@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/src/drizzle/d1-passwords.ts

@@ -1,5 +1,6 @@
 /* oxlint-disable no-explicit-any -- D1 plans bridge consumer-owned Drizzle rows and SQL statements. */
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   coordinateCommit,
   CurrentCommitJournal,
@@ -62,6 +63,7 @@ import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
 import { compileD1ProofCompletionPlan, type D1ProtectedProofMutation } from "./d1-proofs";
 import { D1BatchStatements } from "./D1BatchStatements";
 import { column, isMappedConstraintConflict, PersistenceMappingError, updateValues } from "./model";
+import { nativeDatabase } from "./native-database";
 import {
   type AnyPasswordRegistrationMapping,
   type D1PasswordPersistenceMapping,
@@ -74,6 +76,7 @@ import {
 } from "./password-model";
 import type { PasswordRegistrationAuthority } from "./password-registration";
 import type { D1ProofPersistenceMapping } from "./proof-model";
+import { validateDrizzleStorage } from "./storage-validation";
 import type { SuppliedService } from "./SuppliedService";
 
 type PlanPrepare<Method extends (...args: any[]) => any, A> = (
@@ -2022,6 +2025,11 @@ export const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <
 ) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
   const plans = makePasswordPlans(mapping as unknown as Mapping, proofMapping);
 
@@ -2112,8 +2120,12 @@ export function coordinateD1PasswordPersistence<
   CoordinatorError<E> | DatabaseError,
   Exclude<R, PasswordPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     Effect.gen(function* () {
+      yield* validateDrizzleStorage({
+        ...options.mapping,
+        proof: options.proofMapping,
+      }).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
 
       if (yield* hasCommitScope) return yield* unavailable();
@@ -2234,7 +2246,7 @@ export function coordinateD1PasswordPersistence<
       ).pipe(Effect.provideService(LifecycleHooks, hooks));
 
       return result.value;
-    }),
+    }).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -2466,6 +2478,11 @@ export const makeD1PasswordRegistrationServices = Effect.fnUntraced(function* <
 >(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
   const plans = makeRegistrationPlans(mapping as unknown as RegistrationMapping<Registration>);
 
@@ -2512,8 +2529,9 @@ export function coordinateD1PasswordRegistration<
   CoordinatorError<E> | DatabaseError,
   Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     Effect.gen(function* () {
+      yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
 
       if (yield* hasCommitScope) return yield* unavailable();
@@ -2593,7 +2611,7 @@ export function coordinateD1PasswordRegistration<
       ).pipe(Effect.provideService(LifecycleHooks, hooks));
 
       return result.value;
-    }),
+    }).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 

package/src/drizzle/d1-phone.ts

@@ -1,4 +1,5 @@
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   PhoneOtpUnavailable as PhoneUnavailable,
@@ -14,6 +15,7 @@ import { Context, Effect } from "effect";
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
+import { nativeDatabase } from "./native-database";
 import type { D1PhoneMapping, PhoneMapping, PhoneMappingSource } from "./phone-model";
 import { coordinateTargetPhone, makePhoneTarget, type PhoneCoordinatorError } from "./phone-target";
 type Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };
@@ -61,7 +63,7 @@ export const coordinatePhonePersistence = <
   | RSetup
   | DatabaseRequirements
 > =>
-  Effect.flatMap(acquire, (database) =>
+  Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPhone(
       database,
       options.mapping,
@@ -96,5 +98,5 @@ export const coordinatePhonePersistence = <
 
           return yield* owner.close(Effect.provideContext(body, provided));
         }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );

package/src/drizzle/d1-proofs.ts

@@ -1,5 +1,6 @@
 /* oxlint-disable no-explicit-any -- D1 planning bridges consumer Drizzle tables to Effect SQL statements. */
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   coordinateCommit,
   CurrentCommitJournal,
@@ -52,6 +53,7 @@ import { balancedD1And } from "./d1-generated-statement";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
 import { column, PersistenceMappingError, isMappedConstraintConflict, updateValues } from "./model";
+import { nativeDatabase } from "./native-database";
 import {
   type D1ProofPersistenceMapping,
   requiredProofConstraints,
@@ -63,6 +65,7 @@ import {
   type ProofScopeKeys,
   type ProofScopeKind,
 } from "./proof-model";
+import { validateDrizzleStorage } from "./storage-validation";
 
 type PlanPrepare<Method extends (...args: any[]) => any, A> = (
   value: Parameters<Parameters<Method>[1]>[0],
@@ -725,6 +728,28 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* <A>(
   const seriesVersion = yield* allocateVersion(mapping);
   const active = existingSeries?.[mapping.series.activeProofId] as string | null | undefined;
 
+  const activeGeneration =
+    active === null || active === undefined
+      ? undefined
+      : (yield* readGeneration(mapping, input.record.moduleId, active))[0];
+
+  if (
+    active !== null &&
+    active !== undefined &&
+    (activeGeneration === undefined ||
+      activeGeneration[mapping.generation.purpose] !== input.record.purpose)
+  )
+    return yield* unavailable();
+
+  const matchesActiveBinding =
+    activeGeneration !== undefined &&
+    sameBinding(yield* mapping.generation.decodeBinding(activeGeneration), input.record.binding);
+
+  const replacesLiveProof =
+    activeGeneration !== undefined &&
+    activeGeneration[mapping.generation.state] === "active" &&
+    (yield* mapping.decodeInstant(activeGeneration[mapping.generation.expiresAt])) > now;
+
   const lastIssue =
     existingSeries?.[mapping.series.lastIssueAt] === null ||
     existingSeries?.[mapping.series.lastIssueAt] === undefined
@@ -737,6 +762,7 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* <A>(
     admitted.length === scopes.length &&
     input.record.issuedAtMillis <= now &&
     input.record.expiresAtMillis > now &&
+    (!replacesLiveProof || matchesActiveBinding) &&
     (input.supersedes === undefined || input.supersedes === active) &&
     (lastIssue === undefined || now - lastIssue >= input.policy.abuse.resendCooldownMillis);
 
@@ -806,7 +832,7 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* <A>(
       input.record.purpose,
       "issue",
       input.record.requestId,
-      admitted,
+      allowed ? scopes : [],
       now,
       retentionUntil,
       marker,
@@ -814,6 +840,25 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* <A>(
   );
   if (allowed) {
     const sc = seriesColumns(mapping);
+    const gc = generationColumns(mapping);
+
+    // Recheck replacement authority in the submitted batch. Generation bindings
+    // are immutable; the version and stored binding also fence a changed row.
+    const replacementCondition =
+      activeGeneration === undefined
+        ? sql`1 = 1`
+        : sql`exists(select 1 from ${mapping.generation.table} where ${and(
+            eq(gc.moduleId, input.record.moduleId),
+            eq(gc.proofId, activeGeneration[mapping.generation.proofId]),
+            eq(gc.version, activeGeneration[mapping.generation.version]),
+            eq(
+              column(mapping.generation.table, mapping.generation.binding),
+              activeGeneration[mapping.generation.binding],
+            ),
+            matchesActiveBinding
+              ? sql`1 = 1`
+              : sql`(${gc.state} <> 'active' or ${gc.expiresAt} <= ${mapping.d1.engineNow})`,
+          )})`;
 
     const seriesCondition = and(
       eq(sc.moduleId, input.record.moduleId),
@@ -834,6 +879,7 @@ const issuePlan = Effect.fn("Drizzle.issuePlan")(function* <A>(
       yield* assertion(
         and(
           current.condition,
+          replacementCondition,
           sql`${mapping.d1.engineNowMillis} >= ${input.record.issuedAtMillis}`,
           sql`${mapping.d1.engineNow} < ${sql.param(mapping.encodeInstant(input.record.expiresAtMillis), generationColumns(mapping).expiresAt)}`,
           sql`exists(select 1 from ${mapping.series.table} where ${seriesCondition})`,
@@ -2002,6 +2048,11 @@ export const makeD1ProofPersistenceServices = Effect.fnUntraced(function* <
 >(mapping: D1ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
   const plans = makeProofPlans(mapping as unknown as Mapping);
 
@@ -2066,8 +2117,9 @@ export function coordinateD1ProofPersistence<
   CoordinatorError<E> | DatabaseError,
   Exclude<R, ProofPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     Effect.gen(function* () {
+      yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
 
       if (yield* hasCommitScope) return yield* unavailable();
@@ -2157,7 +2209,7 @@ export function coordinateD1ProofPersistence<
       ).pipe(Effect.provideService(LifecycleHooks, hooks));
 
       return result.value;
-    }),
+    }).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 

package/src/drizzle/d1-sessions.ts

@@ -1,4 +1,5 @@
 import {
+  NativeDatabase,
   decodeStepUpIntent,
   encodeStepUpIntent,
   stepUpIntentLive,
@@ -62,6 +63,7 @@ import {
 } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
 import { column, PersistenceMappingError, isMappedConstraintConflict, updateValues } from "./model";
+import { nativeDatabase } from "./native-database";
 import type {
   D1AuthenticationAuthorityMapping,
   D1PendingAuthenticationMapping,
@@ -69,6 +71,7 @@ import type {
   D1StatefulSessionMapping,
 } from "./session-model";
 import type { D1SessionStepUpMapping } from "./step-up-model";
+import { validateDrizzleStorage } from "./storage-validation";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = D1PlanningDatabase;
@@ -1125,6 +1128,8 @@ export const makeD1StatefulSessions = <Claims>(
 
           const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
 
+          if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
+
           const version = yield* allocate(
             mapping.session.allocateVersion,
             mapping.session.allocateVersionSync,
@@ -1136,7 +1141,10 @@ export const makeD1StatefulSessions = <Claims>(
             version,
             subjectId: input.evidence.revision.subjectId,
             securityRevision: input.evidence.revision.securityRevision,
-            assurance: assessed.assurance,
+            assurance:
+              input.handoffSourceSessionId === undefined
+                ? assessed.assurance
+                : input.session.assurance,
             provenance: yield* snapshotSessionAuthenticationProvenance({
               evidence: input.evidence,
             }),
@@ -1146,7 +1154,7 @@ export const makeD1StatefulSessions = <Claims>(
             issuedAt: DateTime.makeUnsafe(DateTime.toEpochMillis(input.session.issuedAt)),
           };
 
-          let condition = and(
+          const commitCondition = and(
             authorityCondition(mapping, nativeSubjectId, input.evidence),
             freshnessCondition(mapping, input.evidence, policy, true),
             sql`${DateTime.toEpochMillis(record.issuedAt)} <= ${mapping.d1.engineNowMillis}`,
@@ -1154,6 +1162,7 @@ export const makeD1StatefulSessions = <Claims>(
             sql`${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)}`,
           )!;
 
+          let condition = commitCondition;
           const statements: Statement<any>[] = [];
 
           if (input.pending === undefined) {
@@ -1216,6 +1225,9 @@ export const makeD1StatefulSessions = <Claims>(
                 }),
               ),
             ),
+            // Recheck after insertion as well as admission; the capped source
+            // expiry and proof freshness must still hold at the final batch step.
+            yield* assertion(commitCondition),
           );
           const receipt = prepare(record, journal);
 
@@ -1626,6 +1638,8 @@ export const makeD1SessionServiceEffects = {
   authority: <Claims>(mapping: any) =>
     Effect.gen(function* () {
       const database = yield* CurrentD1PlanningDatabase;
+
+      yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
       const raw = makeD1AuthenticationAuthority<Claims>(mapping);
 
@@ -1654,6 +1668,8 @@ export const makeD1SessionServiceEffects = {
   pending: <Claims>(mapping: any) =>
     Effect.gen(function* () {
       const database = yield* CurrentD1PlanningDatabase;
+
+      yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
       const raw = makeD1PendingAuthentication<Claims>(mapping);
 
@@ -1683,6 +1699,8 @@ export const makeD1SessionServiceEffects = {
   stateful: <Claims>(mapping: any) =>
     Effect.gen(function* () {
       const database = yield* CurrentD1PlanningDatabase;
+
+      yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
       const raw = makeD1StatefulSessions<Claims>(mapping);
 
@@ -1718,6 +1736,8 @@ export const makeD1SessionServiceEffects = {
   validity: (mapping: any) =>
     Effect.gen(function* () {
       const database = yield* CurrentD1PlanningDatabase;
+
+      yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
       const hooks = yield* LifecycleHooks;
       const raw = makeD1SignedValidity(mapping);
 
@@ -1759,12 +1779,19 @@ type D1CoordinatorError<E> = E | D1DomainError | HookConfigurationError;
  */
 export const coordinateD1SessionBatch = <Services, A, E, R>(
   database: Database,
+  mapping: unknown,
   make: (batch: D1SessionBatch) => Effect.Effect<Services, never, LifecycleHooks>,
   owner: (services: Services, batch: D1SessionBatch) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, D1CoordinatorError<E>, R | LifecycleHooks> =>
-  Effect.gen(function* (): Effect.fn.Return<A, D1CoordinatorError<E>, R | LifecycleHooks> {
+): Effect.Effect<A, D1CoordinatorError<E>, R | LifecycleHooks | NativeDatabase> =>
+  Effect.gen(function* (): Effect.fn.Return<
+    A,
+    D1CoordinatorError<E>,
+    R | LifecycleHooks | NativeDatabase
+  > {
     if (yield* hasCommitScope) return yield* unavailable();
 
+    yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
+
     const result = yield* coordinateCommit(
       () =>
         Effect.gen(function* () {
@@ -1848,7 +1875,10 @@ export const makeD1AuthenticationAuthorityServices = <
 ) =>
   makeD1SessionServiceEffects
     .authority<Claims>(mapping as any)
-    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
+    .pipe(
+      Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService),
+      Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    );
 
 export const makeD1PendingAuthenticationServices = <
   Claims,
@@ -1869,7 +1899,10 @@ export const makeD1PendingAuthenticationServices = <
 ) =>
   makeD1SessionServiceEffects
     .pending<Claims>(mapping as any)
-    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
+    .pipe(
+      Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService),
+      Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    );
 
 export const makeD1StatefulSessionServices = <
   Claims,
@@ -1894,7 +1927,10 @@ export const makeD1StatefulSessionServices = <
 ) =>
   makeD1SessionServiceEffects
     .stateful<Claims>(mapping as any)
-    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
+    .pipe(
+      Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService),
+      Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    );
 
 export const makeD1SignedSessionValidityServices = <
   Subject extends AnySQLiteTable,
@@ -1906,7 +1942,10 @@ export const makeD1SignedSessionValidityServices = <
 ) =>
   makeD1SessionServiceEffects
     .validity(mapping as any)
-    .pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService));
+    .pipe(
+      Effect.provideServiceEffect(CurrentD1PlanningDatabase, DatabaseService),
+      Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    );
 
 export function coordinateD1AuthenticationAuthority<
   Claims,
@@ -1938,9 +1977,10 @@ export function coordinateD1AuthenticationAuthority<
   D1CoordinatorError<E> | DatabaseError,
   Exclude<R, AuthenticationAuthority | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateD1SessionBatch(
       database,
+      options.mapping,
       (batch) =>
         Effect.gen(function* () {
           const hooks = yield* LifecycleHooks;
@@ -1976,7 +2016,7 @@ export function coordinateD1AuthenticationAuthority<
 
         return Effect.provideContext(body, provided);
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -2012,9 +2052,10 @@ export function coordinateD1PendingAuthentication<
   D1CoordinatorError<E> | DatabaseError,
   Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateD1SessionBatch(
       database,
+      options.mapping,
       (batch) =>
         Effect.gen(function* () {
           const hooks = yield* LifecycleHooks;
@@ -2047,7 +2088,7 @@ export function coordinateD1PendingAuthentication<
 
         return Effect.provideContext(body, provided);
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -2091,9 +2132,10 @@ export function coordinateD1StatefulSessions<
   | LifecycleHooks
   | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateD1SessionBatch(
       database,
+      options.mapping,
       (batch) =>
         Effect.gen(function* () {
           const hooks = yield* LifecycleHooks;
@@ -2142,7 +2184,7 @@ export function coordinateD1StatefulSessions<
 
         return Effect.provideContext(body, provided);
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -2174,9 +2216,10 @@ export function coordinateD1SignedSessionValidity<
   D1CoordinatorError<E> | DatabaseError,
   Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateD1SessionBatch(
       database,
+      options.mapping,
       (batch) =>
         Effect.gen(function* () {
           const hooks = yield* LifecycleHooks;
@@ -2208,7 +2251,7 @@ export function coordinateD1SignedSessionValidity<
 
         return Effect.provideContext(body, provided);
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -2762,6 +2805,11 @@ export const makeD1SessionStepUpServices = Effect.fnUntraced(function* <
 ) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(unavailable),
+  );
+
   const hooks = yield* LifecycleHooks;
   const raw = makeD1SessionStepUp<Claims>(mapping as any);
 
@@ -2826,9 +2874,10 @@ export function coordinateD1SessionStepUp<
   D1CoordinatorError<E> | DatabaseError,
   Exclude<R, Id | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateD1SessionBatch(
       database,
+      options.mapping,
       (batch) =>
         Effect.gen(function* () {
           const hooks = yield* LifecycleHooks;
@@ -2865,6 +2914,6 @@ export function coordinateD1SessionStepUp<
 
         return Effect.provideContext(body, provided);
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }

package/src/drizzle/d1-totp.ts

@@ -1,4 +1,5 @@
 import type { D1Client } from "@effect/sql-d1/D1Client";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { TotpUnavailable, TotpPersistence } from "@yielded/auth/Totp";
 import type { AnyRelations } from "drizzle-orm";
@@ -9,6 +10,7 @@ import { Context, Effect } from "effect";
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
+import { nativeDatabase } from "./native-database";
 import type { D1TotpMapping, TotpMapping, TotpMappingSource } from "./totp-model";
 import { coordinateTargetTotp, makeTotpTarget, type TotpCoordinatorError } from "./totp-target";
 type Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };
@@ -50,7 +52,7 @@ export const coordinateTotpPersistence = <
   TotpCoordinatorError<E> | DatabaseError,
   Exclude<R, TotpPersistence | D1BatchStatements> | LifecycleHooks | RSetup | DatabaseRequirements
 > =>
-  Effect.flatMap(acquire, (database) =>
+  Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetTotp(
       database,
       options.mapping,
@@ -78,5 +80,5 @@ export const coordinateTotpPersistence = <
 
           return yield* owner.close(Effect.provideContext(body, provided));
         }),
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );