@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/src/drizzle/email-registration.ts

@@ -1,3 +1,4 @@
+import type { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   type PrepareEmailCommit,
   type EmailCommandId,
@@ -16,7 +17,7 @@ import type { LoginIdentifier } from "@yielded/auth/Identity";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { type ProofCompletionPlan, ProofUnavailable } from "@yielded/auth/Proofs";
 import type { TokenDigest } from "@yielded/auth/Schema";
-import type { SecurityRevision } from "@yielded/auth/Sessions";
+import { SecurityRevision } from "@yielded/auth/Sessions";
 /* oxlint-disable no-explicit-any -- registration plans bridge consumer-owned Drizzle rows. */
 import { and, eq, isNull } from "drizzle-orm";
 import { Cause, DateTime, Effect, Schema } from "effect";
@@ -26,13 +27,14 @@ import {
   requiredEmailRegistrationConstraints,
 } from "./email-model";
 import { CurrentEmailSql, type EmailSqlDatabase, type EmailSqlQuery } from "./email-sql";
-import { column, isMappedConstraintConflict, PersistenceMappingError } from "./model";
+import { column, isMappedConstraintConflict, PersistenceMappingError, updateValues } from "./model";
 import {
   CurrentProofSql,
   completeProofPlanIn,
   type ProofSqlConfiguration,
   type ProofSqlDatabase,
 } from "./proof-sql";
+import { validateDrizzleStorage } from "./storage-validation";
 
 type Mapping<Registration> = AnyEmailRegistrationMapping<Registration>;
 const unavailable = () => EmailUnavailable.make({});
@@ -146,6 +148,69 @@ const registrationRows = Effect.fn("Drizzle.registrationRows")(function* <Regist
   );
 });
 
+/** Discover before locking, then lock subject before identifier like the other
+ * identity owners. A changed discovery is rejected rather than locking a second
+ * subject in the opposite order. Proof authority separately enforces the host's
+ * active/unverified eligibility policy in the same physical owner. */
+export const readEmailRegistrationTarget = Effect.fnUntraced(function* <Registration>(
+  mapping: Extract<Mapping<Registration>, { readonly mode: "atomic" }>,
+  identifier: LoginIdentifier,
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+  const i = mapping.identifier;
+  const s = mapping.subject;
+
+  const lookup = () =>
+    database
+      .select()
+      .from(i.table)
+      .where(
+        and(
+          eq(column(i.table, i.namespace), identifier.namespace),
+          eq(column(i.table, i.value), identifier.value),
+        ),
+      )
+      .limit(1);
+
+  const discovered = (yield* lookup())[0];
+
+  if (discovered === undefined) return { _tag: "Absent" } as const;
+  if (discovered[i.verifiedAt] !== null) return { _tag: "Rejected" } as const;
+  const nativeSubjectId = discovered[i.subjectId];
+
+  const subject = (yield* selectRows(
+    database
+      .select()
+      .from(s.table)
+      .where(eq(column(s.table, s.id), nativeSubjectId))
+      .limit(1),
+    locking,
+  ))[0];
+
+  const current = (yield* selectRows(lookup(), locking))[0];
+
+  if (
+    subject === undefined ||
+    current === undefined ||
+    current[i.verifiedAt] !== null ||
+    !mapping.subjectId.equals(current[i.subjectId], nativeSubjectId) ||
+    current[i.bindingRevision] !== discovered[i.bindingRevision]
+  )
+    return { _tag: "Rejected" } as const;
+
+  return {
+    _tag: "Reserved" as const,
+    nativeSubjectId,
+    bindingRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(
+      current[i.bindingRevision],
+    ),
+    securityRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(
+      subject[s.securityRevision],
+    ),
+  };
+});
+
 const owned = <A, E, R>(
   database: EmailSqlDatabase,
   configuration: EmailRegistrationConfiguration,
@@ -223,6 +288,7 @@ const registerIn = Effect.fn("DrizzleEmailRegistration.registerIn")(function* <R
   allocated: {
     readonly credentialId?: string;
     readonly securityRevision?: SecurityRevision;
+    readonly displacedSecurityRevision?: SecurityRevision;
     readonly identifierRevision?: SecurityRevision;
     readonly credentialRevision?: SecurityRevision;
     readonly nativeSubjectId?: unknown;
@@ -244,6 +310,20 @@ const registerIn = Effect.fn("DrizzleEmailRegistration.registerIn")(function* <R
   if (!completionMatches(mapping, input)) return prepare({ _tag: "Rejected" }, journal);
   if (!inspected.eligible || inspected.fingerprint !== input.fingerprint)
     return prepare({ _tag: "Rejected" }, journal);
+
+  const target =
+    mapping.mode === "atomic"
+      ? yield* readEmailRegistrationTarget(mapping, input.identifier, configuration.locking)
+      : undefined;
+
+  if (target?._tag === "Rejected") return prepare({ _tag: "Rejected" }, journal);
+  if (
+    target?._tag === "Reserved" &&
+    (allocated.displacedSecurityRevision === undefined ||
+      allocated.displacedSecurityRevision === target.securityRevision ||
+      allocated.identifierRevision === target.bindingRevision)
+  )
+    return yield* unavailable();
   const now = yield* nowMillis;
 
   const intent = {
@@ -298,14 +378,49 @@ const registerIn = Effect.fn("DrizzleEmailRegistration.registerIn")(function* <R
         nativeSubjectId = yield* mapping.provisioning.decodeGeneratedId(rows);
       } else yield* subjectInsert;
       if (nativeSubjectId === undefined) return false;
-      yield* transaction.insert(mapping.identifier.table).values(
-        mapping.identifier.encodeVerifiedInsert({
-          identifier: input.identifier,
-          subjectId: nativeSubjectId,
-          verifiedAtMillis: now,
-          bindingRevision: allocated.identifierRevision,
-        }),
-      );
+      if (target?._tag === "Reserved") {
+        const i = mapping.identifier;
+        const s = mapping.subject;
+
+        // Change only mapped ownership columns. Never delete a consumer-owned
+        // identifier row or copy insertion defaults over unrelated columns.
+        yield* transaction
+          .update(i.table)
+          .set(
+            updateValues([
+              [i.subjectId, nativeSubjectId],
+              [i.verifiedAt, mapping.encodeInstant(now)],
+              [i.bindingRevision, allocated.identifierRevision],
+            ]),
+          )
+          .where(
+            and(
+              eq(column(i.table, i.namespace), input.identifier.namespace),
+              eq(column(i.table, i.value), input.identifier.value),
+              eq(column(i.table, i.subjectId), target.nativeSubjectId),
+              eq(column(i.table, i.bindingRevision), target.bindingRevision),
+              isNull(column(i.table, i.verifiedAt)),
+            ),
+          );
+        yield* transaction
+          .update(s.table)
+          .set(updateValues([[s.securityRevision, allocated.displacedSecurityRevision]]))
+          .where(
+            and(
+              eq(column(s.table, s.id), target.nativeSubjectId),
+              eq(column(s.table, s.securityRevision), target.securityRevision),
+            ),
+          );
+      } else {
+        yield* transaction.insert(mapping.identifier.table).values(
+          mapping.identifier.encodeVerifiedInsert({
+            identifier: input.identifier,
+            subjectId: nativeSubjectId,
+            verifiedAtMillis: now,
+            bindingRevision: allocated.identifierRevision,
+          }),
+        );
+      }
       yield* transaction.insert(mapping.credential.table).values(
         mapping.credential.encodeVerifiedInsert({
           moduleId: input.moduleId,
@@ -456,7 +571,25 @@ const registerIn = Effect.fn("DrizzleEmailRegistration.registerIn")(function* <R
         false,
       ))[0];
 
+      const displaced =
+        target?._tag === "Reserved"
+          ? (yield* transaction
+              .select()
+              .from(mapping.subject.table)
+              .where(
+                and(
+                  eq(subjectId, target.nativeSubjectId),
+                  eq(
+                    column(mapping.subject.table, mapping.subject.securityRevision),
+                    allocated.displacedSecurityRevision,
+                  ),
+                ),
+              )
+              .limit(1))[0]
+          : undefined;
+
       if (
+        (target?._tag === "Reserved" && displaced === undefined) ||
         subject === undefined ||
         !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||
         subject[mapping.subject.securityRevision] !== allocated.securityRevision ||
@@ -544,10 +677,16 @@ export const makeSqlEmailRegistrationAuthority = Effect.fn("makeSqlEmailRegistra
     configuration: EmailRegistrationConfiguration,
   ): Effect.fn.Return<
     EmailRegistrationAuthority<Registration>,
-    never,
-    LifecycleHooks | CurrentEmailSql
+    EmailUnavailable,
+    LifecycleHooks | CurrentEmailSql | NativeDatabase
   > {
     const database = yield* CurrentEmailSql;
+
+    if (!configuration.coordinated)
+      yield* validateDrizzleStorage({
+        ...mapping,
+        proof: configuration.proof.mapping,
+      }).pipe(Effect.mapError(unavailable));
     const hooks = yield* LifecycleHooks;
 
     return {
@@ -618,6 +757,14 @@ export const makeSqlEmailRegistrationAuthority = Effect.fn("makeSqlEmailRegistra
               )
             : undefined;
 
+          const displacedSecurityRevision = atomic
+            ? yield* allocate(
+                configuration.mode,
+                mapping.allocateRevision,
+                mapping.allocateRevisionSync,
+              )
+            : undefined;
+
           const identifierRevision = atomic
             ? yield* allocate(
                 configuration.mode,
@@ -664,6 +811,7 @@ export const makeSqlEmailRegistrationAuthority = Effect.fn("makeSqlEmailRegistra
                 {
                   ...(credentialId === undefined ? {} : { credentialId }),
                   ...(securityRevision === undefined ? {} : { securityRevision }),
+                  ...(displacedSecurityRevision === undefined ? {} : { displacedSecurityRevision }),
                   ...(identifierRevision === undefined ? {} : { identifierRevision }),
                   ...(credentialRevision === undefined ? {} : { credentialRevision }),
                   ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),

package/src/drizzle/email-target.ts

@@ -1,3 +1,4 @@
+import type { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable } from "@yielded/auth/Email";
 import {
   coordinateCommit,
@@ -24,6 +25,7 @@ import {
 } from "./email-sql";
 import type { ProofTargetConfiguration } from "./proof-target";
 import { sqlClientStandaloneGuard, type TransactionService } from "./standalone-guard";
+import { validateDrizzleStorage } from "./storage-validation";
 
 export interface EmailTargetConfiguration {
   readonly mode: "interactive" | "synchronous";
@@ -144,13 +146,21 @@ export const coordinateTargetEmailAddress = <Transaction, A, E, R>(
     transaction: Transaction,
     services: { readonly emailAddressPersistence: EmailAddressPersistence["Service"] },
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, EmailCoordinatorError<E>, R | LifecycleHooks> =>
-  Effect.gen(function* (): Effect.fn.Return<A, EmailCoordinatorError<E>, R | LifecycleHooks> {
+): Effect.Effect<A, EmailCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> =>
+  Effect.gen(function* (): Effect.fn.Return<
+    A,
+    EmailCoordinatorError<E>,
+    R | LifecycleHooks | NativeDatabase
+  > {
     const hooks = yield* LifecycleHooks;
 
     if (yield* hasCommitScope) return yield* EmailUnavailable.make({});
     yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
 
+    yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
+      Effect.mapError(() => EmailUnavailable.make({})),
+    );
+
     const result = yield* coordinateCommit(
       () =>
         database.transaction((transaction) =>
@@ -180,13 +190,21 @@ export const coordinateTargetEmailRegistration = <Registration, Transaction, A,
     transaction: Transaction,
     services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, EmailCoordinatorError<E>, R | LifecycleHooks> =>
-  Effect.gen(function* (): Effect.fn.Return<A, EmailCoordinatorError<E>, R | LifecycleHooks> {
+): Effect.Effect<A, EmailCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> =>
+  Effect.gen(function* (): Effect.fn.Return<
+    A,
+    EmailCoordinatorError<E>,
+    R | LifecycleHooks | NativeDatabase
+  > {
     const hooks = yield* LifecycleHooks;
 
     if (yield* hasCommitScope) return yield* EmailUnavailable.make({});
     yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
 
+    yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
+      Effect.mapError(() => EmailUnavailable.make({})),
+    );
+
     const result = yield* coordinateCommit(
       () =>
         database.transaction((transaction) =>

package/src/drizzle/mysql-emails.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { EmailAddressPersistence, type EmailUnavailable } from "@yielded/auth/Email";
 import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks";
 /* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */
@@ -77,7 +78,10 @@ export const makeMysqlEmailSignInServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetEmailSignInServices(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export const makeMysqlEmailAddressServices = <
   S extends AnyMySqlTable,
@@ -93,7 +97,10 @@ export const makeMysqlEmailAddressServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetEmailAddressServices(mapping, proofMapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlEmailAddress<
   D extends Database,
@@ -179,7 +186,7 @@ export function coordinateMysqlEmailAddress<
   E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetEmailAddress<TransactionOf<D>, Out, E, Exclude<R, EmailAddressPersistence>>(
       database,
       options.mapping,
@@ -196,7 +203,7 @@ export function coordinateMysqlEmailAddress<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -216,7 +223,10 @@ export const makeMysqlEmailRegistrationServices = <
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) =>
       makeTargetEmailRegistrationServices<Registration>(mapping, proofMapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentEmailSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlEmailRegistration<
   TargetId,
@@ -311,7 +321,7 @@ export function coordinateMysqlEmailRegistration<
   E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetEmailRegistration<Registration, TransactionOf<D>, Out, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
@@ -328,6 +338,6 @@ export function coordinateMysqlEmailRegistration<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }

package/src/drizzle/mysql-identity.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -25,6 +26,8 @@ import {
   type SubjectProvisioningTables,
 } from "./model";
 import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
+import { validateDrizzleStorage } from "./storage-validation";
 
 type RuntimeDatabase = EffectMysql2Database<any>;
 const unavailable = () => IdentityUnavailable.make();
@@ -47,6 +50,11 @@ export const makeMysqlSubjectProvisioningServices = Effect.fnUntraced(function*
 >(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(() => IdentityUnavailable.make()),
+  );
+
   const db = database as RuntimeDatabase;
   const requestTable = mapping.provisioningRequest.table;
 
@@ -198,6 +206,11 @@ export const makeMysqlExternalIdentityServices = Effect.fnUntraced(function* <
 >(mapping: ExternalIdentityTables<Subject, External, NativeId>) {
   const database = yield* DatabaseService;
 
+  yield* validateDrizzleStorage(mapping).pipe(
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+    Effect.mapError(() => IdentityUnavailable.make()),
+  );
+
   const db = database as RuntimeDatabase;
   const externalTable = mapping.externalIdentity.table;
 

package/src/drizzle/mysql-password-prepared.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks";
 import type { PasswordUnavailable, PasswordPreparedPersistence } from "@yielded/auth/Password";
 import type { AnyRelations } from "drizzle-orm";
@@ -50,7 +51,10 @@ export const makeMySqlPasswordPreparedPersistenceServices = <
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) =>
       makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),
-  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMySqlPasswordPreparedPersistence<
   TargetId,
@@ -184,7 +188,7 @@ export function coordinateMySqlPasswordPreparedPersistence<
   E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
@@ -201,6 +205,6 @@ export function coordinateMySqlPasswordPreparedPersistence<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }

package/src/drizzle/mysql-passwords.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks";
 import { type PasswordUnavailable, PasswordPersistence } from "@yielded/auth/Password";
 /* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */
@@ -91,7 +92,10 @@ export const makeMysqlPasswordPersistenceServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetPasswordPersistenceServices(mapping, configuration, proofMapping),
-  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlPasswordPersistence<
   D extends Database,
@@ -195,7 +199,7 @@ export function coordinateMysqlPasswordPersistence<
   E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasswordPersistence<TransactionOf<D>, Out, E, Exclude<R, PasswordPersistence>>(
       database,
       options.mapping,
@@ -212,7 +216,7 @@ export function coordinateMysqlPasswordPersistence<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 
@@ -230,7 +234,10 @@ export const makeMysqlPasswordRegistrationServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetPasswordRegistrationServices<Registration>(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlPasswordRegistration<
   TargetId,
@@ -322,7 +329,7 @@ export function coordinateMysqlPasswordRegistration<
   E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetPasswordRegistration<
       Registration,
       TransactionOf<D>,
@@ -344,7 +351,7 @@ export function coordinateMysqlPasswordRegistration<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }
 

package/src/drizzle/mysql-proofs.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks";
 import { type ProofUnavailable, ProofPersistence } from "@yielded/auth/Proofs";
 import type { AnyRelations } from "drizzle-orm";
@@ -70,7 +71,10 @@ export const makeMysqlProofPersistenceServices = <
   Effect.flatMap(
     Effect.map(acquireTransactionService(DatabaseService), configuration),
     (configuration) => makeTargetProofPersistenceServices(mapping, configuration),
-  ).pipe(Effect.provideServiceEffect(CurrentProofSql, nativeDatabase(DatabaseService)));
+  ).pipe(
+    Effect.provideServiceEffect(CurrentProofSql, nativeDatabase(DatabaseService)),
+    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),
+  );
 
 export function coordinateMysqlProofPersistence<
   D extends Database,
@@ -171,7 +175,7 @@ export function coordinateMysqlProofPersistence<
   E | ProofUnavailable | HookConfigurationError | SqlError | DatabaseError,
   Exclude<R, ProofPersistence> | LifecycleHooks | DatabaseRequirements
 > {
-  return Effect.flatMap(acquire, (database) =>
+  return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetProofPersistence<Transaction, A, E, Exclude<R, ProofPersistence>>(
       database,
       options.mapping,
@@ -187,6 +191,6 @@ export function coordinateMysqlProofPersistence<
           ? work
           : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
       },
-    ),
+    ).pipe(Effect.provideService(NativeDatabase, database)),
   );
 }