CACxC,WAAW,OAAO;GAChB,MAAM,WAAW,EAAE,GAAG,MAAM;GAE5B,UAAU,SAAS,aAAa,QAAQ,QAAQ;GAChD,OAAO,UAAU;GAEjB,OAAO,OAAO,UACX,IACC,OAAO,IAAI,YAAY,SAAS,SAAS,SAAS,IAAI,UAAU,OAAO,QAAQ,GAC/E,KACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtD,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACA,SAAS,UAAU,YACjB,OAAO,cAAc;GAEnB,MAAM,QAAQ,OAAO,WAAW,YAAY;GAC5C,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC;GAEzE,OAAO,UAAU,MAAM,KACrB,OAAO,QACL,UAAU,IACR,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,WAAW,SAAS,KAAK,GAC/C,QAAQ,OAAO;IAEjB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;IAClD,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;IAE/C,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;IAC7E,MAAM,OAAO,KAAK,OAAc;IAEhC,OAAO;GACT,CAAC,CACH,CACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;CAChE,CAAC,EACH;AACF,CAAC;AAED,MAAa,6BAOX,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,MAAM,YAAY,OAAO,yBACvB,wBACA,eACA,aACA,QACF;CAEA,OAAO,OAAO,SAAS,SAAS,SAAS;AAC3C,CAAC;AAEH,MAAa,wBACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,OAAO,2BACZ,UACA,wBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,SAAS,IACzC,aAAa,iBAAiB,WAC7B,OAAO,QAAQ,kBAAkB,kBAC/B,KAAK,aAAa,eAAe,MAAM,CACzC,CACJ;AACF,CAAC;;AAOH,MAAa,kBAOX,iBACA,kBACG;CAyDH,SAAS,0BAeP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,qBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAa;GAClD,MAAM,WAAW,QAAQ,KAAK,iBAAiB,SAAS,eAAe;GACvE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,8BACE,YAEA,0BAA0B,SAAS,aAAa,CAAC,CAAC,KAChD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;CACF;AACF"}
+{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { randomId } from \"@yielded/auth-crypto\";\nimport { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  TotpConfigurationError,\n  type TotpUnavailable,\n  TotpMutation,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  type TotpMapping,\n  type TotpMappingSource,\n  type TotpPersistenceServices,\n  requiredTotpConstraints,\n} from \"./totp-model\";\nimport {\n  captureTotp,\n  CurrentTotpTransaction,\n  invariant,\n  mutateTotp,\n  unavailable,\n} from \"./totp-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;\n\nexport type TotpCoordinatorError<E> =\n  | TransactionCoordinatorError<E, TotpUnavailable>\n  | TotpConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientTotpStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nconst validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(TotpPolicy)(mapping.policy);\n  for (const [key, value] of Object.entries(requiredTotpConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    factor: Object.freeze({ ...mapping.factor }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = Effect.fnUntraced(function* (\n  mapping: any,\n  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,\n): Effect.fn.Return<TotpPersistenceServices, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    totpPersistence: TotpPersistence.of({\n      snapshot: Effect.fn(\"TotpNative.snapshot\")(\n        function* (input) {\n          const captured = { ...input };\n\n          invariant(captured.moduleId === mapping.moduleId);\n          yield* execution.admit;\n\n          return yield* execution\n            .run(\n              Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),\n              false,\n            )\n            .pipe(Effect.provideService(LifecycleHooks, hooks));\n        },\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          // Detach caller-owned payloads before any driver or hook can suspend.\n          const codec = Schema.toCodecIso(TotpMutation);\n          const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));\n\n          return execution.admit.pipe(\n            Effect.andThen(\n              execution.run(\n                Effect.gen(function* () {\n                  const decision = yield* mutateTotp(mapping, input),\n                    owner = yield* CurrentTotpTransaction;\n\n                  owner.guards.push(owner.journal.prepare(undefined));\n                  const receipt = prepare(decision, owner.journal);\n\n                  invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n                  owner.guards.push(receipt as any);\n\n                  return receipt;\n                }),\n              ),\n            ),\n            Effect.provideService(LifecycleHooks, hooks),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n});\n\nexport const makeTargetTotpPersistence = <\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,\n  configuration: TotpTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentTotpTransaction,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return yield* services(mapping, execution);\n  });\n\nexport const coordinateTargetTotp = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<M, RSetup>,\n  configuration: TotpTargetConfiguration,\n  body: (\n    transaction: any,\n    services: TotpPersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, TotpCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentTotpTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution),\n      (transaction, acquireServices, append) =>\n        Effect.flatMap(acquireServices, (boundServices) =>\n          body(transaction, boundServices, append),\n        ),\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */\nexport const makeTotpTarget = <\n  DatabaseId,\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: TotpTargetConfiguration,\n) => {\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    Exclude<R, TotpPersistence> | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetTotp(\n        database as any,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services,\n        ): Effect.Effect<A, E, Exclude<R, TotpPersistence>> => {\n          const provided = Context.make(TotpPersistence, services.totpPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    makeTotpPersistenceServices: <S extends T, F extends T, C extends T, N, RSetup = never>(\n      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,\n    ) =>\n      makeTargetTotpPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateTotpPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;;AAgDA,MAAa,gCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAM,mBAAsB,UAAa,kBAA8C;CACrF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,UAAU,CAAC,CAAC,QAAQ,MAAM;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,uBAAuB,GAC/D,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,WAAW,OAAO,WAAW,WACjC,SACA,WACkE;CAClE,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,iBAAiB,gBAAgB,GAAG;EAClC,UAAU,OAAO,GAAG,qBAAqB,CAAC,CACxC,WAAW,OAAO;GAChB,MAAM,WAAW,EAAE,GAAG,MAAM;GAE5B,UAAU,SAAS,aAAa,QAAQ,QAAQ;GAChD,OAAO,UAAU;GAEjB,OAAO,OAAO,UACX,IACC,OAAO,IAAI,YAAY,SAAS,SAAS,SAAS,IAAI,UAAU,OAAO,QAAQ,GAC/E,KACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtD,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACA,SAAS,UAAU,YACjB,OAAO,cAAc;GAEnB,MAAM,QAAQ,OAAO,WAAW,YAAY;GAC5C,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC;GAEzE,OAAO,UAAU,MAAM,KACrB,OAAO,QACL,UAAU,IACR,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,WAAW,SAAS,KAAK,GAC/C,QAAQ,OAAO;IAEjB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;IAClD,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;IAE/C,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;IAC7E,MAAM,OAAO,KAAK,OAAc;IAEhC,OAAO;GACT,CAAC,CACH,CACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;CAChE,CAAC,EACH;AACF,CAAC;AAED,MAAa,6BAOX,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,MAAM,YAAY,OAAO,yBACvB,wBACA,eACA,aACA,QACF;CAEA,OAAO,OAAO,SAAS,SAAS,SAAS;AAC3C,CAAC;AAEH,MAAa,wBACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,OAAO,OAAO,2BACZ,UACA,wBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,SAAS,IACzC,aAAa,iBAAiB,WAC7B,OAAO,QAAQ,kBAAkB,kBAC/B,KAAK,aAAa,eAAe,MAAM,CACzC,CACJ;AACF,CAAC;;AAOH,MAAa,kBAOX,iBACA,kBACG;CAyDH,SAAS,0BAeP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,qBACE,UACA,QAAQ,SACR,gBAEE,aACA,aACqD;GACrD,MAAM,WAAW,QAAQ,KAAK,iBAAiB,SAAS,eAAe;GACvE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,8BACE,YAEA,0BAA0B,SAAS,aAAa,CAAC,CAAC,KAChD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;CACF;AACF"}

package/dist/drizzle/transaction-mysql.mjs

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
-import { EffectMysql2Transaction } from "drizzle-orm/effect-mysql2";
 import { makeWithTransaction } from "effect/sql/SqlClient";
+import { EffectMysql2Transaction } from "drizzle-orm/effect-mysql2";
 //#region src/drizzle/transaction-mysql.ts
 /** Locking discovery and later SQL policy predicates must see the same current
 * authority. MySQL's default repeatable-read snapshot is unsuitable after a

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.14","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.14","@yielded/auth-crypto":"0.1.0-beta.14","@yielded/auth-persistence":"0.1.0-beta.14"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}
+{"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.16","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.16","@yielded/auth-crypto":"0.1.0-beta.16","@yielded/auth-persistence":"0.1.0-beta.16"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}

package/src/drizzle/d1-emails.ts

@@ -1,5 +1,6 @@
 /* oxlint-disable no-explicit-any -- D1 batches bridge consumer-owned Drizzle tables. */
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   EmailAddressPersistence,
   EmailSignInTargets,
@@ -49,7 +50,7 @@ import {
   type EmailRegistrationMapping,
   type EmailSignInMapping,
 } from "./email-model";
-import type { EmailRegistrationAuthority } from "./email-registration";
+import { type EmailRegistrationAuthority, readEmailRegistrationTarget } from "./email-registration";
 import {
   CurrentEmailSql,
   currentAddress,
@@ -63,7 +64,9 @@ import {
   type EmailSqlDatabase,
 } from "./email-sql";
 import { column, isMappedConstraintConflict, PersistenceMappingError, updateValues } from "./model";
+import { nativeDatabase } from "./native-database";
 import type { D1ProofPersistenceMapping } from "./proof-model";
+import { validateDrizzleStorage } from "./storage-validation";
 import type { SuppliedService } from "./SuppliedService";
 
 type PlanPrepare<Method extends (...args: any[]) => any, A> = (
@@ -966,6 +969,7 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* <Regist
   allocated: {
     readonly credentialId?: string;
     readonly securityRevision?: SecurityRevision;
+    readonly displacedSecurityRevision?: SecurityRevision;
     readonly identifierRevision?: SecurityRevision;
     readonly credentialRevision?: SecurityRevision;
     readonly nativeSubjectId?: unknown;
@@ -1000,6 +1004,21 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* <Regist
   )
     return { receipt: prepare({ _tag: "Rejected" }, journal), statements: [] };
 
+  const target =
+    mapping.mode === "atomic"
+      ? yield* readEmailRegistrationTarget(mapping, input.identifier, false)
+      : undefined;
+
+  if (target?._tag === "Rejected")
+    return { receipt: prepare({ _tag: "Rejected" }, journal), statements: [] };
+  if (
+    target?._tag === "Reserved" &&
+    (allocated.displacedSecurityRevision === undefined ||
+      allocated.displacedSecurityRevision === target.securityRevision ||
+      allocated.identifierRevision === target.bindingRevision)
+  )
+    return yield* unavailable();
+
   const intent = {
     moduleId: input.moduleId,
     commandId: input.commandId,
@@ -1062,6 +1081,30 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* <Regist
     const nativeSubjectId = allocated.nativeSubjectId;
 
     desired = { _tag: "Registered" };
+    const i = mapping.identifier;
+    const s = mapping.subject;
+    const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
+
+    if (target?._tag === "Reserved") {
+      // The planning reads hold no locks. Guard both ownership and the displaced
+      // subject revision before any provisioning or invalidation can commit.
+      statements.push(
+        yield* assertion(
+          and(
+            existsSql(sql`select 1 from ${i.table} where
+          ${column(i.table, i.namespace)}=${sql.param(input.identifier.namespace, column(i.table, i.namespace))}
+          and ${column(i.table, i.value)}=${sql.param(input.identifier.value, column(i.table, i.value))}
+          and ${column(i.table, i.subjectId)}=${sql.param(target.nativeSubjectId, column(i.table, i.subjectId))}
+          and ${column(i.table, i.bindingRevision)}=${sql.param(target.bindingRevision, column(i.table, i.bindingRevision))}
+          and ${column(i.table, i.verifiedAt)} is null`),
+            existsSql(sql`select 1 from ${s.table} where
+          ${column(s.table, s.id)}=${sql.param(target.nativeSubjectId, column(s.table, s.id))}
+          and ${column(s.table, s.securityRevision)}=${sql.param(target.securityRevision, column(s.table, s.securityRevision))}`),
+          )!,
+          marker,
+        ),
+      );
+    }
     statements.push(
       yield* statement(
         database.insert(mapping.subject.table).values(
@@ -1071,19 +1114,55 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* <Regist
           }),
         ),
       ),
-      yield* statement(
-        database.insert(mapping.identifier.table).values(
-          driverValues(
-            mapping.identifier.encodeVerifiedInsert({
-              identifier: input.identifier,
-              subjectId: nativeSubjectId,
-              verifiedAtMillis: transitionMillis,
-              bindingRevision: allocated.identifierRevision,
-            }),
-            [[mapping.identifier.verifiedAt, mapping.encodeInstant(transitionMillis)]],
-          ),
-        ),
-      ),
+      ...(target?._tag === "Reserved"
+        ? [
+            yield* statement(
+              database
+                .update(i.table)
+                .set(
+                  updateValues([
+                    [i.subjectId, nativeSubjectId],
+                    [i.verifiedAt, mapping.encodeInstant(transitionMillis)],
+                    [i.bindingRevision, allocated.identifierRevision],
+                  ]),
+                )
+                .where(
+                  and(
+                    eq(column(i.table, i.namespace), input.identifier.namespace),
+                    eq(column(i.table, i.value), input.identifier.value),
+                    eq(column(i.table, i.subjectId), target.nativeSubjectId),
+                    eq(column(i.table, i.bindingRevision), target.bindingRevision),
+                    sql`${column(i.table, i.verifiedAt)} is null`,
+                  ),
+                ),
+            ),
+            yield* statement(
+              database
+                .update(s.table)
+                .set(updateValues([[s.securityRevision, allocated.displacedSecurityRevision]]))
+                .where(
+                  and(
+                    eq(column(s.table, s.id), target.nativeSubjectId),
+                    eq(column(s.table, s.securityRevision), target.securityRevision),
+                  ),
+                ),
+            ),
+          ]
+        : [
+            yield* statement(
+              database.insert(i.table).values(
+                driverValues(
+                  i.encodeVerifiedInsert({
+                    identifier: input.identifier,
+                    subjectId: nativeSubjectId,
+                    verifiedAtMillis: transitionMillis,
+                    bindingRevision: allocated.identifierRevision,
+                  }),
+                  [[i.verifiedAt, mapping.encodeInstant(transitionMillis)]],
+                ),
+              ),
+            ),
+          ]),
       yield* statement(
         database.insert(mapping.credential.table).values(
           mapping.credential.encodeVerifiedInsert({
@@ -1145,6 +1224,11 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* <Regist
     );
 
     applied = and(
+      target?._tag === "Reserved"
+        ? existsSql(sql`select 1 from ${s.table} where
+            ${sId}=${sql.param(target.nativeSubjectId, sId)}
+            and ${sRevision}=${sql.param(allocated.displacedSecurityRevision, sRevision)}`)
+        : sql`true`,
       existsSql(
         sql`select 1 from ${mapping.subject.table} where ${sId}=${sql.param(nativeSubjectId, sId)} and ${sStatus}=${sql.param(mapping.subject.d1ActiveStatusValue, sStatus)} and ${sRevision}=${sql.param(allocated.securityRevision, sRevision)}`,
       ),
@@ -1224,6 +1308,10 @@ const makeRegistrationPlans = <Registration>(
         ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync)
         : undefined;
 
+      const displacedSecurityRevision = atomic
+        ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync)
+        : undefined;
+
       const identifierRevision = atomic
         ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync)
         : undefined;
@@ -1253,6 +1341,7 @@ const makeRegistrationPlans = <Registration>(
         {
           ...(credentialId === undefined ? {} : { credentialId }),
           ...(securityRevision === undefined ? {} : { securityRevision }),
+          ...(displacedSecurityRevision === undefined ? {} : { displacedSecurityRevision }),
           ...(identifierRevision === undefined ? {} : { identifierRevision }),
           ...(credentialRevision === undefined ? {} : { credentialRevision }),
           ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),
@@ -1271,29 +1360,40 @@ export const makeD1EmailSignInServices = <
 >(
   mapping: EmailSignInMapping<S, I, C, NativeId>,
 ) =>
-  Effect.map(DatabaseService, (database) => ({
-    emailSignInTargets: EmailSignInTargets.of({
-      lookup: (input) => {
-        if (!validEmailSignInConstraints(mapping as any)) return Effect.fail(unavailable());
-
-        return emailLookupRows(mapping as any, input.moduleId, input.identifier).pipe(
-          Effect.flatMap((rows) => {
-            const row = rows[0];
-
-            if (row === undefined) return Effect.succeed(Option.none());
-
-            return decodeEmailSnapshot(mapping as any, input.moduleId, input.identifier, row).pipe(
-              Effect.map((snapshot) =>
-                snapshot === undefined ? Option.none() : Option.some(snapshot),
-              ),
+  Effect.flatMap(nativeDatabase(DatabaseService), (database) =>
+    validateDrizzleStorage(mapping).pipe(
+      Effect.provideService(NativeDatabase, database),
+      Effect.mapError(unavailable),
+      Effect.as({
+        emailSignInTargets: EmailSignInTargets.of({
+          lookup: (input) => {
+            if (!validEmailSignInConstraints(mapping as any)) return Effect.fail(unavailable());
+
+            return emailLookupRows(mapping as any, input.moduleId, input.identifier).pipe(
+              Effect.flatMap((rows) => {
+                const row = rows[0];
+
+                if (row === undefined) return Effect.succeed(Option.none());
+
+                return decodeEmailSnapshot(
+                  mapping as any,
+                  input.moduleId,
+                  input.identifier,
+                  row,
+                ).pipe(
+                  Effect.map((snapshot) =>
+                    snapshot === undefined ? Option.none() : Option.some(snapshot),
+                  ),
+                );
+              }),
+              Effect.provideService(CurrentD1PlanningDatabase, database),
+              translateFailure,
             );
-          }),
-          Effect.provideService(CurrentD1PlanningDatabase, database),
-          translateFailure,
-        );
-      },
-    }),
-  }));
+          },
+        }),
+      }),
+    ),
+  );
 
 export const makeD1EmailAddressServices = Effect.fnUntraced(function* <
   S extends AnySQLiteTable,
@@ -1333,6 +1433,11 @@ export const makeD1EmailAddressServices = Effect.fnUntraced(function* <
 ) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
 
   const plans = makeAddressPlans(
@@ -1419,6 +1524,11 @@ export const makeD1EmailRegistrationServices = Effect.fnUntraced(function* <
 ) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
 
   const plans = makeRegistrationPlans(
@@ -1507,8 +1617,12 @@ export function coordinateD1EmailAddress<
   CoordinatorError<E> | DatabaseError,
   Exclude<R, EmailAddressPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     Effect.gen(function* () {
+      yield* validateDrizzleStorage({
+        ...options.mapping,
+        proof: options.proofMapping,
+      }).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
 
       if (yield* hasCommitScope) return yield* unavailable();
@@ -1622,7 +1736,7 @@ export function coordinateD1EmailAddress<
       ).pipe(Effect.provideService(LifecycleHooks, hooks));
 
       return result.value;
-    }),
+    }).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -1678,8 +1792,12 @@ export function coordinateD1EmailRegistration<
   CoordinatorError<E> | DatabaseError,
   Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     Effect.gen(function* () {
+      yield* validateDrizzleStorage({
+        ...options.mapping,
+        proof: options.proofMapping,
+      }).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
 
       if (yield* hasCommitScope) return yield* unavailable();
@@ -1777,7 +1895,7 @@ export function coordinateD1EmailRegistration<
       ).pipe(Effect.provideService(LifecycleHooks, hooks));
 
       return result.value;
-    }),
+    }).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 

package/src/drizzle/d1-identity.ts

@@ -1,4 +1,5 @@
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -34,6 +35,8 @@ import {
   type D1GeneratedIdentityMapping,
   type D1SubjectProvisioningMapping,
 } from "./model";
+import { nativeDatabase } from "./native-database";
+import { validateDrizzleStorage } from "./storage-validation";
 
 type RuntimeDatabase = EffectSQLiteD1Database<any> & { readonly $client: D1Client };
 const unavailable = () => IdentityUnavailable.make();
@@ -100,6 +103,11 @@ export const makeD1SubjectProvisioningServices = Effect.fnUntraced(function* <
 >(mapping: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(() => IdentityUnavailable.make()),
+  );
+
   const db = database as RuntimeDatabase;
   const requestTable = mapping.provisioningRequest.table;
 
@@ -262,6 +270,11 @@ export const makeD1ExternalIdentityServices = Effect.fnUntraced(function* <
 >(mapping: D1ExternalIdentityMapping<Subject, External, NativeId>) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(() => IdentityUnavailable.make()),
+  );
+
   const db = database as RuntimeDatabase;
   const externalTable = mapping.externalIdentity.table;
 

package/src/drizzle/d1-oauth.ts

@@ -131,7 +131,7 @@ export function coordinateD1OAuthSignIn<
   OAuthCoordinatorError<E> | DatabaseError,
   Exclude<R, OAuthSignInPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthSignIn<
       never,
       A,
@@ -162,7 +162,7 @@ export function coordinateD1OAuthSignIn<
 
         return yield* owner.close(Effect.provideContext(body, provided));
       }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -191,7 +191,7 @@ export function coordinateD1OAuthRegistrationIntents<
   OAuthCoordinatorError<E> | DatabaseError,
   Exclude<R, OAuthRegistrationIntents | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthRegistrationIntents<
       never,
       A,
@@ -219,7 +219,7 @@ export function coordinateD1OAuthRegistrationIntents<
 
         return yield* owner.close(Effect.provideContext(body, provided));
       }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -246,7 +246,7 @@ export function coordinateD1OAuthAccounts<
   OAuthCoordinatorError<E> | DatabaseError,
   Exclude<R, OAuthAccountsPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthAccounts<
       never,
       A,
@@ -281,7 +281,7 @@ export function coordinateD1OAuthAccounts<
 
         return yield* owner.close(Effect.provideContext(body, provided));
       }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -314,7 +314,7 @@ export function coordinateD1OAuthRegistration<
   OAuthCoordinatorError<E> | DatabaseError,
   Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthRegistration<
       Registration,
       never,
@@ -346,6 +346,6 @@ export function coordinateD1OAuthRegistration<
 
         return yield* owner.close(Effect.provideContext(body, provided));
       }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }

package/src/drizzle/d1-passkey.ts

@@ -1,4 +1,5 @@
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   PasskeyUnavailable,
@@ -13,6 +14,7 @@ import { Effect, Context } from "effect";
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
+import { nativeDatabase } from "./native-database";
 import { makePasskeyTarget } from "./passkey-drivers";
 import type {
   D1PasskeyMapping,
@@ -96,7 +98,7 @@ export function coordinatePasskeyPersistence<
   | DatabaseRequirements
   | RSetup
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasskey(database, options.mapping, configuration, (_, services, append) =>
       Effect.gen(function* () {
         const original = services.passkeyPersistence;
@@ -123,7 +125,7 @@ export function coordinatePasskeyPersistence<
 
         return yield* owner.close(Effect.provideContext(body, provided));
       }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -158,7 +160,7 @@ export function coordinatePasskeyRegistrationCeremony<
   | DatabaseRequirements
   | RSetup
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasskeyRegistration(
       database,
       options.mapping,
@@ -189,7 +191,7 @@ export function coordinatePasskeyRegistrationCeremony<
 
           return yield* owner.close(Effect.provideContext(body, provided));
         }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -241,7 +243,7 @@ export function coordinatePasskeyManagement<
   | DatabaseRequirements
   | RSetup
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasskeyManagement(
       database,
       options.mapping,
@@ -286,7 +288,7 @@ export function coordinatePasskeyManagement<
 
           return yield* owner.close(Effect.provideContext(body, context));
         }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -330,7 +332,7 @@ export function coordinatePasskeyRegistration<
   | DatabaseRequirements
   | RSetup
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasskeyRegistrationWriter(
       database,
       options.mapping,
@@ -372,6 +374,6 @@ export function coordinatePasskeyRegistration<
 
           return yield* owner.close(Effect.provideContext(body, context));
         }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }

package/src/drizzle/d1-password-prepared.ts

@@ -1,5 +1,6 @@
 /* oxlint-disable no-explicit-any -- driver exports preserve concrete consumer mappings. */
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   coordinateCommit,
   CurrentCommitJournal,
@@ -39,6 +40,7 @@ import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
 import { checkD1ProofCompletion, compileD1ProofCompletionPlan } from "./d1-proofs";
 import { D1BatchStatements } from "./D1BatchStatements";
 import { PersistenceMappingError, column, updateValues } from "./model";
+import { nativeDatabase } from "./native-database";
 import type {
   D1PasswordPreparedPersistenceMapping,
   D1PasswordPreparedProofMapping,
@@ -57,6 +59,7 @@ import {
   unavailable,
 } from "./password-prepared-state";
 import { CurrentPasswordSql, type PasswordSqlDatabase } from "./password-sql";
+import { validateDrizzleStorage } from "./storage-validation";
 import type { SuppliedService } from "./SuppliedService";
 
 type PlanPrepare<Method extends (...args: any[]) => any, A> = (
@@ -990,6 +993,11 @@ export const makeD1PasswordPreparedPersistenceServices = Effect.fnUntraced(funct
 ) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
   const plans = makePreparedPlans(mapping as unknown as Mapping, proofMapping);
 
@@ -1079,8 +1087,12 @@ export function coordinateD1PasswordPreparedPersistence<
   E | PasswordUnavailable | HookConfigurationError | DatabaseError,
   Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     Effect.gen(function* () {
+      yield* validateDrizzleStorage({
+        ...options.mapping,
+        proof: options.proofMapping,
+      }).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
 
       if (yield* hasCommitScope) return yield* unavailable();
@@ -1206,7 +1218,7 @@ export function coordinateD1PasswordPreparedPersistence<
       ).pipe(Effect.provideService(LifecycleHooks, hooks));
 
       return result.value;
-    }),
+    }).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }